this post was submitted on 10 Sep 2023
27 points (100.0% liked)
Free and Open Source Software
17932 readers
9 users here now
If it's free and open source and it's also software, it can be discussed here. Subcommunity of Technology.
This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Alternative to discord: your best bet will be to find a matrix server at https://servers.joinmatrix.org. Element is the most mature client for all platforms.
For Facebook, any of the ActivityPub alternatives like Mastodon, Pleroma, GoToSocial... Too many choices for clients and instances, but if you are looking for a professional provider and care more about a "generic" instance that is well-maintained (or want to run your own), you can try communick. Disclosure, it's my own project and I've been running it for some years now.
I’m a fairly technical guy, but I genuinely cannot figure out why I’d want to use Matrix at this point.
My understanding, which may be wrong, is that it can communicate on its own encrypted standard, and that there are bridges that allow it to communicate with other services like Signal and WhatsApp. You have to register for a home server, which essentially means trusting the individual(s) running that home server not to abuse that privilege, especially considering that not all features are supported by the bridges to other protocols at this point (including end-to-end encryption in some cases), so they may have access to your unencrypted content. Not only that, but your data is then replicated on other servers where the other participants in your conversations are registered, which means you essentially need to trust all those other admins as well.
Then there are the clients, which (at least on iOS) seem to be few and far between. The (seemingly) most popular, Element, appears to collect a crap-ton of personal information - including user content!
I was a big fan of Trillian back in the day, which sought to unify AIM/MSN/ICQ/etc. into one place; am I correct in thinking Matrix seeks to do something similar today?
Given the seemingly large amount of trust you need to put in potentially numerous individuals and organizations, is the convenience of a unifying protocol that may or may not bring your various chat and calling services under one roof with varying levels of compatibility and security (not to mention the apps, some of which appear to collect everything under the sun about you) worth it?
Thats a pretty awesome question imo.
I think Matrix only makes sense if you‘re already using instant messaging of some sort. Either discord, whatsapp, signal, what have you…
If you are using one of these services, there is a high chance that your data is sold, traded and used for all kinds of purposes, from training AI to manipulating your life choices (or as simple as selling something to you).
If a person is not using social media at all (and has an offline friend circle), then they should happily stay away from any of these products, federated/foss same as the others. Simply because social media is addictive.
But for those (like me) who don’t make friends easily offline, social media makes sense. And for those, it is far better to trust db0 or whatever the admins name is of an instance, than google,
has only one answer. Hell yes!
Element is a for profit company and therefore not the best idea if you want to go fully without data collection I assume. But then you also need to keep all smart devices in your home from calling home, you need a rooted android phone or similar, etc.
So I propose that we do our best, keeping the megacorps from collecting and selling our data without a penny of the profits going to us. In the meantime, we make compromises where necessary. If element is the only „usable“ client for you, let them have at it for the time being. Especially on ios, you‘re transparent to apple anyway and besides you don’t see the apps in development until they leave testflight (iirc).
Let me know if you have any further questions. Have a good one. :)
Hey, thanks for taking the time to reply!
I’m still not sure that moving our trust from a megacorp (as you put it) to some random person or organization running a Matrix server is an improvement. Even assuming the Matrix server admins aren’t selling your data out the back door, there’s no guarantee their admin accounts, or the server itself, isn’t compromised by those same corporations or others, allowing them to harvest all your data (and potentially more of your data than would be possible if you were using at least some of these services natively).
I respect that you have your opinion, but I’m not sure it makes sense to move trust from one organization/corporation to another is guaranteed to be an improvement.
From a security perspective, Signal seems to be brought up the most in these conversations, so I am surprised that you called it out between WhatsApp and Discord. Do you have any evidence that the Signal foundation is spying on its users, selling their data, or that the E2EE they natively employ is compromised?
Hi! I‘m pretty sure we are misunderstanding each other. At least partly.
What I‘m saying is that meta for example has evidently sold and leaked userdata far and wide (and paid a joke of a fine for it compared to the estimated earnings). So honestly, I‘d rather join a crack dealer‘s social media than this one.
Because you‘re assuming someone compromises a fediverse server (which is open source and issues are fixed together with hundreds of bright minds), while meta is a closed system and source which evidently does not need to be compromised (also evidently has happened) to do you harm. I think you’re reaching while I have evidence. Can you see that?
I didn’t bring up signal since I don’t have a lot of experience with it (used it a couple times but no ongoing relationships), thats all. I heard that some people say they‘d be spying, which I don’t know about and I‘m not gonna assume but they are closed source and for profit, which the fediverse is not (technically, matrix is not federated afaik but I use it the same as the others so it feels like the fediverse to me).
