6 ms·

US Senators implore Department of Defense to expand the use of Matrix

103 points by neiljohnson 2y ago

deleted 2y ago
[deleted]
Underpass9041 2y ago
I’m not entirely sure why it matters that silos of messaging data exist, if it’s encrypted like Signal and WhatsApp the centralized model is far superior to an arbitrary and unknown number of parties receiving metadata about messaging. It might have been an easier case to make if Matrix wasn’t an uphill battle in terms of usability and performance.
- karel-3d 2y ago
  Yes, working on a single centralised service is orders of magnitude easier than working on a decentralised service. Especially when security and cryptography enters into the picture.
- cies 2y ago
  The reason for the initial development of "the internet" as we know it, basically TCP/IP, was know as the Department of Defense (DoD) model because the research and development were funded by the United States Department of Defense through DARPA. The idea was to build a network that --unlike pre-existing networks-- did not need centralization. The goal was to make the network resilient to parts not working, with obvious military benefits. The same can be said for messaging systems. Centralization makes it easy to take the whole service out. > It might have been an easier case to make if Matrix wasn’t an uphill battle in terms of usability and performance. I expect TCP/IP to have been an uphill battle as well. But now we take it for granted. This likely will also happen to Matrix if it is used everywhere. Now I hope the DoD makes some massive donations to Matrix. Money makes uphill battles more likely to have a good ending.
  - robertlagrant 2y ago
    This is a different type of centralisation, though. WhatsApp isn't running out of a single data centre (I hope).
    - cies 2y ago
      It's not that different. Whatsapp controls nearly everything: servers, clients, protocol. Matrix has open protocols, several implementation of the clients/servers, and people can start their own server node. In the comparison to TCP/IP this is quite similar. You can add to the network without needing approval of a central institution.
      - robertlagrant 2y ago
        > Whatsapp controls nearly everything: servers, clients, protocol. This is nothing to do with resilience in the face of things being destroyed in a war. That's what I'm saying: it's not the same sort of centralisation. > In the comparison to TCP/IP this is quite similar. You can add to the network without needing approval of a central institution. I can join WhatsApp without approval as well. But also - how like that is TCP/IP? All IP addresses have to be agreed and assigned, do they not?
        batch12 2y ago
        WhatsApp can be turned off tomorrow as a result of a war or the whim of an executive. > I can join WhatsApp without approval as well You absolutely need approval to join WhatsApp. Approval and a phone number. > All IP addresses have to be agreed and assigned, do they not You can assign your own IPs and have your own network if you want.
    - TeMPOraL 2y ago
      It is the centralization type that matters. Obligatory reminder that the whole "Internet routes around censorship" like it routes around glassed data centres during nuclear war, etc. applies to layers 3-4 of ISO/OSI model. The problematic centralization of the Internet happens at layer 7.
- dartos 2y ago
  > centralized model is far superior to an arbitrary and unknown number of parties receiving metadata about messaging. One opaque MITM is worse than 1000 MITM whose inner workings are bound by a secure protocol. That’s how the internet works. Your connection doesn’t always go directly to the server you want. Either way, you can run your own network of matrix nodes which are isolated from the rest of the open matrix network.
