9 ms·

Matrix Conference 2025 Highlights

134 points by Arathorn 1y ago

bilal4hmed 1y ago
Compared to Signal, where does element stand today in terms of privacy and encryption? Due to the decentralized nature they werent able to offer the same guarantees from what I remember
- singpolyma3 1y ago
  It's exactly the same encryption tech, but a bit more trustworthy than signal.
  - bilal4hmed 1y ago
    can you expand on how its more trustworthy than signal?
    - candiddevmike 1y ago
      You can validate the code that's running on the client and the server, in theory
      - jeroenhd 1y ago
        You can validate the code running on the client (well, not on iOS, but that's true for all iOS apps unless you've jailbroken your phone). If Signal works well, you shouldn't need to validate what code is running on the server in the first place.
        holowoodman 1y ago
        With Signal, you can't really validate the code running on the client. Signal insists on distributing only via Google Play Store or Apple App Store, so usually updates are automatic and uncontrolled by you. And Signal has a history of not releasing timely updates of their client code, so even if you would do your own builds or compare their released code to their public updates, you would have at least a few weeks latency. And I doubt anyone would notice, since the Signal people tried hard to piss off everyone who did reproducible builds of their code.
        em-bee 1y ago
        Signal insists on distributing only via Google Play Store or Apple App Store on the signal.org website, there is a direct download link right below the google play button. it's still just a binary, but you can control updates. incidentally i just did an update this way.
      - tredre3 1y ago
        In theory you can do the same with Signal, as they source dump their server code every now and then. If you reject that on the basis of "we can't know if it's what they're running" or "it's a partial dump", then I don't see how Matrix is any different. Not only we can't know if Matrix servers have modified software, but we also have to trust/verify several servers instead of a single one.
    - dijit 1y ago
      The fundamental difference boiling down to trust isn't primarily in the cryptography; it's entirely down to the infrastructure and the root of control. Signal is widely regarded as the gold standard for centralised E2EE, but its architecture forces you into two massive, non-negotiable trust compromises: 1) You must trust the Signal corporation with all your metadata. Every routing and handshake detail passes through one single choke point that they control. That is an unacceptable risk for security-minded users. 2) You rely completely on Signal to truthfully publish a pre-compiled binary that actually reflects the open-source code. For the vast majority, this is unverifiable in practice. It's a critical client-side act of faith. Matrix’s design fundamentally eliminates these single points of failure, shifting the root of trust squarely to the user (or a group you trust): 1) Self-hosting; This is the game-changing feature. Host your own Synapse/Dendrite instance. Your metadata never leaves your control. You move the trust boundary from a corporation to yourself. You genuinely achieve "no communication outside your control." 2) Matrix uses an open specification. You can use FluffyChat, Nheko, or Element. This breaks the coupling between the server and the client. Even if you rely on a third-party server, you can use a client built by a completely different team, making the client-side code independently auditable and verifiable across projects. This is the ultimate defence against subtle backdoors in a single vendor's binary. TL;DR: Signal offers "trusted third-party" crypto running on a single, unauditable binary. Matrix is decentralised, verifiable zero-trust communication. The comparison isn't about the strength of the AES key or which data it has been applied to; it's about the architectural freedom to not have to trust another entity with either your data or your code. That freedom represents an essential leap in trustworthiness.
      - Etheryte 1y ago
        You might be making good points, I'm not familiar enough with the context to tell, but whining about downvotes is in bad taste, so a large part of your downvotes probably come from there, mine included.
        dijit 1y ago
        Apologies, it's frustrating watching my comment go from +5 to -2 in a handful of seconds. Not that I'm into karma farming (or that it even means anything), but it irritates me to think that people are gaming the discourse here. There's an implicit groupthink when it comes to seeing greyed out comments; to the point that people may (and do) think that the comment is non-factual or at the very least unpopular. This is especially true in subjects that are critical of Signal.
  - deleted 1y ago
    [deleted]
  - heinrich5991 1y ago
    It's less encrypted. E.g. you'd think that emoji reactions are end-to-end-encrypted (as they are in Signal). But they aren't[1]. I expect similar implementation issues wrt. the encryption in Matrix. [1]: https://github.com/matrix-org/matrix-spec/issues/660 https://github.com/matrix-org/matrix-spec/issues/660
  - some_furry 1y ago
