4 ms·

Happy to hear there apparently are people that can make sensible technical decisions in German government. Realistically there weren't a lot of choices other t

by meibo 5y ago

Happy to hear there apparently are people that can make sensible technical decisions in German government. Realistically there weren't a lot of choices other than Matrix though, looking at what the law demands.

corty 5y ago
Well, they could still have opted for something proprietary, weird and broken. See for example the De-Mail desaster[0] and the beA desaster[1]. Both supposedly better and secure email/messenger replacements with huge problems like lacking end-to-end encryption, design problems, laughably lacking security, high cost, low adoption (except were required by law), no usability, etc. I'm really glad that at least someone here might have learned from those mistakes. [0] https://de.wikipedia.org/wiki/De-Mail https://de.wikipedia.org/wiki/De-Mail https://netzpolitik.org/2015/de-mail-das-tote-pferd-wird-weitergeritten-wieviel-das-kostet-soll-geheim-bleiben/ https://netzpolitik.org/2015/de-mail-das-tote-pferd-wird-wei... [1] https://de.wikipedia.org/wiki/Besonderes_elektronisches_Anwaltspostfach https://de.wikipedia.org/wiki/Besonderes_elektronisches_Anwa...
- GoblinSlayer 5y ago
  Didn't they force a backdoor on tutanota e2ee? Why do they suddenly allow matrix?
  - corty 5y ago
    E2EE isn't forbidden per se. But if you are a public communication provider over a certain size you need to provide access upon request if technically possible. It isn't really clear even in the case of Tutanota if they fall into that regulation, however, they had to preliminarily comply anyways: https://www.heise.de/news/Gericht-zwingt-Mailprovider-Tutanota-zu-Ueberwachungsfunktion-4972460.html https://www.heise.de/news/Gericht-zwingt-Mailprovider-Tutano... Healthcare providers operating a Matrix server won't be communication providers to the public, and if they aren't using a web client or some similar crap, breaking E2EE won't be possible. Webmail providers claiming E2EE like Tutanota are imho liars anyways, because Javascript on a website isn't a secure "end" for the encryption. So use client software that isn't attacker controlled easily, keep your keys private, only encrypt to trustworthy keys and you'll be fine. Matrix ticks all those boxes if you don't use the web client. And the only legal way in for German law enforcement would be to infect your device with some trojan ("Bundestrojaner", like e.g. NSO Pegasus).
  - germanier 5y ago
    German government IT is far removed from being a monolithic entity. There are a lot of different actors involved with different priorities. In this case law enforcement can simply request the data (as long as such a request is legal) at either end. No need to attack the connection in between.
vaylian 5y ago
I wouldn't be surprised if this flew under the radar of the people at the top. > Secretary: "IT said we should use matrix". > Minister: "Whatever. I'm busy with other things. Do I need to sign something?"
- Arathorn 5y ago
  It's the opposite, actually - it seems to be the Ministers and establishment pushing it. e.g: > [Bundesdatenschutzbeauftragte Ulrich] Kelber verweist auf die Entwicklungen in Frankreich. Dort wird eine Whatsappalternative auf Basis des Open-Source-Team-Messengers Matrix und dessen Client Riot entwickelt. In Frankreich "geht man aktuell einen hervorragenden Weg, um sich aus der faktisch in weiten Bereichen der Verwaltung bestehenden Abhängigkeit von Produkten großer amerikanischer IT-Firmen zu lösen", sagte Kleber. or in English: > Federal Data Protection Officer, Ulrich Kelber refers to the developments in France. A Whatsapp alternative based on the open source team messenger Matrix and its client Riot is being developed there. In France, "there is currently an excellent way to free oneself from the fact that many areas of administration are actually dependent on the products of large American IT companies," said Kleber. from https://www.golem.de/news/whatsapp-matrix-oder-xmpp-bmi-sucht-einen-messenger-fuer-bundesbehoerden-1912-145326.html https://www.golem.de/news/whatsapp-matrix-oder-xmpp-bmi-such...
  - solarkraft 5y ago
