5 ms·

Any when you complain about it, Matrix accuses you of acting in the interests of the attackers. I've quit it entirely. They have a real victim complex and don'

by edent 1y ago

Any when you complain about it, Matrix accuses you of acting in the interests of the attackers. I've quit it entirely. They have a real victim complex and don't understand that people have legitimate complaints about them.

mystraline 1y ago
I've never engaged the project admins. But if they're like Tor and their responses to deanonymizing OS reporting (basically hostile and attacking), it wouldn't surprise me. My issue with possession of CSAM is that its statutory without mens rea. That means if my client gets an image without my knowledge or approval, I'm still blamed for it. And blame is a bloody felony. Some jurisdictions call for absurd punishments of 10y prison per image. There are a few rooms I'm in. They are heavily moderated and narrow discussion. One is an speech-to-text from OpenMHZ police scanner for my area. But I also discourage usage - I'm highly technical, and I fear average users would get in over their heads and have a very bad time.
- firefax 1y ago
  >...if they're like Tor and their responses to deanonymizing OS reporting (basically hostile and attacking), it wouldn't surprise me. Can you be more specific about this? I've met several of the devs and they seem open to bug reports, and the Tor blog is always being updated with notes about various fixes that have been implemented...
  - mystraline 1y ago
    Tor silently, last October, quit spoofing OS and now reports over browser headers what OS you are. Previously, every Tor Browser was "windows". The claim I've heard was that there were JavaScript attacks that could uncover what OS you were using. Patching those would be 'too hard'. So now TBB just gives up OS. Seems not very good to voluntarily give up bits of PII. https://m.youtube.com/watch?v=3wlNemFwbwE https://m.youtube.com/watch?v=3wlNemFwbwE is where I was made aware of this problem. I verified it on my infrastructure too.
    - lcampbell 1y ago
      Without knowing anything about Tor, I'd guess you've got it backwards. I imagine Tor leaks your OS through TCP/IP fingerprinting, and whether that fingerprint matches your `navigator.platform` is probably a factor into whether e.g. Cloudflare hellbans you. Then again, I'd also assume Cloudflare just de facto hellbans all Tor exit node IPs, so...
      - notpushkin 1y ago
        Doesn’t TCP/IP fingerprinting only reach your first hop node though?
    - firefax 1y ago
      I was looking more for a whitepaper or blog post, a random youtube video is not an acceptable source for debating the integrity of a browser.
- immibis 1y ago
  Time to debunk this again. Tor had a thin layer of user-agent spoofing: it would always claim to be Windows (I presume) in the User-Agent header. But the real user-agent (which is still spoofed, but platform-specifically) was easily accessible from Javascript without even fingerprinting, since they never spoofed the navigator.userAgent variable in the same way. It could also be detected from other fingerprints such as TLS. They removed the header-only user-agent spoofing so that the User-Agent header now reports the same value as navigator.userAgent, which is one of three distinct values based on your OS type. The rationale is simple: having these different didn't work. It was a failure. It didn't hide any information. And it tripped fingerprint checks on some websites. So they stopped doing that. Certain people are trying to make this into a huge uproar for some reason. As far as I'm concerned, it's a coordinated disinformation campaign to discourage the use of Tor. The developers probably get spammed about this particular change a lot, because of the disinformation campaign, which explains the hostile response.
  - mystraline 1y ago
    Nowhere on Tor's blogs or social media posts mentioned any of these changes, and why. The 'debunking' is required because of media silence, and people online finding out about this. Nor were there any developer statements about this change. From an outsider (user) perspective, this smells like a coverup or an insider threat ala XZ situation. And for software that people sometimes rely on safeguarding their lives with, well, yeah, addressing these significant changes in the open is how you avoid due scrutiny. And I think scrutinizing the lack of communication is a rather damning problem, especially here.
  - majorchord 1y ago
    The real crime to me is tor browser not spoofing navigator.platform. Regardless of the user agent, if this variable can be used to find something that doesn't say Windows, then I think that already greatly hurts your fingerprint as the number of non-Windows installs pales in comparison.
AAAAaccountAAAA 1y ago
They definitely have a victim complex. Few years back, when I complained of the then-insanely poor performance and scalability of the Synapse server, they told me to spend a few thousands of bucks on a high-performance personal server, and to educate myself to set up and maintain a Synapse instance, which was then and is still much harder to do than running most other server software. Hell, I was told I was a some sort of bad person for being unhappy with room joins taking hours or even days. After exhausting all other options, they have improved their software a lot (it's still not perfect, but definitely usable), but their poor attitude has soured their reputation, and made it really difficult to be enthusiastic about Matrix.
- masfuerte 1y ago
  The Conduit server is very lightweight. I run a private server on a 128MB VPS!
  - AAAAaccountAAAA 1y ago
    I have heard so, too. Maybe I'll give it or some of its derivatives a try some time. I think there is a some sort of catch-22 going on. Matrix Foundation can't fund the replacement of Synapse with a better-designed server, because hosting matrix.org consumes all the money. And it consumes so much money because it runs Synapse, which uses computing resources in a very inefficient manner. And the Foundation might have a some sort of conflict-of-interest, since it is closely interwoven with the New Vector company, which business case is being able to make Synapse work despite its flaws.
    - DuncanCoffee 1y ago
      There's an official Golang rewrite called dendrite: https://github.com/element-hq/dendrite https://github.com/element-hq/dendrite it has few start because they recentyl migrated it from the original repo (https://github.com/matrix-org/dendrite https://github.com/matrix-org/dendrite) Development is not fast but it's going on, and it's currently on beta. I haven't tried it, I selfhost a synapse server which I used with friends, and with docker it wasn't hard to set up/maintain after the initial effort.
ezst 1y ago
> a real victim complex that, a thousand times. Combined with a severe lack of objectivity. If you can't see the flaws and can't be critical of your own product, what room/hope is there for improvement? Matrix is a never ending story of over-promises under-delivered, taking feedback in bad faith, and, yeah, playing the victim. I'm amazed that Matrix did manage to capture so much attention for so long while at it. There were there at the right time but with the wrong tech/product/abstraction/competences, sucked all the air out of the "federated personal instant messaging that you can host yourself"-room, and I am still sour that they possibly contributed to the current sad sate of affairs and worst case of consolidation there has ever been in this space (there was a time when WhatsApp wasn't so ubiquitous, facebook messenger, skype, … sucked, GTalk had some amount of interop, and we had a shot at not having our instant messaging in walled gardens).
Arathorn 1y ago
All I did was to DM you to ask you to not post screenshots of the CSAM spammer’s activity, as it amplifies their spam and gives them a platform which further encourages them by giving them attention and a reaction. This should not be remotely controversial. Obviously the Matrix team is very aware of the very real legitimate problem of the CSAM spammer, and all the very real legitimate complaints about it, and we have tackled it as transparently as we can, with very limited resources. I am incredibly disappointed that someone I previously respected and considered a constructive member of the open source community reacted like this to a simple request to not feed the trolls. https://mastodon.matrix.org/@matrix/114540986615467818 https://mastodon.matrix.org/@matrix/114540986615467818
- doublepg23 1y ago
  I’m pretty used to dropping into an HN thread about Matrix and thinking “what FUD is Arathorn going to need to debunk this time”. Sucks tech communities are so toxic, thanks for working hard making Matrix in this environment.

