7 ms·

Matrix v1.15

193 points by todsacerdoti 1y ago

fishgoesblub 1y ago
Every new release or "This week in Matrix" post I check to see if Discord style detailed permissions and voice channels get added and every time I get disappointed. I fear it'll never be added at this point due to the funding issues. I hyped it up to all of my friends who stick to Discord that "One day" it'll compete with Discord and we, and millions of others can all finally be happy. I hope that day will come, but my hope is fading.
- waymon 1y ago
  I'm running matrix with jitsi for voice. No one is gonna leave discord for it though....not yet in my circles at least.
  - luqtas 1y ago
    if people actually cared about freedom/privacy, Discord wouldn't be a thing, right? and even harder to leave Discord now when a lot of users invested in Nitro fancy emoticons and profile enchantments
    - spencerflem 1y ago
      Even without that, its just a much slicker and more useable system. I really want to love matrix but at least last time I tried it, the app was very noticeably more clunky and featureless.
    - 7bit 1y ago
      I care for privacy. But there has to be a compromise between privacy and socializing otherwise we would all use letters with encrypted text, no?
      - alisonatwork 1y ago
        Not really, because the security of letters is guaranteed by the state. The security of Discord is guaranteed by some private citizens based in the US. At least on paper the state exists for the benefit of the people. Discord exists for the benefit of investors who primarily seem to operate out of China and the US - foreign countries to me.
        eviks 1y ago
        > At least on paper But how is this relevant to a discussion of reality?
  - freilanzer 1y ago
    I know of nobody who even knows of Matrix, if I haven't told them beforehand. Discord is so much better than all alternatives, that I just don't see why anyone would leave it.
- Arathorn 1y ago
  What would you say the delta is between Element's current video-rooms and Discord-style voice-rooms (if you go and mute video for everyone), ooi? The only reason Element hasn't implemented precisely the same UI as Discord is because it's not (currently) trying to be a Discord competitor, but more a "run your own encrypted Teams alternative", given that's what Element customers are asking for right now, and we're having to follow the money to try to get sustainable. However, what we're trying to do is to ensure that Discordish features still work, despite having to focus more on Teamsish features. In terms of permissions: I'm a bit surprised that folks feel limited by Matrix's freeform hierarchy of permissions. Every user can have a 'power level' from 0 to 100, and you can then customise the threshold required for literally permission (e.g. you need power level 54 or higher to kick users, or whatever). The only difference with Discord is that Discord lets you pick entirely arbitrary combinations of permissions (e.g. have one user able to kick but not ban, but another user able to ban but not kick, or whatever). How useful really is this in real life usage though? I'm trying to work out whether the problem is if Element's UI for configuring permissions is too basic, or whether folks really do need a full RBAC permission matrix, and if so, for what use case?
  - have_faith 1y ago
    The power level model of permissions feels to me a bit overly simplified. It’s so easy to imagine scenarios where you need exceptions to the rule of permissions existing on a single axis that it seems very limiting from the outset. The idea of ever increasing and overlapping scopes I don’t think maps well to most people’s mental model of who should be allowed to do what. People mostly want to define an arbitrary role; admin, user, team leader, whatever, and just pick what that role is allowed to do in isolation. It’s marginally more work to setup initially picking all of the permissions again, but it removes all of the overhead of having to monitor what permissions are being adopted from lower scopes on the power level axis. I also think the power level system makes it much harder to “refactor” permissions for specific roles without affecting permissions for everyone “above and below”
  - em-bee 1y ago
    the discord style permissions are simply easier to understand. it's classic role based. you define the roles, and assign the roles to users. matrix permissions forces a hierarchy that is awkward and more difficult to apply because i have to force permissions into a hierarchy. on discord i don't have to think about the hierarchy.
- switknee 1y ago
