26 ms·

Time to talk about matrix.org and Element not Signal and definitely not Telegram...

by chagaif 4y ago

sofixa 4y ago
Why not Telegram, it has by far the best UX of all chat apps.
- mritzmann 4y ago
  Telegram (per default) does not have end-to-end encryption.
  - d0mine 4y ago
    "Telegram is more secure than mass market messengers like WhatsApp and Line." https://telegram.org/faq#q-how-secure-is-telegram https://telegram.org/faq#q-how-secure-is-telegram
    - devX3 4y ago
      posts "fact" about product of company factual statement is made by said company doesn't elaborate gigachad.jpg
    - londons_explore 4y ago
      I don't agree with that claim. While there is no e2e encryption, the number of people that can see the chats between me and my mother has just gone from two (me and her) to 500 (all the engineers on the telegram team). Also, being based in the UAE doesn't inspire confidence on the privacy and security front... Nor the fact they promised to release yearly transparency reports and then never did so... Or the fact Der Spiegel claims they have evidence of Telegram handing over user chats to authorities despite the fact telegrams FAQ claims they have never done so...
      - bombolo 4y ago
        You can enable e2e chats. But you lose cloud sync. > Also, being based in the UAE doesn't inspire confidence on the privacy and security front... Well the 5 eyes do not inspire confidence either, and that's where whatsapp is based. And Apple has plans to automatically inform law enforcement from device scans. At least telegram client is open source so that is unlikely to happen on the client side directly.
        rakoo 4y ago
        > You can enable e2e chats. But you lose cloud sync. You also lose talking to more than 1 person at the same time.
        gaius_baltar 4y ago
        And link previews. Groups are never secure, too. Also AFAIK Telegram has access to the plain text data from stickers so when they are downloaded by a person on a secret chat, everybody with server access can also figure a bit of the context of the conversation.
      - gaius_baltar 4y ago
        > the number of people that can see the chats between me and my mother has just gone from two (me and her) to 500 (all the engineers on the telegram team). And everyone from all companies to which Telegram will sell the data once they figure that there is a good money to be made from it. If they have the plain text data they can do whatever they want with it.
    - lima 4y ago
      The opposite is true - of all the major messengers, Telegram is the least secure. It uses a homebrew encryption scheme and does not have E2E encryption (yes, you can enable E2E for individual chats, but nobody uses it because it breaks most features). Not to mention the weird corporate structure, lack of transparency, failed crypto token launch, dishonest marketing...
      - DocTomoe 4y ago
        A non-standardized, homebrew encryption scheme does not necessarily have to be worse than a standardized algorithm - even though it often is. But if implemented correctly and by someone who knows what they are doing, I'd trust a homebrew algo more than one which has been approved by the west's codebreakers for general use.
        worewood 4y ago
        fullstop 4y ago
        The source for the clients is available. 1. https://github.com/DrKLO/Telegram https://github.com/DrKLO/Telegram 2. https://github.com/TelegramMessenger/Telegram-iOS https://github.com/TelegramMessenger/Telegram-iOS 3. https://github.com/overtake/TelegramSwift https://github.com/overtake/TelegramSwift 4. https://github.com/telegramdesktop/tdesktop https://github.com/telegramdesktop/tdesktop
        DocTomoe 4y ago
        I feel you are unnecessarily combative in your approach. I was making a general observation on the merits of different sourced encryption algorithms. I also would like to point out how your false dichotomy leaves no legitimate position when arguing against NSA-approved encryption mechanisms for the general public. From a security perspective, I don't care if open source is solving the backdoor problem - the use of NSA-approved algorithms is the problem, not the source code availability. From a civics perspective, I find potentially insecure algorithms that can be broken into by more local governments a lot more problematic than insecure algorithms that have a backdoor for governments far removed from, and ideally antagonistic to, my own if my own government cannot read it. The government of China or Russia is unlikely to abduct me in the night to put me into a black site. My own, or their American "friends", are a lot more likely to do so. If you have a counter-argument other than another ad hominem, I'm happy to hear it.
    - moffkalast 4y ago
      "Company says they are more secure than competition" Seems legit, I see no reason whatsoever not to trust them completely at their word. No company has ever lied to anyone before after all.
