11 ms·

Germany's national healthcare system adopts Matrix for communication

522 points by Arathorn 5y ago

meibo 5y ago
Happy to hear there apparently are people that can make sensible technical decisions in German government. Realistically there weren't a lot of choices other than Matrix though, looking at what the law demands.
- corty 5y ago
  Well, they could still have opted for something proprietary, weird and broken. See for example the De-Mail desaster[0] and the beA desaster[1]. Both supposedly better and secure email/messenger replacements with huge problems like lacking end-to-end encryption, design problems, laughably lacking security, high cost, low adoption (except were required by law), no usability, etc. I'm really glad that at least someone here might have learned from those mistakes. [0] https://de.wikipedia.org/wiki/De-Mail https://de.wikipedia.org/wiki/De-Mail https://netzpolitik.org/2015/de-mail-das-tote-pferd-wird-weitergeritten-wieviel-das-kostet-soll-geheim-bleiben/ https://netzpolitik.org/2015/de-mail-das-tote-pferd-wird-wei... [1] https://de.wikipedia.org/wiki/Besonderes_elektronisches_Anwaltspostfach https://de.wikipedia.org/wiki/Besonderes_elektronisches_Anwa...
  - GoblinSlayer 5y ago
    Didn't they force a backdoor on tutanota e2ee? Why do they suddenly allow matrix?
    - corty 5y ago
      E2EE isn't forbidden per se. But if you are a public communication provider over a certain size you need to provide access upon request if technically possible. It isn't really clear even in the case of Tutanota if they fall into that regulation, however, they had to preliminarily comply anyways: https://www.heise.de/news/Gericht-zwingt-Mailprovider-Tutanota-zu-Ueberwachungsfunktion-4972460.html https://www.heise.de/news/Gericht-zwingt-Mailprovider-Tutano... Healthcare providers operating a Matrix server won't be communication providers to the public, and if they aren't using a web client or some similar crap, breaking E2EE won't be possible. Webmail providers claiming E2EE like Tutanota are imho liars anyways, because Javascript on a website isn't a secure "end" for the encryption. So use client software that isn't attacker controlled easily, keep your keys private, only encrypt to trustworthy keys and you'll be fine. Matrix ticks all those boxes if you don't use the web client. And the only legal way in for German law enforcement would be to infect your device with some trojan ("Bundestrojaner", like e.g. NSO Pegasus).
    - germanier 5y ago
      German government IT is far removed from being a monolithic entity. There are a lot of different actors involved with different priorities. In this case law enforcement can simply request the data (as long as such a request is legal) at either end. No need to attack the connection in between.
- vaylian 5y ago
  I wouldn't be surprised if this flew under the radar of the people at the top. > Secretary: "IT said we should use matrix". > Minister: "Whatever. I'm busy with other things. Do I need to sign something?"
  - Arathorn 5y ago
    It's the opposite, actually - it seems to be the Ministers and establishment pushing it. e.g: > [Bundesdatenschutzbeauftragte Ulrich] Kelber verweist auf die Entwicklungen in Frankreich. Dort wird eine Whatsappalternative auf Basis des Open-Source-Team-Messengers Matrix und dessen Client Riot entwickelt. In Frankreich "geht man aktuell einen hervorragenden Weg, um sich aus der faktisch in weiten Bereichen der Verwaltung bestehenden Abhängigkeit von Produkten großer amerikanischer IT-Firmen zu lösen", sagte Kleber. or in English: > Federal Data Protection Officer, Ulrich Kelber refers to the developments in France. A Whatsapp alternative based on the open source team messenger Matrix and its client Riot is being developed there. In France, "there is currently an excellent way to free oneself from the fact that many areas of administration are actually dependent on the products of large American IT companies," said Kleber. from https://www.golem.de/news/whatsapp-matrix-oder-xmpp-bmi-sucht-einen-messenger-fuer-bundesbehoerden-1912-145326.html https://www.golem.de/news/whatsapp-matrix-oder-xmpp-bmi-such...
    - solarkraft 5y ago
      Ulrich Kelber may be the coolest higher german official, but he keeps complaining about not being listened to (on Mastodon, in meme form). I tend to think the political machinery isn’t afraid of proprietary/monopoly dependency in general, the issue is rather with those companies not being domestic.
  - germanier 5y ago
    A shift to open source is sanctioned from the very top. For example, in the area of OZG (broad digital access to public services, coming soon) the explicit decision is (my translation): > Open standards must be used in the implementation and operation of digital offerings. The source code from the realization of digital offerings by the administration (in-house development) is made available as open source, i.e., in reusable form, wherever possible. https://www.it-planungsrat.de/fileadmin/beschluesse/2020/Beschluss2020-39_Eckpunkte_Umsetzung_des_OZG.pdf https://www.it-planungsrat.de/fileadmin/beschluesse/2020/Bes... They are also starting a project to host public, open source code which is backed by the federal CIO and many state and local governments: https://www.cio.bund.de/SharedDocs/Kurzmeldungen/DE/2021/pm_os_plattform.html https://www.cio.bund.de/SharedDocs/Kurzmeldungen/DE/2021/pm_... This is not something sneaked in by some techies. Every decision maker is probably aware by now what "open source" means.
- hans1729 5y ago
  For what its worth, open source is en vogue in german government IT at the moment. "Dataport", a government-owned IT-company, has an open-source based project "Phoenix", as a first step in this shift of paradigm. This is interesting because Dataport used to be pretty much a windows-shop; despite old and established hierarchies and its special place in the public domain, change is happening. (Source: I'm working in that project as a consultant)
  - Arathorn 5y ago
    Independently of gematik's work, Phoenix also uses Matrix as its communication backplane (source: the Matrix team is also consulting on it :)
    - hans1729 5y ago
      I've had the pleasure of working with Ben for a while, cheers from team mav! Wearing my matrix hoodie writing this :)
      - toomuchtodo 5y ago
        Can you get a Matrix hoodie without working on Matrix? :D
        Arathorn 5y ago
        https://shop.matrix.org https://shop.matrix.org :D (and yay for Ben - he gets everywhere!)
