Element – All-in-one secure chat app for teams, friends and organisations
element.io
element.io
So far the "network effects" have been coincidental: one small group of colleagues registered on matrix.org after one more colleague from our small circle turned out to have a home server. There are 7-ish of us now, 2 with their home servers (myself and the "other colleague"), and 5 with accounts on matrix.org.
To go "native", I see one lacking point with discoverability: I don't know of a way to discover my "contacts" whether they use Matrix without asking them first. Which is not true in any other messaging apps I have tried: Signal and WhatsApp use my address book and their phone numbers, Messenger is tied to my "friends". However, although Matrix allows entering phone and e-mail identifiers, I haven't seen an easy way to "find" them. Any pointers?
Overall, Synapse is easy to install and run. Took about two evenings to configure synapse + 3 bridges (whatsapp, messenger, hangouts).
https://matrix.org/faq/#what-is-an-identity-server%3F
Many people run their own homeserver but I haven’t heard much about identity servers besides the official one at vector.im / matrix.org.
(I said no, because for my current needs I don't wanna share any contacts with anyone.
Signal works with a contact list, for private 1 to 1 and private groups. You need a phone number to use it, and they claim to encrypt almost all metadata, such as message senders. Signal claims they cannot read the content nor the history of users actions (but you have to trust them on that, they claim to use SGX enclave stuff, but can anyone technically verify that they do what they say they are doing?)
Element works with rooms, there is no contact list. A 1 to 1 conversation is a room with 2 people. The homeserver Matrix.org stores all metadata and they are readable (metadata are not private/not encrypted) by Matrix for some features to work. You only need a nickname to use it (at least for now). The content of conversations are e2e encrypted. In theory, i understand it would be possible for a matrix server to delete any metadata/messages once messages are delivered, but some features would not work, and you would also have to trust the server to actually delete the metadata.
Would be happy to read anyone who could correct or complete me.
As matrix is federated, every user can be on their own homeserver, which will be storing a copy of all messages seen by that user.
E2E is more recent and optional. Most rooms are not E2E, and have browsable history.
Signal: Only E2E, with clients themselves storing the only copy of messages. You can only see messages that a device has received.
Any app you did not write/review and compile requires trusting the author, so this is not a signal specific concern. A crypto app can always store and send keys to a server if it wanted.
However, unlike WhatsApp, these apps are open source and can be reviewed and compiled if you so desire.
E2E is actually turned on by default, as of about one year ago.
Not sure how this is meaningful especially without further context. A large number of rooms on matrix are public channels to begin with (eg bridged rooms from irc, open source collaboration channels, etc), so they have no need for e2e encryption. All this is really saying is that E2EE is optional, which you already said (and which I'd also argue is probably irrelevant, especially given that E2EE is on by default).
I run my own server and don't need my message history to live forever there.
I also have mine set up though without a default_policy so I can have the server forget stuff in my bot control rooms cause they get cluttered with useless stuff pretty fast.
people get that done - look at Instagram which grew despite having to do the exact same
And I hate that Signal's identity is linked to a phone number.
You say that, but for a number of my contacts this is a significant hurdle... especially relatives.
Worth noting that Matrix's crypto is also based on Signal's algorithm (but extended to support efficient encryption in rooms with a large number of participants).
I was confused since the tone of that sentence sounded weird (Apart from <positive>, it also <negative>), but I think it's a typo - I believe you meant to type "Apart from Telegram not having E2E encryption by default"?
Signal's double ratchet algorithm is easily the gold standard for now and there's little reason for anyone pushing a E2EE privacy narrative to not be using it.
"Comms app" isn't exactly what I expect to be 'atomic', or 'simple', either. Aaand "Element Matrix Services"? bitch, please... XD
'Element' is so un-cybery, feels dated. First association is Bam Margera and teenage skateboard consumer culture. The uncool one, lacking punk rock and attitude. Such a 2000s word.
Anyway, naming things is hard and annoying, so I am glad they found something _they like <3
I don't envy the person trying to convince their manager to switch to Riot.
They could at least go with 'LMNT' (leet manager's new tool) and make the logo a cyber ambigram, like this: ` |_|\|\|¯| `.
