5 ms·

I am a daily user, family and friends chatting on Matrix. My take is that there are two layers of friction: a) people that care about chat encryption and woul

by galbar 7mo ago

I am a daily user, family and friends chatting on Matrix. My take is that there are two layers of friction: a) people that care about chat encryption and would be willing to change, already did, to Telegram and/or Signal. "I'm not going to install yet another chat app" is a real answer by a friend of mine b) no one wants to either host their own server, nor pay someone to host it for them. If it wasn't for me and a one of my friends, none of the people I chat with daily would be on Matrix. And yes, there is the matrix.org server. Out of the ~13 people I chat frequently with, 1 is on matrix.org. "What's the point of changing apps if I'm still going to be using the centralized server" is another answer I've gotten. I don't know what the solution to this dynamic is other than us, the power users, setting it up and paying for the group of people around us.

INTPenis 7mo ago
What about maintaining encryption for an entire room of clients? I heard it's very difficult and prone to errors. Do you enforce it?
- Arnt 7mo ago
  I use matrix. Every chat room I use is unencrypted and all have at least one matrix.org user. I assume it can be encrypted but the usability is such that in practice it's cleartext.
  - cge 7mo ago
    As a counterexample: I use Matrix along with ~30-50 people, on a federated server, and every room is encrypted. After sufficiently stressing to people that they need to save their secure backup key, we've had few problems with encryption usability.
    - Arnt 7mo ago
      That reminds me of RFC 1925 Truth 3.
      - INTPenis 7mo ago
        (3) With sufficient thrust, pigs fly just fine. However, this is not necessarily a good idea. It is hard to be sure where they are going to land, and it could be dangerous sitting under them as they fly overhead.
Valodim 7mo ago
> a) people that care about chat encryption and would be willing to change, already did, to Telegram and/or Signal. It continues to baffle me that the "telegram is encrypted" spin is still widely believed, even on a forum like this. Telegram is for 99.9% of intents and purposes not encrypted.
- Anonyneko 7mo ago
  And even when you do enable encryption of the chat contents, the unencrypted metadata is often enough for security services to make a suspect out of you. Granted, this is mostly a concern for Russian and Belarusian users.
- dizhn 7mo ago
  What is encrypted and how is public information. If it doesn't fit your use case don't use it. There is no "spin". People were spreading this kind of FUD until last week when all of a sudden people started claiming it was self evident that "of course Meta can read your WhatsApp messages". I don't get this kind of weird fixation with a product. I suspect it's two things. Perceived Russian origin and that one guy dared write a crypto library rather than using their own. I agree with the latter. The prior is not even true the way people understand it to be. I for one like the stickers. Shoot me :) We even give companies like Google which we know for a fact is looking at all of our data a free pass with the super western "privacy policy" cop out while judging other tools with a different set of rules. Another darling is Signal who refused to stop collecting phone numbers until recently even though they never needed it, does not allow open source or other clients to use their servers (and won't release the actual server code) and frankly does not work half as well as Telegram in terms of UX. All of this is really confusing for me.
  - palata 7mo ago