  Smells like baby duck syndrome. You're used to what you're used to, and you'll never get used to anything else if you don't switch. I do see what people are talking about in reference to the voice channels though, even though I can't stand them.
  - deleted 1y ago
    [deleted]
  - paulryanrogers 1y ago
    Why don't we all speak Esperanto? Inertia. I think hierarchical permission systems are awkward. Role based is easy to understand and setup, even if more complex technically.
    - jimbob45 1y ago
      Why don't we all speak Esperanto? Inertia. Well, also because Ido is the superior language. But also inertia, yes.
    - sampl3username 1y ago
      We don't speak Esperanto because constructed languages work against human nature.
- NanoCoaster 1y ago
  There's cinny, which is a pretty polished Matrix client that is very, uh, inspired by Discord in its look, that might soon add voice rooms: https://github.com/cinnyapp/cinny/pull/2335 https://github.com/cinnyapp/cinny/pull/2335 I played around with this implementation and it's looking pretty good. Not there yet, obviously, but we're in the ballpark I'd say. Obviously, there's lots more to Discord than just voice rooms and a similar-enough UI. But we're slowly getting there.
jedahan 1y ago
Can't wait until MAS is just part of synapse/dendrite, will be a lot easier to install and maintain than the extra moving parts.
- DoctorOW 1y ago
  I kinda like the extra moving parts, it makes it easier to scale away from the slow Python parts.
sneak 1y ago
None of these things are why I and everyone I know doesn’t use Matrix.
- cpfiffer 1y ago
  Why exactly don't people use matrix that much? It strikes me as a reasonably good open, secure comms protocol.
  - panki27 1y ago
    Because it entails getting people away from WhatsApp/Telegram/etc. - I speak from experience.
    - jacooper 1y ago
      That's why bridges exist.
  - hashworks 1y ago
    The official client is clunky and being electron on the desktop doesn't make it better. Messengers live and die on UX. Since it's an open protocol alternative clients exist of course, but are often not feature complete. Things are often slow, especially with large group channels with lots of messages. If you host a server yourself - it's great that you can! - you'll try the official implementation, synapse — ...and discover that it's a resource hog. Things got a bit better with some streaming sync protocol or something like that, but last time I looked it up that was still experimental and the server is still a chonker. Again, alternative servers exist, again the problem with feature parity. I feel like the protocol is bloated as well, but I didn't dive into it too much to have a good opinion on that. When choosing a messenger, I go to Signal for security, to IRC for simplicity and to Telegram for UX. I never thought "Oh let's use Matrix"...
    - deleted 1y ago
      [deleted]
    - 1y ago
lousken 1y ago
custom emojis still didn't make the cut?
- exyi 1y ago
  The protocol must support it somehow already, as some bridges can send custom emojis from other platforms
  - Arathorn 1y ago
    https://github.com/matrix-org/matrix-spec-proposals/pull/2545 https://github.com/matrix-org/matrix-spec-proposals/pull/254... is the de-facto way that custom emoji are done today, but as you can see from the labyrinthine Matrix Spec Change, it still needs some work to get stabilised and formally merged into the spec. Meanwhile, folks are always welcome to use experimental MSCs in the wild.
deberon 1y ago
There’s a surprising amount of negativity in here. Matrix is great for me. I’m happy to see the improvements. I’m also happy to hear the team is approaching sustainability. Matrix isn’t perfect but it has only improved in the 5 years I’ve been using it. I’m looking forward to what they can do in another 5 years.
- godelski 1y ago
  I think HN just tends to be negative, though it seems to be getting more negative. I think a lot of people don't understand that finding problems is easy. Fixing them is hard. Which yes, you need to identify first but criticize, don't complain. But it's funny because anytime someone talks about Signal lots of people point to Matrix as "better". I'm not going to do the reverse because they solve different problems, which is okay. Besides, we should have a diversity of platforms, competition is good and there's no one size fits all. Biggest problem is people thinking there should be one superapp. I'm pretty confident people are mostly forming opinions to justify their decisions rather than speaking from informed points of view. My evidence is that these platforms solve different problems. Personally, I don't use matrix other than occasionally playing around. But I'm glad it exists and want it to keep existing
  - WhyNotHugo 1y ago