        toomuchtodo 5y ago
        Thank you so much!
  - ltultraweight 5y ago
    Isn't Phoenix merely rebranding already existing projects like Jitsi Meet and matrix.org? If not, where can this project be publicly inspected?
- Andrew_nenakhov 5y ago
  they could have opted for XMPP, which is clearly a better and more mature alternative.
  - solarkraft 5y ago
    Hey, why not IRC?
  - unethical_ban 5y ago
    What experience in the field do you have implementing or managing Matrix or XMPP solutions?
    - Andrew_nenakhov 5y ago
      Does the development of an XMPP client with a few million downloads count as sufficient experience in the field?
    - deuill 5y ago
      This isn't necessarily an endorsement of one protocol/ecosystem over the other, nor do I have direct experience with integrating Matrix or XMPP (though I run the latter on my home-server for family), but XMPP has seen a few large deployments, including in healthcare (in the UK)[0][1] and in Germany[2]. The consumer-facing client ecosystem for XMPP has indeed seen less rapid development than Matrix (the latter probably benefits from a more cohesive approach), but the server ecosystem for XMPP is very mature, and servers such as Ejabberd are known to scale to hundreds of thousands of connections on a single, modest host[3]. Obviously, that's only one part of the puzzle, hence why Matrix was chosen here. Still, it'd be interesting to see how the two evolve and compare down the line. [0]: https://www.erlang-solutions.com/case-studies/pando-health-case-study/ https://www.erlang-solutions.com/case-studies/pando-health-c... [1]: https://medium.com/miquido/successful-migration-to-a-custom-xmpp-solution-76fcdecb0928 https://medium.com/miquido/successful-migration-to-a-custom-... [2]: https://twitter.com/iNPUTmice/status/1203611711967813633 https://twitter.com/iNPUTmice/status/1203611711967813633 [3]: https://www.process-one.net/blog/ejabberd-nintendo-switch-npns/ https://www.process-one.net/blog/ejabberd-nintendo-switch-np...
    - 5y ago
javajosh 5y ago
Cool. Does anyone have a paper comparing all the neu-fangled IM tech? I find myself a bit confused. BTW my favorite Matrix feature from the concept paper: "Integrität dank hohem Out-of-the-box-Sicherheitsniveau" - dank, hohem out-of-the-box Sicherheitsniveau sounds pretty great. (Wonder why they didn't say "aus der Box"?)
- geff82 5y ago
  Because we adopted that word.
  - nosianu 5y ago
    And anyway, it all comes full circle, because "out" and "of" both have Germanic roots (google "etymology some-word" and you don't even have to go to any specific website, Google already showing a nice graph). Box has Greek/Latin roots, and German has plenty of those too (List of German words with Latin roots: https://de.wikipedia.org/wiki/Liste_lateinischer_Lehn-_und_Fremdw%C3%B6rter_im_Deutschen https://de.wikipedia.org/wiki/Liste_lateinischer_Lehn-_und_F...).
- burundi_coffee 5y ago
  Because that phrase doesn't exist in German like that. They could have used "standardmäßig" but out-of-the box is more widely used when talking about software and tech.
  - zapnuk 5y ago
    Well we do have "von Haus aus" but it's less formal and can't be used as a 1:1 replacement because of the grammar.
    - kleiba 5y ago
      You could say a priori but then you're just exchanging English for Latin.
    - solarkraft 5y ago
nimbius 5y ago
curious to know if matrix ever resolved their "federated" authentication problem. Can I finally host my own node completely separate from the matrix? this always made portability somewhat of a dicey situation.
- q3k 5y ago
  What do you mean by federated authentication? If you just want to have your own homeserver, and users there to be identified as @whoever:example.com, then this just works, is fully federated, and has been like this since forever. The only unfederated part is, from what I know, the Identity Server, which is run by Vector.im to allow discovering Matrix identities by phone number or email addresses.
  - sneak 5y ago
    Matrix installations by default (even on your own server) have all users phoning back home to the Vector identity stuff. Same goes for the push service for the iOS app, but that isn't really their fault as Apple makes it impossible for federated systems to do push without each homeserver having their own app. All notifications for a single app need to come from one centralized push certificate holder.
    - Arathorn 5y ago
      There's no "phoning home". What I think you're talking about is that Element Web's default config specifies the identity lookup server at vector.im: https://github.com/vector-im/element-web/blob/develop/config.sample.json#L8 https://github.com/vector-im/element-web/blob/develop/config.... The identity server is optional, and just used for looking up matrix IDs based on email address or phone number. When Element Web launches is currently checks if your config is valid (i.e. do these URLs actually point to valid servers?). If you're running your own deployment with your own server, then you'd point the config to whatever identity server you wanted, or just remove it entirely - just as you'd point the config to default to your own homeserver. We have a separate bug to defer the server validation check until the user actually tries to talk to the identity (or home) server, but it hasn't got to the top of the todo list yet; patches welcome! Edit: To clarify: this behaviour only occurs with Element Web (rather than Matrix clients or servers in general)
johnchristopher 5y ago
Great [0] ! Anyone can comment on how this is going to be used ? What are people using matrix for in the German healthcare system context ? The full plan document is in German (which I don't speak). [0] and you can check out my history to see I am not a die hard matrix fan, far from it.
- Semaphor 5y ago
  It’s a very dense document. But from a quick glance, it’s eventually (there are 3 levels of functionality that will be developed over time) supposed to be an asynchronous version of telephone calls between pretty much everyone in health care, including patients. Also Broadcasting, secure document sharing, and connections to medical devices.
kken 5y ago
That sounds a lot like IRC https://matrix.org/docs/guides/introduction https://matrix.org/docs/guides/introduction
- corty 5y ago