    This is factually incorrect. https://soatok.blog/2025/02/18/reviewing-the-cryptography-used-by-signal/ https://soatok.blog/2025/02/18/reviewing-the-cryptography-us... https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/ https://soatok.blog/2024/08/14/security-issues-in-matrixs-ol... Signal uses a whole suite of modern cryptography, including post-quantum ratchets for key agreement and zero-knowledge proofs for group membership. Meanwhile, Matrix has a plaintext mode and knowingly shipped libraries with side-channels for years, by their own admission (and left many clients in the ecosystem depending on the vulnerable C implementation when they rewrote their cryptography protocol in Rust). Even today, they are not the same protocol. Olm/Megolm is distinct from Signal in a lot of ways that I've outlined in my previous blog posts. I don't particularly care if people like Matrix, but please don't spread falsehoods about the cryptography being used.
- _def 1y ago
  I think these two topics need to be looked at a bit separately, similar to for example WhatsApp, where you have e2ee but there are still lots of privacy risks. In the matrix ecosystem, as far as I understand, having only one user from the matrix.org homeserver in your room already undermines metadata privacy to some degree. Also, there still are issues with decrypting messages from time to time with certain combinations of clients, rooms and homeservers, which effectively means that the "failsafe" option for getting messages across the network is using unencrypted rooms. Having free, secure, federated, usable instant messaging is still not solved imho, and I think it's not easy to solve. So far matrix is the best attempt in my book, but it's also not there (yet?).
  - uyzstvqs 1y ago
    > So far matrix is the best attempt in my book, but it's also not there (yet?). IMO XMPP is the best attempt so far, but it's completely outdated by today's standards. Matrix is a modern attempt, but it's just bad. I doubt that Matrix will actually get anywhere usable in the future. It's absolutely possible to build such a protocol with high performance, seamless UX, Signal's level of privacy and security, and Discord's level of features. It's just a lot of work to actually build the specifications and flagship implementations, compared to just building a good centralized option.
    - _def 1y ago
      On XMPP, I agree. I think requirements also changed a lot over the years with smartphones and mobile internet access everywhere. And yeah it's definitely possible, but it's a lot of work, both technically and from an organizational perspective (funding, governance, etc).
      - upofadown 1y ago
        >I think requirements also changed a lot over the years with smartphones and mobile internet access everywhere. I recently started using an XMPP client on a smart phone (Cheogram, fork of Conversations). It handles that stuff remarkably well. Switching between, say, mobile data and WiFi takes seconds. It seems to have some way of noticing the loss of connection and immediately fires up a new TCP connection on the new medium.
- jeroenhd 1y ago
  Matrix allows for unencrypted messages so it's inherently less encrypted than Signal. The federation capability also means messages leak metadata. Furthermore, encrypted messages also contain some metadata in the unencrypted envelope. Some protocol features (emoji reactions) also ended up outside of the encrypted envelope because of that. It's a risk with any protocol that has encryption bolted on and optional. On the other hand, you can host your own Matrix server and still participate in the network, whereas Signal will have you convince your friends and family to install a custom Signal client if you want to run your own Signal server, for instance because you don't want to rely on Amazon's servers (Signal was down when Amazon went down this morning). Signal sacrifices network openness for encryption capabilities. There's also the MLS/MIMI side of things, but AFAIK that work hasn't been completed yet (MIMI isn't even a full RFC yet). Element/Matrix, with some modifications, has been chosen as the messenger of choice by the French government (Tchap) as well as the German military (BwMessenger, BundesMessenger) and healthcare (TI-Messenger).
  - nxor 1y ago
    Somewhat related - Can someone explain this to me? France and Germany want to lessen dependence on American organizations, so they choose Matrix, also an American organization.
    - dijit 1y ago
      If it's open source (and libre software) then it's not as important where the main development offices are (or where the company is incorporated). You still have control. Seems like the majority of the team are in the EU anyway: https://matrix.org/foundation/about/ https://matrix.org/foundation/about/
      - nxor 1y ago
        Thank you, and I see it's registered in the UK. I think it started in the US? Well, not like it's relevant anymore. And can you answer this question: If everyone has secure chat, then won't that benefit criminal organizations? I struggle to understand the love for private communication when it seems like that would benefit, for example, religious sects and sex abuse rings. NOT that I like that Zuckerborg keeping all my messages.
- the_gipsy 1y ago
  Signal requires a phone number, and AFAIK the PIN to prevent carrier-level attacks (well known) is not enabled by default.
- basilikum 1y ago
  Signal is a cryptographically well thought out protocol that reduces meta data. Matrix does not even encrypt emoji reactions.
- fsflover 1y ago
