12 ms·
Matrix 1.0 and the Matrix.org Foundation
- mxuribe 7y agoCongrats to everyone involved!!!
- deleted 7y ago[deleted]
- driminicus 7y agoCongratulations on this huge milestone!
- elagost 7y agoThis is exciting. Glad to know they're focusing on making a stable, secure protocol, and that development is going strong. Great job and keep up the great work!
- xj9 7y agothere are some big security and performance holes in the DAG resolution algorithm, but hopefully more funding will give them the resources to revisit some of their dangerous assumptions.
- Arathorn 7y agoIf you are aware of security holes in the DAG resolution algorithm please let us know asap at security@matrix.org as per https://matrix.org/security-disclosure-policy/ https://matrix.org/security-disclosure-policy/. As far as we know, we have addressed all known issues in the original algorithm - which is why we have declared ourselves out of beta. Matrix 1.0 has an entirely new state resolution alg, as well as many other security fixes. Performancewise there are still issues, but we know what needs to be done to fix them, and this will be landing shortly now 1.0 is out.
- s9w 7y agoMatrix is a very generic name.
- k__ 7y agoAt least they didn't call it Tensor, lol
- Arathorn 7y agocough https://github.com/davidar/tensor https://github.com/davidar/tensor also https://matrix.org/docs/projects/client/quaternion https://matrix.org/docs/projects/client/quaternion O:-)
- TuringTest 7y agoIt evokes The Matrix, [1] which seems apt given that the project intends to be a universal, decentralized middleware protocol. Funny that this submission arrives nearly after a project called Desktop Neo. [1] https://en.wikipedia.org/wiki/The_Matrix https://en.wikipedia.org/wiki/The_Matrix [2] https://desktopneo.com/ https://desktopneo.com/
- superfist 7y agoGood job!
- davefp 7y agoFantastic! I know what I'll be doing this evening :D
- reizorc 7y agoEnd-to-end encryption is all well and good but until the app stores provide verifiable builds I think promoting messaging apps such as Riot as "Secure decentralised chat/VoIP" is unprovable and therefore somewhat misleading.
- jchw 7y agoI disagree that it’s totally hopeless but OTOH verifiable builds sounds like an awesome idea to increase security. Still, at the end of the day you always are trusting some entity or machines...
- Arathorn 7y agoFdroid looks to be heading in the general direction of verifiable builds where possible. Failing that it’s really not that hard to build yourself. But in the end you have to be trusting trust somewhere...
- danShumway 7y agoSecurity isn't binary. That's not to say that we shouldn't have verifiable builds (we totally should), but if we follow this line of logic we will never be able to call anything secure. By the time we have verifiable builds we will have identified other security risks that also need to be addressed. Apps like Riot are secure compared to the majority of alternatives available today. Arguably we shouldn't use a binary term to describe that, but I'm sympathetic to the idea that consumers think in those terms and that it's not too harmful to use them. Other metrics typically don't see this kind of feedback (for example, you hardly ever see anyone complaining about someone marketing their app as 'fast', even though performance is also not binary).
- SI_Rob 7y agoWords like security and decentralization are indeed not binary, but referring to them as being on "a continuum" or something similar is not particularly helpful either. I wish I saw more application of them as modalities, such that they refer to not to a perpetual state but a systemic tendency toward an ideal (if asymptotic) structural equilibrium over time, as in "X tends toward greater decentralization", "tends towards greater security" over time. Even better if these claims could be backed, if not by a formal proof, at least an informal definition of these terms as used in the claim and reasonable justification as to why the models being promoted would not tend to collapse into greater centralization, weaker security over time.
- ntw1103 7y agoThis is exciting. Great job! I've been using matrix for over a year now, and I've been extremely happy with it, as have the users of my homeserver.
- Numberwang 7y agoWho are you talking with?
- benatkin 7y agoMy first thought was that this is probably a 1.0 for a morale boost or because of industry-wide version inflation, and not because it's actually a 1.0. My suspicion is confirmed, for me, by seeing this typo in the release announcement (emphasis mine): Using .well-known URIs to discover servers, in case you can’t get a valid TLS certificate for your sever’s domain. https://wompwompwomp.com/ https://wompwompwomp.com/ That said I think Matrix is a good thing and very encouraging! Just don't want to get my hopes up too much.
- vore 7y agoI'm not sure how you've managed to conclude that from a single typo in the release notes.
- benatkin 7y agoMy guess is that fewer than two people reviewed it before hitting publish. For a project with the level of ambition that Matrix has, when they release 1.0 I would expect more attention than that. Just my two cents though.