  Well, yes. Matrix is a federated protocol like IRC, XMPP/Jabber, IRCv3 and a few other less known ones. Being federated is basically what made Email so widespread, and I guess in the long run that model of doing things will be the only viable one. For most people, states, companies and organisations, using a centralized foreign service, no matter how trustworthy it were said to be, isn't an option.
- dividedbyzero 5y ago
  I think it shares lots of the core ideas behind IRC, but it thankfully incorporates a lot of progress made since IRC. You get creature comforts like Slack and the like (depending on the client), but it's still decentralized (even the Gematik setup, apparently!) and it you can make it very secure.
- preya2k 5y ago
  Similar, but different: IRC is decentralized (you connect to a certain server, and you can interact with users/rooms on this server). Matrix is federated (you connect to a certain server, but you can interact with users/rooms on every other server – much like you can write E-Mails to anyone who has an E-Mail address, no matter if its Gmail or Yahoo). So when you want to compare it to anything else: it's much rather like XMPP than it is like IRC.
  - q3k 5y ago
    It goes even further than XMPP, as rooms in Matrix are fully distributed, with no single server owning them. Names like #foo:example.com are aliases, and aliases can be added under other homserver domains, too. XMPP MUC rooms are, IIRC, dependent on the server hosting them and generally coordinating exchange.
    - 5y ago
throawayclose 5y ago
Great! now they only need to fix the problem of doctors giving preference to private health insurance vs public health insurance. Or the problem of doctors systematically rejecting immigrants to be their GP or even giving them an appointment.
- cyberpunk 5y ago
  My private healthcare is substantially cheaper than the state one my SO has too...
  - oaiey 5y ago
    Wait till you are older
rjzzleep 5y ago
TI is Telematik Infrastruktur. So TI-Messenger is just a messenger running on the VPN used for patient-data. It's good to see this happening. One of the biggest German healthcare contractors - famous for terrible code - had managed to creep their S/MIME demo implementation derivative code as a standard for secure communication in the healthcare world. With a MITM at each Kassenaerztliche Vereinigung(i.e. the people that represent the doctors and that charge ~2% per transaction for charging the public insurance companies). So it's unaudited "E2E" with a MITM by design. Given the complexity of this codebase, I do hope that they just use it unmodified. EDIT: one of the reasons why the KVs rolls/ed their own is because of inherent distrust between the physicians or the institution representing them and the governments health ministry getting that data. They believe that the government is incentivizing hospitals to take over physicians share of the cake. I wouldn't say that the distrust is misplaced, but unfortunately these crappy half baked own solutions born out of nepotism don't help their case.
- dmos62 5y ago
  As a sidenote, it's crazy how bad some of the government IT projects are. In the country I'm thinking of I'm pretty sure corruption plays a big role in it, but even so, you have to be very illiterate in IT for it to not be obvious that the contractor didn't do their job. I guess a lot of the administrators responsible for evaluating the project's status are too old to have grown up with internet and computers around them.
  - rjzzleep 5y ago
    I think there's a lot of corruption there, but it goes beyond that. Government IT consulting is a very exclusive niche that's hard to get into. None of the managers are willing to risk losing an IT contractor/or product no matter how terrible they/it are/is. There are basically two IT choices that they do: 1. Choose a really big expensive company that is in Gartner(they do have the best dinners though, also you get to travel business class to visit them for seminars). 2. Choose someone that they know through somebody. It's quite amazing that Matrix has managed to get as much government traction as it has. I've seen a person not willing to kick out a product where I had to walkthrough the creator of it on a Teamviewer on how to debug his own app in the web inspector, and it was unable to display pdfs if they were in landscape(for years). And everyone knew they were bad, the managers would joke about it. As they say, nobody ever got fired for buying IBM. These people are absolutely terrified of making a bad decision that may cost them a promotion in the future.
deadalus 5y ago
Digital Communications Protocols (comparison) : https://docs.google.com/spreadsheets/d/1-UlA4-tslROBDS9IqHalWVztqZo7uxlCeKPQ-8uoFOU/edit#gid=0 https://docs.google.com/spreadsheets/d/1-UlA4-tslROBDS9IqHal...
stuartbman 5y ago
This is a much better system. In the UK we've gone from using pagers (I still use one) to proprietary systems which don't talk to one another (Medic Bleep, NerveCentre) in order to meet the ISO standard.
kragen 5y ago
This is wonderful! I've been using Matrix for the last several months for work, and it's mostly a huge improvement over that vile ransomware Slack. Especially Gomuks is a huge improvement. One drawback I've been suffering is that I can't figure out how to keep logs. Our server had a failure and was down for a day, so Element on my phone decided it should forget all its keys (and also my password). Now I've lost access to all the past channel logs on our E2E channels, and it seems like nobody on the channel has a version they can usably copy and paste; Element in particular doesn't allow you to copy and paste large chunks of chat history because, when you scroll back a lot, the chunks that are scrolled out of view cease to exist (from the point of view of the copy-paste buffer). Also gomuks deleted all my session information when my local disk got full. Maybe I should try Bitlbee? So, there are still a lot of rough edges! But there's a path to getting them fixed, since it's free software and an open protocol spec. Hopefully the German government will be a good collaborator in contributing improvements!
- Arathorn 5y ago
  https://github.com/russelldavies/matrix-archive https://github.com/russelldavies/matrix-archive is your best bet for exporting conversations right now. There's a GSoC project ongoing to build something like this into Element Web too so you can just hit "download" on a room and export it all nicely.
  - kragen 5y ago
