4 ms·

Okay, so maybe "unbelievable crappy" was a bit of an exaggeration. After all, I do use it. But I'll try to explain. It starts with the fact that so many of the

Okay, so maybe "unbelievable crappy" was a bit of an exaggeration. After all, I do use it. But I'll try to explain. It starts with the fact that so many of the features still aren't up to par with what e.g. Discord provides. It feels like a knock-off. The biggest problem I've faced is dealing with the encryption. Every new device in a conversation has to be verified with every other, which means you need n(n-1)/2 pairings for a room with n devices. That's right, if you're trying to set up a chat with 10 people who have an average of three devices, you're going to need to do 435 pairings. The pairings themselves are a huge pain: there are different pairing "methods" to use, and different clients will make guesses about the method the other client supports, and the whole thing falls apart if it guesses wrong (there's no negotiation, as far as I can tell) or if the person with the device doesn't immediately respond. There's no notion of a web of trust or trusting a person instead of a specific device. Even if everything goes right (it usually doesn't) it's going to take about 30 seconds per person to do each pairing, which means your group chat with just 10 people is going to take over 7 hours to set up. You could just ignore the verification stuff, but presumably the reason you wanted to use Matrix (instead of a centralized service) in the first place was because you thought it was more secure / private. Someone adds a new device, or logs out of a device, or there's some glitch (it's happened to me)? Everyone in the room gets to do another pairing. With every one of their devices. Another issue has been the unreliability of the service itself. Sometimes it breaks, logging you out. (Hope everyone backed up their keys!) Or they get hacked and the server goes down for days: https://matrix.org/blog/2019/05/08/post-mortem-and-remediations-for-apr-11-security-incident https://matrix.org/blog/2019/05/08/post-mortem-and-remediati... And then there's just the random client bugs. I literally just opened the tab for Riot to remind myself of other issues and was greeted with this: https://i.imgur.com/8Rgebfr.png https://i.imgur.com/8Rgebfr.png They don't seem to be keeping up with them, either. Riot Web alone has almost 4000 open issues: https://github.com/vector-im/riot-web/issues https://github.com/vector-im/riot-web/issues Having a searchable history is supposed to be one of the major advantages of a Discord-like interface, but I just did a search for a word that I'm looking at in the chat and got no results. So basically, it's a mess right now. I'm using it with one person because they're the only person who wants a Discord-like chat with me and are willing to put up with the amount of nonsense needed to use an alternative that doesn't siphon off your data to a private company.

Arathorn 7y ago
So, firstly - huge thanks for taking the time to list the problems :) I'm the project lead for Matrix & Riot hence my interest. Totally agreed that the lack of cross-signing for key verification is our single biggest problem. It turns out that this is not an easy problem to solve, but after a few rethinks we finally have a design (https://github.com/matrix-org/matrix-doc/pull/1756 https://github.com/matrix-org/matrix-doc/pull/1756) and an implementation (https://scitech.video/videos/watch/d1ef04a8-397a-4570-a9a9-cef143ea637c https://scitech.video/videos/watch/d1ef04a8-397a-4570-a9a9-c...) which works. The only bit that remains is wiring it into the Riot's UI itself, which we started a few weeks ago and is looking promising. The TL;DR is that it optimises the number of verifications to the absolute bare minimum. You verify your new device once when you log into it (a bit like WhatsApp), and then everyone else will transitively trust the new device. In terms of the unreliability of the matrix.org server: we added encrypted key backup about a year ago to solve the whole "if you get logged out you lose your keys" problem, but agreed it used to be a massive problem. And yes, the matrix.org security breach was a nightmare - apologies. For the i18n bug: if the request to load the i18n file for your language fails for whatever reason, you get that ugly error - it's similar to getting an ugly page if the CSS didn't load. We can make the i18n req retry, though - i just filed https://github.com/vector-im/riot-web/issues/10965 https://github.com/vector-im/riot-web/issues/10965 for this. In terms of the number of bugs - yes, we have 3775 open, and 5871 closed. This is because we deliberately try to track each and every possible suggestion & feature request & bug of every severity in the issue tacker; trying to use it as the main knowledge store for the project. I wouldn't judge the quality of a project by the number of bugs - it's like judging the quality of a book by the number of pages. It doesn't tell you much beyond how big a book it is. Search should work, but delegates straight through to postgres's FTS engine. We need to tune it better, for sure. > So basically, it's a mess right now Hopefully key verification will fix the biggest issue here. Thanks for persevering with it in the interim.
- bscphil 7y ago
  Hey, I didn't know you were the project lead. Thanks for taking the time to reply! By the way, when I said > If Discord is "good enough" for social media, then Matrix is trying to be an open source, decentralized Discord. It's also (in my personal experience) unbelievably crappy it was sort of a loving complaint. I brought up Matrix in the first place because to me it is one of the few attempts to solve the personal social media problem with decentralized open source software. So I really want to see it succeed, and my quick rant about how the state of it now was in that light. Kind of like complaining about your favorite sports team. You forget sometimes what a range of people are on HN, and so I hope you / others who work on Matrix aren't too disheartened by complaints. I've been following the cross-signing bug for a while now. I had hoped to see it implemented earlier, but it's good that it's being worked on. I wonder if an encrypted copy of the keys could be stored in the browser's local storage, so that logging out doesn't reset the client. It would also be great to have all my devices store encrypted backups of each other's keys, so that unless all my devices get signed out everything just works without requiring a backup or re-verifying devices. I think Signal works like that, and I thought Matrix was supposed to do this partially, but it didn't work last time I was signed out. From the user's point of view, you want one identity / set of keys / backup for all your devices, even if that's not what's happening at a lower level. > the i18n bug Since you already have the pre-translation English text, wouldn't it make sense to fall back to showing that instead of "translation failed" on every line of text? Plus, my locale is en_US so especially in my case failing to fetch the i18n files shouldn't result in such an ugly bug. > Search should work, but delegates straight through to postgres's FTS engine. If I'm understanding you, this means the search is always done server-side. Doesn't this mean that search will never work on encrypted chats, since the Matrix server doesn't have the text of my chats to search? If that's expected, some user-facing way of making this obvious would help. Thanks again for the detailed reply.