    Ulrich Kelber may be the coolest higher german official, but he keeps complaining about not being listened to (on Mastodon, in meme form). I tend to think the political machinery isn’t afraid of proprietary/monopoly dependency in general, the issue is rather with those companies not being domestic.
- germanier 5y ago
  A shift to open source is sanctioned from the very top. For example, in the area of OZG (broad digital access to public services, coming soon) the explicit decision is (my translation): > Open standards must be used in the implementation and operation of digital offerings. The source code from the realization of digital offerings by the administration (in-house development) is made available as open source, i.e., in reusable form, wherever possible. https://www.it-planungsrat.de/fileadmin/beschluesse/2020/Beschluss2020-39_Eckpunkte_Umsetzung_des_OZG.pdf https://www.it-planungsrat.de/fileadmin/beschluesse/2020/Bes... They are also starting a project to host public, open source code which is backed by the federal CIO and many state and local governments: https://www.cio.bund.de/SharedDocs/Kurzmeldungen/DE/2021/pm_os_plattform.html https://www.cio.bund.de/SharedDocs/Kurzmeldungen/DE/2021/pm_... This is not something sneaked in by some techies. Every decision maker is probably aware by now what "open source" means.
hans1729 5y ago
For what its worth, open source is en vogue in german government IT at the moment. "Dataport", a government-owned IT-company, has an open-source based project "Phoenix", as a first step in this shift of paradigm. This is interesting because Dataport used to be pretty much a windows-shop; despite old and established hierarchies and its special place in the public domain, change is happening. (Source: I'm working in that project as a consultant)
- Arathorn 5y ago
  Independently of gematik's work, Phoenix also uses Matrix as its communication backplane (source: the Matrix team is also consulting on it :)
  - hans1729 5y ago
    I've had the pleasure of working with Ben for a while, cheers from team mav! Wearing my matrix hoodie writing this :)
    - toomuchtodo 5y ago
      Can you get a Matrix hoodie without working on Matrix? :D
      - Arathorn 5y ago
        https://shop.matrix.org https://shop.matrix.org :D (and yay for Ben - he gets everywhere!)
        toomuchtodo 5y ago
        Thank you so much!
- ltultraweight 5y ago
  Isn't Phoenix merely rebranding already existing projects like Jitsi Meet and matrix.org? If not, where can this project be publicly inspected?
Andrew_nenakhov 5y ago
they could have opted for XMPP, which is clearly a better and more mature alternative.
- solarkraft 5y ago
  Hey, why not IRC?
- unethical_ban 5y ago
  What experience in the field do you have implementing or managing Matrix or XMPP solutions?
  - Andrew_nenakhov 5y ago
    Does the development of an XMPP client with a few million downloads count as sufficient experience in the field?
  - deuill 5y ago
    This isn't necessarily an endorsement of one protocol/ecosystem over the other, nor do I have direct experience with integrating Matrix or XMPP (though I run the latter on my home-server for family), but XMPP has seen a few large deployments, including in healthcare (in the UK)[0][1] and in Germany[2]. The consumer-facing client ecosystem for XMPP has indeed seen less rapid development than Matrix (the latter probably benefits from a more cohesive approach), but the server ecosystem for XMPP is very mature, and servers such as Ejabberd are known to scale to hundreds of thousands of connections on a single, modest host[3]. Obviously, that's only one part of the puzzle, hence why Matrix was chosen here. Still, it'd be interesting to see how the two evolve and compare down the line. [0]: https://www.erlang-solutions.com/case-studies/pando-health-case-study/ https://www.erlang-solutions.com/case-studies/pando-health-c... [1]: https://medium.com/miquido/successful-migration-to-a-custom-xmpp-solution-76fcdecb0928 https://medium.com/miquido/successful-migration-to-a-custom-... [2]: https://twitter.com/iNPUTmice/status/1203611711967813633 https://twitter.com/iNPUTmice/status/1203611711967813633 [3]: https://www.process-one.net/blog/ejabberd-nintendo-switch-npns/ https://www.process-one.net/blog/ejabberd-nintendo-switch-np...
  - 5y ago