    - barbariangrunge 4y ago
      “Local man is taller and braver than other men” - says local man
- rglullis 4y ago
  It's still centralized and still a SPOF.
- Ayesh 4y ago
  Yeah I don't even know if that upper post was meant to be sarcastic. Telegram, despite the security theater, is amazing UX-wise. It's such a joy to use and I see myself more and more engaging with Telegram contacts just because it's convenient in many subtle yet impactful ways.
  - rglullis 4y ago
    You can improve the UX of Matrix clients. You can not make Telegram decentralized or take it out of control of one single entity.
    - mritzmann 4y ago
      > You can improve the UX of Matrix clients No. Most people can't do that (because not everyone is a software developer).
      - Spacemolte 4y ago
        I don't think he means you, or the users that needs this, but instead that it is possible to do if they are open source.
        rglullis 4y ago
        I'm always befuddled by how some people really take things so literally...
        spockz 4y ago
        Indeed. That is why I started using “one could” instead of “you can”. This prevented a lot of misunderstanding.
        uptown 4y ago
        How can you possibly expect ONE person to do all of this? /s
- chagaif 4y ago
  That's true, but it has some really annoying stuff and I have a specific bug as well... https://bugs.telegram.org/c/65 https://bugs.telegram.org/c/65
- Schroedingersat 4y ago
  Moving to another centralized service is just getting on the same wagon again. 'email' doesn't go down, that's not even a coherent concept.
  - cyberlurker 4y ago
    Poor example seeing how most use gmail.com or some other centralized service for email these days or risk emails not showing up from a self host solution.
- bombolo 4y ago
  It has a decent desktop client that is present in linux distributions, so that automatically disqualifies it, apparently.
- kornhole 4y ago
  It is centralized and mostly not E2ee. It has mainly the same problems as WhatsApp.
- stiltzkin 4y ago
  Black and white problem, do you need to speak privately?, use Matrix or Session or trust Telegram secret chats. Telegram is great for other no privacy related stuff as bots, channels and groups.
Vinnl 4y ago
I mean, that's great and all, but it would still be pretty annoying if large parts of your network go down, and especially if matrix.org would go down.
- wakeupcall 4y ago
  But nobody is forcing you to use matrix.org, and if you have the resources it's easy to run a separate instance with peering, so that you get both the benefits of being able to communicate with everyone and have a faster/locally controlled instance with whatever rules you like. We're keeping one alive with friends, not because we need it, but because we can and it's easy to do so. We can argue matrix has not the most fancyful clients right now, and it might not be a perfect solution for everybody, however there are many clients to choose from, you can write one easily with many support libraries, it's easy to script, you can have full control. This is what we should push for. I've recommended signal to a lot of friends, and I currently feel stupid for doing so: It was a hurdle to convince them, and what I achieved was to move some to another privately run network with arbitrary rules and mandated software controlled by a single entity which is now starting to do random crap.
  - Vinnl 4y ago
    I might not use matrix.org, but when 90% of my friends do (and currently that's closer to 100%), that doesn't do much for me... (But also: I don't have the resources to run a separate instance for myself, let alone for my friends.)
    - wakeupcall 4y ago
      Perfectly understandable. If matrix took off a little more, we might see an increase in resources for the official homeserver, or see more peered homeservers becoming popular (as people today get a gmail account and expect to work with users on offic360 without questioning). Meanwhile you also have the option to get a client with multi-account support. Again, not all clients have this, but this is again something that no other messenger does, or will ever allow purely for market reasons.
zeitlupe 4y ago
Why not Signal?
- rakoo 4y ago
  Signal is as centralized as Whatsapp, so you could one day read the exact same headline for it
  - cyphar 4y ago
    In fact, this did happen last year[1]. Moxie has infamously made the argument that decentralisation reduces reliability because if any one server goes down reliability is affected (ignoring that partial outages are better than total outages). [1]: https://techcrunch.com/2021/09/26/signal-the-encrypted-messaging-app-is-currently-down-for-many-users/ https://techcrunch.com/2021/09/26/signal-the-encrypted-messa...
    - rakoo 4y ago
      Interesting. I think it's a semantical battle between reliability (literally "can I rely on the system to be up ?") and resiliency ("if it takes a hit can I keep using it in degraded mode")
