Riot/Matrix enables cross-signed verification and E2E encryption by default

Bravo Matrix contributors! This work in my mind is as close as we can get to the golden days of Pidgin being able to talk to everything and everyone, and having E2EE default is a must-have these days. So amazing to watch the progress of this from 'a few HN talking heads' to 'hundreds of contributors and dedicated staff'.

While Matrix will feel less secure than Signal since the feature just landed, having the E2EE data be self-hosted, federation-possible, and support multiple clients, removable-users-from-groups, and other features Signal is working on but tight-lipped about, means the trade off is increasingly trending towards worth the cost of migration to another client.

Matrix is just so much more collaborative and less authoritarian than Signal. Don't get me wrong, I currently use Signal above all others, DMs, groups, calls, the works. But the cloak and dagger radio silence, reticence to accept PRs, and lack of even basic documentation to self-host your own Signal server do eventually leave me with a sense that, while I'm glad for free access to this most-secure-for-my-use-case software, even free apps on phones and desktop could be improved.

> Finally, we no longer nag and block messages even when an unverified session appears in a conversation - the user’s shield going red is your cue to warn you that badness may be happening.

As with dialogue boxes stealing focus, without mitigation, not warning exposes me to a window of risk when an unverified session appears around the moment I'm sending a message. Assuming there is zero latency of the shield, being human I can anyway not expect to react in time and abort my sending of the message to the potentially adversarial session. If a new session appears and I submit a message within a time period (to be determined), I need some form of mitigation to prevent sending that to the new untrusted session.

An immediate idea is to send to all except the new session(s), and ask about sending to the new. That would avoid interrupting the flow of the writer.

I've had the pleasure of meeting some of the core team and they are some of the smartest and humblest people.

Looking forward to the realization of a unified and open messaging/communication layer with the help of your thoughtful effort.

This work may sometimes be thankless. But here to say the community appreciates you all; including all the open source contributors working on the clients, server implementations, and supporting software (bridges, extensions, bots)!!