    Competition can be good, for example, if we had new clients for existing federated IM protocols. But Matrix brings fragmentation more than anything else: a brand new protocol that's slowly re-inventing what we already had. Matrix clients don't really compete with existing ones for open (or closed) protocols, they exist in an entirely new sphere. I don't think this is a net positive; the general ecosystem has finite manpower, the more we fragment it, the less each protocol gets. In the end, we have a new federated IM protocol which doesn't bring many new things to the table, but we still don't have any reliably easy-to-use clients.
    - tcfhgj 1y ago
      > But Matrix brings fragmentation more than anything else: a brand new protocol that's slowly re-inventing what we already had. We certainly didn't have decentralized rooms before
2Gkashmiri 1y ago
I use beeper to connect with WhatsApp. Saves me from 4 device WhatsApp web limit that is imposed. That said, I am personally not so keen on using matrix. Remember India government banned matrix and other apps for "facilitating terrorist communications". Ah... the joys of democracy.
- n2h4 1y ago
  [dead]
DavideNL 1y ago
It baffles me that when you install the Element App (which uses matrix.org by default), you can not easily find any of your friends, because you cant “connect” your phone number… This makes the App a no-go for everyone and their grandmother. The registration and setup process was so cumbersome, even people with some tech knowledge in my friend circle had trouble getting it to work. Anyway, it seems so user hostile, why not just make connecting a phone number optional? That would attract many more people?
- pixxel 1y ago
  > It baffles me It baffles me that people use corporate surveillance software, and balk at the tiniest of privacy hurdles.
- _flux 1y ago
  You can add your phone number.. But I don't know if it can actually be used to find you, even though it's the stated purpose :). You can find it from Settings/Security and Privacy. Most probably don't add it anyway because it's far from mandatory (I haven't created an account for some time, but I assume it's not part of the flow), so it probably wouldn't work out great in practice.
- foresto 1y ago
  I don't use that functionality, but I'm pretty sure it exists: https://spec.matrix.org/latest/identity-service-api/ https://spec.matrix.org/latest/identity-service-api/ https://github.com/matrix-org/sydent https://github.com/matrix-org/sydent
  - DavideNL 1y ago
    Yea that's correct, it seems to exist; However apparently the default server, matrix.org , does not support it... (which everyone uses who follows the default App setup flow.)
    - Arathorn 1y ago
      We disabled it on matrix.org because it was being used for 2FA SMS fraud, costing us $$$K, and we didn't want to burn time building an anti-fraud system. Getting access to everyone's phonebooks is also a privacy risk (even if you do fancy stuff with SGX like Signal does). Meanwhile, government deployments typically have LDAP or similar to discover users - and so it hasn't come up as a big requirement for the folks generating $. It's on the radar though as one of the main blockers for mainstream uptake... but right now we're trying to keep the lights on first before focusing on accelerating mainstream uptake.
zevon 1y ago
I'm happy Matrix exists and I've been a user in deployments at more than one university (where - fortunately - Teams, Slack and all the other externally hosted stuff isn't even an option).
lifty 1y ago
Super happy to see matrix chug along. I’ve been self hosting dendrite home server for a long time but it doesn’t have sliding sync support, so can’t use the new modernized client. Anyone using conduit for self hosting and do you know if it works with the new client?
- nadir_ishiguro 1y ago
  Maybe I'm confusing something, but I thought dendrite development had stopped due to budget concerns. I see now that there were actually recent releases on github.
btdmaster 1y ago
Does anyone know if homeservers still control room membership + user key lists or if it's somehow properly signed now? I couldn't find anything on https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients/ https://matrix.org/blog/2022/09/28/upgrade-now-to-address-en...
- Arathorn 1y ago
  Room membership is still determined by the server rather than the client - but we now warn the user and freeze the room if devices which are not signed by their owner are present in the room. Constraining the user membership to be controlled by the client is Hard in a fully decentralised world, but we're working on it: one option is MSC4256 (which pushes the whole problem to MLS); another option is to run Matrix's state resolution algorithm on the client (making the client implementation even more complex) to ensure that the client agrees with the server on the correct user membership.