- ale42 4y ago
  Because it can suffer the same problem WhatsApp had, because it's centralized. If something on their infrastructure goes down, it might have consequences for all users. This is not the case for distributes solutions like Matrix. (I actually use Signal, though, and not Matrix, because the latter, although it has many advantages, has a relatively bad UX compared to Signal, or at least used to, and it's hard to get contacts to get to use it...)
  - sneak 4y ago
    Centralized management does not mean centralized infrastructure. Any of these systems could distribute the APIs and message delivery infra across multiple independent jurisdictions, regions, and providers, and do clientside load balancing. The fact that these systems are centralized in management does not mean that they need to have any SPOFs. Also, the Apple App Store and iOS activation servers are the biggest SPOFs of all. Without them, even with a brand new working device, you can't activate it or install apps to communicate.
sneak 4y ago
Matrix/Element iOS builds send all notifications (by Apple's design) through centralized developer-run servers that wake up your client app to talk to your homeserver. There's no way for you to avoid SPOFs for notifications on Apple devices, because APNS is designed so that the only way you can wake up an app to talk to an API is via notifications sent from the developer of that app. This means that if the APNS servers go down (unlikely), or that the vector.im notification relay servers go down, nobody using Element on iOS gets any notifications. It also means that vector.im sees all of the notification events (who got notified when), though I don't believe they see the notification content. The notifications (I speculate) are simply app wakeup events that make the app then contact the homeserver to see what it has new.
- Steltek 4y ago
  This is a problem with iOS, not Matrix or any other chat protocol. If you want more freedom and control over your communications, you wouldn't choose iOS anyway.
  - sneak 4y ago
    That's not accurate.
tjixxu 4y ago
The Matrix team seems to be focusing on anything but making it as performant and usable as Telegram or Slack. The project leaders have been told this multiple times but there is always a reason.
- d3nj4l 4y ago
  I'm unhappy with the python implementation's performance too (ran it on a $5 VPS for a while and then gave up) but I think the Go implementation is much better and catching up in features really quickly, and I'd be happy to give it a shot again when I have more time.
- ryukafalz 4y ago
  Speak for yourself. The recent addition of space-protected rooms eliminated one of the biggest issues preventing my local hackerspace from using it. (Of course, it did so roughly as we finally qualified for the nonprofit Slack plan, so it was a bit too late to have a real advantage - but it's an option now where it wasn't before.)
  - tetris11 4y ago
    I've been using spaces for a while, but I am genuinely still baffled by it. Intuitively, a space should be where I group rooms or people in a non-overlapping way, and cleanup the side-panel clutter... But I can access all rooms from all spaces, so what is it's purpose exactly other than a namespace in which to connect to other places?
    - ryukafalz 4y ago
      The most important thing in my view is that you can invite other people to the space, and you can use that membership to control access to multiple rooms. So let's say I were using Matrix for the hackerspace. With spaces, I can invite a new member to the space and they can join whatever associated rooms they want on their own. Without spaces, I'd be stuck either inviting people individually to every room, or making every room completely public, neither of which are particularly palatable.
dt3ft 4y ago
Why not Telegram or Signal?
- _s 4y ago
  Not P2P.
zaik 4y ago
Why not the IETF standard XMPP?
- jraph 4y ago
  Which XEPs are you talking about? No, this is not a question, this is an answer. At this point, XMPP is not a solution, but a basis for an actual coherent solution to be built on, but it does not exist yet (or anymore). Matrix is also only a partial answer, because in practice you will direct users to matrix.org, and that makes matrix.org not a single point of failure, but still a huge point of failure and matrix will be down for most people if matrix.org goes down.
  - rakoo 4y ago
    Core XMPP is decentralized today. Room chats standardization in XMPP started 20 years ago. Any server existing today has solved the issue whatsapp is facing right now.
    - jraph 4y ago
