Arathorn

60 ms·

871.
by Arathorn 4y ago
> In 2022 we should absolutely refrain from leaving the decision to the user w.r.t if it is safe or trustworthy. Users suck. Don't trust users to look at warnings Yup, totally. Which is why we are addressing it. The current behaviou
872.
by Arathorn 4y ago
Will do. Just want to land at least the tofu work first, as fun as it’d be to sit there saying “coming soon” on loop.
873.
by Arathorn 4y ago
Totally agreed. We didn’t have the $ to do more than libolm at first, and then we did vodozemac in May. That one was the first of 4 planned audits, the rest of which go up the rest of the stack (respectively matrix-rust-sdk-crypto, matrix-r
874.
by Arathorn 4y ago
For the sake of accuracy, it’s worth pointing out that points 2 through 5 were implementation bugs resolved in https://matrix.org/blog/2022/09/28/upgrade-now-to-address-en... . They are not current attack
875.
by Arathorn 4y ago
> Let's do an episode where you explain why this isn't as big a deal as we made it out to be! We're game. Sure, sounds like a plan. In order to actually present a balanced view and not end up with another one-sided episode
876.
by Arathorn 4y ago
All the pointing-and-laughing derision on the podcast seemed pretty toxic, tbh. Rather than all the "oh look how stupid Matrix are" schtick, it might have been even more interesting and informative (and less obnoxious) to get the
877.
by Arathorn 4y ago
You are completely misinterpreting my quote, which makes me question whether you are acting in good faith. Totally agreed that Signal servers cannot just add a device to a group chat. What I saying was: in any system, you have to verify use
878.
by Arathorn 4y ago
The point is that if your threat model cares about interception, you have to verify the identity of users out of band - same as Signal or WhatsApp or whatever. Then, if you've done that, and an unverified device is added to the conve
879.
by Arathorn 4y ago
We (the matrix team) addressed the implementation vulnerabilities discussed here back in September: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-en... . The only pending work is switching to
880.
by Arathorn 4y ago
I’m sorry - how are we doing a terrible job fixing the issues? We are working solidly to switch Element over to the newly audited vodozemac crypto implementation ( https://matrix.org/blog/2022/05/16/inde
881.
by Arathorn 4y ago
As others have pointed out… > They killed it. It's dead. …is ridiculous hyperbole. This is a debate around the “system warns you when something bad happens” versus “system stops something bad happening in the first place”. It’s like
882.
by Arathorn 4y ago
I'm biased on this, as project lead for Matrix, but: we've done loads of work to support Matrix for corporate communication - especially as a route to migrate away from Skype For Business, or a secure alternative to Slack & Te
883.
by Arathorn 4y ago
fwiw we are developing a new Matrix client from scratch at Element, currently codenamed Element X: https://matrix.org/blog/2022/08/15/the-matrix-summer-special... . It’s built to outperform telegram :)
884.
by Arathorn 4y ago
If anyone reading this has a ton of cash to dump into element/matrix development, please head over to funding@matrix.org immediately (cf https://matrix.org/blog/2022/12/01/funding-matrix-via-the-ma..
885.
by Arathorn 4y ago
weechat-matrix works pretty well, tbh. but agreed IRC is simpler to get right than XMPP & Matrix. Matrix stability at least is improving constantly though (but agreed it's not quite at the same level as IRC. Turns out decentralised
886.
Funding Matrix via the Matrix.org Foundation(matrix.org)
3 points by Arathorn 4y ago|0 comments
887.
by Arathorn 4y ago
fwiw https://github.com/matrix-org/matrix-spec-proposals/blob/fay... is the ongoing work to solve the problem of server-controlled group membership. unfortunately it’s not a trivial problem in a decentralised
888.
by Arathorn 4y ago
It found my old account (ara4n; i lost the password) at 0.63. More amusingly it found my cofounder too, who hardly ever posts here (at 0.48)
889.
by Arathorn 4y ago
the problem of AGPL for Matrix is that it would have likely impeded uptake significantly. But yes, it’s something we’ve considered.
890.
by Arathorn 4y ago
Ironically very little of the $ seems to be propagating back to Matrix itself…
891.
by Arathorn 4y ago
It’s definitely unfortunate that there’s a schism between e2ee matrix and e2ee xmpp there.
892.
by Arathorn 4y ago
Element X is gearing up to be that, fwiw
893.
by Arathorn 4y ago
Getting the balance of this right to prevent a tragedy of the commons turns out to be hard. Element (who funds most of Matrix dev) has released almost everything we do as permissive-licensed FOSS open source. As a result, there's a hug
894.
by Arathorn 4y ago
Tchap isn’t a disaster at all. There was one auth bug (thanks to a bug in python’s email validator) which meant that signup wasn’t locked to @gouv.fr email addresses, exposing public chatrooms, which was fixed within about 4h of being repo
895.
by Arathorn 4y ago
Tchap is currently for lower classification comms. It would sure be cool if Matrix was used for the stuff in the article here, though…
896.
by Arathorn 4y ago
probably, but the hard bit of doing that is needing the p2p overlay network to provide connectivity - eg Pinecone is what we use for P2P Matrix (see https://arewep2pyet.com )
897.
by Arathorn 4y ago
Matrix is actually switching to use OpenID natively: https://areweoidcyet.com
898.
by Arathorn 4y ago
This is very similar to how Third Room’s user generated content engine is being implemented (supporting C, Rust and Zig alongside QuickJS though): https://thenewstack.io/third-room-teases-user-generated-cont...
899.
by Arathorn 4y ago
if the amount of FUD that gets levelled against Matrix was converted into work on other solutions, Matrix wouldn’t need to exist.
900.
by Arathorn 4y ago
Verification is nothing to do with decryption - verification is how you confirm that you're really speaking to the person you think you're speaking to. What you're describing sounds like a plain old encryption bug, although I

More ›