- Arathorn 7y agothe reality is that this was a case of https://www.wsj.com/graphics/apple-still-hasnt-fixed-its-macbook-keyboard-problem/ https://www.wsj.com/graphics/apple-still-hasnt-fixed-its-mac.... thanks for pointing out the typo
- nurettin 7y agoAt least I learned a lot from the github issues their hacker opened. Wonder if there are any surviving archives of those that the repo owners did not delete in shame. https://news.ycombinator.com/item?id=19642554 https://news.ycombinator.com/item?id=19642554
- Arathorn 7y agoI (the repo owner) reposted them via links to archive.org after github deleted them, actually: https://github.com/matrix-org/matrix.org/issues/367#issuecomment-482649539 https://github.com/matrix-org/matrix.org/issues/367#issuecom.... See https://matrix.org/blog/2019/05/08/post-mortem-and-remediations-for-apr-11-security-incident/ https://matrix.org/blog/2019/05/08/post-mortem-and-remediati... for the full details of what happened, fwiw.
- nothrabannosir 7y agoAs much as I love ridiculing matrix, I must admit that’s a beautiful move. Thank you, and apologies for laughing at the parent post.
- jancsika 7y agoWere the GPG signing keys the hacker found for signing official Debian packages for Matrix-related software?
- cyphar 7y agoThey were for signing the Debian and Ubuntu packages of the matrix.org Debian repos. But Debian also has its own packages for matrix-synapse (with the latest version usually available in experimental) -- so you could just use those instead.
- jbverschoor 7y agoI have no idea what matrix is, and it is not explained
- TuringTest 7y agoBecause it's a blog entry for a project milestone. The definition is at the homepage and FAQ, one link away. https://matrix.org/ https://matrix.org/ https://matrix.org/faq/ https://matrix.org/faq/
- ngcc_hk 7y agoShould it be in the first thing to do is to explain who you are and what your project is doing? Not everyone is in the matrix or everyone are but not woke up. Need to say. Anyway thanks. Now has a lead.
- chrismorgan 7y agoBlog posts that you can reasonably expect may be shared in places where context will not be known should start out by clarifying what the subject of the post is. Rust is an example of doing this very well. Take a couple of release announcements, for example: https://blog.rust-lang.org/2015/05/15/Rust-1.0.html https://blog.rust-lang.org/2015/05/15/Rust-1.0.html, https://blog.rust-lang.org/2019/05/23/Rust-1.35.0.html https://blog.rust-lang.org/2019/05/23/Rust-1.35.0.html. Both clarify what Rust is in the first paragraph.
- jbverschoor 7y agoChecked my history. Before I opened the matrix link in the top left iirc( mobile) It took me to the try now page. Maybe not, but that’s where I ended up
- jbverschoor 7y agoI pressed the hamburger menu on mobile. It took me to try now, which is also on the top right: https://matrix.org/try-now https://matrix.org/try-now
- dwb 7y agoCongratulations, it's very heartening to see a new open application-layer protocol get to a stable v1.0 :)
- rschulman 7y agoI am thrilled to be one of the newly announced Guardians of the non-profit foundation. I'm happy to answer any questions people may have, though bearing in mind that I'm going to be a little distracted for the next while until my son goes to bed.
- mikenew 7y agoAre there any firm plans for what happens to the matrix.org matrix server in the future? I worry that all the friends and family that I've been convincing to register an account on matrix.org are going to one day be asked to migrate their account to somewhere else, and that feels like it could be a big bump in the road for the non-technical ones.
- rschulman 7y agoSo, New Vector (the for-profit org that the foundation has just spun out of) operates the matrix.org homeserver on behalf of the community. With that said, though, I don't think it is going anywhere any time soon. Portable accounts/identity is on the spec roadmap and is a personal passion of mine, so moving servers while keeping all of your identity will hopefully be possible in the not-too-distant future.
- Arathorn 7y agoYup, to echo this: the matrix.org homeserver isn’t going away anytime soon. One of the problems we saw with other protocols when starting Matrix was that often it was hard to pick a good server to host your account, and the project’s “ground zero” server was often overloaded or unavailable. So we consciously made the decision to keep the matrix.org server running to help bootstrap Matrix - but the second we have decentralised accounts we will gently start encouraging users to migrate off to alternatives, assuming that good trusted public alternatives exist. We envisage this to be seamless though; users will just need to click something to opt into storing their account on their new server, and their account will then replicate across the servers where it is hosted. Over time, we might then ask people to stop using the matrix.org server if they empirically are using other servers too, and hopefully eventually get to the point where we have both closed signups on matrix.org and even turned it off. But we are categorically not going to leave any users high & dry. It’s worth noting that running a massive server like matrix.org is a significant burden and distracts badly from actually building Matrix (especially when things go wrong), so we would love to spread the traffic out as soon as we can. All this remains scifi for now though, although MSC1228 gives some hints on how it could evolve.