      It has decentralization today, but also no users today. I would be happy with it but my contact list quite empty. I'm not outright rejecting XMPP. I would like it very much to just use XMPP, but something needs to happen. It needs to be easy to use, friction-less, have all the fancy features and probably more to sell than Signal, Telegram, WhatsApp, Facebook Messenger and Matrix at the same time, which is no small feat. Core XMPP does not cut it. People expect more from a chat solution and won't adopt it as-is. XMPP has had decentralization for a very long time, but almost no users (if speaking about actual, decentralized, chat; it's used in many other things). It had both decentralization and users for a short time with Google chat, and user with no decentralization with Google chat and Facebook chat for a longer time, but both things are dead now. The network effect is the biggest issue to overcome for a chat system, not the actual tech, and XMPP has not solved it. Unfortunately, if you ask me. Element/Matrix, in contrast, have the features and a beginning of adoption. it now needs polish, smoothing the rough edges, and adoption. And also adoption. And even more adoption. Including from people/entities providing homeservers. I tried to make people adopt it. I failed. Signal, however, has been a success so far. Element/Matrix is great and a success in my company, however.
fyvhbhn 4y ago
Thought the same
asim 4y ago
I'm sorry but matrix is a convoluted mess. Speaking from experience, when there's a deep focus on protocols and technical architecture before usability it becomes incredibly hard for the consumer side to get started. It's still very much a DIY thing and the promise of Element hosted offerings kind of just defies the point of the federated design for what most came into it for, self hosting. Honestly, we just need a drop dead simple chat client/server that can be self hosted and may be eventually extended via wireguard/tailscale networks and MagicDNS.
- ddevault 4y ago
  Funny, my criticisms of Matrix are that it puts usability (or at least UI/UX) before the technical details.
  - asim 4y ago
    The project was founded in 2014. It was heavily focused on building a federated protocol before there was anything related to end usability. Maybe they've just flubbed the implementation and done a poor job of it, I don't know. I can tell you from the external perspective it's not doing a great job at anything technical or end UX. WhatsApp nailed distribution, Signal does privacy well, Telegram is simple and scalable. What is Matrix? None of the above. I'm sorry, that might come across as harsh but I see a lot of wishful posts here that kind of throw users in that direction without real insight and knowledge into it. We don't want DIY that's endlessly complex and hard to maintain. The reason centralised apps work is because there's no setup, so really you're fighting frictionless experiences. Want to make self hosting a better experience, make it frictionless.
    - gausswho 4y ago
      I'm a fan of Matrix but am inclined to agree. In 2018 I looked at the Riot (Element) codebase with a hope to contribute to improving the client. In my estimation, the interfaces and data structures were bonkers convoluted and the maintainers gave dire warnings about how all of them were subject to radical change. I put my attention elsewhere. I wish they'd focused on building a messenger first, rather than trying to be a Slack/Teams/Discord. That said, it's taken a while but the Element client is dramatically better now. It still doesn't have the polish of other messengers, but I'm rooting for them to dial that in.
barbariangrunge 4y ago
What about mattermost? And, out of curiosity, how bad is discord for privacy?
protomyth 4y ago
I'm actually convinced that all the open source messaging apps are harder to install than postfix or opensmtpd thus a true pain in the butt. I get that most are trying to sell services but having an easy to install and setup program would make a real difference.
- asim 4y ago
  Agreed, simple installs for the win. The true test. How quickly can I get something running on a pure VPS. Maybe even without docker. How do I build it, how I do run it. Are there pre-packaged binaries, even better.
smingo 4y ago
Do we have an opinion on Threema ?
- chagaif 4y ago
  Centralized? But I really like the copy group feature
cookiengineer 4y ago
I'd disagree. In terms of privacy and anonymity, Matrix is an unguaranteeable nightmare. Just all the IRC bridges alone are a worst case scenario on what can happen with your data. I'd rather recommend Briar [1] which is really end to end encrypted, and works even offline via bluetooth or Wi-Fi LAN. [1] https://briarproject.org/ https://briarproject.org/
- genpfault 4y ago
  Sadness[1] :( https://code.briarproject.org/briar/briar/-/wikis/FAQ#can-i-use-the-same-account-with-several-devices https://code.briarproject.org/briar/briar/-/wikis/FAQ#can-i-...
prmoustache 4y ago
I would have mentionned xmpp, deltachat, tox and briar before matrix.
stiltzkin 4y ago
I do use Telegram as I do with Twitter, Reddit, HN and Discord. If you want privacy messages use Matrix or Session.

