Riot.im: The Big 1.0

I love the privacy thing. With some chat clients I stopped using them, or turned off features to protect ips being leaked from each room participant to all the others in the room. It's important for safety and security.

I believe this is what would cause us to force the use of a stun/turn server if we switched to web sockets. I have seen nefarious users pull and use ip info from chat rooms in many ways for blackmail and worse.

I've also watched some of these wicked people use other tricks like share a picture in the chat room - then check their server logs to see which ips pulled the jpg request - then use that info to hack everyone's home routers, pull their pics, put them up..

So yes I get the importance.

However I can assure you that times are coming where people are going to need better blocking tools with these chat systems.

The main reason I have not started testing with the riot / matrix with my groups of users is becuase I would feel bad for those other people who run instances - as they would be flooded with a few groups of evil wicked trolls - and since there appears to be little moderation ability - it would quickly ruin the chats of all who allowed any user sign ups.

They are coming, it's just that matrix has not been pointed out as a ripe target yet. They will spam, for fun and profit. They will send bots, they will send dozens of humans to do it. Then they will post stuff to make everyone ill - nazi stuff, child prn stuff, all the things you don't want in your system and your other users will leave if they see it.

Whatever you do to ban them, they will return. If it's possible to come back with a new ip and a new email addy - they will be back with six identities before you finish banning the last one. They will register names that look like other's in your system. Heaven forbid you have not blocked blank space ascii/unicode characters..

When these groups of people find that it frustrates you to have your system turned into 4chan, then the real fun begins. Even if you can see their ips it won't matter, they have access to thousands of subnets.

Anyhow, I hope more moderation tools come to riot / matrix / etc - I would be fine with giving my appointed moderators the ability to click to block subnet and have the server do it even if the moderators could not actually see the ip of the individual.

The blocking is most important. Some of my mods look at ips to try to determine cases where someone is suspected of being an imposter and things like that - but that's not as needed. All of my moderators have made agreements with have about ips and personal info during the training process and get how important we take privacy.

I would think this is going to be extremely important with the federated options and such.

I am guessing the popular chat platforms you refer to are mainly used in walled gardens or have other censoring / moderating options. In my experience chat systems that are open to new registerations are a ripe target for 4chat like trolls - it's only a matter of time before they come and make all your users wish you could see everyone's ips.

even if you can't see them, having an option to ban / block ips, subnets, cidrs, is one of the most important lines of defense if you have an open system. At least in my experiences.

Please see some additional info in this regard I just posted below here -> https://news.ycombinator.com/item?id=19171614

I think I mentioned this before, but I think you should allow for the case where all participants in the virtual room physically meet. Think conference, or a meeting on business premises. They should be able to swap keys with each other efficiently, perhaps using NFC, and without having to have O(n^2) interactions. Yes it may not be super-secure but you can assume the security is already taken care of by the physical security of the meeting.