    Thank you! Should I report the fact that Element on my phone deleted all its session keys due to some kind of server hiccup (the server was incorrectly reporting incorrect-password stuff, probably because A. was reinstalling it and hadn't restored the user database yet) as a bug? Certainly deleting all my past conversations and my encryption keys when there's a temporary server failure, is not the behavior I desire, but maybe it's by design? (In that particular case, it resulted in me losing the address where I had to go that afternoon, which was in a Matrix chat message on my phone, before Element peremptorily deleted all my past messages with no confirmation. Fortunately I was able to remember enough of the address to get close enough...)
ChrisArchitect 5y ago
curious about the process to get this accepted behind the scenes. Some IT team convincing higher ups, trendy open source, coupled with standard/growing German disdain for anything US/foreign, and weird obsession with privacy ideals
cbmuser 5y ago
Since when does Germany have a national health care system? Germany has health insurances, both private and public but there is not one unified system really. I can go to a doctor and pay the bill on my own without getting in touch with any government organization. Gematik also is a private company according to their website. So nothing that is associated with the government.
- Arathorn 5y ago
  The second paragraph of https://de.wikipedia.org/wiki/Gematik https://de.wikipedia.org/wiki/Gematik spells out that gematik is majority owned by the government (BMG, and a bunch of other ministries). So while there isn't one unified system, gematik seems to exist to provide interoperability between the myriad different factions. Hence, pushing Matrix to do so.
- Barrin92 5y ago
  We don't have a centralized healthcare system but that doesn't mean there's no need for interoperability because healthcare institutions constantly exchange information. When you go to the doctor you are presumably insured. So your doctor needs to communicate with your insurance. Insurers might need to communicate with government agencies and regulatory bodies, and so on. If you've seen Covid data in Germany, that data comes from every corner in Germany, and all those institutions need to be able to talk toe each other.
  - hdkrgr 5y ago
    To be fair: As a patient, except for them scanning my insurance card, I see very little evidence that would suggest that most of data exchange isn't being done via fax, snail-mail, or people talking into phones. Why in the world do I get a piece of paper from my doctor that I'm supposed to mail to my insurance provider (or scan and upload if you're lucky) when I'm being diagnosed with something? Doctor's offices are the least digitized businesses around. There's first signs of this getting better, but I can't wait for things to change...
    - 5y ago
Evergreen1234 5y ago
German doctor here. I want this! How does this relate to KIM (Kommunikation in der Medizin) a kind of secure e-mail as far as i understand, wich is sold to us now as the future standard of communication in healthcare?
- ArmandGrillet 5y ago
  Gematik (the company mentioned in the post) is also behind KIM: https://www.gematik.de/anwendungen/kim/ https://www.gematik.de/anwendungen/kim/
throwawayboise 5y ago
Wasn't there a city in Germany that to some fanfare moved all of their office IT to linux, and then a few years later switched back to Windows?
- c-st 5y ago
  Yes, that was Munich with its LiMux project. Incidentally and possibly unrelated, the project was abandoned after Microsoft moved their headquarters back into Munich.
- summm 5y ago
  It was Munich, the project was called Linux. Their previous mayor (Ude, social democrat) started the Linux project. The next mayor, Reiter, also a social democrat, even called himself a Microsoft fan and cancelled it against all advice. Suddenly Microsoft moved their Germany headquarters from a suburb to the city, so you go figure. Also, there were some internal power struggles between departments and some obvious mismanagement. Conservatives always have supported Microsoft, and the G, as usual, had no clue about tech and first supported Microsoft, but now claim to always have supported open source... Total shitshow.
  - oaiey 5y ago
    Sounds like new CEO comes in and moves IT to his personal preference but leaves later before the move finished. Sounds familiar? ;)
MayeulC 5y ago
It looks like a private federation though, so while it's great that Matrix gets adopted more, it seems like every big entity they quote federate privately. Imagine e-mail but only being able to contact your company! It's a bit restrictive...
- Arathorn 5y ago
  In practice, what we see happen with the big private Matrix federations is that the users start demanding being able to talk with users on other private federations, and/or the public Matrix network - and threaten to otherwise start using WhatsApp or Telegram or whatever for these sensitive but external conversations. So there is a huge incentive to actually federate properly, and we're talking to pretty much all of them on figuring out how to do so.
  - oaiey 5y ago
    Well, they have very sensitive data they do not want to bleed outside of their controlled bubble (see GDPR). So this gateways will be very interesting :)
- oaiey 5y ago
  Yeah, but the fact you can do that is a big sales point for matrix. This concrete system is intentionally restricted to avoid the risk of data loss.
hda2 5y ago
Does Matrix have a client that makes it easy to send voice messages like Whatsapp and Telegram? This is the only thing stopping us from using Matrix fulltime.
- crossroadsguy 5y ago
  Short answer: no. Long answer: there’s not even a simple native client that can even try to replace these apps. Often you see recommendations about some cartoonish app called Fluffy. No it’s no good. Every client is half baked, half cooked other than main client which was a electron monstrosity last time I checked. So the client space is still a mess (other than the org changing the name of its main client something -> riot -> element -> next name change awaited) compared to other personal messaging cum audio/video call apps. But a promising mess. Or so I hope.
- tffgg 5y ago
  Steps in FluffyChat: 1. Press voice button next to text box on the bottom 2. Say what you have to say 3. Press "Send"
- Arathorn 5y ago
  Element Web has voice messages on develop, and should be landing on mobile in the coming weeks.
  - vfclists 5y ago
    "Web" = "Bloat"

