7 ms·

Breaking the 100bps barrier with Matrix, meshsim and coap-proxy (2019)

sharmin123 5y ago
How Does A Hacker Hack A Phone? How To Avoid Phone Hacking?: https://www.hackerslist.co/how-does-a-hacker-hack-a.../ https://www.hackerslist.co/how-does-a-hacker-hack-a.../
Raineer 5y ago
This is so awesome. I'm thrilled to see work progressing at the other end of the bandwidth spectrum.
Arathorn 5y ago
This work has progressed a lot since 2019, although the blog post here describes the original spurt of work on it. Nowadays Matrix has MSC3079 to formally spec low bandwidth transports: https://matrix.org/blog/2021/06/10/low-bandwidth-matrix-an-implementation-guide https://matrix.org/blog/2021/06/10/low-bandwidth-matrix-an-i... and we’ll be building it into clients & servers by default in future. The final major unsolved problem is that the sync API doesn’t support pagination yet, so on a big account you can end up burning bandwidth (and cpu) syncing data for rooms or room members that the client doesn’t care about. This is the final piece of the puzzle, and the lowbandwidth team is working on it right now - and will probably be the most exciting and fundamental improvement in Matrix in years :)
- hirako2000 5y ago
  It's fascinating to see so much fundamental work taken on by the team at matrix. One thing I still can't understand though, as a matrix user, I try to get on my circle onto it. But instead of hearing praises for the technological superiority of the network, all I get is hate and quick dump of its use. I wondered why. And then realise their claim is justified. The market is dominated by centralised pseudo e2e encrypted services. And people stick to them for two reasons, network effect and the fact it just works. The official client is plagued with UX bugs. Push notifications works some of the time, sometimes the app would hang trying to open or access a channel, some message get stuck as the last entry with no means to delete them. It makes the network barely usable since clients can't keep up with whatever is going on at the network level. I think technological advances shouldn't be made at the expense of the UX. Today's problem with matrix is adoption, and the slow adoption rate isn't due to not breaking the 100byte barrier. People would greatly benefit in getting an alternative car engine that doesn't burn polluting fuel, and matrix is delivering a propulsion engine to send us to Mars, at zero cost to consumers. I still admire the project and its contributors, I just wish those hundreds of real issues on each of their github projects were being prioritised over cutting edge innovation.
  - foxfluff 5y ago
    Not just UX.. one day Element just wouldn't connect anymore (and in a typical webapp fashion, no useful error messages). Nuking its config directory and starting from scratch fixed it (never needed to do that in 20 years of using irssi). I've seen other issues like video previews getting their bottom half completely crippled. Can't make a video call just sharing the desktop with someone -- it demands a microphone. Can't disable read markers that are broadcast to everyone (bad for privacy imo). They were working on this when I looked into it but I've no idea if they've fixed it yet. And yes I've seen UX bugs such as some UI setting getting stuck in a state when you try to toggle it in the settings. I'm guessing these are more Element issues rather than Matrix issues (except for the read markers). But I get the vibe that we won't be seeing a client I like anytime soon; or it'll be a very minimalistic client with no support for all the fancy modern features, in which case I'd likely get the same or better experience with IRC anyway.
    - githubalphapapa 5y ago
      > But I get the vibe that we won't be seeing a client I like anytime soon; or it'll be a very minimalistic client with no support for all the fancy modern features, in which case I'd likely get the same or better experience with IRC anyway. I don't know if you're the Emacs type, but you might be interested in https://github.com/alphapapa/ement.el https://github.com/alphapapa/ement.el. It feels kind of like an upgraded IRC, with support for features like images and rich text, and it tries to be privacy-respecting (e.g. read receipts and typing notifications are enabled by default, to imitate Element, but optional). It doesn't support E2EE natively, but E2EE works through the Pantalaimon proxy, so it can be used with E2EE rooms that way. (Or if you don't care about E2EE rooms, like me (I mostly don't), you can use it in unencrypted rooms without using Pantalaimon.)