Whatsapp i brought up since it also is actively spying on you (i may have formulated it wrong or easy to misunderstand) and the same goes for instagram (and threads).
So, as I said: if someone uses whatsapp or discord, matrix makes sense imo while its not an insane improvement (imo) from signal. Same goes for telegram btw. I have no knowledge what they are or arent doing so I wont warn anyone about them. For meta I have enough evidence to suggest burning all bridges that lead there.
Thanks for being so polite btw. I appreciate it.
Same to you regarding the politeness, I’m appreciating the conversation!
I’m with you regarding Facebook Messenger and even (to a more limited extent) WhatsApp Messenger. Their motivation is to provide the cheapest ways possible to keep you engaged with their platform so they can collect as much data about you as possible to sell. That is their reason for existence, essentially. Whether that trade off is worth it to the individual user is up to them, and I have decided it is not worth it for me.
Where I’m getting confused is with your characterization of Signal. It is neither closed source, nor is it a for-profit company. It is a non-profit organization whose mission is "to develop open-source privacy technology that protects free expression and enables secure global communication.". The app they built leverages end-to-end encryption, and you can find their source code here.
I will be honest, I feel Signal is the closest I’ve found to a FOSS, E2EE messaging solution that has a chance at some adoption by people who aren’t technology enthusiasts. It makes some compromises to achieve that - the fact that your account must be associated with a valid phone number is a point of frustration for privacy advocates, and it isn’t perfect when it comes to anonymity in some ways - but it is encrypted. It seems to favor security over anonymity, which is something with which I have seen the average user be able to get onboard.
Given the ease of use and security of Signal, it leaves me even more confused as to where some of the competitors differentiate themselves in ways that would make most people are likely to adopt them.
Whoops! Now that really was news to me. I default to closed source for profit and this was the first time I got it completely wrong. Sorry and thanks for correcting me.
But I already told you I have no knowledge of signal. So I guess my fault was to jump to this conclusion when prompted.
But now I have to ask. How does the backend of signal work? I just saw the frontend/client to download but I cant remember there being servers. How do you find your grandma on signal? That must be going to some kind of server, right? Also, signal got hacked at some point and lost 10k+ phone numbers of users which is unfortunate. And there is the benefit of matrix again. You can host your own server with your 10 friends and as long as you update regularly, you‘re a very bad target (small and up to date).
I think matrix is absolutely not at the stage where you can compare it to something as polished as signal. I just checked wikipedia and they made 8 digits a year. So, I get that they‘re not making billions and not selling data but people „work“ there in stark opposition to matrix (bar element). I‘ll say that signal is probably a very good product and overall trustworthy. Although I have to say that it’s not a competitor to discord, unlike matrix. Which was my actual claim.
You are indeed misunderstanding some of the points about it:
Communication that happens exclusively via Matrix are always end-to-end encrypted. No one will have access to it. The only point where e2ee is "broken" is when/if you are using any of the bridges to any of the protocols where the messages are in clear text. If you are worried about having your messages read by a third-party, then you wouldn't be using the insecure protocol in the first place, right?
Not true. Data that goes to the other servers is always encrypted and only the intended recipients can read it. No trust required.
Technically speaking, every client "collects user content", no? The question is what the application does with it. The code is open source and I'm yet to hear anyone claiming bad practices or security flaws in the client.
Thanks for replying!
There are lots of services using E2EE, so I’m really not sure this is a unique benefit of Matrix and would not convince me to use Matrix by itself. It is a fair point in favor of Matrix, though!
I already use enough platforms as it is given what the individuals with whom I speak are already using. I’ve convinced some to standardize on platforms using E2EE, but the overwhelming majority of people who are not technology enthusiasts cannot be bothered to mess with something more complicated than what comes with their phone or the services that they’re already using (and fair enough, this isn’t a knock on them).
For that reason, the bridges Matrix offers are the only feature I’ve heard of so far that might make me switch. Unifying the services I already have to use due to what is used by my friends, family, and colleagues would be killer, but if they don’t at least leverage the E2EE supported by those services’ native apps, it negates pretty much all benefits for me. Yes, using stuff that isn’t encrypted in the first place isn’t ideal, but the answer to that for me is not “well, it’s already visible to some people so trusting the admins for this other third party service isn’t a big deal”. Additionally, integrating with services that do natively support E2EE in a way that breaks that E2EE is a huge step backward. I don’t blame Matrix for this, but it also doesn’t win any points for it in my mind.
