6 ms·

For everyone not reading the post: > Practically speaking, that means that people and organisations running a Matrix server with open registration must verify

For everyone not reading the post: > Practically speaking, that means that people and organisations running a Matrix server with open registration must verify the ages of users in countries which require it. Last summer we announced a series of changes to the terms and conditions of the Matrix.org homeserver instance, to ensure UK-based users are handled in alignment with the UK’s Online Safety Act (OSA). At least you can self-host matrix and messages are end to end encrypted, unlike IRC.

Bender 7mo ago
unlike IRC There are a few IRC clients that support OTR. irssi-otr is one [1] weechat-otr is another [2]. Pidgin though I have not used it in a very long time. Hexchat using an always work in progress plugin. There may be others. OTR could use some updates to include modern ciphers similar to the recent work of OpenSSH but probably good enough for most people. E2EE aside having chat split up into gazillions of self hosted instances makes it much harder for chat to be hoovered up all in one place. It takes more effort to target each person and that becomes a government scalability issue. Example effort: [3] [1] - https://github.com/cryptodotis/irssi-otr https://github.com/cryptodotis/irssi-otr [2] - https://github.com/mmb/weechat-otr https://github.com/mmb/weechat-otr [3] - https://archive.ph/4wi5t https://archive.ph/4wi5t
- progval 7mo ago
  Links 1 and 2 have not had updates in 10 and 8 years respectively, they probably don't even compile anymore. They implement OTRv3 which was published in about 2005 and uses 1536-bits primes. As far as I know, neither the protocol nor the implementations were audited (and especially not audited recently). This is not good encryption at all. Additionally, OTRv3 does not allow multiple clients per account, which makes it unusable for anyone who wants to chat from two devices.
  - Bender 7mo ago
    I use link [1] all the time. It comes pre-compiled for many Linux distributions but not installed by default. And yeah like I said it needs cipher updates like was recently performed in OpenSSH. HN has a handful of cryptographic nerds that could update OTR in their sleep if they so desired maybe even rewrite in Rust but being cryptographic nerds they probably have no need. If the same is true with cryptographers as is with car mechanics and plumbers they probably only use plain text as mechanics have broken down cars in their yards and some plumbers have old leaky pipes due to burn out.
    - queenkjuul 7mo ago
      As a mechanic-minded person, all the broken down junk i plan to fix someday has no bearing on the state of the tools i actually use day to day (In my case, all the old broken guitar pedals and vintage computers littering my house have no bearing on the state of my workstations and gigging setup)
- notepad0x90 7mo ago
  Those are all opportunistic. being able to talk to anyone secure, even if they haven't setup a special client with special plugins is important.
- 1vuio0pswjnm7 7mo ago
  To what is [3] pointing Why not provide the URL Some people cannot access archive.today sites These sites also serve CAPTCHAs. They block users who prefer not to use Javascript for non-interactive www use, e.g., reading documents
  - Bender 7mo ago
    Some have reported not being able to browse .ru sites. The source URL is at the top of the page as is for every archive.{is|ph|today} snapshot.
wolvoleo 7mo ago
IRC is also most commonly used for open servers where anyone can join whenever they want to without as much as needing to register for an 'account'! You just pick a nickname out of thin air and off you go. In that kind of environment, end to end encryption really doesn't add value.
- cuillevel3 7mo ago
  The IRC admins can read all your messages, be it to a channel or to another user. Even without registering my nick, I would expect a modern protocol to keep my pm communication private by default.
  - direwolf20 7mo ago
    How will you verify who you're talking to?
    - Woodi 7mo ago
      Imagine joining IRC channel and all messages are as meanningfull as reading base64 strings aloud aka all are somehow encrypted messages. Now you can cryptographically check to who you are talking. No other party can read your plain text. You can pick any cryptographic property you like future proofing or deniability, etc. Becouse IRC is just very nice transport. And clients can be very easily scrypted to encrypt and display just human readable text. You can even relay messages to wherever you want, HR lady, video player, anywhere. Try that with Matrix or Discord ;)
      - Anon1096 7mo ago
        That is indeed how Matrix works already. And Discord is also doable with https://gitlab.com/An0/SimpleDiscordCrypt https://gitlab.com/An0/SimpleDiscordCrypt
        Woodi 7mo ago
        O, didn't know that. I think I had in mind triviality of adding client-side encryption to IRC messages. However server side... :) Looked probably twice to hosting Matrix server and Java part was fat no no. And Discord one-click "servers" ? :) Edit: Ok, can't find any Java in Matrix servers context... Must be I messed it with Signal server.
drnick1 7mo ago
> Practically speaking, that means that people and organisations running a Matrix server with open registration must verify the ages of users in countries which require it. Practically speaking, I would just ignore this requirement. The UK government has no jurisdiction on this side of the pond.
- ThrowawayTestr 7mo ago
  That's fine if you never intend to visit the UK
- digiown 7mo ago
  Oops your plane had some issue on its way to a different European country and now has to make an emergency landing at Heathrow. https://en.wikipedia.org/wiki/Ryanair_Flight_4978 https://en.wikipedia.org/wiki/Ryanair_Flight_4978
  - drnick1 7mo ago
    That's assuming UK authorities can even identify who is operating the Matrix instance. At the very least this assumes that a warrant is served to the registrar and/or the owner of the server/VPS in the correct jurisdiction, and that obfuscation measures were not taken by the operator. All of this will probably go nowhere.
    - digiown 7mo ago
      I'm sure your server will be fine. Now if you put up a big declaration like that on your website, some bureaucrat might just decide to pick on you when they get the chance like France with Durov.
phyzome 7mo ago
You can try to self-host. Neither Synapse nor Dendrite is in a good state for running a server. I tried Dendrite for a while and it was always playing catchup to Synapse, despite being the supposed successor, and is now not even under development? I can't even tell what's going on over there. Anyway, my main experience of Matrix is "failed to decrypt message". It's... not great. I wish it were better.
- iknowstuff 7mo ago
  You did it wrong. The correct approach is to flip a coin and let it decide between tuwunel and continuwuity, then self hold that until it dies along with its database format
  - LorenzoGood 7mo ago
    Ah yes, tuwunnel, the successor to continuity which is the successor to conduit. All of which have non depricated repositories and recent commits.
- tcfhgj 7mo ago
  > It's... not great. I wish it were better. Unable to decrypt has improved quite a bit fwiw
vonunov 7mo ago
or what
kkfx 7mo ago
IMVHO these days chats serve two purposes: - notes left there for work, family organization, etc basically things for which an email is "too much" but a small scrap of text seen by some serve the purpose well - calls, whether audio-only or audio + video For social use, I see Lemmy or Nostr/Habla more than Matrix. But for all of this, there's a major lack of a single app that is easy go install-able, pip install-able, or cargo build-able without a gazillion dependencies and a thousand setup problems, to the point that most people just choose Docker, using stuff made by others that they know almost nothing about because setting up and maintaining these solutions is just too complex.

