Comment by lousken | Hacker News Reader

Comment by lousken | Hacker News Reader

So after testing matrix and riot with friends for a couple of months, there're still a ton of work to be done. We all used the most common setup - matrix.org homeserver, riot and riotX as apps. (Also please don't point me to dev version, I am only considering what's in stable.) Random stuff not in particular order:

1a) e2e is a choice that affects experience in riot, a lot - you can't use search, you don't see recent images/files ...

1b) you have to verify each others devices, N:M; although they're working on a change

2) I hoped that riotX will be a lot better at the end of this year, but there're still lots of bugs, messages get stuck at the bottom, mobile - mobile e2e can't be decrypted sometimes, you have to have another device online; and you can't even zoom in or save an image that's sent to you which is infuriating

3) matrix.org homeserver performance, although a lot better now is still sometimes utterly slow

4) riot is still missing crucial functions like copy entire message, online status, jump to date, and lacking any good notification system(the current one is really simple/stupid) and you can't even enable notifications without sound e.g.

4) also it's still lacking custom emote support although many ppl asked, there's no option to pin/save messages...

1a/1b and 2 is where all our work is going currently. We're trying to get E2E on by default in Jan, and likewise exit beta for RiotX/Android around the same time. We're going as fast as we can.

3: Matrix.org homeserver performance should be absolutely fine now. Delays when doing things like joining big rooms are unrelated to the hardware, but perf optimisations we need to do to synapse in general. They're on the radar.

4: This is literally the first time i've heard an ask for 'copy entire message'. The other features exist in labs, and yes, we need to fix notifs and add custom emoji. "Many people asking" doesn't magically produce features unfortunately, especially when we are battling points 1 & 2. Contributions help though. Thanks for testing though.

After spending several months convincing a few friends to use Riot, the ongoing fiasco with E2E has caused all of them to leave within a couple of days. Obviously they're unlikely to ever come back.

It's a real shame. These are technical people who don't particularly mind verifying a key by hand. In fact I personally even prefer it.

The problem is not only that certain things are not done automatically, but that the UI is designed to make it difficult to do them even manually!

E.g., I have one device 'foo' which you already trust. I add a new device 'bar'. Why on earth would you want to verify its key manually when I could just send you the new key from 'foo' which you already trust?

Even worse, the key for 'bar' is not straightforwardly available anywhere in the UI on device 'foo'. It should be easily viewable in the right hand pane where the list of devices is, but it's not. The only way to get the device ID and key is to send a message from 'bar' to 'foo' and view the details of the message. Why?

> E.g., I have one device 'foo' which you already trust. I add a new device 'bar'. Why on earth would you want to verify its key manually when I could just send you the new key from 'foo' which you already trust?

This particular issue is being worked on right now in Riot, and should be fixed early in the new year.

That is awesome, but any thoughts on why I cannot easily view the keys of my other devices in the UI?

If I could then this would be a minor inconvenience at best, I'd just copy/paste the key from the already-trusted device.

I guess we just prioritised working on cross-signing etc rather than adding in UI for this. Sorry; it's an oversight.

Thank you for your quick and patient answers to my perhaps too demanding questions.

Cross-signing is obviously better, no question about that. However this simple UI change would be at least 95% as good, and certainly good enough to have prevented my friends from giving up on Riot.

I hope that is at least somewhat constructive. Thank you for your work.

I guess https://github.com/vector-im/riot-web/issues/2735 is the bug to upvote. Annoying it's been stuck open forever :(

> Obviously they're unlikely to ever come back.

I recognize this is a common attitude, but it makes no sense to me.

Some software you tried today isn't designed in a way you prefer, so you go back to using something else. Okay. Makes sense.

But to declare the whole project forever hopeless as if it can never be improved upon because the snapshot of your first experience with it was negative is truly irrational.

I think it's less that people assume that it can never be improved and more that they find something else that is "good enough" and they won't leave that ecosystem until it stops being good enough. Generally speaking, I've found others (and myself, at times) don't re-evaluate their options until there's a need for them to upgrade or its brought to their attention by someone else.