  - btdmaster 1y ago
    Thanks a lot for chiming in! That's nice to hear it's better and improving. View from 1000 feet: maybe a way to lock a room's users would be interesting? So that new users in, say, a DM room do not get decryption keys for messages from the client. Something like a weaker form of "only send messages to verified users", where you could have a DM room with (at most) 2 people. Or, instead, maybe an option to disable forwarding session keys older than the user's room join event, to keep forward secrecy so that a new user does not get to read old messages (or does this already happen every 100 messages?).
    - Arathorn 1y ago
      > View from 1000 feet: maybe a way to lock a room's users would be interesting? That's a really interesting idea - having immutable memberships could be a good band-aid. The problem is that right now the fact that room membership is typically mutable can be valuable: you add assistants into DMs (human or virtual); you can bridge the DM to other platforms; you can add (benign) audit bots for compliance purposes; you can migrate between Matrix IDs by inviting in your new ID and kicking out the old one; etc. Of course, this same flexibility comes with a risk, and I see the point that it might be better to 'seal' membership if you know this is flexibility you don't want. We'll have a think. > Or, instead, maybe an option to disable forwarding session keys older than the user's room join event, to keep forward secrecy so that a new user does not get to read old messages (or does this already happen every 100 messages?). Currently we never forward session keys, so new users don't get to read old messages whatever. This obviously causes its own problems, especially for Slack/Teams style use cases where new joiners expect to be able to read conversation history. Work is ongoing right now to finally fix this (https://github.com/element-hq/element-meta/issues/39 https://github.com/element-hq/element-meta/issues/39), but we are very mindful of the risk of not sharing existing history to the wrong users (or devices), which is one of the reasons it's taken so long to land. The 100-message thing is separate: it's the maximum number of times a session-key ratchet can be advanced before it gets replaced. In other words, if you steal a session key, you can only use it to decrypt a maximum of the 100 subsequent messages sent by that device.
freilanzer 1y ago
I like the idea of matrix and element, but the execution is just so lackluster. Even Signal added a lot of quality of life improvements, and WhatsApp is consistently getting better. I don't like the idea of using a messenger owned by Meta, but honestly, messengers absolutely need an excellent UX and UI, QOL features, etc. and Element is just far behind in this regard.
- Arathorn 1y ago
  $50 says that this is yet another instance of the failure-mode explained in https://news.ycombinator.com/item?id=44392479 https://news.ycombinator.com/item?id=44392479.
  - freilanzer 1y ago
    ElemntX does not support all features that Element does, so if I'm using a space to group rooms, then I can't use it.
darqis 1y ago
I used it for a month. It's full of cartoon kiddie porn and porn in general.
- mindslight 1y ago
  Find better friends?
  - episode404 1y ago
    [dead]
makematrixriot 1y ago
So my issues are with Element and not matrix specifically. Dropping Element One was not a great decision. This was a great opportunity to get funding and let hobbyists in a the ground level without insane business pricing that reminds you of Microsoft or Atlassian. The devs convinced the leadership to completely halt improvement of features and implementation of new features to rewrite their codebase in an obscure and niche language that offers minimal benefits. Yes Rust is cool. Yes rust may be more secure. Completely re-implementing your main client in a new language while removing tons of functionality was a bad decision. There's no mobile client support for spaces, you can't browse public rooms from mobile, threads is horrifically broken, replies are terrible, they completely redesigned the emojis but dropped support for / commands. Element Server Suite is terrible, it isn't even close to enterprise level. There's no meaningful way to manage rooms at an admin level. There's no way to manager users through MAS in a reasonable way. You can't let admins take over rooms unless there is an admin bot in every room, including DMs. There's no way to manage federation. Requiring K8S to run a chat server is insane. The entire stack is way too heavy and most of the features that would make it worthwhile are pure vaporware.