Time to talk about matrix.org and Element not Signal and definitely not Telegram...

sofixa 4y ago

Why not Telegram, it has by far the best UX of all chat apps.

mritzmann 4y ago
Telegram (per default) does not have end-to-end encryption.
- d0mine 4y ago
  "Telegram is more secure than mass market messengers like WhatsApp and Line." https://telegram.org/faq#q-how-secure-is-telegram https://telegram.org/faq#q-how-secure-is-telegram
  - devX3 4y ago
    posts "fact" about product of company factual statement is made by said company doesn't elaborate gigachad.jpg
  - londons_explore 4y ago
    I don't agree with that claim. While there is no e2e encryption, the number of people that can see the chats between me and my mother has just gone from two (me and her) to 500 (all the engineers on the telegram team). Also, being based in the UAE doesn't inspire confidence on the privacy and security front... Nor the fact they promised to release yearly transparency reports and then never did so... Or the fact Der Spiegel claims they have evidence of Telegram handing over user chats to authorities despite the fact telegrams FAQ claims they have never done so...
    - bombolo 4y ago
      You can enable e2e chats. But you lose cloud sync. > Also, being based in the UAE doesn't inspire confidence on the privacy and security front... Well the 5 eyes do not inspire confidence either, and that's where whatsapp is based. And Apple has plans to automatically inform law enforcement from device scans. At least telegram client is open source so that is unlikely to happen on the client side directly.
      - rakoo 4y ago
        > You can enable e2e chats. But you lose cloud sync. You also lose talking to more than 1 person at the same time.
        gaius_baltar 4y ago
        And link previews. Groups are never secure, too. Also AFAIK Telegram has access to the plain text data from stickers so when they are downloaded by a person on a secret chat, everybody with server access can also figure a bit of the context of the conversation.
    - gaius_baltar 4y ago
      > the number of people that can see the chats between me and my mother has just gone from two (me and her) to 500 (all the engineers on the telegram team). And everyone from all companies to which Telegram will sell the data once they figure that there is a good money to be made from it. If they have the plain text data they can do whatever they want with it.
  - lima 4y ago
    The opposite is true - of all the major messengers, Telegram is the least secure. It uses a homebrew encryption scheme and does not have E2E encryption (yes, you can enable E2E for individual chats, but nobody uses it because it breaks most features). Not to mention the weird corporate structure, lack of transparency, failed crypto token launch, dishonest marketing...
    - DocTomoe 4y ago
      A non-standardized, homebrew encryption scheme does not necessarily have to be worse than a standardized algorithm - even though it often is. But if implemented correctly and by someone who knows what they are doing, I'd trust a homebrew algo more than one which has been approved by the west's codebreakers for general use.
      - worewood 4y ago
        fullstop 4y ago
        The source for the clients is available. 1. https://github.com/DrKLO/Telegram https://github.com/DrKLO/Telegram 2. https://github.com/TelegramMessenger/Telegram-iOS https://github.com/TelegramMessenger/Telegram-iOS 3. https://github.com/overtake/TelegramSwift https://github.com/overtake/TelegramSwift 4. https://github.com/telegramdesktop/tdesktop https://github.com/telegramdesktop/tdesktop
        DocTomoe 4y ago
        I feel you are unnecessarily combative in your approach. I was making a general observation on the merits of different sourced encryption algorithms. I also would like to point out how your false dichotomy leaves no legitimate position when arguing against NSA-approved encryption mechanisms for the general public. From a security perspective, I don't care if open source is solving the backdoor problem - the use of NSA-approved algorithms is the problem, not the source code availability. From a civics perspective, I find potentially insecure algorithms that can be broken into by more local governments a lot more problematic than insecure algorithms that have a backdoor for governments far removed from, and ideally antagonistic to, my own if my own government cannot read it. The government of China or Russia is unlikely to abduct me in the night to put me into a black site. My own, or their American "friends", are a lot more likely to do so. If you have a counter-argument other than another ad hominem, I'm happy to hear it.
  - moffkalast 4y ago
    "Company says they are more secure than competition" Seems legit, I see no reason whatsoever not to trust them completely at their word. No company has ever lied to anyone before after all.
  - barbariangrunge 4y ago
    “Local man is taller and braver than other men” - says local man
rglullis 4y ago
It's still centralized and still a SPOF.
Ayesh 4y ago
Yeah I don't even know if that upper post was meant to be sarcastic. Telegram, despite the security theater, is amazing UX-wise. It's such a joy to use and I see myself more and more engaging with Telegram contacts just because it's convenient in many subtle yet impactful ways.
- rglullis 4y ago
  You can improve the UX of Matrix clients. You can not make Telegram decentralized or take it out of control of one single entity.
  - mritzmann 4y ago
    > You can improve the UX of Matrix clients No. Most people can't do that (because not everyone is a software developer).
    - Spacemolte 4y ago
      I don't think he means you, or the users that needs this, but instead that it is possible to do if they are open source.
      - rglullis 4y ago
        I'm always befuddled by how some people really take things so literally...
        spockz 4y ago
        Indeed. That is why I started using “one could” instead of “you can”. This prevented a lot of misunderstanding.
        uptown 4y ago
        How can you possibly expect ONE person to do all of this? /s
chagaif 4y ago
That's true, but it has some really annoying stuff and I have a specific bug as well... https://bugs.telegram.org/c/65 https://bugs.telegram.org/c/65
Schroedingersat 4y ago
Moving to another centralized service is just getting on the same wagon again. 'email' doesn't go down, that's not even a coherent concept.
- cyberlurker 4y ago
  Poor example seeing how most use gmail.com or some other centralized service for email these days or risk emails not showing up from a self host solution.
bombolo 4y ago
It has a decent desktop client that is present in linux distributions, so that automatically disqualifies it, apparently.
kornhole 4y ago
It is centralized and mostly not E2ee. It has mainly the same problems as WhatsApp.
stiltzkin 4y ago
Black and white problem, do you need to speak privately?, use Matrix or Session or trust Telegram secret chats. Telegram is great for other no privacy related stuff as bots, channels and groups.