    - lrvick 5y ago
      If you prefer Irssi I would suggest weechat-matrix which I have used with high stability for over a year. Today I use the F-Droid Element client and Element web client for all my chat needs and they just work for my needs. YMMV.
  - 5y ago
- kixiQu 5y ago
  As an admin and end user, I'm gonna tell you that the most exciting improvement was voice messages, which I am so happy to have again and definitely didn't get as much attention as they deserved. Wish I could buy y'all a beer. I made a bot [send the audio] to a speech-to-text API so I've got the feature I really missed from Google Allo. The lower-level work is real interesting, but I hope people in this thread are also aware that the user experience is improving a lot all the time because y'all are working on features like that too. [send the audio]: https://maya.land/monologues/2021/08/05/matrix-bot-transcribe-speech-audio-messages.html https://maya.land/monologues/2021/08/05/matrix-bot-transcrib...
Gerald4799 5y ago
Thanks for the information, keep sharing this type of info. https://www.onevanilla.one/ https://www.onevanilla.one/
pantalaimon 5y ago
There is also https://comatrix.eu https://comatrix.eu which I think implements this.
- Arathorn 5y ago
  That’s a different but similar variant of matrix over coap :)
meibo 5y ago
This is awesome. Hope this will be adopted eventually for their P2P project - would do wonders over slow mesh networks, additionally to stuff like Tor.
- goodpoint 5y ago
  ...or just use Briar.
sharmin123 5y ago
How Does A Hacker Hack A Phone? How To Avoid Phone Hacking?: https://www.hackerslist.co/how-does-a-hacker-hack-a-phone-how-to-avoid-phone-hacking/ https://www.hackerslist.co/how-does-a-hacker-hack-a-phone-ho...
throwawaymanbot 5y ago
Such bellyaching over a free service. Yes UX is important, Yes consistency is great. I cannot say however, whatsapp UX is great, nor can I say, matrix' rivals have been glitch free. so lets remember that. Matrix is a great idea. Its looking like a great implementation, and in its time it will be mostly perfect. Its a work in progress. I hope the Matrix Team keep up the great work. Matrix' biggest issue is gonna be getting people to change over to use it from whatsapp, et al. There is a social comms app saturation happening. Resistance to use comes from people saying, I already use so many different apps, and no one I know is on matrix. Now THIS is hard to fix.
FullyFunctional 5y ago
I'm sorry if I miss it, but no protocol in this millennium should be without mitigation for denial of service. DJB's curveprotect uses fixed sized packages (refusing small ones) to kill amplification attacks. I wonder if they considered such issues.
- Arathorn 5y ago
  iirc curveprotect is effectively a replacement for TCP which uses EC crypto to encrypt each packet individually, and protects against DoS by each packet being cryptographically authenticated. Ultra low bandwidth Matrix does the same thing but using Noise instead.
  - FullyFunctional 5y ago
    No, that doesn't protect again amplification attacks by itself. Quoting https://curvecp.org/availability.html https://curvecp.org/availability.html: Blind amplification Some protocols allow attackers anywhere on the Internet to generate a packet that will trigger a much larger outgoing packet from the server to a victim address selected by the attacker. The issue here isn't the availability of that protocol; the issue is that the protocol is amplifying the attacker's resources, damaging availability for the rest of the Internet. The worst offender at the moment is DNSSEC, which has set up a remote-controlled machine-gun pool containing more than 2000 servers with amplification factors between 30 and 95 and with an overall outgoing attack capacity estimated to be close to 50 gigabits per second. With CurveCP, the first incoming packet from the client is padded so that it is as large as the outgoing packet from the server. If this padding is missing, the server won't respond. Subsequent packets from the client need to repeat server cookies and can't be generated blindly.
    - Arathorn 5y ago
      Right, understood - it’s the same reason that QUIC pads incoming packets to MTU. We deliberately don’t do this on ultra-low-bandwidth Matrix (as described in the original post) to save bits, so you would typically use it on a private network. For low-bandwidth matrix we use DTLS rather than Noise, which gets this right.