193 points by todsacerdoti 1y ago

Every new release or "This week in Matrix" post I check to see if Discord style detailed permissions and voice channels get added and every time I get disappointed. I fear it'll never be added at this point due to the funding issues. I hyped it up to all of my friends who stick to Discord that "One day" it'll compete with Discord and we, and millions of others can all finally be happy. I hope that day will come, but my hope is fading.

waymon 1y ago
I'm running matrix with jitsi for voice. No one is gonna leave discord for it though....not yet in my circles at least.
- luqtas 1y ago
  if people actually cared about freedom/privacy, Discord wouldn't be a thing, right? and even harder to leave Discord now when a lot of users invested in Nitro fancy emoticons and profile enchantments
  - spencerflem 1y ago
    Even without that, its just a much slicker and more useable system. I really want to love matrix but at least last time I tried it, the app was very noticeably more clunky and featureless.
  - 7bit 1y ago
    I care for privacy. But there has to be a compromise between privacy and socializing otherwise we would all use letters with encrypted text, no?
    - alisonatwork 1y ago
      Not really, because the security of letters is guaranteed by the state. The security of Discord is guaranteed by some private citizens based in the US. At least on paper the state exists for the benefit of the people. Discord exists for the benefit of investors who primarily seem to operate out of China and the US - foreign countries to me.
      - eviks 1y ago
        > At least on paper But how is this relevant to a discussion of reality?
- freilanzer 1y ago
  I know of nobody who even knows of Matrix, if I haven't told them beforehand. Discord is so much better than all alternatives, that I just don't see why anyone would leave it.
Arathorn 1y ago
What would you say the delta is between Element's current video-rooms and Discord-style voice-rooms (if you go and mute video for everyone), ooi? The only reason Element hasn't implemented precisely the same UI as Discord is because it's not (currently) trying to be a Discord competitor, but more a "run your own encrypted Teams alternative", given that's what Element customers are asking for right now, and we're having to follow the money to try to get sustainable. However, what we're trying to do is to ensure that Discordish features still work, despite having to focus more on Teamsish features. In terms of permissions: I'm a bit surprised that folks feel limited by Matrix's freeform hierarchy of permissions. Every user can have a 'power level' from 0 to 100, and you can then customise the threshold required for literally permission (e.g. you need power level 54 or higher to kick users, or whatever). The only difference with Discord is that Discord lets you pick entirely arbitrary combinations of permissions (e.g. have one user able to kick but not ban, but another user able to ban but not kick, or whatever). How useful really is this in real life usage though? I'm trying to work out whether the problem is if Element's UI for configuring permissions is too basic, or whether folks really do need a full RBAC permission matrix, and if so, for what use case?
- have_faith 1y ago
  The power level model of permissions feels to me a bit overly simplified. It’s so easy to imagine scenarios where you need exceptions to the rule of permissions existing on a single axis that it seems very limiting from the outset. The idea of ever increasing and overlapping scopes I don’t think maps well to most people’s mental model of who should be allowed to do what. People mostly want to define an arbitrary role; admin, user, team leader, whatever, and just pick what that role is allowed to do in isolation. It’s marginally more work to setup initially picking all of the permissions again, but it removes all of the overhead of having to monitor what permissions are being adopted from lower scopes on the power level axis. I also think the power level system makes it much harder to “refactor” permissions for specific roles without affecting permissions for everyone “above and below”
- em-bee 1y ago
  the discord style permissions are simply easier to understand. it's classic role based. you define the roles, and assign the roles to users. matrix permissions forces a hierarchy that is awkward and more difficult to apply because i have to force permissions into a hierarchy. on discord i don't have to think about the hierarchy.
switknee 1y ago
Smells like baby duck syndrome. You're used to what you're used to, and you'll never get used to anything else if you don't switch. I do see what people are talking about in reference to the voice channels though, even though I can't stand them.
- deleted 1y ago
  [deleted]
- paulryanrogers 1y ago
  Why don't we all speak Esperanto? Inertia. I think hierarchical permission systems are awkward. Role based is easy to understand and setup, even if more complex technically.
  - jimbob45 1y ago
    Why don't we all speak Esperanto? Inertia. Well, also because Ido is the superior language. But also inertia, yes.
  - sampl3username 1y ago
    We don't speak Esperanto because constructed languages work against human nature.
NanoCoaster 1y ago
There's cinny, which is a pretty polished Matrix client that is very, uh, inspired by Discord in its look, that might soon add voice rooms: https://github.com/cinnyapp/cinny/pull/2335 https://github.com/cinnyapp/cinny/pull/2335 I played around with this implementation and it's looking pretty good. Not there yet, obviously, but we're in the ballpark I'd say. Obviously, there's lots more to Discord than just voice rooms and a similar-enough UI. But we're slowly getting there.