Arathorn 7y ago

So, firstly - huge thanks for taking the time to list the problems :) I'm the project lead for Matrix & Riot hence my interest. Totally agreed that the lack of cross-signing for key verification is our single biggest problem. It turns out that this is not an easy problem to solve, but after a few rethinks we finally have a design (https://github.com/matrix-org/matrix-doc/pull/1756 https://github.com/matrix-org/matrix-doc/pull/1756) and an implementation (https://scitech.video/videos/watch/d1ef04a8-397a-4570-a9a9-cef143ea637c https://scitech.video/videos/watch/d1ef04a8-397a-4570-a9a9-c...) which works. The only bit that remains is wiring it into the Riot's UI itself, which we started a few weeks ago and is looking promising. The TL;DR is that it optimises the number of verifications to the absolute bare minimum. You verify your new device once when you log into it (a bit like WhatsApp), and then everyone else will transitively trust the new device. In terms of the unreliability of the matrix.org server: we added encrypted key backup about a year ago to solve the whole "if you get logged out you lose your keys" problem, but agreed it used to be a massive problem. And yes, the matrix.org security breach was a nightmare - apologies. For the i18n bug: if the request to load the i18n file for your language fails for whatever reason, you get that ugly error - it's similar to getting an ugly page if the CSS didn't load. We can make the i18n req retry, though - i just filed https://github.com/vector-im/riot-web/issues/10965 https://github.com/vector-im/riot-web/issues/10965 for this. In terms of the number of bugs - yes, we have 3775 open, and 5871 closed. This is because we deliberately try to track each and every possible suggestion & feature request & bug of every severity in the issue tacker; trying to use it as the main knowledge store for the project. I wouldn't judge the quality of a project by the number of bugs - it's like judging the quality of a book by the number of pages. It doesn't tell you much beyond how big a book it is. Search should work, but delegates straight through to postgres's FTS engine. We need to tune it better, for sure. > So basically, it's a mess right now Hopefully key verification will fix the biggest issue here. Thanks for persevering with it in the interim.

bscphil 7y ago
Hey, I didn't know you were the project lead. Thanks for taking the time to reply! By the way, when I said > If Discord is "good enough" for social media, then Matrix is trying to be an open source, decentralized Discord. It's also (in my personal experience) unbelievably crappy it was sort of a loving complaint. I brought up Matrix in the first place because to me it is one of the few attempts to solve the personal social media problem with decentralized open source software. So I really want to see it succeed, and my quick rant about how the state of it now was in that light. Kind of like complaining about your favorite sports team. You forget sometimes what a range of people are on HN, and so I hope you / others who work on Matrix aren't too disheartened by complaints. I've been following the cross-signing bug for a while now. I had hoped to see it implemented earlier, but it's good that it's being worked on. I wonder if an encrypted copy of the keys could be stored in the browser's local storage, so that logging out doesn't reset the client. It would also be great to have all my devices store encrypted backups of each other's keys, so that unless all my devices get signed out everything just works without requiring a backup or re-verifying devices. I think Signal works like that, and I thought Matrix was supposed to do this partially, but it didn't work last time I was signed out. From the user's point of view, you want one identity / set of keys / backup for all your devices, even if that's not what's happening at a lower level. > the i18n bug Since you already have the pre-translation English text, wouldn't it make sense to fall back to showing that instead of "translation failed" on every line of text? Plus, my locale is en_US so especially in my case failing to fetch the i18n files shouldn't result in such an ugly bug. > Search should work, but delegates straight through to postgres's FTS engine. If I'm understanding you, this means the search is always done server-side. Doesn't this mean that search will never work on encrypted chats, since the Matrix server doesn't have the text of my chats to search? If that's expected, some user-facing way of making this obvious would help. Thanks again for the detailed reply.