  Signal is centralized, so it becomes a huge target of all kinds of hackers and three-letter agencies. This alone is sufficient for me to never touch it. And then, there is this: https://news.ycombinator.com/item?id=42788647 https://news.ycombinator.com/item?id=42788647 https://news.ycombinator.com/item?id=39445976 https://news.ycombinator.com/item?id=39445976
  - JuniperMesos 1y ago
    If the open source client encryption is good enough, it shouldn't matter if the CIA itself is openly running the centralized portion of Signal.
    - fsflover 1y ago
      I'm not an expert, but it doesn't look so simple: https://news.ycombinator.com/item?id=39421128 https://news.ycombinator.com/item?id=39421128 https://news.ycombinator.com/item?id=39445976 https://news.ycombinator.com/item?id=39445976
    - upofadown 1y ago
      The vast majority of people using "end to end encrypted" messaging systems fail to verify the identity of their contacts. So those running the servers can fairly trivially MITM the messages. So in practice it does matter who controls the servers.
      - heinrich5991 1y ago
        The good thing is that verifying the other contact is invisible to the server in Signal. This means that it's stochastically sufficient that a few people do check their contacts in order to see whether there is any widespread MITMing going on.
- deleted 1y ago
  [deleted]
- tptacek 1y ago
  I don't think this is a super useful comparison, because the two services have wildly different threat models. I think of Matrix as a secure replacement for Discord. Signal is about small group messaging. It's literally a replacement for the built-in texting app on your phone, and that's its intended userbase. Signal is what you use when you need to know, to the limit of best practices available to ordinary users, that your messages will be as private as they can be made to be. That's a goal that isn't compatible with many of the affordances people want for project discussion platforms and things like that. If you pit Signal against Matrix and make the competition purely about security, Signal will win for the foreseeable future. But I think it makes much more sense to think about different sets of tradeoffs being more appropriate for different kinds of problems.
Scene_Cast2 1y ago
I noticed that they renamed the Element mobile app to Element Classic. Has Element X reached feature parity and stability yet? For how long will Classic be maintained?
- _def 1y ago
  As of lately, Spaces are now supported in Element X which possibly brings it to feature parity (at least I wouldn't know what's missing, and I've been using Element X now for some months because of these plans)
- noident 1y ago
  > The outgoing Element mobile app (‘classic Element’) will remain available in the app stores until at least the end of 2025, to ensure a smooth transition https://element.io/blog/mas-migration-unleashes-element-x-on-matrix-org/ https://element.io/blog/mas-migration-unleashes-element-x-on... I can't find any other communication from Element Creations other than that. The renaming to Element Classic doesn't bode well considering that Element X still doesn't support a vast number of home servers and a number of Synapse authn/authz features. If they remove it from the app store, my advice for my users is going to be to switch to fluffychat, and I'll eventually migrate away from Synapse to some flavor of Conduit.
- Arathorn 1y ago
  Element X now has initial support for threads & spaces (as of last week), which were the main things missing from full parity with Element Classic.
  - JuniperMesos 1y ago
    Good to know! These are very important features and not having them really gets in the way of switching off of classic. I am worried about "intial" support - what is going to break with threads and spaces that I try to join with thr new Element X?
  - conor- 1y ago
    Sorry to hijack this thread to ask - but what is the current state of sliding sync? Does it still require a separate proxy service to enable sliding sync if you're self-hosting a homeserver; or is it upstreamed into synapse? Also is there a list of clients that are sliding sync aware?
the__alchemist 1y ago
User report from 2025: Both the application and web UI are still buggy and slow. This is not acceptable in an application this simple in nature, that has been around for so long.
- Arathorn 1y ago
  which app are you talking about? as per the conference keynote, there are loads of different ones now, written in different stacks without any overlapping implementations. If you're talking about the old Element Classic mobile app, then yes, it's now been replaced by Element X (which now has spaces & threads support, and so pretty much has parity with the old app), and it is super fast, and not buggy.
  - abeindoria 1y ago
    It's not buggy? You should try going to the app store(s) and looking at reviews.
    - Arathorn 1y ago
      again, which app are you talking about? it's like saying "the web is buggy" but not saying what browser you're using. Looking at the App Store reviews for Element X at https://apps.apple.com/us/app/element-x-secure-chat-call/id1631335820 https://apps.apple.com/us/app/element-x-secure-chat-call/id1..., there are no complaints about bugs at all (only missing functionality, which has since been added)?
      - abeindoria 1y ago
        Brother, look at reviews for element x for android on play store. Come on, you're being intentionally obtuse.
  - the__alchemist 1y ago