jedahan 1y ago

Can't wait until MAS is just part of synapse/dendrite, will be a lot easier to install and maintain than the extra moving parts.

DoctorOW 1y ago
I kinda like the extra moving parts, it makes it easier to scale away from the slow Python parts.

sneak 1y ago

None of these things are why I and everyone I know doesn’t use Matrix.

cpfiffer 1y ago
Why exactly don't people use matrix that much? It strikes me as a reasonably good open, secure comms protocol.
- panki27 1y ago
  Because it entails getting people away from WhatsApp/Telegram/etc. - I speak from experience.
  - jacooper 1y ago
    That's why bridges exist.
- hashworks 1y ago
  The official client is clunky and being electron on the desktop doesn't make it better. Messengers live and die on UX. Since it's an open protocol alternative clients exist of course, but are often not feature complete. Things are often slow, especially with large group channels with lots of messages. If you host a server yourself - it's great that you can! - you'll try the official implementation, synapse — ...and discover that it's a resource hog. Things got a bit better with some streaming sync protocol or something like that, but last time I looked it up that was still experimental and the server is still a chonker. Again, alternative servers exist, again the problem with feature parity. I feel like the protocol is bloated as well, but I didn't dive into it too much to have a good opinion on that. When choosing a messenger, I go to Signal for security, to IRC for simplicity and to Telegram for UX. I never thought "Oh let's use Matrix"...
  - deleted 1y ago
    [deleted]
  - 1y ago

lousken 1y ago

custom emojis still didn't make the cut?

exyi 1y ago
The protocol must support it somehow already, as some bridges can send custom emojis from other platforms
- Arathorn 1y ago
  https://github.com/matrix-org/matrix-spec-proposals/pull/2545 https://github.com/matrix-org/matrix-spec-proposals/pull/254... is the de-facto way that custom emoji are done today, but as you can see from the labyrinthine Matrix Spec Change, it still needs some work to get stabilised and formally merged into the spec. Meanwhile, folks are always welcome to use experimental MSCs in the wild.

deberon 1y ago

There’s a surprising amount of negativity in here. Matrix is great for me. I’m happy to see the improvements. I’m also happy to hear the team is approaching sustainability. Matrix isn’t perfect but it has only improved in the 5 years I’ve been using it. I’m looking forward to what they can do in another 5 years.