    > All of this is really confusing for me. Yep, I can see that. The problem with Telegram is that it is not an E2EE messaging platform, period. It is a non-E2EE platform that has an option to encrypt 1:1 messages with a criticised algorithm. Whoever uses Telegram does it for all the nice features that are not E2EE. > all of a sudden people started claiming it was self evident that "of course Meta can read your WhatsApp messages". Because some people say stuff like this doesn't make it right. WhatsApp messages are E2EE encrypted, unlike Telegram. There are other things to criticise with WhatsApp, but not that. > Signal who refused to stop collecting phone numbers until recently even though they never needed it As you said, you're confused. Signal needed the phone numbers for convenience, so that you could reach your friends. Exactly the same reason as WhatsApp. Could they have done without it? Yes, but maybe Signal would not be as popular. That's a valid tradeoff, and Signal never lied about it. Also having to share your phone number with Signal is still better than any of the other popular platforms. Anything that is "more private" than Signal hasn't managed to get on the map.
bdunks 7mo ago
> “I’m not going to install yet another chat app” This is legitimate. I have to use: - iMessage & SMS for most US based family, casual friends and co workers. - WhatsApp for European Family - Signal for one group of friends - Telegram for another group of friends Every time I message someone I have to remember what app to use. It’s annoying. This in addition to random threads that pick up with the same people on instagram, discord, etc., which I try to redirect to our “standard” channel as aggressively as I can.
- shagie 7mo ago
  The relevant xkcd is Chat Systems https://xkcd.com/1810/ https://xkcd.com/1810/
  - bdunks 7mo ago
    As they say, a relevant XKCD for everything. Thanks for sharing. I hadn’t seen that one before.
    - shagie 7mo ago
      While I knew that one off the top of my head... one of the neat "Show HN" that I recall from a bit ago: Show HN: Find the relevant Xkcd comic for your post using RAG https://news.ycombinator.com/item?id=44799291 https://news.ycombinator.com/item?id=44799291 > How it works - Simply paste your entire message or post into the search box to get the most relevant xkcd for it. No need to search by keywords, etc.
- ptman 7mo ago
  In my case matrix with bridges allows me to ignore many separate apps: whatsapp,telegram,slack,irc,...
thesuitonym 7mo ago
> no one wants to either host their own server, nor pay someone to host it for them. I hear this every time anyone brings up a federated chat/social media/anything service, and I just don't get it. If you don't want to host it, don't. There are plenty of servers out there, and a lot of them are free. Yeah, you have to trust the person hosting it, but why is that only a problem for federated services?
- psychoslave 7mo ago
  My wild guess is that "big corp" - are willing mostly to harvest data at scale, mostly for ad target or whatever political agenda owner that can pay bills - will make big breaking changes only if more money is expected in a some quarters The local/small benevolent geeks: - aren’t entangled into micro-management policies and might just be logging everything to target individual as seen relevant by someone that could be whatever evil profile one can think of - are possibly going to do their best for free, but could well end the experiment tomorrow without prior warning as they burn out into a growing discontent user base despite best efforts (and few to no recognition for that), or simply because they found a new hobby to spend attention to And of course hosting all at home is taking the burden on one self. For people in IT, that might be something affordable, but otherwise this is like baking your own bread, sewing your own garment, producing and storing your own electricity, cultivate your own garden. Yes all of them are doable by an individual, especially those already proficient in the field. But obviously, this is not going to scale easily, and it’s not the general tendency of most contemporary societies. Doing otherwise would require humankind to make a giant leap in civilization tendencies.
  - wolvoleo 7mo ago
    No but hosting a small server is much more manageable financially than hosting the whole world. One geek can host hundreds of people for pocket change.
- lukeschlather 7mo ago
  There are two things: trusting the person's intentions and trusting the person's competence. Federation makes both problems worse, because you need to trust an unbounded number of organizations rather than a single organization. Even if you take it for granted that I trust all of those orgs intentions, there's no way they are as competent as the multimillion and multibillion dollar organizations running the big names.