Thank you for dispelling my misconception about the data replication!
To gain widespread adoption, any protocol will have to have friction-free sign up and usage, which is a tough nut to crack given how sharded chat already is and has always been. Email, which Matrix strives to emulate, was an established standard that predated most users’ access to the internet by a decade and a half or more. Conversely, chat has basically always been fragmented and siloed.
Unification would be a killer feature that would even have a chance of convincing non tech enthusiasts to switch, which could then lead them to start switching more of their communications over to native Matrix traffic as more of their friends also switch (relying less on the bridges over time). Given doing what I’ve described above requires compromises on security, though, I can’t see a path to wide adoption for this protocol (which really makes me sad). Since I don’t see a path for it pulling in non tech enthusiasts, and the bridges can break other platforms’ existing security, I don’t see myself adopting another platform for chat.
Please let me know if I’m still getting anything wrong!
Apologies in advance for my coming rant. I don't mean it as a personal attack, but I've been this type of discussion so many times that it gets a bit repetitive and I think most people don't get all the different forces at play here, so perhaps if I write something a bit nastier than the usual self it won't fall flat into deaf ears.
/beginrant
Your whole response can be summarized at best as "network effects are hard. Let's go shopping" and at worst as "Let me use other people's apathy and laziness to couch my own and keep the status quo".
Instead of excusing yourself on "why should I be using Matrix if others don't do it", let's play a little elimination game and ask yourself why you should be using any of the other alternatives:
WhatsApp? No, it has e2ee but Facebook still has access to your meta-data (usage patterns, call history, list of contacts, even location tracing) and it can derive all the data mining they need. E.g, they can have a good guess at potential health issues just by recording that you call/texted the number of a medical office.
iMessage? Closed to Apple's ecosystem, vendor lock-in.
Discord? Closed source, proprietary protocol, vendor lock-in.
Signal? Slightly better, but centralized and with questionable funding ties.
Telegram? Closed source (on server side), questionable cryptography, ties with Russian oligarch.
Also notice how none of these alternatives "comes with their phone", so the point about "non-technical people not interested in switching" is moot. They had to learn how to use WhatsApp and Discord once, they can learn how to use Matrix as well.
You can run your own Matrix homeserver, along with whatever bridges you decide to set up. You don't have to trust anyone, it's just an option given to you.
First, there is no such thing as "friction-free". There is always some friction. One of the things that turned me off WhatsApp (and Signal) is the fact that it requires a phone number. The fact that (most) people happened to have overcome some initial obstacle doesn't mean it was never there.
Second, it seems that no matter what FOSS developers do, there is always yet-another obstacle put by users who simply do not want to be bothered with change, even when what is asked of them is well within their range of actionable work.
How about you take the first step and try for yourself to see what are the real challenges for "non-tech" people? I'm out of WhatsApp and got my parents (both getting closer to their 70s) to use Element. UX annoyances do exist, but nothing that stops them from using properly. Why can't you, e.g, get your circle of friends in one Discord server and try it out collectively to see how it goes? It's not that hard.
Matrix is well past the "only suitable for early-adopters" phase. What it needs now is for individuals and companies to just get their heads out of the sand and put just a little bit of effort into it.
/endrant
My turn for a wall of text, sorry!
I do appreciate your preface, and I can certainly empathize with your frustration. Like you, I think that secure, private communications is generally a good thing and I am happy that there are awesome FOSS devs and groups devoting their time and skill to try and bring stuff like that to life. It is inspiring and I really do appreciate it. I, too, have had many a similar conversation :)
That said, I cannot disagree with your "it's not that hard" statement. At best it's well meaning but wrong, and at worst it is dismissive and counterproductive. Every change of any kind has a cost, as you pointed out (correctly): there is always some friction. When it comes to something that most non-tech enthusiast users view as pretty insignificant as messaging platform's privacy policies, any entrant is going to need to have a lot going for it to overcome the existing market inertia of the current players.
Honestly speaking, most people settled on their chat platforms of choice out of convenience a long time ago. Their friends used WhatsApp, so they hopped on. Meta bought them, but did that drive anyone away? Not really. They changed their privacy policy in ways that raised all sorts of alarm bells, but did it really change anything with their general user base? The fact that they still have somewhere between 2 and 3 billion people on the platform would seem to suggest it didn't have much, if any, effect either.