522 points by Arathorn 5y ago

Happy to hear there apparently are people that can make sensible technical decisions in German government. Realistically there weren't a lot of choices other than Matrix though, looking at what the law demands.

corty 5y ago
Well, they could still have opted for something proprietary, weird and broken. See for example the De-Mail desaster[0] and the beA desaster[1]. Both supposedly better and secure email/messenger replacements with huge problems like lacking end-to-end encryption, design problems, laughably lacking security, high cost, low adoption (except were required by law), no usability, etc. I'm really glad that at least someone here might have learned from those mistakes. [0] https://de.wikipedia.org/wiki/De-Mail https://de.wikipedia.org/wiki/De-Mail https://netzpolitik.org/2015/de-mail-das-tote-pferd-wird-weitergeritten-wieviel-das-kostet-soll-geheim-bleiben/ https://netzpolitik.org/2015/de-mail-das-tote-pferd-wird-wei... [1] https://de.wikipedia.org/wiki/Besonderes_elektronisches_Anwaltspostfach https://de.wikipedia.org/wiki/Besonderes_elektronisches_Anwa...
- GoblinSlayer 5y ago
  Didn't they force a backdoor on tutanota e2ee? Why do they suddenly allow matrix?
  - corty 5y ago
    E2EE isn't forbidden per se. But if you are a public communication provider over a certain size you need to provide access upon request if technically possible. It isn't really clear even in the case of Tutanota if they fall into that regulation, however, they had to preliminarily comply anyways: https://www.heise.de/news/Gericht-zwingt-Mailprovider-Tutanota-zu-Ueberwachungsfunktion-4972460.html https://www.heise.de/news/Gericht-zwingt-Mailprovider-Tutano... Healthcare providers operating a Matrix server won't be communication providers to the public, and if they aren't using a web client or some similar crap, breaking E2EE won't be possible. Webmail providers claiming E2EE like Tutanota are imho liars anyways, because Javascript on a website isn't a secure "end" for the encryption. So use client software that isn't attacker controlled easily, keep your keys private, only encrypt to trustworthy keys and you'll be fine. Matrix ticks all those boxes if you don't use the web client. And the only legal way in for German law enforcement would be to infect your device with some trojan ("Bundestrojaner", like e.g. NSO Pegasus).
  - germanier 5y ago
    German government IT is far removed from being a monolithic entity. There are a lot of different actors involved with different priorities. In this case law enforcement can simply request the data (as long as such a request is legal) at either end. No need to attack the connection in between.
vaylian 5y ago
I wouldn't be surprised if this flew under the radar of the people at the top. > Secretary: "IT said we should use matrix". > Minister: "Whatever. I'm busy with other things. Do I need to sign something?"
- Arathorn 5y ago
  It's the opposite, actually - it seems to be the Ministers and establishment pushing it. e.g: > [Bundesdatenschutzbeauftragte Ulrich] Kelber verweist auf die Entwicklungen in Frankreich. Dort wird eine Whatsappalternative auf Basis des Open-Source-Team-Messengers Matrix und dessen Client Riot entwickelt. In Frankreich "geht man aktuell einen hervorragenden Weg, um sich aus der faktisch in weiten Bereichen der Verwaltung bestehenden Abhängigkeit von Produkten großer amerikanischer IT-Firmen zu lösen", sagte Kleber. or in English: > Federal Data Protection Officer, Ulrich Kelber refers to the developments in France. A Whatsapp alternative based on the open source team messenger Matrix and its client Riot is being developed there. In France, "there is currently an excellent way to free oneself from the fact that many areas of administration are actually dependent on the products of large American IT companies," said Kleber. from https://www.golem.de/news/whatsapp-matrix-oder-xmpp-bmi-sucht-einen-messenger-fuer-bundesbehoerden-1912-145326.html https://www.golem.de/news/whatsapp-matrix-oder-xmpp-bmi-such...
  - solarkraft 5y ago
    Ulrich Kelber may be the coolest higher german official, but he keeps complaining about not being listened to (on Mastodon, in meme form). I tend to think the political machinery isn’t afraid of proprietary/monopoly dependency in general, the issue is rather with those companies not being domestic.
- germanier 5y ago
  A shift to open source is sanctioned from the very top. For example, in the area of OZG (broad digital access to public services, coming soon) the explicit decision is (my translation): > Open standards must be used in the implementation and operation of digital offerings. The source code from the realization of digital offerings by the administration (in-house development) is made available as open source, i.e., in reusable form, wherever possible. https://www.it-planungsrat.de/fileadmin/beschluesse/2020/Beschluss2020-39_Eckpunkte_Umsetzung_des_OZG.pdf https://www.it-planungsrat.de/fileadmin/beschluesse/2020/Bes... They are also starting a project to host public, open source code which is backed by the federal CIO and many state and local governments: https://www.cio.bund.de/SharedDocs/Kurzmeldungen/DE/2021/pm_os_plattform.html https://www.cio.bund.de/SharedDocs/Kurzmeldungen/DE/2021/pm_... This is not something sneaked in by some techies. Every decision maker is probably aware by now what "open source" means.
hans1729 5y ago
For what its worth, open source is en vogue in german government IT at the moment. "Dataport", a government-owned IT-company, has an open-source based project "Phoenix", as a first step in this shift of paradigm. This is interesting because Dataport used to be pretty much a windows-shop; despite old and established hierarchies and its special place in the public domain, change is happening. (Source: I'm working in that project as a consultant)
- Arathorn 5y ago
  Independently of gematik's work, Phoenix also uses Matrix as its communication backplane (source: the Matrix team is also consulting on it :)
  - hans1729 5y ago
    I've had the pleasure of working with Ben for a while, cheers from team mav! Wearing my matrix hoodie writing this :)
    - toomuchtodo 5y ago
      Can you get a Matrix hoodie without working on Matrix? :D
      - Arathorn 5y ago
        https://shop.matrix.org https://shop.matrix.org :D (and yay for Ben - he gets everywhere!)
        toomuchtodo 5y ago
        Thank you so much!
- ltultraweight 5y ago
  Isn't Phoenix merely rebranding already existing projects like Jitsi Meet and matrix.org? If not, where can this project be publicly inspected?
Andrew_nenakhov 5y ago
they could have opted for XMPP, which is clearly a better and more mature alternative.
- solarkraft 5y ago
  Hey, why not IRC?
- unethical_ban 5y ago
  What experience in the field do you have implementing or managing Matrix or XMPP solutions?
  - Andrew_nenakhov 5y ago
    Does the development of an XMPP client with a few million downloads count as sufficient experience in the field?
  - deuill 5y ago
    This isn't necessarily an endorsement of one protocol/ecosystem over the other, nor do I have direct experience with integrating Matrix or XMPP (though I run the latter on my home-server for family), but XMPP has seen a few large deployments, including in healthcare (in the UK)[0][1] and in Germany[2]. The consumer-facing client ecosystem for XMPP has indeed seen less rapid development than Matrix (the latter probably benefits from a more cohesive approach), but the server ecosystem for XMPP is very mature, and servers such as Ejabberd are known to scale to hundreds of thousands of connections on a single, modest host[3]. Obviously, that's only one part of the puzzle, hence why Matrix was chosen here. Still, it'd be interesting to see how the two evolve and compare down the line. [0]: https://www.erlang-solutions.com/case-studies/pando-health-case-study/ https://www.erlang-solutions.com/case-studies/pando-health-c... [1]: https://medium.com/miquido/successful-migration-to-a-custom-xmpp-solution-76fcdecb0928 https://medium.com/miquido/successful-migration-to-a-custom-... [2]: https://twitter.com/iNPUTmice/status/1203611711967813633 https://twitter.com/iNPUTmice/status/1203611711967813633 [3]: https://www.process-one.net/blog/ejabberd-nintendo-switch-npns/ https://www.process-one.net/blog/ejabberd-nintendo-switch-np...
  - 5y ago