Keep in mind the only reason they tried the software is that I regularly pressured to do so for months, before they finally caved.

After all that they quickly come to realize that something simple like adding a new device is a massive pain in the ass.

It's not that they declare the whole project as forever hopeless, it's that they invested time and effort into trying it already and it turned out (for them) to be a waste.

It's just a bad taste left in the mouth. In order for them to try it again, they not only have to overcome their natural laziness/time constraints, but also the rather unpleasant memory of the last time.

The same thing happened to me, but I am thinking of having another go and just discouraging the use of E2EE. (The community I’m thinking of is currently on Slack, so there would be no marginal loss of privacy.) Have you considered that, or is your group already using another E2EE platform that isn’t a massive pain in the ass? I’ve yet to discover one myself.

They all use Signal, with varying degrees of dissatisfaction. I'm the only one who doesn't have a Signal account.

For me it is usually lost trust in the creators. If they market it like a finished product when it barely works I will not trust them anymore.

Now, if it is obvious that something is a work in progress then I personally wont mind giving it a new shot.

ad 1a - E2E by default - meaning you'll flip the switch once there's a feature parity with non encypted rooms in riot?

ad 3 - from my testing it's fine for about 98% of the time, but sometimes it takes ~3-8seconds to send a message (sitting on 300 or 500Mbps wired connection), in e2e direct message room

ad 4 - @ copy entire message - interesting, i needed it just recenly so i went into the submenu and there's show source, show decrypted source (which is cool but maybe something that should probably be enabled in via a toggle in the options menu) and quote but no message copy (and using quote messes up markdown formatting...)

ad many people asking - i totally understand that, however, this could be used as a roadmap for shipping features. And since I don't write code (read javascript) I am trying to contribute with testing/reporting bugs (so although not obvious from my OP, my testing continues as is suffering of my friends ;) )

1a: Yes. the second we have parity, we'll start turning it on by default for private rooms. We'll probably start with DMs, and we'll probably do a fairly soft roll-out to sneak in some final testing. Current status is that we have E2E Search working (github.com/matrix-org/seshat); we have E2E cross-signing almost done (https://dashboard.lant.uk/#/plan?epic=vector-im/user-stories... we have eyes on the remaining causes of undecryptable messages and are working through them. We're aiming for Jan.

3: Interesting. It could be a very temporary CPU saturation on the Matrix.org CPU master. We're working on sharding the master per-room to mitigate this, but it's going to be a few months to land.

4: Looks like there is a bug for this already - please upvote https://github.com/vector-im/riot-web/issues/10649.

Testing & reporting bugs is absolutely invaluable - thank you.

On 4, yes, please support "copy entire message". It already works if the entire message is a code block, and it's unfortunate there is no alternative when it is not.

I've often encountered this when I paste one of my Markdown notes from my knowledge base into the chat in order for it to be rendered so that the other participants may read it in a visually appealing form. But then I decide that I also want to give this same note to someone else in another room, but there's no way to copy the message and simply paste it at the new destination.

Conversely, sometimes I write a worthwhile Markdown note directly in Riot and I'd like to save it in my notes system, but it's hard since there is no "copy entire message" button.

2) could be partially solved by backing up all of your keys from all devices. After that, non-decryptable messages decreased about 95%.

Ironically, backing up your keys is done by recovering your keys from a backup – Settings → Cryptography Keys Management → Encrypted Messages Recovery → Restore from backup.

(Web version: Settings → Security and Privacy → Key Backup → Restore from Backup)

You can verify that you set it up properly by checking if the backups are signed by all your currently used devices (and possibly old ones, too).

3) can be mitigated by using workers. You'll need a beefy server, but message transfer and synchronisation will be super fast.

The other things you mentioned are works in progress and I think the progress is outlined pretty transparently on Github, even if some people disagree with how the Matrix team is handling things.

Reply on news.ycombinator.com