- neiljohnson 2y ago
  Signal and WhatsApp only address the personal messaging usecase, whereas the letter is also talking about wider chat services like Teams. More to the point, even with e2ee, there is still communication metadata that is leaving your network for a third-party service. In a defense context, you would almost certainly prefer that the data does not leave your network unnecessarily. In terms of Matrix usability and performance, Matrix 2.0 (https://matrix.org/blog/2024/10/29/matrix-2.0-is-here/ https://matrix.org/blog/2024/10/29/matrix-2.0-is-here/) represents a huge step forward and can be used today with compatible clients such as Element X (https://element.io/blog/deep-dive-into-element-x/ https://element.io/blog/deep-dive-into-element-x/)
- ndsipa_pomu 2y ago
  > I’m not entirely sure why it matters that silos of messaging data exist It doesn't matter until one day, something happens that does make it matter. Imagine if a centralised model was used and a foreign state managed to sever connections to the internet that was used by that country/central server. It's more resilient to be able to route messages even if the network is under attack. This kind of thinking is behind the original design of the internet although we now seem to have centralised large portions of functionality.
- Timshel 2y ago
  Encryption won't help you much if you are not the one hosting the server and they disappear ...
- mycall 2y ago
  Decentralized messaging and communications are more compatible with the first principles of the internet.
  - Yeul 2y ago
    The real principles have always been a US dominated and controlled internet. The only ones who ever understood that and didn't sign up to Pax Americana are the Chinese who are building their own internet.
evilDagmar 2y ago
Are they seriously talking about /this/ Matrix? https://www.operation-passionflower.com/ https://www.operation-passionflower.com/
- 0_____0 2y ago
  I hate the HN "No." But.... no. https://en.wikipedia.org/wiki/Matrix_(protocol) https://en.wikipedia.org/wiki/Matrix_(protocol) is what this is talking about, note the disambiguation header in the wiki article.
- Arathorn 2y ago
  no? they're talking about matrix.org, which is nothing whatsoever to do with https://www.operation-passionflower.com/ https://www.operation-passionflower.com/
- neiljohnson 2y ago
  No, it is an unfortunate naming collision and has nothing to do with the Matrix protocol. https://matrix.org/blog/2024/12/unrelated-cybercriminal-network-taken-down/ https://matrix.org/blog/2024/12/unrelated-cybercriminal-netw...
- worble 2y ago
  No, they're talking about this Matrix: https://matrix.org/ https://matrix.org/ Relevant blog post: https://matrix.org/blog/2024/12/unrelated-cybercriminal-network-taken-down/ https://matrix.org/blog/2024/12/unrelated-cybercriminal-netw...
impish9208 2y ago
Previously: https://news.ycombinator.com/item?id=42321334 https://news.ycombinator.com/item?id=42321334
- ndsipa_pomu 2y ago
  Better still, read the letter directly: https://www.wyden.senate.gov/imo/media/doc/wyden-schmitt_dod_letter.pdf https://www.wyden.senate.gov/imo/media/doc/wyden-schmitt_dod...
deleted 2y ago
[deleted]
neilv 2y ago
> The senators cite “a potentially more secure superior communications platform, known as Matrix, which is end-to-end encrypted by default, interoperable, not controlled by any one company, and widely used by multiple NATO allies.” What's the current state of this open-ness? Last I checked, it looked like Matrix was de facto mostly controlled by Element, even more than the Web browser is currently controlled by Google. I'm not questioning intentions, and I'm aware that there are now a few other clients that support E2E. Just want an update on the reality. I don't want this to turn into a company with a Slack-like IPO, or an MS acquisition, and have the open-ness situation turn worse when we were waiting for it to turn better. (Edit: Downvoters, did you think this is not an important question?)
