> What would you think if you discovered that a new messaging software claiming to be decentralized is sending lots of your private data and metadata to their c

> What would you think if you discovered that a new messaging software claiming to be decentralized is sending lots of your private data and metadata to their central servers despite you installed your own instance? It's funny that the article links an early version[1] of the matrix.org website. In the beginnings they didn't even claim Matrix was decentralized, but wanted to be a federated network of servers, similar to how email works now. It's only recently with the new plans for fully p2p clients that they switched to the "decentralized" design. In fact in the pages linked the world "decentralized" never appears. > Matrix is not a community-based software, it was born [00] in Amdocs [01], a multinational corporation founded in Israel. > On the Internet we find many pieces information connecting Amdocs with Israel’s Intelligence [02][03][04]. Tor was built by the US navy and the NSA gave us SELinux and Ghidra, so what? If it's an open standard who cares who built it? > Riot, the Matrix client, was created with Electron Riot (now Element) is a web client: you don't need electron to use it as much as you need it for any other web application. Moreover there are a dozen[2] of independently developed clients, including native clients built with Qt (Nheko, Quaternion, Neochat), GTK (Fractal), Flutter (FluffyChat), etc. > Matrix arrived with this plan to interconnect every existing IM and VoIP network through what they call Bridges [10], which could be seen as a centralizing hub where metadata could be analyzed, as well as the right place to try Person In The Middle Attacks. Agreed, but you can run your own server: it's in fact encouraged, unlike other actually centralized services like Signal. If you're using something like NixOS[3] it's actually relatively easy to configure a homeserver and bridges. Also, if they manage to migrate to decentralized identisies and p2p clients, most of these concerns will be addressed. > Summary of the Notes on privacy and data collection of Matrix.org - Matrix IDs are actually intended to be removed from the protocol messages to make identities portable[4]; - email addresses and phone numbers are optional if you don't want to use the identity server (allow people to find you using email, phone etc.) - IP address: yeah, try to write a networked application that doesn't use them - Room IDs and other servers are other essential data for the protocol to work - user devices and system information: I don't know about this, is this collected by some crash reporter? - Profile name avatars: this is public information, really. Again, most of this is not a concern if you run your own server now, or with p2p in the future. matrix.org is just a reference homeserver, you are not forced to use it in any way, you don't loose any feature. [1]: https://web.archive.org/web/20141217141653/http://matrix.org/ https://web.archive.org/web/20141217141653/http://matrix.org... [2]: https://matrix.org/clients/ https://matrix.org/clients/ [3]: https://nixos.org/manual/nixos/stable/index.html#module-services-matrix https://nixos.org/manual/nixos/stable/index.html#module-serv... [4]: https://github.com/matrix-org/matrix-doc/pull/2787 https://github.com/matrix-org/matrix-doc/pull/2787