    Hi! I'm referring to the one on element.io/download marked "Desktop" I haven't tried element.x. Seems to be phone only?
deleted 1y ago
[deleted]
solarkraft 1y ago
Aurora is a big deal! I’ve been waiting for the Rust SDK to come to the web. I’m not fully through the talk yet, but it looks like they’re first modernizing the old application and planning to eventually switch base to Aurora, which seems sensible! Either way, Rust SDK on the web, finally! This will hopefully make it easier to write other Matrix clients, since the JS SDK is pretty undocumented (and outdated).
- Arathorn 1y ago
  So Aurora (https://github.com/element-hq/aurora https://github.com/element-hq/aurora) is a proof-of-concept we put together of rust-sdk on Web, using the new MVVM components from Element Web. However, the plan is likely not to actually switch base to Aurora, but instead migrate SDK within the existing app codebase eventually. (We might end up using Aurora for other purposes though). Either way, the ground work is the same: to split up the current app into MVVM components which can run on either js-sdk or rust-sdk.
A4ET8a8uTh0_v2 1y ago
So honest question as I am now looking into matrix as a solution to combine multiple messaging channels. Does it play well with signal/telegram these days or do I need to constantly update various connectors and hope for the best?
- Arathorn 1y ago
  Your best bet for that is almost certainly beeper.com, which isn't FOSS, but specialises in combining messaging channels and is built on Matrix. Otherwise, you do have to run your own bridges and hope for the best, and moreover the bridges re-encrypt Signal and so miss the point of its end-to-end encryption. On the Element side, we're not focusing on bridging currently.
  - db579 1y ago
    Is Element One not being offered anymore? Will existing users continue to be supported?
- yaky 1y ago
  I've been hosting Matrix Synapse and mautrix-WhatsApp bridge for many years. Due to WhatsApp changes, bridge has to be updated periodically (about 1-2 times a year IIRC), but it has worked pretty reliably otherwise.
- JadedBlueEyes 1y ago
  You do have to keep bridges up to date, because they need to remain compatible with the internal APIs of other platforms. Beeper.com (mentioned by a sibling comment) is a commercial deployment of the mautrix matrix bridges, along with some propietary components. You can deploy the exact same bridges using their documentation: https://docs.mau.fi/bridges/ https://docs.mau.fi/bridges/ - although you won't have access to the propietary beeper client or hungryserv.
- osamagirl69 1y ago
  I have been self hosting a matrix setup for a few years now, using the spantaleev ansible playbook. It does require updates roughly once a year to keep up with changes of the 3rd party chat APIs. Generally that involves logging into the server and running 'just update' followed by 'just install-all', but occasionally there are changes that need updates to the playbook as described in the release notes. In the worst case, if one of your bridges does go down you can always fall back to the vendor client for that protocol until you get the bridge updated. Overall it has been absolutely rock solid, and the new element x app has been night and day compared to the old one. Feels a lot like the days of using Pidgin chat, but since the bridges run on the server you only need to authenticate once instead of going through the process for every device.
TheCycoONE 1y ago
I apologize if it was mentioned anywhere but has there been any retrospectives on the August security update and v12 room roll out. The v12 room upgrade in particular seems to be difficult, and still not supported by many of the bridges. Is there a plan to force upgrade all rooms on matrix.org at some point?
- Arathorn 1y ago
  There was an internal retro, but nothing external - from our perspective the upgrade was overall successful. What bridges are you thinking of which don't support v12? We will start force-upgrading foundation-managed matrix.org rooms sooner or later; the only reason we haven't yet is trust & safety manpower rather than there being a problem with v12.
  - TheCycoONE 1y ago
    Sure, t2bot and OOYE discord bridges have told us they are not yet compatible and still months away. The appservice-irc bridge has this issue which is more of a question: https://github.com/matrix-org/matrix-appservice-irc/issues/1855 https://github.com/matrix-org/matrix-appservice-irc/issues/1... which hasn't been answered. These are keeping our space on an earlier version.
BrenBarn 1y ago
It's good to see Matrix getting more adoption. I still feel a bit uneasy when so much of it is focused on big institutional deployments, but hopefully that can trickle down to a better experience for average users.
- Arathorn 1y ago
  the rationale is to get element (and the foundation) sustainable by funding from big institutions. meanwhile the competition is typically whatsapp & signal, so the hope is that whatever works for institutions will also work for average users.
  - didacusc 1y ago
    Is this an appropriate course ahead? I found the split of Element Pro and Element much more interesting to achieve a nice app for normal users and a power app for professionals. I don't think I'd like my WhatsApp replacement to look/feel like a Slack replacement. And most importantly, is there a completely new approach that Element / Matrix can bring to messaging that doesn't feel like it's replacing something?