- alwayslikethis 2y ago
  There are a few others that's pretty usable now. The difference is mainly in some more advanced features, such as spaces, threads, or SSO, but many people don't use these anyway. The company also doesn't control the network, as it's not difficult for any organization to spin up their own server. With some government investment it's not hard to imagine building a good competing client to Element.
- dkasak 2y ago
  The Matrix.org Foundation has been steadily increasing its independence, with the recent introduction of the Governing Board (https://matrix.org/blog/2024/06/election-results/ https://matrix.org/blog/2024/06/election-results/) which includes a mix of representatives from commercial players, the community, as well as Spec Core Team members and Guardians. Also, there are nowadays several Spec Core Team members who are not employed or contracted by Element, including some who are working for (near-)competitors in the space. In other words, people are actively thinking of and implementing measures to mitigate the risk of accidentally/unintentionally backsliding into a closed standard.
- ndsipa_pomu 2y ago
  Currently it seems easy enough to write clients/servers using the protocol and the Synapse server can easily be forked (https://github.com/element-hq/synapse https://github.com/element-hq/synapse) if you find the need to do so. It does seem to be mainly worked on by Element, so there's always a risk that they might stop working on it and instead work on a closed source implementation. That does seem unlikely though as it goes against their goals and the idea of an open, secure communication standard.
solarkraft 2y ago
Matrix has pretty good government buy-in at this point, I just wish it was, well … nicely usable. It has been getting better, but is maybe about 80% there. I keep preaching that it needs to be easier to build a client (encryption of course not being optional). The spec keeps changing (for the better, but the changes are often breaking), so the maintenance burden is high. This means only the biggest of libraries are really good picks. Highest on my wish list are currently JavaScript bindings for the Rust SDK.
ChrisArchitect 2y ago
Related: PRC Targeting of Commercial Telecommunications Infrastructure https://news.ycombinator.com/item?id=42132014 https://news.ycombinator.com/item?id=42132014
comte7092 2y ago
Very difficult to take this article seriously when it characterizes WhatsApp and signal as “obvious honeypots” of “foreign nation states” (obviously in reference here to non western aligned countries). Absolutely a ridiculous statement.
- stiltzkin 2y ago
  [dead]
- xethos 2y ago
  Targeting, blackmailing, or extorting a Facebook engineer to insert a subtle backdoor into a closed-source app does seem like a hell of an investment for the Kremlin. Currently stating it's a honeypot is a touch hyperbolic, but I wouldn't be at all surprised to see it happen And even to a Canadian like me, America is objectively a foreign nation state. Notably, a foreign nation with a "business-focused" incoming president-elect that has previously tried to buy Greenland, and just went "Ha-ha wouldn't it make sense for Canada to become the fifty-first state" If there was ever a time to trust America less, I'd argue it's now.
  - comte7092 2y ago
    Your reasoning it entirely fair. My point is that this is an article about the perspective of the US government, calling it an obvious honeypot of, say, Russia, is just farcical.