How Does A Hacker Hack A Phone? How To Avoid Phone Hacking?: https://www.hackerslist.co/how-does-a-hacker-hack-a.../ https://www.hackerslist.co/how-does-a-hacker-hack-a.../

Raineer 5y ago

This is so awesome. I'm thrilled to see work progressing at the other end of the bandwidth spectrum.

Arathorn 5y ago

This work has progressed a lot since 2019, although the blog post here describes the original spurt of work on it. Nowadays Matrix has MSC3079 to formally spec low bandwidth transports: https://matrix.org/blog/2021/06/10/low-bandwidth-matrix-an-implementation-guide https://matrix.org/blog/2021/06/10/low-bandwidth-matrix-an-i... and we’ll be building it into clients & servers by default in future. The final major unsolved problem is that the sync API doesn’t support pagination yet, so on a big account you can end up burning bandwidth (and cpu) syncing data for rooms or room members that the client doesn’t care about. This is the final piece of the puzzle, and the lowbandwidth team is working on it right now - and will probably be the most exciting and fundamental improvement in Matrix in years :)

hirako2000 5y ago
It's fascinating to see so much fundamental work taken on by the team at matrix. One thing I still can't understand though, as a matrix user, I try to get on my circle onto it. But instead of hearing praises for the technological superiority of the network, all I get is hate and quick dump of its use. I wondered why. And then realise their claim is justified. The market is dominated by centralised pseudo e2e encrypted services. And people stick to them for two reasons, network effect and the fact it just works. The official client is plagued with UX bugs. Push notifications works some of the time, sometimes the app would hang trying to open or access a channel, some message get stuck as the last entry with no means to delete them. It makes the network barely usable since clients can't keep up with whatever is going on at the network level. I think technological advances shouldn't be made at the expense of the UX. Today's problem with matrix is adoption, and the slow adoption rate isn't due to not breaking the 100byte barrier. People would greatly benefit in getting an alternative car engine that doesn't burn polluting fuel, and matrix is delivering a propulsion engine to send us to Mars, at zero cost to consumers. I still admire the project and its contributors, I just wish those hundreds of real issues on each of their github projects were being prioritised over cutting edge innovation.
- foxfluff 5y ago
  Not just UX.. one day Element just wouldn't connect anymore (and in a typical webapp fashion, no useful error messages). Nuking its config directory and starting from scratch fixed it (never needed to do that in 20 years of using irssi). I've seen other issues like video previews getting their bottom half completely crippled. Can't make a video call just sharing the desktop with someone -- it demands a microphone. Can't disable read markers that are broadcast to everyone (bad for privacy imo). They were working on this when I looked into it but I've no idea if they've fixed it yet. And yes I've seen UX bugs such as some UI setting getting stuck in a state when you try to toggle it in the settings. I'm guessing these are more Element issues rather than Matrix issues (except for the read markers). But I get the vibe that we won't be seeing a client I like anytime soon; or it'll be a very minimalistic client with no support for all the fancy modern features, in which case I'd likely get the same or better experience with IRC anyway.
  - githubalphapapa 5y ago
    > But I get the vibe that we won't be seeing a client I like anytime soon; or it'll be a very minimalistic client with no support for all the fancy modern features, in which case I'd likely get the same or better experience with IRC anyway. I don't know if you're the Emacs type, but you might be interested in https://github.com/alphapapa/ement.el https://github.com/alphapapa/ement.el. It feels kind of like an upgraded IRC, with support for features like images and rich text, and it tries to be privacy-respecting (e.g. read receipts and typing notifications are enabled by default, to imitate Element, but optional). It doesn't support E2EE natively, but E2EE works through the Pantalaimon proxy, so it can be used with E2EE rooms that way. (Or if you don't care about E2EE rooms, like me (I mostly don't), you can use it in unencrypted rooms without using Pantalaimon.)
  - lrvick 5y ago
    If you prefer Irssi I would suggest weechat-matrix which I have used with high stability for over a year. Today I use the F-Droid Element client and Element web client for all my chat needs and they just work for my needs. YMMV.
- 5y ago
kixiQu 5y ago
As an admin and end user, I'm gonna tell you that the most exciting improvement was voice messages, which I am so happy to have again and definitely didn't get as much attention as they deserved. Wish I could buy y'all a beer. I made a bot [send the audio] to a speech-to-text API so I've got the feature I really missed from Google Allo. The lower-level work is real interesting, but I hope people in this thread are also aware that the user experience is improving a lot all the time because y'all are working on features like that too. [send the audio]: https://maya.land/monologues/2021/08/05/matrix-bot-transcribe-speech-audio-messages.html https://maya.land/monologues/2021/08/05/matrix-bot-transcrib...