godelski 1y ago
I think HN just tends to be negative, though it seems to be getting more negative. I think a lot of people don't understand that finding problems is easy. Fixing them is hard. Which yes, you need to identify first but criticize, don't complain. But it's funny because anytime someone talks about Signal lots of people point to Matrix as "better". I'm not going to do the reverse because they solve different problems, which is okay. Besides, we should have a diversity of platforms, competition is good and there's no one size fits all. Biggest problem is people thinking there should be one superapp. I'm pretty confident people are mostly forming opinions to justify their decisions rather than speaking from informed points of view. My evidence is that these platforms solve different problems. Personally, I don't use matrix other than occasionally playing around. But I'm glad it exists and want it to keep existing
- WhyNotHugo 1y ago
  Competition can be good, for example, if we had new clients for existing federated IM protocols. But Matrix brings fragmentation more than anything else: a brand new protocol that's slowly re-inventing what we already had. Matrix clients don't really compete with existing ones for open (or closed) protocols, they exist in an entirely new sphere. I don't think this is a net positive; the general ecosystem has finite manpower, the more we fragment it, the less each protocol gets. In the end, we have a new federated IM protocol which doesn't bring many new things to the table, but we still don't have any reliably easy-to-use clients.
  - tcfhgj 1y ago
    > But Matrix brings fragmentation more than anything else: a brand new protocol that's slowly re-inventing what we already had. We certainly didn't have decentralized rooms before

2Gkashmiri 1y ago

I use beeper to connect with WhatsApp. Saves me from 4 device WhatsApp web limit that is imposed. That said, I am personally not so keen on using matrix. Remember India government banned matrix and other apps for "facilitating terrorist communications". Ah... the joys of democracy.

n2h4 1y ago
[dead]

DavideNL 1y ago

It baffles me that when you install the Element App (which uses matrix.org by default), you can not easily find any of your friends, because you cant “connect” your phone number… This makes the App a no-go for everyone and their grandmother. The registration and setup process was so cumbersome, even people with some tech knowledge in my friend circle had trouble getting it to work. Anyway, it seems so user hostile, why not just make connecting a phone number optional? That would attract many more people?

pixxel 1y ago
> It baffles me It baffles me that people use corporate surveillance software, and balk at the tiniest of privacy hurdles.
_flux 1y ago
You can add your phone number.. But I don't know if it can actually be used to find you, even though it's the stated purpose :). You can find it from Settings/Security and Privacy. Most probably don't add it anyway because it's far from mandatory (I haven't created an account for some time, but I assume it's not part of the flow), so it probably wouldn't work out great in practice.
foresto 1y ago
I don't use that functionality, but I'm pretty sure it exists: https://spec.matrix.org/latest/identity-service-api/ https://spec.matrix.org/latest/identity-service-api/ https://github.com/matrix-org/sydent https://github.com/matrix-org/sydent
- DavideNL 1y ago
  Yea that's correct, it seems to exist; However apparently the default server, matrix.org , does not support it... (which everyone uses who follows the default App setup flow.)
  - Arathorn 1y ago
    We disabled it on matrix.org because it was being used for 2FA SMS fraud, costing us $$$K, and we didn't want to burn time building an anti-fraud system. Getting access to everyone's phonebooks is also a privacy risk (even if you do fancy stuff with SGX like Signal does). Meanwhile, government deployments typically have LDAP or similar to discover users - and so it hasn't come up as a big requirement for the folks generating $. It's on the radar though as one of the main blockers for mainstream uptake... but right now we're trying to keep the lights on first before focusing on accelerating mainstream uptake.

zevon 1y ago

I'm happy Matrix exists and I've been a user in deployments at more than one university (where - fortunately - Teams, Slack and all the other externally hosted stuff isn't even an option).

lifty 1y ago

Super happy to see matrix chug along. I’ve been self hosting dendrite home server for a long time but it doesn’t have sliding sync support, so can’t use the new modernized client. Anyone using conduit for self hosting and do you know if it works with the new client?

nadir_ishiguro 1y ago
Maybe I'm confusing something, but I thought dendrite development had stopped due to budget concerns. I see now that there were actually recent releases on github.

btdmaster 1y ago

Does anyone know if homeservers still control room membership + user key lists or if it's somehow properly signed now? I couldn't find anything on https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients/ https://matrix.org/blog/2022/09/28/upgrade-now-to-address-en...