134 points by Arathorn 1y ago

Compared to Signal, where does element stand today in terms of privacy and encryption? Due to the decentralized nature they werent able to offer the same guarantees from what I remember

singpolyma3 1y ago
It's exactly the same encryption tech, but a bit more trustworthy than signal.
- bilal4hmed 1y ago
  can you expand on how its more trustworthy than signal?
  - candiddevmike 1y ago
    You can validate the code that's running on the client and the server, in theory
    - jeroenhd 1y ago
      You can validate the code running on the client (well, not on iOS, but that's true for all iOS apps unless you've jailbroken your phone). If Signal works well, you shouldn't need to validate what code is running on the server in the first place.
      - holowoodman 1y ago
        With Signal, you can't really validate the code running on the client. Signal insists on distributing only via Google Play Store or Apple App Store, so usually updates are automatic and uncontrolled by you. And Signal has a history of not releasing timely updates of their client code, so even if you would do your own builds or compare their released code to their public updates, you would have at least a few weeks latency. And I doubt anyone would notice, since the Signal people tried hard to piss off everyone who did reproducible builds of their code.
        em-bee 1y ago
        Signal insists on distributing only via Google Play Store or Apple App Store on the signal.org website, there is a direct download link right below the google play button. it's still just a binary, but you can control updates. incidentally i just did an update this way.
    - tredre3 1y ago
      In theory you can do the same with Signal, as they source dump their server code every now and then. If you reject that on the basis of "we can't know if it's what they're running" or "it's a partial dump", then I don't see how Matrix is any different. Not only we can't know if Matrix servers have modified software, but we also have to trust/verify several servers instead of a single one.
  - dijit 1y ago
    The fundamental difference boiling down to trust isn't primarily in the cryptography; it's entirely down to the infrastructure and the root of control. Signal is widely regarded as the gold standard for centralised E2EE, but its architecture forces you into two massive, non-negotiable trust compromises: 1) You must trust the Signal corporation with all your metadata. Every routing and handshake detail passes through one single choke point that they control. That is an unacceptable risk for security-minded users. 2) You rely completely on Signal to truthfully publish a pre-compiled binary that actually reflects the open-source code. For the vast majority, this is unverifiable in practice. It's a critical client-side act of faith. Matrix’s design fundamentally eliminates these single points of failure, shifting the root of trust squarely to the user (or a group you trust): 1) Self-hosting; This is the game-changing feature. Host your own Synapse/Dendrite instance. Your metadata never leaves your control. You move the trust boundary from a corporation to yourself. You genuinely achieve "no communication outside your control." 2) Matrix uses an open specification. You can use FluffyChat, Nheko, or Element. This breaks the coupling between the server and the client. Even if you rely on a third-party server, you can use a client built by a completely different team, making the client-side code independently auditable and verifiable across projects. This is the ultimate defence against subtle backdoors in a single vendor's binary. TL;DR: Signal offers "trusted third-party" crypto running on a single, unauditable binary. Matrix is decentralised, verifiable zero-trust communication. The comparison isn't about the strength of the AES key or which data it has been applied to; it's about the architectural freedom to not have to trust another entity with either your data or your code. That freedom represents an essential leap in trustworthiness.
    - Etheryte 1y ago
      You might be making good points, I'm not familiar enough with the context to tell, but whining about downvotes is in bad taste, so a large part of your downvotes probably come from there, mine included.
      - dijit 1y ago
        Apologies, it's frustrating watching my comment go from +5 to -2 in a handful of seconds. Not that I'm into karma farming (or that it even means anything), but it irritates me to think that people are gaming the discourse here. There's an implicit groupthink when it comes to seeing greyed out comments; to the point that people may (and do) think that the comment is non-factual or at the very least unpopular. This is especially true in subjects that are critical of Signal.
- deleted 1y ago
  [deleted]
- heinrich5991 1y ago
  It's less encrypted. E.g. you'd think that emoji reactions are end-to-end-encrypted (as they are in Signal). But they aren't[1]. I expect similar implementation issues wrt. the encryption in Matrix. [1]: https://github.com/matrix-org/matrix-spec/issues/660 https://github.com/matrix-org/matrix-spec/issues/660
- some_furry 1y ago
  This is factually incorrect. https://soatok.blog/2025/02/18/reviewing-the-cryptography-used-by-signal/ https://soatok.blog/2025/02/18/reviewing-the-cryptography-us... https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/ https://soatok.blog/2024/08/14/security-issues-in-matrixs-ol... Signal uses a whole suite of modern cryptography, including post-quantum ratchets for key agreement and zero-knowledge proofs for group membership. Meanwhile, Matrix has a plaintext mode and knowingly shipped libraries with side-channels for years, by their own admission (and left many clients in the ecosystem depending on the vulnerable C implementation when they rewrote their cryptography protocol in Rust). Even today, they are not the same protocol. Olm/Megolm is distinct from Signal in a lot of ways that I've outlined in my previous blog posts. I don't particularly care if people like Matrix, but please don't spread falsehoods about the cryptography being used.
_def 1y ago