Gerald4799 5y ago

Thanks for the information, keep sharing this type of info. https://www.onevanilla.one/ https://www.onevanilla.one/

pantalaimon 5y ago

There is also https://comatrix.eu https://comatrix.eu which I think implements this.

Arathorn 5y ago
That’s a different but similar variant of matrix over coap :)

meibo 5y ago

This is awesome. Hope this will be adopted eventually for their P2P project - would do wonders over slow mesh networks, additionally to stuff like Tor.

goodpoint 5y ago
...or just use Briar.

sharmin123 5y ago

How Does A Hacker Hack A Phone? How To Avoid Phone Hacking?: https://www.hackerslist.co/how-does-a-hacker-hack-a-phone-how-to-avoid-phone-hacking/ https://www.hackerslist.co/how-does-a-hacker-hack-a-phone-ho...

throwawaymanbot 5y ago

Such bellyaching over a free service. Yes UX is important, Yes consistency is great. I cannot say however, whatsapp UX is great, nor can I say, matrix' rivals have been glitch free. so lets remember that. Matrix is a great idea. Its looking like a great implementation, and in its time it will be mostly perfect. Its a work in progress. I hope the Matrix Team keep up the great work. Matrix' biggest issue is gonna be getting people to change over to use it from whatsapp, et al. There is a social comms app saturation happening. Resistance to use comes from people saying, I already use so many different apps, and no one I know is on matrix. Now THIS is hard to fix.

FullyFunctional 5y ago

I'm sorry if I miss it, but no protocol in this millennium should be without mitigation for denial of service. DJB's curveprotect uses fixed sized packages (refusing small ones) to kill amplification attacks. I wonder if they considered such issues.

Arathorn 5y ago
iirc curveprotect is effectively a replacement for TCP which uses EC crypto to encrypt each packet individually, and protects against DoS by each packet being cryptographically authenticated. Ultra low bandwidth Matrix does the same thing but using Noise instead.
- FullyFunctional 5y ago
  No, that doesn't protect again amplification attacks by itself. Quoting https://curvecp.org/availability.html https://curvecp.org/availability.html: Blind amplification Some protocols allow attackers anywhere on the Internet to generate a packet that will trigger a much larger outgoing packet from the server to a victim address selected by the attacker. The issue here isn't the availability of that protocol; the issue is that the protocol is amplifying the attacker's resources, damaging availability for the rest of the Internet. The worst offender at the moment is DNSSEC, which has set up a remote-controlled machine-gun pool containing more than 2000 servers with amplification factors between 30 and 95 and with an overall outgoing attack capacity estimated to be close to 50 gigabits per second. With CurveCP, the first incoming packet from the client is padded so that it is as large as the outgoing packet from the server. If this padding is missing, the server won't respond. Subsequent packets from the client need to repeat server cookies and can't be generated blindly.
  - Arathorn 5y ago
    Right, understood - it’s the same reason that QUIC pads incoming packets to MTU. We deliberately don’t do this on ultra-low-bandwidth Matrix (as described in the original post) to save bits, so you would typically use it on a private network. For low-bandwidth matrix we use DTLS rather than Noise, which gets this right.