103 points by neiljohnson 2y ago

deleted 2y ago

[deleted]

I’m not entirely sure why it matters that silos of messaging data exist, if it’s encrypted like Signal and WhatsApp the centralized model is far superior to an arbitrary and unknown number of parties receiving metadata about messaging. It might have been an easier case to make if Matrix wasn’t an uphill battle in terms of usability and performance.

karel-3d 2y ago
Yes, working on a single centralised service is orders of magnitude easier than working on a decentralised service. Especially when security and cryptography enters into the picture.
cies 2y ago
The reason for the initial development of "the internet" as we know it, basically TCP/IP, was know as the Department of Defense (DoD) model because the research and development were funded by the United States Department of Defense through DARPA. The idea was to build a network that --unlike pre-existing networks-- did not need centralization. The goal was to make the network resilient to parts not working, with obvious military benefits. The same can be said for messaging systems. Centralization makes it easy to take the whole service out. > It might have been an easier case to make if Matrix wasn’t an uphill battle in terms of usability and performance. I expect TCP/IP to have been an uphill battle as well. But now we take it for granted. This likely will also happen to Matrix if it is used everywhere. Now I hope the DoD makes some massive donations to Matrix. Money makes uphill battles more likely to have a good ending.
- robertlagrant 2y ago
  This is a different type of centralisation, though. WhatsApp isn't running out of a single data centre (I hope).
  - cies 2y ago
    It's not that different. Whatsapp controls nearly everything: servers, clients, protocol. Matrix has open protocols, several implementation of the clients/servers, and people can start their own server node. In the comparison to TCP/IP this is quite similar. You can add to the network without needing approval of a central institution.
    - robertlagrant 2y ago
      > Whatsapp controls nearly everything: servers, clients, protocol. This is nothing to do with resilience in the face of things being destroyed in a war. That's what I'm saying: it's not the same sort of centralisation. > In the comparison to TCP/IP this is quite similar. You can add to the network without needing approval of a central institution. I can join WhatsApp without approval as well. But also - how like that is TCP/IP? All IP addresses have to be agreed and assigned, do they not?
      - batch12 2y ago
        WhatsApp can be turned off tomorrow as a result of a war or the whim of an executive. > I can join WhatsApp without approval as well You absolutely need approval to join WhatsApp. Approval and a phone number. > All IP addresses have to be agreed and assigned, do they not You can assign your own IPs and have your own network if you want.
  - TeMPOraL 2y ago
    It is the centralization type that matters. Obligatory reminder that the whole "Internet routes around censorship" like it routes around glassed data centres during nuclear war, etc. applies to layers 3-4 of ISO/OSI model. The problematic centralization of the Internet happens at layer 7.
dartos 2y ago
> centralized model is far superior to an arbitrary and unknown number of parties receiving metadata about messaging. One opaque MITM is worse than 1000 MITM whose inner workings are bound by a secure protocol. That’s how the internet works. Your connection doesn’t always go directly to the server you want. Either way, you can run your own network of matrix nodes which are isolated from the rest of the open matrix network.
neiljohnson 2y ago
Signal and WhatsApp only address the personal messaging usecase, whereas the letter is also talking about wider chat services like Teams. More to the point, even with e2ee, there is still communication metadata that is leaving your network for a third-party service. In a defense context, you would almost certainly prefer that the data does not leave your network unnecessarily. In terms of Matrix usability and performance, Matrix 2.0 (https://matrix.org/blog/2024/10/29/matrix-2.0-is-here/ https://matrix.org/blog/2024/10/29/matrix-2.0-is-here/) represents a huge step forward and can be used today with compatible clients such as Element X (https://element.io/blog/deep-dive-into-element-x/ https://element.io/blog/deep-dive-into-element-x/)
ndsipa_pomu 2y ago
> I’m not entirely sure why it matters that silos of messaging data exist It doesn't matter until one day, something happens that does make it matter. Imagine if a centralised model was used and a foreign state managed to sever connections to the internet that was used by that country/central server. It's more resilient to be able to route messages even if the network is under attack. This kind of thinking is behind the original design of the internet although we now seem to have centralised large portions of functionality.
Timshel 2y ago
Encryption won't help you much if you are not the one hosting the server and they disappear ...
mycall 2y ago
Decentralized messaging and communications are more compatible with the first principles of the internet.
- Yeul 2y ago
  The real principles have always been a US dominated and controlled internet. The only ones who ever understood that and didn't sign up to Pax Americana are the Chinese who are building their own internet.

evilDagmar 2y ago

Are they seriously talking about /this/ Matrix? https://www.operation-passionflower.com/ https://www.operation-passionflower.com/

0_____0 2y ago
I hate the HN "No." But.... no. https://en.wikipedia.org/wiki/Matrix_(protocol) https://en.wikipedia.org/wiki/Matrix_(protocol) is what this is talking about, note the disambiguation header in the wiki article.
Arathorn 2y ago
no? they're talking about matrix.org, which is nothing whatsoever to do with https://www.operation-passionflower.com/ https://www.operation-passionflower.com/
neiljohnson 2y ago
No, it is an unfortunate naming collision and has nothing to do with the Matrix protocol. https://matrix.org/blog/2024/12/unrelated-cybercriminal-network-taken-down/ https://matrix.org/blog/2024/12/unrelated-cybercriminal-netw...
worble 2y ago
No, they're talking about this Matrix: https://matrix.org/ https://matrix.org/ Relevant blog post: https://matrix.org/blog/2024/12/unrelated-cybercriminal-network-taken-down/ https://matrix.org/blog/2024/12/unrelated-cybercriminal-netw...