- bongobongo 7y agoThis is exciting. A big thank-you to all involved in bringing this sorely needed standard to life!
- ngcc_hk 7y agoSorry but may be too upset by the Hong Kong extradition law. Still, after reading the whole readme I cannot stop asking the question - https://youtu.be/jXeF1rMkpQw https://youtu.be/jXeF1rMkpQw Maths, communication server, or ... ???
- mikenew 7y agoThe not-so-talked-about but killer feature of Matrix is that you can bridge other services into it. I'm currently able to send and receive messages from Hangouts, iMessage, SMS, and Slack all from within Matrix. If I'm working on my laptop I can put my phone in my bag and not even touch it for 8 hours, because there's no need. I have Riot running on my laptop with a full keyboard and access to all my communication platforms. It's not exactly easy to do (iMessage requires a dedicated Mac, for example), but it's possible. And it works pretty well. Pulling out my phone to tap out an SMS when I have a full keyboard in front of me seems silly at this point. Hopefully the bridging will continue to evolve and become more accessible to the average user, because it's amazing.
- ixwt 7y agoIs this difficult to setup? How much of the data do you control?
- lytedev 7y agoIt's not super easy, I'll say, but you have all the data and it's searchable in the Riot client.
- lytedev 7y agoHuge props to the Matrix team! It's given me back ownership of my messages for which I am very grateful. Simple integration is a really killer feature! I'm not sure why every matrix post seems to be met with a lot of negativity here on HN, but I always appreciate the way devs handle it. Well done!
- dustinmr 7y agoCan you point to any tutorials/articles/documentation? I got off Mac for Linux or Chromebook with the whole keyboard horror. About the only thing I miss is a full keyboard for sms & iMessage. And I have an old Mac Mini laying around that could be put to use if necessary.
- mikenew 7y ago
- megous 7y agoSo where's the spec 1.0? All I see is old <1.0 versions. https://matrix.org/docs/spec/ https://matrix.org/docs/spec/
- Arathorn 7y agohttps://matrix.org/docs/spec/#matrix-versions https://matrix.org/docs/spec/#matrix-versions. Matrix 1.0 is the blanket term for the set of various specific API releases we just cut: CS API 0.5 etc. We could have bumped them all to 1.0 for the sake of it (and perhaps we should have), but it felt cleaner to let each API version evolve independently, and instead say “hey, as of this set of versions, we consider the protocol stable”.
- megous 7y agoThanks for the clarification.
- est31 7y agoLooking forward to seeing performant server implementations. Especially looking forward to ruma maturation: https://github.com/ruma/ruma https://github.com/ruma/ruma
- cyphar 7y agoOr even dendrite. The Ruma author said on Reddit that they are waiting for async/await to stabilise in Rust before they continue working on Ruma because they'd likely need to rewrite it later if it was written without async from the start.
- est31 7y agoasync/await is right around the corner. Meaning few months give or take until it's on stable. The 1.37 goal [1] will most likely be missed though. [1]: https://boats.gitlab.io/blog/post/await-decision-ii/ https://boats.gitlab.io/blog/post/await-decision-ii/
- cyphar 7y agoYup, I've been following the Rust discussion too. I am quite excited to see this happen -- as someone who tried to wrap their head around tokio two years ago I'm glad something more akin to other languages is around the corner.
- avinium 7y agoMatrix has been on my to-do list for some time - I'm interested in exploring it as a replacement for team Slack. As a side-note, I think the copy on the Matrix website could use some love - it's a little wordy and not immediately clear what Matrix is, and why/how you would use it. I've read a few other commenters make the same point. Are you open to some suggested wording? If so, how would you prefer to receive it?
- Arathorn 7y agoSo we just reworded some of the site, but agreed it needs more love. We're (hopefully) much better at writing communication protocols than describing them to a broad audience. Proposals for changes are very welcome (although we can't guarantee we'll accept them verbatim); the new site lives at https://github.com/matrix-org/matrix.org https://github.com/matrix-org/matrix.org. PRs welcome.
- avinium 7y agoGreat. If I have any suggestions once I've actually had a chance to take it for a spin, I'll make sure to submit it for consideration via Github.