Vinnl 4y ago

I mean, that's great and all, but it would still be pretty annoying if large parts of your network go down, and especially if matrix.org would go down.

wakeupcall 4y ago
But nobody is forcing you to use matrix.org, and if you have the resources it's easy to run a separate instance with peering, so that you get both the benefits of being able to communicate with everyone and have a faster/locally controlled instance with whatever rules you like. We're keeping one alive with friends, not because we need it, but because we can and it's easy to do so. We can argue matrix has not the most fancyful clients right now, and it might not be a perfect solution for everybody, however there are many clients to choose from, you can write one easily with many support libraries, it's easy to script, you can have full control. This is what we should push for. I've recommended signal to a lot of friends, and I currently feel stupid for doing so: It was a hurdle to convince them, and what I achieved was to move some to another privately run network with arbitrary rules and mandated software controlled by a single entity which is now starting to do random crap.
- Vinnl 4y ago
  I might not use matrix.org, but when 90% of my friends do (and currently that's closer to 100%), that doesn't do much for me... (But also: I don't have the resources to run a separate instance for myself, let alone for my friends.)
  - wakeupcall 4y ago
    Perfectly understandable. If matrix took off a little more, we might see an increase in resources for the official homeserver, or see more peered homeservers becoming popular (as people today get a gmail account and expect to work with users on offic360 without questioning). Meanwhile you also have the option to get a client with multi-account support. Again, not all clients have this, but this is again something that no other messenger does, or will ever allow purely for market reasons.

zeitlupe 4y ago

Why not Signal?