Bender 7mo ago

unlike IRC There are a few IRC clients that support OTR. irssi-otr is one [1] weechat-otr is another [2]. Pidgin though I have not used it in a very long time. Hexchat using an always work in progress plugin. There may be others. OTR could use some updates to include modern ciphers similar to the recent work of OpenSSH but probably good enough for most people. E2EE aside having chat split up into gazillions of self hosted instances makes it much harder for chat to be hoovered up all in one place. It takes more effort to target each person and that becomes a government scalability issue. Example effort: [3] [1] - https://github.com/cryptodotis/irssi-otr https://github.com/cryptodotis/irssi-otr [2] - https://github.com/mmb/weechat-otr https://github.com/mmb/weechat-otr [3] - https://archive.ph/4wi5t https://archive.ph/4wi5t

progval 7mo ago
Links 1 and 2 have not had updates in 10 and 8 years respectively, they probably don't even compile anymore. They implement OTRv3 which was published in about 2005 and uses 1536-bits primes. As far as I know, neither the protocol nor the implementations were audited (and especially not audited recently). This is not good encryption at all. Additionally, OTRv3 does not allow multiple clients per account, which makes it unusable for anyone who wants to chat from two devices.
- Bender 7mo ago
  I use link [1] all the time. It comes pre-compiled for many Linux distributions but not installed by default. And yeah like I said it needs cipher updates like was recently performed in OpenSSH. HN has a handful of cryptographic nerds that could update OTR in their sleep if they so desired maybe even rewrite in Rust but being cryptographic nerds they probably have no need. If the same is true with cryptographers as is with car mechanics and plumbers they probably only use plain text as mechanics have broken down cars in their yards and some plumbers have old leaky pipes due to burn out.
  - queenkjuul 7mo ago
    As a mechanic-minded person, all the broken down junk i plan to fix someday has no bearing on the state of the tools i actually use day to day (In my case, all the old broken guitar pedals and vintage computers littering my house have no bearing on the state of my workstations and gigging setup)
notepad0x90 7mo ago
Those are all opportunistic. being able to talk to anyone secure, even if they haven't setup a special client with special plugins is important.
1vuio0pswjnm7 7mo ago
To what is [3] pointing Why not provide the URL Some people cannot access archive.today sites These sites also serve CAPTCHAs. They block users who prefer not to use Javascript for non-interactive www use, e.g., reading documents
- Bender 7mo ago
  Some have reported not being able to browse .ru sites. The source URL is at the top of the page as is for every archive.{is|ph|today} snapshot.