- c487bd62 7y agoHonest question. What's stopping Matrix from being adopted by, say, Google or Facebook, and then pulling a XMPPEEE? Imagine Matrix gets really popular, more even than Discord. So they offer their own "version" but add features like free 250GB on Google Drive or things like that. After they get everybody on board they do what they do best and cease control of it.
- Arathorn 7y agoWe're obviously very aware of this risk, and one approach is to try (as the Foundation) to steer uptake as best we can to ensure that no single 800lb gorilla ends up adopting Matrix and smothering it with love(?), even if they have the best intentions. So if Google did suddenly start using Matrix, we'd do everything we possibly can to ensure that at least one of Microsoft/Facebook/Amazon/Apple/Samsung/etc jumped on board too, to try to balance things out and ensure that the value of participating in open network outweighed the risk of proprietary extensions leaking in. But in the end, the onus is on us to make sure there's enough stuff of value in the wider open network that the idea of someone using the protocol to try to create a walled garden is laughable and clearly missing the point - much like running a private email network is somewhat missing the point, or for that matter a walled garden like the web content on old-school AOL. Hopefully we're on the right track to ensure there's enough stuff of value on the public Matrix network to make participation in it a no-brainer.
- c487bd62 7y agoVery interesting. I wonder if there's a killer feature that would appear when you follow that line of thought. So even if adoption looks like 60~70% users and 30~40% enterprise, if you're indispensable to either of them, it would still prevent a take over because of the network effect. And the fact that you have an API that developers can trust would solidify the position even more. If that feature ever surfaces I hope it doesn't involve blockchain or machine learning.
- Arathorn 7y agoWell, the feature might just be one of ubiquitous interoperability, much as email provides today. Particularly in an enterprise context: if you want to do some kind of realtime collaboration with someone, you might just reach them directly via Matrix rather than sending them an Email with a link to Slack/Zoom/whatever. It'd certainly be more compelling if it was an actual feature though. Joking aside, federated machine learning could be an interesting approach, if the value that Matrix provided included a decentralised search engine which could help you sift through all the available content to find the chatrooms and communities you're interested in (and hide the ones you're not...)
- nerd7473 7y agoMatrix really is an awesome clinet/service. Really glad this Matrix exists and allows for security and privacy.
- sansnomme 7y agoWhat's the best option available for chat embedding right now? E.g. if I want to build Facebook's chat feature or Fiverr's Inbox feature and have it integrated into my main web app.
- Arathorn 7y agoWe haven't published an official embedded chat SDK for Matrix yet, but there are a bunch of options from the community. https://gitlab.com/sanlox/tangent https://gitlab.com/sanlox/tangent is one, which is very new and immature but looks to be headed in the right direction. Alternatively, you could take a scalpel to matrix-react-sdk and strip it down to do what's needed. Maintaining UI SDKs like this is very time consuming, and we're currently putting our time into ensuring matrix-react-sdk (and thus Riot) pull their weight against Slack & Discord etc.
- sansnomme 7y agoThe biggest issue I have found is Auth, specifically session sharing. Any advice for that?
- jjdjr0odo7 7y agoBah. I just want this to be tied to my email and different UIs for different types of communication. IMAP and SMTP are battle tested for volume. The UX just sucks
- sandGorgon 7y agoCongratulations for the release. We were seriously evaluating Matrix as a replacement for Hipchat (about a few months back) through their hosted service modular.im . We didn't end up going for it because it didn't have privacy controls (there's no concept of an org like Slack) and integration with Auth mechanisms like SAML/Google,etc. I'm glad that matrix.org is now a very different organisation than New Vector. Hopefully it should allow you to focus on polishing the user facing product, Riot.im I have already used the re-designed Riot - it's nice from a UI perspective, but there's a lot of enterprise use cases that are missing.
- Iv 7y agoIs there a docker image of synapse (Matrix's reference server implementation) that is updated with 1.0 version? I found this https://github.com/matrix-org/synapse/tree/master/docker https://github.com/matrix-org/synapse/tree/master/docker but the last update is 21 days ago. I guess for now, installing from source is the only option to get 1.0?
- slyrus 7y agoIt's unfortunate that "Matrix" has nothing to do with actual matrices and that "Synapse" has nothing to do with neuroscience or even neural networks. Makes me want to name my next matrix (actual rows and columns of numbers) library something like "advanced telephony and messaging" but a stupid name for a stupid name makes the whole world utterly ungoogleable so I'll refrain.