rakoo 4y ago
Signal is as centralized as Whatsapp, so you could one day read the exact same headline for it
- cyphar 4y ago
  In fact, this did happen last year[1]. Moxie has infamously made the argument that decentralisation reduces reliability because if any one server goes down reliability is affected (ignoring that partial outages are better than total outages). [1]: https://techcrunch.com/2021/09/26/signal-the-encrypted-messaging-app-is-currently-down-for-many-users/ https://techcrunch.com/2021/09/26/signal-the-encrypted-messa...
  - rakoo 4y ago
    Interesting. I think it's a semantical battle between reliability (literally "can I rely on the system to be up ?") and resiliency ("if it takes a hit can I keep using it in degraded mode")
ale42 4y ago
Because it can suffer the same problem WhatsApp had, because it's centralized. If something on their infrastructure goes down, it might have consequences for all users. This is not the case for distributes solutions like Matrix. (I actually use Signal, though, and not Matrix, because the latter, although it has many advantages, has a relatively bad UX compared to Signal, or at least used to, and it's hard to get contacts to get to use it...)
- sneak 4y ago
  Centralized management does not mean centralized infrastructure. Any of these systems could distribute the APIs and message delivery infra across multiple independent jurisdictions, regions, and providers, and do clientside load balancing. The fact that these systems are centralized in management does not mean that they need to have any SPOFs. Also, the Apple App Store and iOS activation servers are the biggest SPOFs of all. Without them, even with a brand new working device, you can't activate it or install apps to communicate.

sneak 4y ago

Matrix/Element iOS builds send all notifications (by Apple's design) through centralized developer-run servers that wake up your client app to talk to your homeserver. There's no way for you to avoid SPOFs for notifications on Apple devices, because APNS is designed so that the only way you can wake up an app to talk to an API is via notifications sent from the developer of that app. This means that if the APNS servers go down (unlikely), or that the vector.im notification relay servers go down, nobody using Element on iOS gets any notifications. It also means that vector.im sees all of the notification events (who got notified when), though I don't believe they see the notification content. The notifications (I speculate) are simply app wakeup events that make the app then contact the homeserver to see what it has new.

Steltek 4y ago
This is a problem with iOS, not Matrix or any other chat protocol. If you want more freedom and control over your communications, you wouldn't choose iOS anyway.
- sneak 4y ago
  That's not accurate.

tjixxu 4y ago

The Matrix team seems to be focusing on anything but making it as performant and usable as Telegram or Slack. The project leaders have been told this multiple times but there is always a reason.

d3nj4l 4y ago
I'm unhappy with the python implementation's performance too (ran it on a $5 VPS for a while and then gave up) but I think the Go implementation is much better and catching up in features really quickly, and I'd be happy to give it a shot again when I have more time.
ryukafalz 4y ago
Speak for yourself. The recent addition of space-protected rooms eliminated one of the biggest issues preventing my local hackerspace from using it. (Of course, it did so roughly as we finally qualified for the nonprofit Slack plan, so it was a bit too late to have a real advantage - but it's an option now where it wasn't before.)
- tetris11 4y ago
  I've been using spaces for a while, but I am genuinely still baffled by it. Intuitively, a space should be where I group rooms or people in a non-overlapping way, and cleanup the side-panel clutter... But I can access all rooms from all spaces, so what is it's purpose exactly other than a namespace in which to connect to other places?
  - ryukafalz 4y ago
    The most important thing in my view is that you can invite other people to the space, and you can use that membership to control access to multiple rooms. So let's say I were using Matrix for the hackerspace. With spaces, I can invite a new member to the space and they can join whatever associated rooms they want on their own. Without spaces, I'd be stuck either inviting people individually to every room, or making every room completely public, neither of which are particularly palatable.

dt3ft 4y ago

Why not Telegram or Signal?

_s 4y ago
Not P2P.

zaik 4y ago

Why not the IETF standard XMPP?

jraph 4y ago
Which XEPs are you talking about? No, this is not a question, this is an answer. At this point, XMPP is not a solution, but a basis for an actual coherent solution to be built on, but it does not exist yet (or anymore). Matrix is also only a partial answer, because in practice you will direct users to matrix.org, and that makes matrix.org not a single point of failure, but still a huge point of failure and matrix will be down for most people if matrix.org goes down.
- rakoo 4y ago
  Core XMPP is decentralized today. Room chats standardization in XMPP started 20 years ago. Any server existing today has solved the issue whatsapp is facing right now.
  - jraph 4y ago
    It has decentralization today, but also no users today. I would be happy with it but my contact list quite empty. I'm not outright rejecting XMPP. I would like it very much to just use XMPP, but something needs to happen. It needs to be easy to use, friction-less, have all the fancy features and probably more to sell than Signal, Telegram, WhatsApp, Facebook Messenger and Matrix at the same time, which is no small feat. Core XMPP does not cut it. People expect more from a chat solution and won't adopt it as-is. XMPP has had decentralization for a very long time, but almost no users (if speaking about actual, decentralized, chat; it's used in many other things). It had both decentralization and users for a short time with Google chat, and user with no decentralization with Google chat and Facebook chat for a longer time, but both things are dead now. The network effect is the biggest issue to overcome for a chat system, not the actual tech, and XMPP has not solved it. Unfortunately, if you ask me. Element/Matrix, in contrast, have the features and a beginning of adoption. it now needs polish, smoothing the rough edges, and adoption. And also adoption. And even more adoption. Including from people/entities providing homeservers. I tried to make people adopt it. I failed. Signal, however, has been a success so far. Element/Matrix is great and a success in my company, however.