wolvoleo 7mo ago

IRC is also most commonly used for open servers where anyone can join whenever they want to without as much as needing to register for an 'account'! You just pick a nickname out of thin air and off you go. In that kind of environment, end to end encryption really doesn't add value.

cuillevel3 7mo ago
The IRC admins can read all your messages, be it to a channel or to another user. Even without registering my nick, I would expect a modern protocol to keep my pm communication private by default.
- direwolf20 7mo ago
  How will you verify who you're talking to?
  - Woodi 7mo ago
    Imagine joining IRC channel and all messages are as meanningfull as reading base64 strings aloud aka all are somehow encrypted messages. Now you can cryptographically check to who you are talking. No other party can read your plain text. You can pick any cryptographic property you like future proofing or deniability, etc. Becouse IRC is just very nice transport. And clients can be very easily scrypted to encrypt and display just human readable text. You can even relay messages to wherever you want, HR lady, video player, anywhere. Try that with Matrix or Discord ;)
    - Anon1096 7mo ago
      That is indeed how Matrix works already. And Discord is also doable with https://gitlab.com/An0/SimpleDiscordCrypt https://gitlab.com/An0/SimpleDiscordCrypt
      - Woodi 7mo ago
        O, didn't know that. I think I had in mind triviality of adding client-side encryption to IRC messages. However server side... :) Looked probably twice to hosting Matrix server and Java part was fat no no. And Discord one-click "servers" ? :) Edit: Ok, can't find any Java in Matrix servers context... Must be I messed it with Signal server.

drnick1 7mo ago

> Practically speaking, that means that people and organisations running a Matrix server with open registration must verify the ages of users in countries which require it. Practically speaking, I would just ignore this requirement. The UK government has no jurisdiction on this side of the pond.

ThrowawayTestr 7mo ago
That's fine if you never intend to visit the UK
digiown 7mo ago
Oops your plane had some issue on its way to a different European country and now has to make an emergency landing at Heathrow. https://en.wikipedia.org/wiki/Ryanair_Flight_4978 https://en.wikipedia.org/wiki/Ryanair_Flight_4978
- drnick1 7mo ago
  That's assuming UK authorities can even identify who is operating the Matrix instance. At the very least this assumes that a warrant is served to the registrar and/or the owner of the server/VPS in the correct jurisdiction, and that obfuscation measures were not taken by the operator. All of this will probably go nowhere.
  - digiown 7mo ago
    I'm sure your server will be fine. Now if you put up a big declaration like that on your website, some bureaucrat might just decide to pick on you when they get the chance like France with Durov.

phyzome 7mo ago

You can try to self-host. Neither Synapse nor Dendrite is in a good state for running a server. I tried Dendrite for a while and it was always playing catchup to Synapse, despite being the supposed successor, and is now not even under development? I can't even tell what's going on over there. Anyway, my main experience of Matrix is "failed to decrypt message". It's... not great. I wish it were better.

iknowstuff 7mo ago
You did it wrong. The correct approach is to flip a coin and let it decide between tuwunel and continuwuity, then self hold that until it dies along with its database format
- LorenzoGood 7mo ago
  Ah yes, tuwunnel, the successor to continuity which is the successor to conduit. All of which have non depricated repositories and recent commits.
tcfhgj 7mo ago
> It's... not great. I wish it were better. Unable to decrypt has improved quite a bit fwiw

vonunov 7mo ago

or what

kkfx 7mo ago

IMVHO these days chats serve two purposes: - notes left there for work, family organization, etc basically things for which an email is "too much" but a small scrap of text seen by some serve the purpose well - calls, whether audio-only or audio + video For social use, I see Lemmy or Nostr/Habla more than Matrix. But for all of this, there's a major lack of a single app that is easy go install-able, pip install-able, or cargo build-able without a gazillion dependencies and a thousand setup problems, to the point that most people just choose Docker, using stuff made by others that they know almost nothing about because setting up and maintaining these solutions is just too complex.