- mlevental 7y agomatrix /ˈmeɪtrɪks/ noun noun: matrix; plural noun: matrices; plural noun: matrixes 5. an organizational structure in which two or more lines of command, responsibility, or communication may run through the same individual. "matrix structures are said to foster greater flexibility"
- nullwasamistake 7y agoMatrix works great once setup but they really need to work on install process. All the "easy ways" are unofficial. Some of the clients, like Riot, appear to be really well written, but the server itself gives me pause. Just from looking at the configuration, the codebase appears to be a mess. They also built the thing without specifying a protocol which was the original goal. I once attempted to implement a matrix client and the majority of doc pages on the protocol are "TDB" or "look at server source"
- Arathorn 7y agothe client-server API has been stable and fully docced since early 2016, which explains why there are so many matrix clients out there. you must have been attempting a long time ago...
- __david__ 7y agoI note the announcement says this about things coming soon: > - Editable messages! (These are in Synapse 1.0 and Riot already, but still stabilising so not enabled by default) Is there some way to enable editing on a locally hosted server to play with? (In my case I don't care if federated servers don't handle it). I've poked around the code a bit and I don't see anything obvious documented…
- Arathorn 7y agoOn Riot/Web, you’ll need to enable it in labs settings (in config.json) - riot.im/develop already has it turned on. On synapse there is a config flag called experimental_aggregation_support or something, but it’s optional (it makes reactions/edits more efficient).
- __david__ 7y agoThanks! In case anyone else is wondering, I added: "features": { "feature_message_editing": "labs" } to my Riot's config.json and experimental_msc1849_support_enabled: true to Matrix's homeserver.yaml.
- Arathorn 7y agothat's the one :) Editing unsent/sending messages should land tomorrow, and then the feature is pretty much done. Sorry for not having the right config details when answering on my phone yesterday!
- zaarn 7y agoDid 1.0 fix the crippling resource consumption of their "reference implementation" or are they still tinkering on something half done? Did they fix the barely working and maintained bridge ecosystem (ie, everything other than IRC)? I'm someone who ran a Matrix server in the past and got burned by it, the announcement doesn't seem to address any of the issues I encountered running my server or make the UI any more discoverable for non-technical users compared to alternatives like Discord. It feels more like this 1.0 announcement was done so they could have 1.0 and declare to have done it, without actually fixing the glaring issues in the Matrix ecosystem. At this point, the ActivityPub Ecosystem (Pleroma, Misskey, Mastodon) offers more versatile and user friendly experiences. I hope someone builds a chat server on top of AP.
- nickik 7y agoMaybe consider reading the post?
- larkeith 7y ago> Did 1.0 fix the crippling resource consumption of their "reference implementation" or are they still tinkering on something half done? From the fourth paragraph: "...we have deliberately not focused on performance or features in the 1.0 release - so I’m afraid that synapse’s RAM footprint will not have got significantly better..." "Crippling resource consumption" is an interesting viewpoint, however - I'm federating to the four largest rooms currently available and using <.75g RAM, so unless you consider every modern browser "crippling"...
- zaarn 7y agoI did run a Matrix server for a while. It continously consumed between 4 and 6 Gigabytes of RAM with about 5-10 users active at all times. Joining on of the larger rooms took 3 days, 2 days unil I didn't just receive plain errors and then another day until it would let me open the room without timeouting. While joining large room sit consumed almost all available CPU and several database connections for IO. This was less than 3 months ago on a fresh install based on Docker with no modifications to the code other than instructed in the installation guide.
- intea 7y agoAre there decent Admin tools for hosting your own homeserver now? Last time I checked it out I could neither disable file uploads completely nor remove users from the server short of editing the database.
- Arathorn 7y agoyou can disable fileuploads completely from the config (set a max filetransfer size of 0). however, we still need to build a proper admin web interface for it. the admin API is improving however, but it's a matter of hitting the API with curl currently (for removing users etc).
- intea 7y agoSetting the max filetransfer size to 0 still showed the button and allowed uploading of 0 byte files. Probably just a UX oversight but annoying nonetheless. Not having a simple to use admin or even moderator interface makes Matrix unusable for my purposes for the time being.
- Arathorn 7y agoright, understood. this is why the original post explicitly says: > so I’m afraid that synapse’s RAM footprint will not have got significantly better, and your favourite long-awaited features (automatically defragmenting rooms with lots of forward extremities, configurable message retention, admin management web-interface etc) have not yet landed We know that admin management interfaces are critical, and we'll be adding them now 1.0 is out asap. Meanwhile, I filed https://github.com/vector-im/riot-web/issues/10025 https://github.com/vector-im/riot-web/issues/10025 for "hide the upload button" feature req.
- intea 7y agoThanks!