bonifartius 𒂼𒄄 @bonifartius@social.cleverlibre.org

@velartrill
tl;dr: i just don't like the _way_ (which is kind of panicy) this is discussed, not that it _is_ discussed.
@TheFuzzStone@fosstodon.org @skells

@velartrill
i think this is most of the stuff you referred to with some commentary from Matthew Hodgson:
https://matrix.org/~matthew/Response_to_-_Notes_on_privacy_and_data_collection_of_Matrix.pdf

seems pretty.. unspectacular. surely some fuckups, but i'd really assume that spooks would be a bit more subtle. if anything, their heavy usage of webshit is really something worthy of critique.

> then i'm not sure why you said anything in the first place. mischaracterizing peoples' arguments (not to mention calling them "retarded" without offering any justification) and then expecting nobody to disagree with you is kind of unreasonable, and it's uncharacteristic of you. i understand having strong reactions to certain subjects that are personal sore points, but at that point it may be better for your own sake to just keyword-mute them. nobody is attacking you for any decisions you have made in terms of what software to use, obviously understanding the tradeoffs better than anyone else will in your particular use cases; those of us who criticize matrix's security flaws and sketchy behavior are trying to warn other people away from making choices that may unknowingly cause them substantial personal harm, or at the very least making sure they have more information available for their own decision-making processes than simply the "matrix is totally secure you guys" propaganda from the corporation and its boosters.

i called the blog post i have seen some time ago "retarded", because it was full of technical misunderstandings/wrong simplifications. if anyone thought i called him directly a retard, it wasn't my intention.

the point with the reported issues is: if one wants to declare something absolutely b0rken, it's a requirement that said person _understands_ the technology. the stuff above is more or less a critique of the default configuration. if it would be voiced like this, it'd be _perfectly_ fine by me (remember that i have disabled integrations stuff from the config manually). the devs of matrix have chosen the "out of the box" approach, which isn't optimal. another point is that i've seen no sketchy behavior, i follow the matrix development for a few years now. if there was an issue it got communicated timely and quite well, imho. i know other messenging projects who are much more shitty with this stuff.
i can follow the line of thought that said default configuration of things isn't good if you say something is "totally secure" (whatever that might be ;). i also require people who set up servers to use their brain and review the configuration for anything with unintended effects. that's just due diligence if you want to setup something secure.
i'm a bit tired of the "matrix is spyware" meme where the same points get iterated over and over again when the alternatives (with roughly the same set of functionality) are centralized and closed source. concerning the (old, if one can believe wikipedia) amdocs connection, i've already argued it's hard to use any computer where no shady company was involved (intel management engine etc.).
i at least haven't seen suspicious activity on my server.

@TheFuzzStone@fosstodon.org @skells

@velartrill
iirc it was the "integrations" stuff of element and not "matrix". it is is kind of obvious that if you load stuff from another server it will be loaded from another server. i think this behavior was noted somewhere, because i disabled integrations for my element nee riot installation back then.

it also might have been the 3rd party id stuff, where it is also kind of obvious that you need a centralized registry if you want to map things like phone numbers or mail addresses to usernames. again, nobody is forced to use that and it was noted in the manuals.

it's just interesting that everyone repeats what that one "revealing" blog post by someone said. "leaked metadata" which every admin knew about because it's clearly noted in the manuals, and "OMG THEY WORKED FOR AN ISREALI COMPANY", as if this would still mean anything in this world. could as well been a US company. or german. everything is shady.

if i stopped using anything by anyone who worked with anyone shady, i could stop using computers. if i want to still use computers i can only try to rely on open source and selfhosting (and reading the manuals of the software i use).

i used the "alternatives". i tried hard with xmpp, but it was just shit for 10 years. file transfers never worked. e2ee never worked. it's a burning wreck of XEPs. if i got nobody to talk with on a protocol, it's worthless, that's what happened to xmpp for me.

like i've said, i don't force anyone to use matrix, and i'll mute this thread now. i'm really not in the mood for this discussion (as i wrote a few posts back).
@TheFuzzStone@fosstodon.org @skells

@Xalef
public encrypted rooms aren't scaling as you would have giant cyphertext messages if you have really many people in a room.
in the default setting, encrypted rooms are invite only. messages are forwarded to the servers involved, not "everybody". additionally it's kind of braindead to use crypto without invites, you get the same security as irc with tls.
it really isn't hard to understand, but somehow people like to scream devil.
if you don't like it, don't use it. i don't force anyone.
@TheFuzzStone@fosstodon.org @skells @velartrill

@Xalef .. thats why the messages are stored encrypted with forward security if the room has crypto enabled.

the git part was more of an analogy, i found the distributed synced graph idea to be a quite nice change from the "stream distribution" of xmpp/irc.

@TheFuzzStone@fosstodon.org @skells @velartrill

@verita84 everyone read that retarded blog artice i guess 🤷‍♀️
@TheFuzzStone@fosstodon.org @skells @velartrill

@velartrill just my 2 cents, i don't want a heated discussion: matrix is open source and you can host your own element and turn off integrations support. or just use a different client like fluffychat. or just build your own. server side dendrite seems to be running quite well.
there is quite valid criticism of some parts of the matrix ecosystem, but the protocol is just git on speed in the end. libolm is reviewed crypto, having well designed multi device group chat crypto is really a killer feature.

@TheFuzzStone@fosstodon.org @skells

@velartrill if signal isn't a complete honeypot run by spooks, it at least is "tolerated" because said spooks might be very well able to just do timing attacks etc. at the borders of their network.

remember that there were cryptographic curves weakened "by accident". that's the level of sophistication one has to think about.

why signal is tolerated, but tor isn't and node operators are constantly harassed. maybe one of them works and the other doesn't.

@TheFuzzStone@fosstodon.org

@TheFuzzStone@fosstodon.org ✨ magic! ✨

@TheFuzzStone@fosstodon.org i still don't trust signal. moxie is an egomanic who spreads fud about federated services, signal is US based, the server is defacto closed source and this may as well be a psyop.

@velartrill it's good that just because someone has good ideas i don't have to marry him :P