javajosh 5y ago

Cool. Does anyone have a paper comparing all the neu-fangled IM tech? I find myself a bit confused. BTW my favorite Matrix feature from the concept paper: "Integrität dank hohem Out-of-the-box-Sicherheitsniveau" - dank, hohem out-of-the-box Sicherheitsniveau sounds pretty great. (Wonder why they didn't say "aus der Box"?)

geff82 5y ago
Because we adopted that word.
- nosianu 5y ago
  And anyway, it all comes full circle, because "out" and "of" both have Germanic roots (google "etymology some-word" and you don't even have to go to any specific website, Google already showing a nice graph). Box has Greek/Latin roots, and German has plenty of those too (List of German words with Latin roots: https://de.wikipedia.org/wiki/Liste_lateinischer_Lehn-_und_Fremdw%C3%B6rter_im_Deutschen https://de.wikipedia.org/wiki/Liste_lateinischer_Lehn-_und_F...).
burundi_coffee 5y ago
Because that phrase doesn't exist in German like that. They could have used "standardmäßig" but out-of-the box is more widely used when talking about software and tech.
- zapnuk 5y ago
  Well we do have "von Haus aus" but it's less formal and can't be used as a 1:1 replacement because of the grammar.
  - kleiba 5y ago
    You could say a priori but then you're just exchanging English for Latin.
  - solarkraft 5y ago

nimbius 5y ago

curious to know if matrix ever resolved their "federated" authentication problem. Can I finally host my own node completely separate from the matrix? this always made portability somewhat of a dicey situation.

q3k 5y ago
What do you mean by federated authentication? If you just want to have your own homeserver, and users there to be identified as @whoever:example.com, then this just works, is fully federated, and has been like this since forever. The only unfederated part is, from what I know, the Identity Server, which is run by Vector.im to allow discovering Matrix identities by phone number or email addresses.
- sneak 5y ago
  Matrix installations by default (even on your own server) have all users phoning back home to the Vector identity stuff. Same goes for the push service for the iOS app, but that isn't really their fault as Apple makes it impossible for federated systems to do push without each homeserver having their own app. All notifications for a single app need to come from one centralized push certificate holder.
  - Arathorn 5y ago
    There's no "phoning home". What I think you're talking about is that Element Web's default config specifies the identity lookup server at vector.im: https://github.com/vector-im/element-web/blob/develop/config.sample.json#L8 https://github.com/vector-im/element-web/blob/develop/config.... The identity server is optional, and just used for looking up matrix IDs based on email address or phone number. When Element Web launches is currently checks if your config is valid (i.e. do these URLs actually point to valid servers?). If you're running your own deployment with your own server, then you'd point the config to whatever identity server you wanted, or just remove it entirely - just as you'd point the config to default to your own homeserver. We have a separate bug to defer the server validation check until the user actually tries to talk to the identity (or home) server, but it hasn't got to the top of the todo list yet; patches welcome! Edit: To clarify: this behaviour only occurs with Element Web (rather than Matrix clients or servers in general)

johnchristopher 5y ago

Great [0] ! Anyone can comment on how this is going to be used ? What are people using matrix for in the German healthcare system context ? The full plan document is in German (which I don't speak). [0] and you can check out my history to see I am not a die hard matrix fan, far from it.