by edent 1y ago

mystraline 1y ago

I've never engaged the project admins. But if they're like Tor and their responses to deanonymizing OS reporting (basically hostile and attacking), it wouldn't surprise me. My issue with possession of CSAM is that its statutory without mens rea. That means if my client gets an image without my knowledge or approval, I'm still blamed for it. And blame is a bloody felony. Some jurisdictions call for absurd punishments of 10y prison per image. There are a few rooms I'm in. They are heavily moderated and narrow discussion. One is an speech-to-text from OpenMHZ police scanner for my area. But I also discourage usage - I'm highly technical, and I fear average users would get in over their heads and have a very bad time.

firefax 1y ago
>...if they're like Tor and their responses to deanonymizing OS reporting (basically hostile and attacking), it wouldn't surprise me. Can you be more specific about this? I've met several of the devs and they seem open to bug reports, and the Tor blog is always being updated with notes about various fixes that have been implemented...
- mystraline 1y ago
  Tor silently, last October, quit spoofing OS and now reports over browser headers what OS you are. Previously, every Tor Browser was "windows". The claim I've heard was that there were JavaScript attacks that could uncover what OS you were using. Patching those would be 'too hard'. So now TBB just gives up OS. Seems not very good to voluntarily give up bits of PII. https://m.youtube.com/watch?v=3wlNemFwbwE https://m.youtube.com/watch?v=3wlNemFwbwE is where I was made aware of this problem. I verified it on my infrastructure too.
  - lcampbell 1y ago
    Without knowing anything about Tor, I'd guess you've got it backwards. I imagine Tor leaks your OS through TCP/IP fingerprinting, and whether that fingerprint matches your `navigator.platform` is probably a factor into whether e.g. Cloudflare hellbans you. Then again, I'd also assume Cloudflare just de facto hellbans all Tor exit node IPs, so...
    - notpushkin 1y ago
      Doesn’t TCP/IP fingerprinting only reach your first hop node though?
  - firefax 1y ago
    I was looking more for a whitepaper or blog post, a random youtube video is not an acceptable source for debating the integrity of a browser.
immibis 1y ago
Time to debunk this again. Tor had a thin layer of user-agent spoofing: it would always claim to be Windows (I presume) in the User-Agent header. But the real user-agent (which is still spoofed, but platform-specifically) was easily accessible from Javascript without even fingerprinting, since they never spoofed the navigator.userAgent variable in the same way. It could also be detected from other fingerprints such as TLS. They removed the header-only user-agent spoofing so that the User-Agent header now reports the same value as navigator.userAgent, which is one of three distinct values based on your OS type. The rationale is simple: having these different didn't work. It was a failure. It didn't hide any information. And it tripped fingerprint checks on some websites. So they stopped doing that. Certain people are trying to make this into a huge uproar for some reason. As far as I'm concerned, it's a coordinated disinformation campaign to discourage the use of Tor. The developers probably get spammed about this particular change a lot, because of the disinformation campaign, which explains the hostile response.
- mystraline 1y ago
  Nowhere on Tor's blogs or social media posts mentioned any of these changes, and why. The 'debunking' is required because of media silence, and people online finding out about this. Nor were there any developer statements about this change. From an outsider (user) perspective, this smells like a coverup or an insider threat ala XZ situation. And for software that people sometimes rely on safeguarding their lives with, well, yeah, addressing these significant changes in the open is how you avoid due scrutiny. And I think scrutinizing the lack of communication is a rather damning problem, especially here.
- majorchord 1y ago
  The real crime to me is tor browser not spoofing navigator.platform. Regardless of the user agent, if this variable can be used to find something that doesn't say Windows, then I think that already greatly hurts your fingerprint as the number of non-Windows installs pales in comparison.