And it is important to highlight that that sort of inertia - a single platform being used by somewhere between a quarter and a third of every human being on this planet - is what needs to be overcome. Even Signal, arguably the current most mainstream FOSS app designed for private (though not anonymous) communication, which has been operating for around half a decade and has millions of dollars behind its development, has only managed to capture a measly 50 million or so users.
Then there's the reality that these standards keep changing which leads to new apps and protocols coming out. Again, I don't view this as a bad thing as a techie, but it could lead a reasonable user to ask: "why bother switching to this platform when I just switched to that other platform a year or two ago?".
I don't think the argument you are trying to make is that the overwhelming majority of people should be onboard with chasing after a new, more secure/private/anonymous/whatever platform every few years, but that's what it honestly amounts to at this point. No platform has everything, and even if something were written today that does have the everything of today, there's nothing to stop someone else from developing something new to entice people away yet again especially when you factor in profit motive to do stuff like that (case in point could be Meta's entering, and planned expansion within, the fediverse).
None of the above should be seen as arguments to accept the status quo or that people shouldn't be looking to move to something better. I wrote the above only to illustrate that moving platforms, especially for non-technical users, really is hard. It's frustrating for me because I, like you, would love to see users move to privacy-respecting and secure platforms. The reality, though, is that most people genuinely just don't care; nothing can make that more clear to me than WhatsApp. That is why having bridges (that wouldn't break native security and privacy features and wouldn't potentially get your account banned) would have been a gigantic feature that maybe could have enticed the average user. Unfortunately, that is not what the Matrix bridges do so I am left without a strong reason for even me, as a technical individual, to move off my current platforms.
Matrix doesn't provide better encryption than Signal (or even WhatsApp, ignoring the privacy side), it still requires trust someone just like Signal (your own paid, or someone else's, server vs Signal's servers), and even if I do adopt it I don't know that I would feel comfortable trying to convince the few members of my social groups to move as well given they are entrenched in their platforms and don't value the few additional benefits Matrix would seem to bring over something like Signal (which most of them didn't switch to, either).
I would love something like Matrix to "win" if it is as good as you say it is, but if its biggest (maybe only) selling point is privacy and security then I really don't think most users will move. Given Signal's security and seeming lack of a profit motive to sell my metadata, I am also ok (though not necessarily screaming with joy) with what they offer as well.
If you feel I missed or got anything wrong, I am open to hearing it! I feel we agree on way, way more than we do not.
My main point is that all your arguments can feel perfectly reasonable, but they don't seem especially virtuous. Yes, change has a cost and is not easy. But the alternative is simply letting these huge corporations in control. We can do better than that. We can simply start out by refusing to join the larger networks. We can be part of the intolerant minority that ends up setting the course.
No, that is not the main selling point. The selling point is control. Signal may be "private" and "secure", but requires you to trust their implementation and keeps them in control of crucial infrastructure. Matrix (or other open protocols like XMPP) give people full freedom to control how their communications works: it can be a professional hosting company, or it can an enthusiast running in their basement, or it could even be a public service offered by a local government, or it can be an university running their own servers for all students and faculty.
It will win, at least in the same sense as Linux has "won" the operating system wars. Even if we don't get everyone running Element on their phones, we already have a directive in the EU that will force all major messengers to be able to interoperate, which will lead at least to the larger players to create some set of common functionality that will be supported by the basic phones, and there is a good chance that this will end up being powered by Matrix. There is also the fact that large sectors of the German and French Governments are investing and deploying a lot of their communication systems based on Matrix. Lastly, we can not ignore the fact that even if it's not super famous, there are already an estimated number of 60 million active accounts on Matrix.
Sorry for not replying in some time.
You may be happy to know that you convinced me to at least give Matrix a try. So, you won? lol
I stood it up on one of my public servers via Docker with Traefik, and I am able to connect with a client. I cannot, however, for the life of me figure out how to get the federation side of things working in Traefik, so if you know anything about that I would sincerely appreciate the help. At least with it running and accepting client connections, I can have chats with the people I allow to set up an account on my server. It also gives me a chance to play with the bridges.
I still REALLY don't like all the data Element (and Element X) collect on iOS, and I refuse to use it. FluffyChat sems ok, though...
Hey, if I manage to bring you to Matrix and you come out happier for it, then I'd say that we all won. :)
Re: federation. I've setup my matrix server with nginx as proxy so I won't be able to just point you to my configuration, but I can tell you that https://federationtester.matrix.org is of great help to show you what is missing.
I do need to look into how to setup matrix with traefik through, so if you want some help me you can send me a DM with your domain and we can work through the issues.
nice