Semaphor 5y ago
It’s a very dense document. But from a quick glance, it’s eventually (there are 3 levels of functionality that will be developed over time) supposed to be an asynchronous version of telephone calls between pretty much everyone in health care, including patients. Also Broadcasting, secure document sharing, and connections to medical devices.

kken 5y ago

That sounds a lot like IRC https://matrix.org/docs/guides/introduction https://matrix.org/docs/guides/introduction

corty 5y ago
Well, yes. Matrix is a federated protocol like IRC, XMPP/Jabber, IRCv3 and a few other less known ones. Being federated is basically what made Email so widespread, and I guess in the long run that model of doing things will be the only viable one. For most people, states, companies and organisations, using a centralized foreign service, no matter how trustworthy it were said to be, isn't an option.
dividedbyzero 5y ago
I think it shares lots of the core ideas behind IRC, but it thankfully incorporates a lot of progress made since IRC. You get creature comforts like Slack and the like (depending on the client), but it's still decentralized (even the Gematik setup, apparently!) and it you can make it very secure.
preya2k 5y ago
Similar, but different: IRC is decentralized (you connect to a certain server, and you can interact with users/rooms on this server). Matrix is federated (you connect to a certain server, but you can interact with users/rooms on every other server – much like you can write E-Mails to anyone who has an E-Mail address, no matter if its Gmail or Yahoo). So when you want to compare it to anything else: it's much rather like XMPP than it is like IRC.
- q3k 5y ago
  It goes even further than XMPP, as rooms in Matrix are fully distributed, with no single server owning them. Names like #foo:example.com are aliases, and aliases can be added under other homserver domains, too. XMPP MUC rooms are, IIRC, dependent on the server hosting them and generally coordinating exchange.
  - 5y ago

throawayclose 5y ago

Great! now they only need to fix the problem of doctors giving preference to private health insurance vs public health insurance. Or the problem of doctors systematically rejecting immigrants to be their GP or even giving them an appointment.

cyberpunk 5y ago
My private healthcare is substantially cheaper than the state one my SO has too...
- oaiey 5y ago
  Wait till you are older

rjzzleep 5y ago

TI is Telematik Infrastruktur. So TI-Messenger is just a messenger running on the VPN used for patient-data. It's good to see this happening. One of the biggest German healthcare contractors - famous for terrible code - had managed to creep their S/MIME demo implementation derivative code as a standard for secure communication in the healthcare world. With a MITM at each Kassenaerztliche Vereinigung(i.e. the people that represent the doctors and that charge ~2% per transaction for charging the public insurance companies). So it's unaudited "E2E" with a MITM by design. Given the complexity of this codebase, I do hope that they just use it unmodified. EDIT: one of the reasons why the KVs rolls/ed their own is because of inherent distrust between the physicians or the institution representing them and the governments health ministry getting that data. They believe that the government is incentivizing hospitals to take over physicians share of the cake. I wouldn't say that the distrust is misplaced, but unfortunately these crappy half baked own solutions born out of nepotism don't help their case.

dmos62 5y ago
As a sidenote, it's crazy how bad some of the government IT projects are. In the country I'm thinking of I'm pretty sure corruption plays a big role in it, but even so, you have to be very illiterate in IT for it to not be obvious that the contractor didn't do their job. I guess a lot of the administrators responsible for evaluating the project's status are too old to have grown up with internet and computers around them.
- rjzzleep 5y ago
  I think there's a lot of corruption there, but it goes beyond that. Government IT consulting is a very exclusive niche that's hard to get into. None of the managers are willing to risk losing an IT contractor/or product no matter how terrible they/it are/is. There are basically two IT choices that they do: 1. Choose a really big expensive company that is in Gartner(they do have the best dinners though, also you get to travel business class to visit them for seminars). 2. Choose someone that they know through somebody. It's quite amazing that Matrix has managed to get as much government traction as it has. I've seen a person not willing to kick out a product where I had to walkthrough the creator of it on a Teamviewer on how to debug his own app in the web inspector, and it was unable to display pdfs if they were in landscape(for years). And everyone knew they were bad, the managers would joke about it. As they say, nobody ever got fired for buying IBM. These people are absolutely terrified of making a bad decision that may cost them a promotion in the future.

deadalus 5y ago

Digital Communications Protocols (comparison) : https://docs.google.com/spreadsheets/d/1-UlA4-tslROBDS9IqHalWVztqZo7uxlCeKPQ-8uoFOU/edit#gid=0 https://docs.google.com/spreadsheets/d/1-UlA4-tslROBDS9IqHal...

stuartbman 5y ago

This is a much better system. In the UK we've gone from using pagers (I still use one) to proprietary systems which don't talk to one another (Medic Bleep, NerveCentre) in order to meet the ISO standard.

kragen 5y ago

This is wonderful! I've been using Matrix for the last several months for work, and it's mostly a huge improvement over that vile ransomware Slack. Especially Gomuks is a huge improvement. One drawback I've been suffering is that I can't figure out how to keep logs. Our server had a failure and was down for a day, so Element on my phone decided it should forget all its keys (and also my password). Now I've lost access to all the past channel logs on our E2E channels, and it seems like nobody on the channel has a version they can usably copy and paste; Element in particular doesn't allow you to copy and paste large chunks of chat history because, when you scroll back a lot, the chunks that are scrolled out of view cease to exist (from the point of view of the copy-paste buffer). Also gomuks deleted all my session information when my local disk got full. Maybe I should try Bitlbee? So, there are still a lot of rough edges! But there's a path to getting them fixed, since it's free software and an open protocol spec. Hopefully the German government will be a good collaborator in contributing improvements!