AAAAaccountAAAA 1y ago

They definitely have a victim complex. Few years back, when I complained of the then-insanely poor performance and scalability of the Synapse server, they told me to spend a few thousands of bucks on a high-performance personal server, and to educate myself to set up and maintain a Synapse instance, which was then and is still much harder to do than running most other server software. Hell, I was told I was a some sort of bad person for being unhappy with room joins taking hours or even days. After exhausting all other options, they have improved their software a lot (it's still not perfect, but definitely usable), but their poor attitude has soured their reputation, and made it really difficult to be enthusiastic about Matrix.

masfuerte 1y ago
The Conduit server is very lightweight. I run a private server on a 128MB VPS!
- AAAAaccountAAAA 1y ago
  I have heard so, too. Maybe I'll give it or some of its derivatives a try some time. I think there is a some sort of catch-22 going on. Matrix Foundation can't fund the replacement of Synapse with a better-designed server, because hosting matrix.org consumes all the money. And it consumes so much money because it runs Synapse, which uses computing resources in a very inefficient manner. And the Foundation might have a some sort of conflict-of-interest, since it is closely interwoven with the New Vector company, which business case is being able to make Synapse work despite its flaws.
  - DuncanCoffee 1y ago
    There's an official Golang rewrite called dendrite: https://github.com/element-hq/dendrite https://github.com/element-hq/dendrite it has few start because they recentyl migrated it from the original repo (https://github.com/matrix-org/dendrite https://github.com/matrix-org/dendrite) Development is not fast but it's going on, and it's currently on beta. I haven't tried it, I selfhost a synapse server which I used with friends, and with docker it wasn't hard to set up/maintain after the initial effort.

ezst 1y ago

> a real victim complex that, a thousand times. Combined with a severe lack of objectivity. If you can't see the flaws and can't be critical of your own product, what room/hope is there for improvement? Matrix is a never ending story of over-promises under-delivered, taking feedback in bad faith, and, yeah, playing the victim. I'm amazed that Matrix did manage to capture so much attention for so long while at it. There were there at the right time but with the wrong tech/product/abstraction/competences, sucked all the air out of the "federated personal instant messaging that you can host yourself"-room, and I am still sour that they possibly contributed to the current sad sate of affairs and worst case of consolidation there has ever been in this space (there was a time when WhatsApp wasn't so ubiquitous, facebook messenger, skype, … sucked, GTalk had some amount of interop, and we had a shot at not having our instant messaging in walled gardens).

Arathorn 1y ago

All I did was to DM you to ask you to not post screenshots of the CSAM spammer’s activity, as it amplifies their spam and gives them a platform which further encourages them by giving them attention and a reaction. This should not be remotely controversial. Obviously the Matrix team is very aware of the very real legitimate problem of the CSAM spammer, and all the very real legitimate complaints about it, and we have tackled it as transparently as we can, with very limited resources. I am incredibly disappointed that someone I previously respected and considered a constructive member of the open source community reacted like this to a simple request to not feed the trolls. https://mastodon.matrix.org/@matrix/114540986615467818 https://mastodon.matrix.org/@matrix/114540986615467818

doublepg23 1y ago
I’m pretty used to dropping into an HN thread about Matrix and thinking “what FUD is Arathorn going to need to debunk this time”. Sucks tech communities are so toxic, thanks for working hard making Matrix in this environment.