5 ms·

So, firstly - huge thanks for taking the time to list the problems :) I'm the project lead for Matrix & Riot hence my interest. Totally agreed that the lack of

So, firstly - huge thanks for taking the time to list the problems :) I'm the project lead for Matrix & Riot hence my interest. Totally agreed that the lack of cross-signing for key verification is our single biggest problem. It turns out that this is not an easy problem to solve, but after a few rethinks we finally have a design (https://github.com/matrix-org/matrix-doc/pull/1756 https://github.com/matrix-org/matrix-doc/pull/1756) and an implementation (https://scitech.video/videos/watch/d1ef04a8-397a-4570-a9a9-cef143ea637c https://scitech.video/videos/watch/d1ef04a8-397a-4570-a9a9-c...) which works. The only bit that remains is wiring it into the Riot's UI itself, which we started a few weeks ago and is looking promising. The TL;DR is that it optimises the number of verifications to the absolute bare minimum. You verify your new device once when you log into it (a bit like WhatsApp), and then everyone else will transitively trust the new device. In terms of the unreliability of the matrix.org server: we added encrypted key backup about a year ago to solve the whole "if you get logged out you lose your keys" problem, but agreed it used to be a massive problem. And yes, the matrix.org security breach was a nightmare - apologies. For the i18n bug: if the request to load the i18n file for your language fails for whatever reason, you get that ugly error - it's similar to getting an ugly page if the CSS didn't load. We can make the i18n req retry, though - i just filed https://github.com/vector-im/riot-web/issues/10965 https://github.com/vector-im/riot-web/issues/10965 for this. In terms of the number of bugs - yes, we have 3775 open, and 5871 closed. This is because we deliberately try to track each and every possible suggestion & feature request & bug of every severity in the issue tacker; trying to use it as the main knowledge store for the project. I wouldn't judge the quality of a project by the number of bugs - it's like judging the quality of a book by the number of pages. It doesn't tell you much beyond how big a book it is. Search should work, but delegates straight through to postgres's FTS engine. We need to tune it better, for sure. > So basically, it's a mess right now Hopefully key verification will fix the biggest issue here. Thanks for persevering with it in the interim.

bscphil 7y ago
Hey, I didn't know you were the project lead. Thanks for taking the time to reply! By the way, when I said > If Discord is "good enough" for social media, then Matrix is trying to be an open source, decentralized Discord. It's also (in my personal experience) unbelievably crappy it was sort of a loving complaint. I brought up Matrix in the first place because to me it is one of the few attempts to solve the personal social media problem with decentralized open source software. So I really want to see it succeed, and my quick rant about how the state of it now was in that light. Kind of like complaining about your favorite sports team. You forget sometimes what a range of people are on HN, and so I hope you / others who work on Matrix aren't too disheartened by complaints. I've been following the cross-signing bug for a while now. I had hoped to see it implemented earlier, but it's good that it's being worked on. I wonder if an encrypted copy of the keys could be stored in the browser's local storage, so that logging out doesn't reset the client. It would also be great to have all my devices store encrypted backups of each other's keys, so that unless all my devices get signed out everything just works without requiring a backup or re-verifying devices. I think Signal works like that, and I thought Matrix was supposed to do this partially, but it didn't work last time I was signed out. From the user's point of view, you want one identity / set of keys / backup for all your devices, even if that's not what's happening at a lower level. > the i18n bug Since you already have the pre-translation English text, wouldn't it make sense to fall back to showing that instead of "translation failed" on every line of text? Plus, my locale is en_US so especially in my case failing to fetch the i18n files shouldn't result in such an ugly bug. > Search should work, but delegates straight through to postgres's FTS engine. If I'm understanding you, this means the search is always done server-side. Doesn't this mean that search will never work on encrypted chats, since the Matrix server doesn't have the text of my chats to search? If that's expected, some user-facing way of making this obvious would help. Thanks again for the detailed reply.

bscphil 7y ago

Hey, I didn't know you were the project lead. Thanks for taking the time to reply! By the way, when I said > If Discord is "good enough" for social media, then Matrix is trying to be an open source, decentralized Discord. It's also (in my personal experience) unbelievably crappy it was sort of a loving complaint. I brought up Matrix in the first place because to me it is one of the few attempts to solve the personal social media problem with decentralized open source software. So I really want to see it succeed, and my quick rant about how the state of it now was in that light. Kind of like complaining about your favorite sports team. You forget sometimes what a range of people are on HN, and so I hope you / others who work on Matrix aren't too disheartened by complaints. I've been following the cross-signing bug for a while now. I had hoped to see it implemented earlier, but it's good that it's being worked on. I wonder if an encrypted copy of the keys could be stored in the browser's local storage, so that logging out doesn't reset the client. It would also be great to have all my devices store encrypted backups of each other's keys, so that unless all my devices get signed out everything just works without requiring a backup or re-verifying devices. I think Signal works like that, and I thought Matrix was supposed to do this partially, but it didn't work last time I was signed out. From the user's point of view, you want one identity / set of keys / backup for all your devices, even if that's not what's happening at a lower level. > the i18n bug Since you already have the pre-translation English text, wouldn't it make sense to fall back to showing that instead of "translation failed" on every line of text? Plus, my locale is en_US so especially in my case failing to fetch the i18n files shouldn't result in such an ugly bug. > Search should work, but delegates straight through to postgres's FTS engine. If I'm understanding you, this means the search is always done server-side. Doesn't this mean that search will never work on encrypted chats, since the Matrix server doesn't have the text of my chats to search? If that's expected, some user-facing way of making this obvious would help. Thanks again for the detailed reply.