by meibo 5y ago

corty 5y ago

Well, they could still have opted for something proprietary, weird and broken. See for example the De-Mail desaster[0] and the beA desaster[1]. Both supposedly better and secure email/messenger replacements with huge problems like lacking end-to-end encryption, design problems, laughably lacking security, high cost, low adoption (except were required by law), no usability, etc. I'm really glad that at least someone here might have learned from those mistakes. [0] https://de.wikipedia.org/wiki/De-Mail https://de.wikipedia.org/wiki/De-Mail https://netzpolitik.org/2015/de-mail-das-tote-pferd-wird-weitergeritten-wieviel-das-kostet-soll-geheim-bleiben/ https://netzpolitik.org/2015/de-mail-das-tote-pferd-wird-wei... [1] https://de.wikipedia.org/wiki/Besonderes_elektronisches_Anwaltspostfach https://de.wikipedia.org/wiki/Besonderes_elektronisches_Anwa...

GoblinSlayer 5y ago
Didn't they force a backdoor on tutanota e2ee? Why do they suddenly allow matrix?
- corty 5y ago
  E2EE isn't forbidden per se. But if you are a public communication provider over a certain size you need to provide access upon request if technically possible. It isn't really clear even in the case of Tutanota if they fall into that regulation, however, they had to preliminarily comply anyways: https://www.heise.de/news/Gericht-zwingt-Mailprovider-Tutanota-zu-Ueberwachungsfunktion-4972460.html https://www.heise.de/news/Gericht-zwingt-Mailprovider-Tutano... Healthcare providers operating a Matrix server won't be communication providers to the public, and if they aren't using a web client or some similar crap, breaking E2EE won't be possible. Webmail providers claiming E2EE like Tutanota are imho liars anyways, because Javascript on a website isn't a secure "end" for the encryption. So use client software that isn't attacker controlled easily, keep your keys private, only encrypt to trustworthy keys and you'll be fine. Matrix ticks all those boxes if you don't use the web client. And the only legal way in for German law enforcement would be to infect your device with some trojan ("Bundestrojaner", like e.g. NSO Pegasus).
- germanier 5y ago
  German government IT is far removed from being a monolithic entity. There are a lot of different actors involved with different priorities. In this case law enforcement can simply request the data (as long as such a request is legal) at either end. No need to attack the connection in between.

vaylian 5y ago

I wouldn't be surprised if this flew under the radar of the people at the top. > Secretary: "IT said we should use matrix". > Minister: "Whatever. I'm busy with other things. Do I need to sign something?"

Arathorn 5y ago
It's the opposite, actually - it seems to be the Ministers and establishment pushing it. e.g: > [Bundesdatenschutzbeauftragte Ulrich] Kelber verweist auf die Entwicklungen in Frankreich. Dort wird eine Whatsappalternative auf Basis des Open-Source-Team-Messengers Matrix und dessen Client Riot entwickelt. In Frankreich "geht man aktuell einen hervorragenden Weg, um sich aus der faktisch in weiten Bereichen der Verwaltung bestehenden Abhängigkeit von Produkten großer amerikanischer IT-Firmen zu lösen", sagte Kleber. or in English: > Federal Data Protection Officer, Ulrich Kelber refers to the developments in France. A Whatsapp alternative based on the open source team messenger Matrix and its client Riot is being developed there. In France, "there is currently an excellent way to free oneself from the fact that many areas of administration are actually dependent on the products of large American IT companies," said Kleber. from https://www.golem.de/news/whatsapp-matrix-oder-xmpp-bmi-sucht-einen-messenger-fuer-bundesbehoerden-1912-145326.html https://www.golem.de/news/whatsapp-matrix-oder-xmpp-bmi-such...
- solarkraft 5y ago
  Ulrich Kelber may be the coolest higher german official, but he keeps complaining about not being listened to (on Mastodon, in meme form). I tend to think the political machinery isn’t afraid of proprietary/monopoly dependency in general, the issue is rather with those companies not being domestic.
germanier 5y ago
A shift to open source is sanctioned from the very top. For example, in the area of OZG (broad digital access to public services, coming soon) the explicit decision is (my translation): > Open standards must be used in the implementation and operation of digital offerings. The source code from the realization of digital offerings by the administration (in-house development) is made available as open source, i.e., in reusable form, wherever possible. https://www.it-planungsrat.de/fileadmin/beschluesse/2020/Beschluss2020-39_Eckpunkte_Umsetzung_des_OZG.pdf https://www.it-planungsrat.de/fileadmin/beschluesse/2020/Bes... They are also starting a project to host public, open source code which is backed by the federal CIO and many state and local governments: https://www.cio.bund.de/SharedDocs/Kurzmeldungen/DE/2021/pm_os_plattform.html https://www.cio.bund.de/SharedDocs/Kurzmeldungen/DE/2021/pm_... This is not something sneaked in by some techies. Every decision maker is probably aware by now what "open source" means.