fyvhbhn 4y ago

Thought the same

asim 4y ago

I'm sorry but matrix is a convoluted mess. Speaking from experience, when there's a deep focus on protocols and technical architecture before usability it becomes incredibly hard for the consumer side to get started. It's still very much a DIY thing and the promise of Element hosted offerings kind of just defies the point of the federated design for what most came into it for, self hosting. Honestly, we just need a drop dead simple chat client/server that can be self hosted and may be eventually extended via wireguard/tailscale networks and MagicDNS.

ddevault 4y ago
Funny, my criticisms of Matrix are that it puts usability (or at least UI/UX) before the technical details.
- asim 4y ago
  The project was founded in 2014. It was heavily focused on building a federated protocol before there was anything related to end usability. Maybe they've just flubbed the implementation and done a poor job of it, I don't know. I can tell you from the external perspective it's not doing a great job at anything technical or end UX. WhatsApp nailed distribution, Signal does privacy well, Telegram is simple and scalable. What is Matrix? None of the above. I'm sorry, that might come across as harsh but I see a lot of wishful posts here that kind of throw users in that direction without real insight and knowledge into it. We don't want DIY that's endlessly complex and hard to maintain. The reason centralised apps work is because there's no setup, so really you're fighting frictionless experiences. Want to make self hosting a better experience, make it frictionless.
  - gausswho 4y ago
    I'm a fan of Matrix but am inclined to agree. In 2018 I looked at the Riot (Element) codebase with a hope to contribute to improving the client. In my estimation, the interfaces and data structures were bonkers convoluted and the maintainers gave dire warnings about how all of them were subject to radical change. I put my attention elsewhere. I wish they'd focused on building a messenger first, rather than trying to be a Slack/Teams/Discord. That said, it's taken a while but the Element client is dramatically better now. It still doesn't have the polish of other messengers, but I'm rooting for them to dial that in.

barbariangrunge 4y ago

What about mattermost? And, out of curiosity, how bad is discord for privacy?

protomyth 4y ago

I'm actually convinced that all the open source messaging apps are harder to install than postfix or opensmtpd thus a true pain in the butt. I get that most are trying to sell services but having an easy to install and setup program would make a real difference.

asim 4y ago
Agreed, simple installs for the win. The true test. How quickly can I get something running on a pure VPS. Maybe even without docker. How do I build it, how I do run it. Are there pre-packaged binaries, even better.

smingo 4y ago

Do we have an opinion on Threema ?

chagaif 4y ago
Centralized? But I really like the copy group feature

cookiengineer 4y ago

I'd disagree. In terms of privacy and anonymity, Matrix is an unguaranteeable nightmare. Just all the IRC bridges alone are a worst case scenario on what can happen with your data. I'd rather recommend Briar [1] which is really end to end encrypted, and works even offline via bluetooth or Wi-Fi LAN. [1] https://briarproject.org/ https://briarproject.org/

genpfault 4y ago
Sadness[1] :( https://code.briarproject.org/briar/briar/-/wikis/FAQ#can-i-use-the-same-account-with-several-devices https://code.briarproject.org/briar/briar/-/wikis/FAQ#can-i-...

prmoustache 4y ago

I would have mentionned xmpp, deltachat, tox and briar before matrix.

stiltzkin 4y ago

I do use Telegram as I do with Twitter, Reddit, HN and Discord. If you want privacy messages use Matrix or Session.