Arathorn 1y ago
Room membership is still determined by the server rather than the client - but we now warn the user and freeze the room if devices which are not signed by their owner are present in the room. Constraining the user membership to be controlled by the client is Hard in a fully decentralised world, but we're working on it: one option is MSC4256 (which pushes the whole problem to MLS); another option is to run Matrix's state resolution algorithm on the client (making the client implementation even more complex) to ensure that the client agrees with the server on the correct user membership.
- btdmaster 1y ago
  Thanks a lot for chiming in! That's nice to hear it's better and improving. View from 1000 feet: maybe a way to lock a room's users would be interesting? So that new users in, say, a DM room do not get decryption keys for messages from the client. Something like a weaker form of "only send messages to verified users", where you could have a DM room with (at most) 2 people. Or, instead, maybe an option to disable forwarding session keys older than the user's room join event, to keep forward secrecy so that a new user does not get to read old messages (or does this already happen every 100 messages?).
  - Arathorn 1y ago
    > View from 1000 feet: maybe a way to lock a room's users would be interesting? That's a really interesting idea - having immutable memberships could be a good band-aid. The problem is that right now the fact that room membership is typically mutable can be valuable: you add assistants into DMs (human or virtual); you can bridge the DM to other platforms; you can add (benign) audit bots for compliance purposes; you can migrate between Matrix IDs by inviting in your new ID and kicking out the old one; etc. Of course, this same flexibility comes with a risk, and I see the point that it might be better to 'seal' membership if you know this is flexibility you don't want. We'll have a think. > Or, instead, maybe an option to disable forwarding session keys older than the user's room join event, to keep forward secrecy so that a new user does not get to read old messages (or does this already happen every 100 messages?). Currently we never forward session keys, so new users don't get to read old messages whatever. This obviously causes its own problems, especially for Slack/Teams style use cases where new joiners expect to be able to read conversation history. Work is ongoing right now to finally fix this (https://github.com/element-hq/element-meta/issues/39 https://github.com/element-hq/element-meta/issues/39), but we are very mindful of the risk of not sharing existing history to the wrong users (or devices), which is one of the reasons it's taken so long to land. The 100-message thing is separate: it's the maximum number of times a session-key ratchet can be advanced before it gets replaced. In other words, if you steal a session key, you can only use it to decrypt a maximum of the 100 subsequent messages sent by that device.

freilanzer 1y ago

I like the idea of matrix and element, but the execution is just so lackluster. Even Signal added a lot of quality of life improvements, and WhatsApp is consistently getting better. I don't like the idea of using a messenger owned by Meta, but honestly, messengers absolutely need an excellent UX and UI, QOL features, etc. and Element is just far behind in this regard.

Arathorn 1y ago
$50 says that this is yet another instance of the failure-mode explained in https://news.ycombinator.com/item?id=44392479 https://news.ycombinator.com/item?id=44392479.
- freilanzer 1y ago
  ElemntX does not support all features that Element does, so if I'm using a space to group rooms, then I can't use it.

darqis 1y ago

I used it for a month. It's full of cartoon kiddie porn and porn in general.

mindslight 1y ago
Find better friends?
- episode404 1y ago
  [dead]

makematrixriot 1y ago

So my issues are with Element and not matrix specifically. Dropping Element One was not a great decision. This was a great opportunity to get funding and let hobbyists in a the ground level without insane business pricing that reminds you of Microsoft or Atlassian. The devs convinced the leadership to completely halt improvement of features and implementation of new features to rewrite their codebase in an obscure and niche language that offers minimal benefits. Yes Rust is cool. Yes rust may be more secure. Completely re-implementing your main client in a new language while removing tons of functionality was a bad decision. There's no mobile client support for spaces, you can't browse public rooms from mobile, threads is horrifically broken, replies are terrible, they completely redesigned the emojis but dropped support for / commands. Element Server Suite is terrible, it isn't even close to enterprise level. There's no meaningful way to manage rooms at an admin level. There's no way to manager users through MAS in a reasonable way. You can't let admins take over rooms unless there is an admin bot in every room, including DMs. There's no way to manage federation. Requiring K8S to run a chat server is insane. The entire stack is way too heavy and most of the features that would make it worthwhile are pure vaporware.