hans1729 5y ago

For what its worth, open source is en vogue in german government IT at the moment. "Dataport", a government-owned IT-company, has an open-source based project "Phoenix", as a first step in this shift of paradigm. This is interesting because Dataport used to be pretty much a windows-shop; despite old and established hierarchies and its special place in the public domain, change is happening. (Source: I'm working in that project as a consultant)

Arathorn 5y ago
Independently of gematik's work, Phoenix also uses Matrix as its communication backplane (source: the Matrix team is also consulting on it :)
- hans1729 5y ago
  I've had the pleasure of working with Ben for a while, cheers from team mav! Wearing my matrix hoodie writing this :)
  - toomuchtodo 5y ago
    Can you get a Matrix hoodie without working on Matrix? :D
    - Arathorn 5y ago
      https://shop.matrix.org https://shop.matrix.org :D (and yay for Ben - he gets everywhere!)
      - toomuchtodo 5y ago
        Thank you so much!
ltultraweight 5y ago
Isn't Phoenix merely rebranding already existing projects like Jitsi Meet and matrix.org? If not, where can this project be publicly inspected?

Andrew_nenakhov 5y ago

they could have opted for XMPP, which is clearly a better and more mature alternative.

solarkraft 5y ago
Hey, why not IRC?
unethical_ban 5y ago
What experience in the field do you have implementing or managing Matrix or XMPP solutions?
- Andrew_nenakhov 5y ago
  Does the development of an XMPP client with a few million downloads count as sufficient experience in the field?
- deuill 5y ago
  This isn't necessarily an endorsement of one protocol/ecosystem over the other, nor do I have direct experience with integrating Matrix or XMPP (though I run the latter on my home-server for family), but XMPP has seen a few large deployments, including in healthcare (in the UK)[0][1] and in Germany[2]. The consumer-facing client ecosystem for XMPP has indeed seen less rapid development than Matrix (the latter probably benefits from a more cohesive approach), but the server ecosystem for XMPP is very mature, and servers such as Ejabberd are known to scale to hundreds of thousands of connections on a single, modest host[3]. Obviously, that's only one part of the puzzle, hence why Matrix was chosen here. Still, it'd be interesting to see how the two evolve and compare down the line. [0]: https://www.erlang-solutions.com/case-studies/pando-health-case-study/ https://www.erlang-solutions.com/case-studies/pando-health-c... [1]: https://medium.com/miquido/successful-migration-to-a-custom-xmpp-solution-76fcdecb0928 https://medium.com/miquido/successful-migration-to-a-custom-... [2]: https://twitter.com/iNPUTmice/status/1203611711967813633 https://twitter.com/iNPUTmice/status/1203611711967813633 [3]: https://www.process-one.net/blog/ejabberd-nintendo-switch-npns/ https://www.process-one.net/blog/ejabberd-nintendo-switch-np...
- 5y ago