impish9208 2y ago

Previously: https://news.ycombinator.com/item?id=42321334 https://news.ycombinator.com/item?id=42321334

ndsipa_pomu 2y ago
Better still, read the letter directly: https://www.wyden.senate.gov/imo/media/doc/wyden-schmitt_dod_letter.pdf https://www.wyden.senate.gov/imo/media/doc/wyden-schmitt_dod...

deleted 2y ago

[deleted]

neilv 2y ago

> The senators cite “a potentially more secure superior communications platform, known as Matrix, which is end-to-end encrypted by default, interoperable, not controlled by any one company, and widely used by multiple NATO allies.” What's the current state of this open-ness? Last I checked, it looked like Matrix was de facto mostly controlled by Element, even more than the Web browser is currently controlled by Google. I'm not questioning intentions, and I'm aware that there are now a few other clients that support E2E. Just want an update on the reality. I don't want this to turn into a company with a Slack-like IPO, or an MS acquisition, and have the open-ness situation turn worse when we were waiting for it to turn better. (Edit: Downvoters, did you think this is not an important question?)

alwayslikethis 2y ago
There are a few others that's pretty usable now. The difference is mainly in some more advanced features, such as spaces, threads, or SSO, but many people don't use these anyway. The company also doesn't control the network, as it's not difficult for any organization to spin up their own server. With some government investment it's not hard to imagine building a good competing client to Element.
dkasak 2y ago
The Matrix.org Foundation has been steadily increasing its independence, with the recent introduction of the Governing Board (https://matrix.org/blog/2024/06/election-results/ https://matrix.org/blog/2024/06/election-results/) which includes a mix of representatives from commercial players, the community, as well as Spec Core Team members and Guardians. Also, there are nowadays several Spec Core Team members who are not employed or contracted by Element, including some who are working for (near-)competitors in the space. In other words, people are actively thinking of and implementing measures to mitigate the risk of accidentally/unintentionally backsliding into a closed standard.
ndsipa_pomu 2y ago
Currently it seems easy enough to write clients/servers using the protocol and the Synapse server can easily be forked (https://github.com/element-hq/synapse https://github.com/element-hq/synapse) if you find the need to do so. It does seem to be mainly worked on by Element, so there's always a risk that they might stop working on it and instead work on a closed source implementation. That does seem unlikely though as it goes against their goals and the idea of an open, secure communication standard.

solarkraft 2y ago

Matrix has pretty good government buy-in at this point, I just wish it was, well … nicely usable. It has been getting better, but is maybe about 80% there. I keep preaching that it needs to be easier to build a client (encryption of course not being optional). The spec keeps changing (for the better, but the changes are often breaking), so the maintenance burden is high. This means only the biggest of libraries are really good picks. Highest on my wish list are currently JavaScript bindings for the Rust SDK.

ChrisArchitect 2y ago

Related: PRC Targeting of Commercial Telecommunications Infrastructure https://news.ycombinator.com/item?id=42132014 https://news.ycombinator.com/item?id=42132014

comte7092 2y ago

Very difficult to take this article seriously when it characterizes WhatsApp and signal as “obvious honeypots” of “foreign nation states” (obviously in reference here to non western aligned countries). Absolutely a ridiculous statement.

stiltzkin 2y ago
[dead]
xethos 2y ago
Targeting, blackmailing, or extorting a Facebook engineer to insert a subtle backdoor into a closed-source app does seem like a hell of an investment for the Kremlin. Currently stating it's a honeypot is a touch hyperbolic, but I wouldn't be at all surprised to see it happen And even to a Canadian like me, America is objectively a foreign nation state. Notably, a foreign nation with a "business-focused" incoming president-elect that has previously tried to buy Greenland, and just went "Ha-ha wouldn't it make sense for Canada to become the fifty-first state" If there was ever a time to trust America less, I'd argue it's now.
- comte7092 2y ago
  Your reasoning it entirely fair. My point is that this is an article about the perspective of the US government, calling it an obvious honeypot of, say, Russia, is just farcical.