I think these two topics need to be looked at a bit separately, similar to for example WhatsApp, where you have e2ee but there are still lots of privacy risks. In the matrix ecosystem, as far as I understand, having only one user from the matrix.org homeserver in your room already undermines metadata privacy to some degree. Also, there still are issues with decrypting messages from time to time with certain combinations of clients, rooms and homeservers, which effectively means that the "failsafe" option for getting messages across the network is using unencrypted rooms. Having free, secure, federated, usable instant messaging is still not solved imho, and I think it's not easy to solve. So far matrix is the best attempt in my book, but it's also not there (yet?).
- uyzstvqs 1y ago
  > So far matrix is the best attempt in my book, but it's also not there (yet?). IMO XMPP is the best attempt so far, but it's completely outdated by today's standards. Matrix is a modern attempt, but it's just bad. I doubt that Matrix will actually get anywhere usable in the future. It's absolutely possible to build such a protocol with high performance, seamless UX, Signal's level of privacy and security, and Discord's level of features. It's just a lot of work to actually build the specifications and flagship implementations, compared to just building a good centralized option.
  - _def 1y ago
    On XMPP, I agree. I think requirements also changed a lot over the years with smartphones and mobile internet access everywhere. And yeah it's definitely possible, but it's a lot of work, both technically and from an organizational perspective (funding, governance, etc).
    - upofadown 1y ago
      >I think requirements also changed a lot over the years with smartphones and mobile internet access everywhere. I recently started using an XMPP client on a smart phone (Cheogram, fork of Conversations). It handles that stuff remarkably well. Switching between, say, mobile data and WiFi takes seconds. It seems to have some way of noticing the loss of connection and immediately fires up a new TCP connection on the new medium.
jeroenhd 1y ago
Matrix allows for unencrypted messages so it's inherently less encrypted than Signal. The federation capability also means messages leak metadata. Furthermore, encrypted messages also contain some metadata in the unencrypted envelope. Some protocol features (emoji reactions) also ended up outside of the encrypted envelope because of that. It's a risk with any protocol that has encryption bolted on and optional. On the other hand, you can host your own Matrix server and still participate in the network, whereas Signal will have you convince your friends and family to install a custom Signal client if you want to run your own Signal server, for instance because you don't want to rely on Amazon's servers (Signal was down when Amazon went down this morning). Signal sacrifices network openness for encryption capabilities. There's also the MLS/MIMI side of things, but AFAIK that work hasn't been completed yet (MIMI isn't even a full RFC yet). Element/Matrix, with some modifications, has been chosen as the messenger of choice by the French government (Tchap) as well as the German military (BwMessenger, BundesMessenger) and healthcare (TI-Messenger).
- nxor 1y ago
  Somewhat related - Can someone explain this to me? France and Germany want to lessen dependence on American organizations, so they choose Matrix, also an American organization.
  - dijit 1y ago
    If it's open source (and libre software) then it's not as important where the main development offices are (or where the company is incorporated). You still have control. Seems like the majority of the team are in the EU anyway: https://matrix.org/foundation/about/ https://matrix.org/foundation/about/
    - nxor 1y ago
      Thank you, and I see it's registered in the UK. I think it started in the US? Well, not like it's relevant anymore. And can you answer this question: If everyone has secure chat, then won't that benefit criminal organizations? I struggle to understand the love for private communication when it seems like that would benefit, for example, religious sects and sex abuse rings. NOT that I like that Zuckerborg keeping all my messages.
the_gipsy 1y ago
Signal requires a phone number, and AFAIK the PIN to prevent carrier-level attacks (well known) is not enabled by default.
basilikum 1y ago
Signal is a cryptographically well thought out protocol that reduces meta data. Matrix does not even encrypt emoji reactions.
fsflover 1y ago
Signal is centralized, so it becomes a huge target of all kinds of hackers and three-letter agencies. This alone is sufficient for me to never touch it. And then, there is this: https://news.ycombinator.com/item?id=42788647 https://news.ycombinator.com/item?id=42788647 https://news.ycombinator.com/item?id=39445976 https://news.ycombinator.com/item?id=39445976
- JuniperMesos 1y ago
  If the open source client encryption is good enough, it shouldn't matter if the CIA itself is openly running the centralized portion of Signal.
  - fsflover 1y ago
    I'm not an expert, but it doesn't look so simple: https://news.ycombinator.com/item?id=39421128 https://news.ycombinator.com/item?id=39421128 https://news.ycombinator.com/item?id=39445976 https://news.ycombinator.com/item?id=39445976
  - upofadown 1y ago
    The vast majority of people using "end to end encrypted" messaging systems fail to verify the identity of their contacts. So those running the servers can fairly trivially MITM the messages. So in practice it does matter who controls the servers.
    - heinrich5991 1y ago
      The good thing is that verifying the other contact is invisible to the server in Signal. This means that it's stochastically sufficient that a few people do check their contacts in order to see whether there is any widespread MITMing going on.
deleted 1y ago
[deleted]
tptacek 1y ago
I don't think this is a super useful comparison, because the two services have wildly different threat models. I think of Matrix as a secure replacement for Discord. Signal is about small group messaging. It's literally a replacement for the built-in texting app on your phone, and that's its intended userbase. Signal is what you use when you need to know, to the limit of best practices available to ordinary users, that your messages will be as private as they can be made to be. That's a goal that isn't compatible with many of the affordances people want for project discussion platforms and things like that. If you pit Signal against Matrix and make the competition purely about security, Signal will win for the foreseeable future. But I think it makes much more sense to think about different sets of tradeoffs being more appropriate for different kinds of problems.