Arathorn 5y ago
https://github.com/russelldavies/matrix-archive https://github.com/russelldavies/matrix-archive is your best bet for exporting conversations right now. There's a GSoC project ongoing to build something like this into Element Web too so you can just hit "download" on a room and export it all nicely.
- kragen 5y ago
  Thank you! Should I report the fact that Element on my phone deleted all its session keys due to some kind of server hiccup (the server was incorrectly reporting incorrect-password stuff, probably because A. was reinstalling it and hadn't restored the user database yet) as a bug? Certainly deleting all my past conversations and my encryption keys when there's a temporary server failure, is not the behavior I desire, but maybe it's by design? (In that particular case, it resulted in me losing the address where I had to go that afternoon, which was in a Matrix chat message on my phone, before Element peremptorily deleted all my past messages with no confirmation. Fortunately I was able to remember enough of the address to get close enough...)

ChrisArchitect 5y ago

curious about the process to get this accepted behind the scenes. Some IT team convincing higher ups, trendy open source, coupled with standard/growing German disdain for anything US/foreign, and weird obsession with privacy ideals

cbmuser 5y ago

Since when does Germany have a national health care system? Germany has health insurances, both private and public but there is not one unified system really. I can go to a doctor and pay the bill on my own without getting in touch with any government organization. Gematik also is a private company according to their website. So nothing that is associated with the government.

Arathorn 5y ago
The second paragraph of https://de.wikipedia.org/wiki/Gematik https://de.wikipedia.org/wiki/Gematik spells out that gematik is majority owned by the government (BMG, and a bunch of other ministries). So while there isn't one unified system, gematik seems to exist to provide interoperability between the myriad different factions. Hence, pushing Matrix to do so.
Barrin92 5y ago
We don't have a centralized healthcare system but that doesn't mean there's no need for interoperability because healthcare institutions constantly exchange information. When you go to the doctor you are presumably insured. So your doctor needs to communicate with your insurance. Insurers might need to communicate with government agencies and regulatory bodies, and so on. If you've seen Covid data in Germany, that data comes from every corner in Germany, and all those institutions need to be able to talk toe each other.
- hdkrgr 5y ago
  To be fair: As a patient, except for them scanning my insurance card, I see very little evidence that would suggest that most of data exchange isn't being done via fax, snail-mail, or people talking into phones. Why in the world do I get a piece of paper from my doctor that I'm supposed to mail to my insurance provider (or scan and upload if you're lucky) when I'm being diagnosed with something? Doctor's offices are the least digitized businesses around. There's first signs of this getting better, but I can't wait for things to change...
  - 5y ago

Evergreen1234 5y ago

German doctor here. I want this! How does this relate to KIM (Kommunikation in der Medizin) a kind of secure e-mail as far as i understand, wich is sold to us now as the future standard of communication in healthcare?

ArmandGrillet 5y ago
Gematik (the company mentioned in the post) is also behind KIM: https://www.gematik.de/anwendungen/kim/ https://www.gematik.de/anwendungen/kim/

throwawayboise 5y ago

Wasn't there a city in Germany that to some fanfare moved all of their office IT to linux, and then a few years later switched back to Windows?

c-st 5y ago
Yes, that was Munich with its LiMux project. Incidentally and possibly unrelated, the project was abandoned after Microsoft moved their headquarters back into Munich.
summm 5y ago
It was Munich, the project was called Linux. Their previous mayor (Ude, social democrat) started the Linux project. The next mayor, Reiter, also a social democrat, even called himself a Microsoft fan and cancelled it against all advice. Suddenly Microsoft moved their Germany headquarters from a suburb to the city, so you go figure. Also, there were some internal power struggles between departments and some obvious mismanagement. Conservatives always have supported Microsoft, and the G, as usual, had no clue about tech and first supported Microsoft, but now claim to always have supported open source... Total shitshow.
- oaiey 5y ago
  Sounds like new CEO comes in and moves IT to his personal preference but leaves later before the move finished. Sounds familiar? ;)

MayeulC 5y ago

It looks like a private federation though, so while it's great that Matrix gets adopted more, it seems like every big entity they quote federate privately. Imagine e-mail but only being able to contact your company! It's a bit restrictive...

Arathorn 5y ago
In practice, what we see happen with the big private Matrix federations is that the users start demanding being able to talk with users on other private federations, and/or the public Matrix network - and threaten to otherwise start using WhatsApp or Telegram or whatever for these sensitive but external conversations. So there is a huge incentive to actually federate properly, and we're talking to pretty much all of them on figuring out how to do so.
- oaiey 5y ago
  Well, they have very sensitive data they do not want to bleed outside of their controlled bubble (see GDPR). So this gateways will be very interesting :)
oaiey 5y ago
Yeah, but the fact you can do that is a big sales point for matrix. This concrete system is intentionally restricted to avoid the risk of data loss.

hda2 5y ago

Does Matrix have a client that makes it easy to send voice messages like Whatsapp and Telegram? This is the only thing stopping us from using Matrix fulltime.

crossroadsguy 5y ago
Short answer: no. Long answer: there’s not even a simple native client that can even try to replace these apps. Often you see recommendations about some cartoonish app called Fluffy. No it’s no good. Every client is half baked, half cooked other than main client which was a electron monstrosity last time I checked. So the client space is still a mess (other than the org changing the name of its main client something -> riot -> element -> next name change awaited) compared to other personal messaging cum audio/video call apps. But a promising mess. Or so I hope.
tffgg 5y ago
Steps in FluffyChat: 1. Press voice button next to text box on the bottom 2. Say what you have to say 3. Press "Send"
Arathorn 5y ago
Element Web has voice messages on develop, and should be landing on mobile in the coming weeks.
- vfclists 5y ago
  "Web" = "Bloat"