5 ms·

I used to host a homeserver for myself up until very recently, but during their most recent conference, some folks decided to conduct a harassment campaign wher

I used to host a homeserver for myself up until very recently, but during their most recent conference, some folks decided to conduct a harassment campaign where they repeatedly posted CSAM in the Synapse Admins channel. Synapse didn't really offer me any built-in tools to preempt that sort of behavior - you can't even block domains. I found a third party moderation bot but it didn't look quick or easy to set up. Being exposed personally to that sort of thing was bad enough but making sure it wasn't persisted in backups and my S3 buckets was way more trouble than it was worth, so I shut the service down and nuked the whole thing. I was mostly hanging out in public channels and using bridges; I only had one small group of IRL friends that I talked to on it and they practically leapt at the opportunity when I suggested moving the group chat to a different platform. I see that "Trust & Safety" is on their list of things to tackle next, so perhaps I'll check it out when they announce Matrix 3.0.

jcul 2y ago
That's terrible. I used to host a home server many years ago, though it was mainly serving as a matrix bridge. Because of that I still idle in the synapse admins channel, though I have it muted and haven't opened it for years. It makes me worry that csam from the muted channel could be sitting on my hard drive somewhere.
- Arathorn 2y ago
  Content only gets stored on your local server if a local user downloads it by viewing it before the message or the original content gets deleted. Separately, you can block abusive servers manually if needed (e.g. https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#prevent_media_downloads_from https://element-hq.github.io/synapse/latest/usage/configurat...). For instance, this is better than email, where if someone sends you email with abusive attachments, it'll end up hitting your mail spool and likely your imap server whatever. That said, agreed that moderation and anti-abuse tooling is fragmented currently, and we're working away on improving it. Recently a lot of time got taken on authenticated media (to make it much harder to distribute abusive content): https://matrix.org/blog/2024/06/26/sunsetting-unauthenticated-media https://matrix.org/blog/2024/06/26/sunsetting-unauthenticate... but the top priority for The Matrix.org Foundation is to improve the anti-abuse situation (by securing funding for more folks to work on it).
  - jcul 2y ago
    Yeah it's a good point about email. To be clear I'm not currently hosting my own homeserver, these days I just use matrix.org. Hope to self host again once I can find some time.
- Imustaskforhelp 2y ago
  Earlier I was writing about how its an issue in federated system , but now I have come to realisation that this is an issue in any encrypted system (even discord can have csam but it can detect it) and to be honest , thus becomes a compromise , encrypted but you have the risk of csam or unencrypted , but to be really honest , I think considering edward's snowden blow on the nsa , I think I am much more safer in the encrypted land here was my original post which I was writing csam is an issue in federated systems (whether its p2p or non p2p) (source I read once on HN that some friend had created in the 1990's a sort of thing similar to chitchatter.im , only to it spread out of word and then came the csam) it happens on matrix as well.
  - mossTechnician 2y ago
    I realize you're probably using this discussion about the Synapse Admins chat as a springboard to talk about encryption in general, but for anybody unfamiliar with Matrix rooms: encryption is optional, and wasn't a factor in the issue. The Synapse Admins channel discussed by GP and GGP is not encrypted at all, and its messages are publicly accessible to anyone[1]. This means that various detection scripts could be run on messages at any time by the server, including when receiving them, and before propagating them to their database. [1]: https://app.element.io/#/room/#synapse:matrix.org https://app.element.io/#/room/#synapse:matrix.org
    - Imustaskforhelp 2y ago
      yes encryption is optional , and its generally not recommended in big groups but for me and my friend in a very basic group , encryption was causing problem in matrix and basically no problem in signal
- Imustaskforhelp 2y ago
  for some people , encryption is a must because you never know what the govt. thinks is right or wrong and simply giving the govt. power to surveillance is quite powerful to govt. because then they can tweak that info into metaphorically speaking whatever they like. there are entire communities based on this idea For example r/privacy , https://discuss.privacyguides.net/ https://discuss.privacyguides.net/ on which you rather have discussion on which protocol is more "encrypted" and "decentralized" in some sense to the extreme (like recent was simplex vs cwtch )

jcul 2y ago

That's terrible. I used to host a home server many years ago, though it was mainly serving as a matrix bridge. Because of that I still idle in the synapse admins channel, though I have it muted and haven't opened it for years. It makes me worry that csam from the muted channel could be sitting on my hard drive somewhere.

Arathorn 2y ago
Content only gets stored on your local server if a local user downloads it by viewing it before the message or the original content gets deleted. Separately, you can block abusive servers manually if needed (e.g. https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#prevent_media_downloads_from https://element-hq.github.io/synapse/latest/usage/configurat...). For instance, this is better than email, where if someone sends you email with abusive attachments, it'll end up hitting your mail spool and likely your imap server whatever. That said, agreed that moderation and anti-abuse tooling is fragmented currently, and we're working away on improving it. Recently a lot of time got taken on authenticated media (to make it much harder to distribute abusive content): https://matrix.org/blog/2024/06/26/sunsetting-unauthenticated-media https://matrix.org/blog/2024/06/26/sunsetting-unauthenticate... but the top priority for The Matrix.org Foundation is to improve the anti-abuse situation (by securing funding for more folks to work on it).
- jcul 2y ago
  Yeah it's a good point about email. To be clear I'm not currently hosting my own homeserver, these days I just use matrix.org. Hope to self host again once I can find some time.
Imustaskforhelp 2y ago
Earlier I was writing about how its an issue in federated system , but now I have come to realisation that this is an issue in any encrypted system (even discord can have csam but it can detect it) and to be honest , thus becomes a compromise , encrypted but you have the risk of csam or unencrypted , but to be really honest , I think considering edward's snowden blow on the nsa , I think I am much more safer in the encrypted land here was my original post which I was writing csam is an issue in federated systems (whether its p2p or non p2p) (source I read once on HN that some friend had created in the 1990's a sort of thing similar to chitchatter.im , only to it spread out of word and then came the csam) it happens on matrix as well.
- mossTechnician 2y ago
  I realize you're probably using this discussion about the Synapse Admins chat as a springboard to talk about encryption in general, but for anybody unfamiliar with Matrix rooms: encryption is optional, and wasn't a factor in the issue. The Synapse Admins channel discussed by GP and GGP is not encrypted at all, and its messages are publicly accessible to anyone[1]. This means that various detection scripts could be run on messages at any time by the server, including when receiving them, and before propagating them to their database. [1]: https://app.element.io/#/room/#synapse:matrix.org https://app.element.io/#/room/#synapse:matrix.org
  - Imustaskforhelp 2y ago
    yes encryption is optional , and its generally not recommended in big groups but for me and my friend in a very basic group , encryption was causing problem in matrix and basically no problem in signal
Imustaskforhelp 2y ago
for some people , encryption is a must because you never know what the govt. thinks is right or wrong and simply giving the govt. power to surveillance is quite powerful to govt. because then they can tweak that info into metaphorically speaking whatever they like. there are entire communities based on this idea For example r/privacy , https://discuss.privacyguides.net/ https://discuss.privacyguides.net/ on which you rather have discussion on which protocol is more "encrypted" and "decentralized" in some sense to the extreme (like recent was simplex vs cwtch )