Scene_Cast2 1y ago

I noticed that they renamed the Element mobile app to Element Classic. Has Element X reached feature parity and stability yet? For how long will Classic be maintained?

_def 1y ago
As of lately, Spaces are now supported in Element X which possibly brings it to feature parity (at least I wouldn't know what's missing, and I've been using Element X now for some months because of these plans)
noident 1y ago
> The outgoing Element mobile app (‘classic Element’) will remain available in the app stores until at least the end of 2025, to ensure a smooth transition https://element.io/blog/mas-migration-unleashes-element-x-on-matrix-org/ https://element.io/blog/mas-migration-unleashes-element-x-on... I can't find any other communication from Element Creations other than that. The renaming to Element Classic doesn't bode well considering that Element X still doesn't support a vast number of home servers and a number of Synapse authn/authz features. If they remove it from the app store, my advice for my users is going to be to switch to fluffychat, and I'll eventually migrate away from Synapse to some flavor of Conduit.
Arathorn 1y ago
Element X now has initial support for threads & spaces (as of last week), which were the main things missing from full parity with Element Classic.
- JuniperMesos 1y ago
  Good to know! These are very important features and not having them really gets in the way of switching off of classic. I am worried about "intial" support - what is going to break with threads and spaces that I try to join with thr new Element X?
- conor- 1y ago
  Sorry to hijack this thread to ask - but what is the current state of sliding sync? Does it still require a separate proxy service to enable sliding sync if you're self-hosting a homeserver; or is it upstreamed into synapse? Also is there a list of clients that are sliding sync aware?

the__alchemist 1y ago

User report from 2025: Both the application and web UI are still buggy and slow. This is not acceptable in an application this simple in nature, that has been around for so long.

Arathorn 1y ago
which app are you talking about? as per the conference keynote, there are loads of different ones now, written in different stacks without any overlapping implementations. If you're talking about the old Element Classic mobile app, then yes, it's now been replaced by Element X (which now has spaces & threads support, and so pretty much has parity with the old app), and it is super fast, and not buggy.
- abeindoria 1y ago
  It's not buggy? You should try going to the app store(s) and looking at reviews.
  - Arathorn 1y ago
    again, which app are you talking about? it's like saying "the web is buggy" but not saying what browser you're using. Looking at the App Store reviews for Element X at https://apps.apple.com/us/app/element-x-secure-chat-call/id1631335820 https://apps.apple.com/us/app/element-x-secure-chat-call/id1..., there are no complaints about bugs at all (only missing functionality, which has since been added)?
    - abeindoria 1y ago
      Brother, look at reviews for element x for android on play store. Come on, you're being intentionally obtuse.
- the__alchemist 1y ago
  Hi! I'm referring to the one on element.io/download marked "Desktop" I haven't tried element.x. Seems to be phone only?

deleted 1y ago

[deleted]

solarkraft 1y ago

Aurora is a big deal! I’ve been waiting for the Rust SDK to come to the web. I’m not fully through the talk yet, but it looks like they’re first modernizing the old application and planning to eventually switch base to Aurora, which seems sensible! Either way, Rust SDK on the web, finally! This will hopefully make it easier to write other Matrix clients, since the JS SDK is pretty undocumented (and outdated).