by galbar 7mo ago

INTPenis 7mo ago

What about maintaining encryption for an entire room of clients? I heard it's very difficult and prone to errors. Do you enforce it?

Arnt 7mo ago
I use matrix. Every chat room I use is unencrypted and all have at least one matrix.org user. I assume it can be encrypted but the usability is such that in practice it's cleartext.
- cge 7mo ago
  As a counterexample: I use Matrix along with ~30-50 people, on a federated server, and every room is encrypted. After sufficiently stressing to people that they need to save their secure backup key, we've had few problems with encryption usability.
  - Arnt 7mo ago
    That reminds me of RFC 1925 Truth 3.
    - INTPenis 7mo ago
      (3) With sufficient thrust, pigs fly just fine. However, this is not necessarily a good idea. It is hard to be sure where they are going to land, and it could be dangerous sitting under them as they fly overhead.

Valodim 7mo ago

> a) people that care about chat encryption and would be willing to change, already did, to Telegram and/or Signal. It continues to baffle me that the "telegram is encrypted" spin is still widely believed, even on a forum like this. Telegram is for 99.9% of intents and purposes not encrypted.

Anonyneko 7mo ago
And even when you do enable encryption of the chat contents, the unencrypted metadata is often enough for security services to make a suspect out of you. Granted, this is mostly a concern for Russian and Belarusian users.
dizhn 7mo ago
What is encrypted and how is public information. If it doesn't fit your use case don't use it. There is no "spin". People were spreading this kind of FUD until last week when all of a sudden people started claiming it was self evident that "of course Meta can read your WhatsApp messages". I don't get this kind of weird fixation with a product. I suspect it's two things. Perceived Russian origin and that one guy dared write a crypto library rather than using their own. I agree with the latter. The prior is not even true the way people understand it to be. I for one like the stickers. Shoot me :) We even give companies like Google which we know for a fact is looking at all of our data a free pass with the super western "privacy policy" cop out while judging other tools with a different set of rules. Another darling is Signal who refused to stop collecting phone numbers until recently even though they never needed it, does not allow open source or other clients to use their servers (and won't release the actual server code) and frankly does not work half as well as Telegram in terms of UX. All of this is really confusing for me.
- palata 7mo ago
  > All of this is really confusing for me. Yep, I can see that. The problem with Telegram is that it is not an E2EE messaging platform, period. It is a non-E2EE platform that has an option to encrypt 1:1 messages with a criticised algorithm. Whoever uses Telegram does it for all the nice features that are not E2EE. > all of a sudden people started claiming it was self evident that "of course Meta can read your WhatsApp messages". Because some people say stuff like this doesn't make it right. WhatsApp messages are E2EE encrypted, unlike Telegram. There are other things to criticise with WhatsApp, but not that. > Signal who refused to stop collecting phone numbers until recently even though they never needed it As you said, you're confused. Signal needed the phone numbers for convenience, so that you could reach your friends. Exactly the same reason as WhatsApp. Could they have done without it? Yes, but maybe Signal would not be as popular. That's a valid tradeoff, and Signal never lied about it. Also having to share your phone number with Signal is still better than any of the other popular platforms. Anything that is "more private" than Signal hasn't managed to get on the map.

bdunks 7mo ago

> “I’m not going to install yet another chat app” This is legitimate. I have to use: - iMessage & SMS for most US based family, casual friends and co workers. - WhatsApp for European Family - Signal for one group of friends - Telegram for another group of friends Every time I message someone I have to remember what app to use. It’s annoying. This in addition to random threads that pick up with the same people on instagram, discord, etc., which I try to redirect to our “standard” channel as aggressively as I can.

shagie 7mo ago
The relevant xkcd is Chat Systems https://xkcd.com/1810/ https://xkcd.com/1810/
- bdunks 7mo ago
  As they say, a relevant XKCD for everything. Thanks for sharing. I hadn’t seen that one before.
  - shagie 7mo ago
    While I knew that one off the top of my head... one of the neat "Show HN" that I recall from a bit ago: Show HN: Find the relevant Xkcd comic for your post using RAG https://news.ycombinator.com/item?id=44799291 https://news.ycombinator.com/item?id=44799291 > How it works - Simply paste your entire message or post into the search box to get the most relevant xkcd for it. No need to search by keywords, etc.
ptman 7mo ago
In my case matrix with bridges allows me to ignore many separate apps: whatsapp,telegram,slack,irc,...

thesuitonym 7mo ago

> no one wants to either host their own server, nor pay someone to host it for them. I hear this every time anyone brings up a federated chat/social media/anything service, and I just don't get it. If you don't want to host it, don't. There are plenty of servers out there, and a lot of them are free. Yeah, you have to trust the person hosting it, but why is that only a problem for federated services?

psychoslave 7mo ago
My wild guess is that "big corp" - are willing mostly to harvest data at scale, mostly for ad target or whatever political agenda owner that can pay bills - will make big breaking changes only if more money is expected in a some quarters The local/small benevolent geeks: - aren’t entangled into micro-management policies and might just be logging everything to target individual as seen relevant by someone that could be whatever evil profile one can think of - are possibly going to do their best for free, but could well end the experiment tomorrow without prior warning as they burn out into a growing discontent user base despite best efforts (and few to no recognition for that), or simply because they found a new hobby to spend attention to And of course hosting all at home is taking the burden on one self. For people in IT, that might be something affordable, but otherwise this is like baking your own bread, sewing your own garment, producing and storing your own electricity, cultivate your own garden. Yes all of them are doable by an individual, especially those already proficient in the field. But obviously, this is not going to scale easily, and it’s not the general tendency of most contemporary societies. Doing otherwise would require humankind to make a giant leap in civilization tendencies.
- wolvoleo 7mo ago
  No but hosting a small server is much more manageable financially than hosting the whole world. One geek can host hundreds of people for pocket change.
lukeschlather 7mo ago
There are two things: trusting the person's intentions and trusting the person's competence. Federation makes both problems worse, because you need to trust an unbounded number of organizations rather than a single organization. Even if you take it for granted that I trust all of those orgs intentions, there's no way they are as competent as the multimillion and multibillion dollar organizations running the big names.