Arathorn 1y ago
So Aurora (https://github.com/element-hq/aurora https://github.com/element-hq/aurora) is a proof-of-concept we put together of rust-sdk on Web, using the new MVVM components from Element Web. However, the plan is likely not to actually switch base to Aurora, but instead migrate SDK within the existing app codebase eventually. (We might end up using Aurora for other purposes though). Either way, the ground work is the same: to split up the current app into MVVM components which can run on either js-sdk or rust-sdk.

A4ET8a8uTh0_v2 1y ago

So honest question as I am now looking into matrix as a solution to combine multiple messaging channels. Does it play well with signal/telegram these days or do I need to constantly update various connectors and hope for the best?

Arathorn 1y ago
Your best bet for that is almost certainly beeper.com, which isn't FOSS, but specialises in combining messaging channels and is built on Matrix. Otherwise, you do have to run your own bridges and hope for the best, and moreover the bridges re-encrypt Signal and so miss the point of its end-to-end encryption. On the Element side, we're not focusing on bridging currently.
- db579 1y ago
  Is Element One not being offered anymore? Will existing users continue to be supported?
yaky 1y ago
I've been hosting Matrix Synapse and mautrix-WhatsApp bridge for many years. Due to WhatsApp changes, bridge has to be updated periodically (about 1-2 times a year IIRC), but it has worked pretty reliably otherwise.
JadedBlueEyes 1y ago
You do have to keep bridges up to date, because they need to remain compatible with the internal APIs of other platforms. Beeper.com (mentioned by a sibling comment) is a commercial deployment of the mautrix matrix bridges, along with some propietary components. You can deploy the exact same bridges using their documentation: https://docs.mau.fi/bridges/ https://docs.mau.fi/bridges/ - although you won't have access to the propietary beeper client or hungryserv.
osamagirl69 1y ago
I have been self hosting a matrix setup for a few years now, using the spantaleev ansible playbook. It does require updates roughly once a year to keep up with changes of the 3rd party chat APIs. Generally that involves logging into the server and running 'just update' followed by 'just install-all', but occasionally there are changes that need updates to the playbook as described in the release notes. In the worst case, if one of your bridges does go down you can always fall back to the vendor client for that protocol until you get the bridge updated. Overall it has been absolutely rock solid, and the new element x app has been night and day compared to the old one. Feels a lot like the days of using Pidgin chat, but since the bridges run on the server you only need to authenticate once instead of going through the process for every device.

TheCycoONE 1y ago

I apologize if it was mentioned anywhere but has there been any retrospectives on the August security update and v12 room roll out. The v12 room upgrade in particular seems to be difficult, and still not supported by many of the bridges. Is there a plan to force upgrade all rooms on matrix.org at some point?

Arathorn 1y ago
There was an internal retro, but nothing external - from our perspective the upgrade was overall successful. What bridges are you thinking of which don't support v12? We will start force-upgrading foundation-managed matrix.org rooms sooner or later; the only reason we haven't yet is trust & safety manpower rather than there being a problem with v12.
- TheCycoONE 1y ago
  Sure, t2bot and OOYE discord bridges have told us they are not yet compatible and still months away. The appservice-irc bridge has this issue which is more of a question: https://github.com/matrix-org/matrix-appservice-irc/issues/1855 https://github.com/matrix-org/matrix-appservice-irc/issues/1... which hasn't been answered. These are keeping our space on an earlier version.

BrenBarn 1y ago

It's good to see Matrix getting more adoption. I still feel a bit uneasy when so much of it is focused on big institutional deployments, but hopefully that can trickle down to a better experience for average users.

Arathorn 1y ago
the rationale is to get element (and the foundation) sustainable by funding from big institutions. meanwhile the competition is typically whatsapp & signal, so the hope is that whatever works for institutions will also work for average users.
- didacusc 1y ago
  Is this an appropriate course ahead? I found the split of Element Pro and Element much more interesting to achieve a nice app for normal users and a power app for professionals. I don't think I'd like my WhatsApp replacement to look/feel like a Slack replacement. And most importantly, is there a completely new approach that Element / Matrix can bring to messaging that doesn't feel like it's replacing something?