As you can see, I do sympathize with their struggles XD
And yeah, Element is a pretty boring name.
Is there an update that warrants this new post?
I run a matrix server, which has been nothing but a constant pain. My friends that use it can also use my ircv3 server or xmpp server that I run that use no resources and take up none of my time with maintenance. They do not. The only thing I've run that they like better so far is mattermost. I don't like the open core though. Matrix, xmpp and irc are backed by ldap which is impossible with mattermost.
Here is the last time I complained about matrix. https://news.ycombinator.com/item?id=25100873
I saw your comment and considered posting a facetious comment about how you would need 80TB of ram and at least twice as much disk space.... but that would add nothing to the discussion.
Of course I was using sqlite when there weren't nearly as many users as there are today or when I had federation disabled.
If they're people who want a web client you can look at mod_conversejs: https://modules.prosody.im/mod_conversejs - but it is not as comprehensive a web client as Element, in my opinion.
The real kicker is that having the data on my own server is certainly nice, but I just don't think it's less likely to be exposed while I'm holding it vs someone else. I remember when everyone had a self-hosted WordPress blog. Eventually you'd get tired of applying patches every 2 weeks and instantly get added to a bot farm. No thank you.
https://github.com/matrix-org/synapse/blob/master/INSTALL.md
This is bad for any mainstream ambitions by the Matrix team. If it becomes the next Gab/Parler, normal people will avoid being associated with it. I know this association would absolutely sink my friends exploring the platform further while we're exploring alternatives for when Google Hangouts is decommissioned.
Matrix is not a platform, it's a protocol and some implementation software developed in the open.
Like Mastodon, Matrix has it built-in in its principles that a federated instance can prevent being contacted from another (this is the whitelist setting). Feel free to correct me, I am not 100% sure.
[0] or available for real money !
If the headline “(extremist group) use / flock to matrix to plan (nefarious thing)” shows up in the news, these distinctions hardly matter anymore.
https://www.express.co.uk/life-style/science-technology/6275...
P(I use this | I’m a bad person)
because, like you point out, this obscures cases, like breathing air, where P(I use this) is already high. Instead, we care about
P(I’m a bad person | I use this)
And we especially care if this conditional probability is perceived to be high. This is because then your potential users will worry that if they use your product, others will make the (justified!) Bayesian inference that they are bad people. Because they don’t want to be seen to be bad people, they will avoid it.
Matrix's policies are pretty well enough to keep them pretty far out of contention for such a comparison https://matrix.org/legal/code-of-conduct#definitions
> I know this association would absolutely sink my friends exploring the platform further while we're exploring alternatives for when Google Hangouts is decommissioned.
Should there be such rooms (that still fall short of being removed for "abuse") you're not forced to join them. No different than you not joining Google Hangouts full of people you'd rather not talk to.
Chat systems like IRC/Element don't force you to join and speak with anyone you don't want to unlike social media sites which try to have literally everyone in the same pool.
If your standard is "people I don't like are able to use this service" you will find no service that will have 0% of said people.
It's just a fundamentally different system than what you're comparing it to and has many well established communities that aren't what you appear to be alluding to.
>It doesn't matter. Your technical and logical distinctions are minor and irrelevant to most people compared to an overwhelmingly negative reputation.
Are there any major situations involving matrix that you can point to?
I'm not aware of any major issues and just because it's not one of the major social media platforms (arguably not even social media depending on your definition) doesn't mean it's inherently bad.
You may as well be telling me how wonderful BitTorrent is for downloading Linux ISOs and to ignore that whole The Pirate Bay thing.
The hash checks help validate that the ISO file is properly in tact and not corrupted in transit and the peer to peer nature keeps speeds high by distributing the load between multiple peers.
Have a nice day.
Telegram 806 points
Zom 3 points
Viber 15 points
Threema 69 points
Signal 1699 points
Discord 102 points
Matrix (added after 25 mins) 374 points
Last I read speculations were that Signal had something like 10 millions users/downloads and Matrix 25 millions users (take that with a boulder of salt).
Beware, they removed the warning from the android client though. It confused people.
When one of your friends account is hijacked and has someone snooping on messages, you'd want to know that.
Though I see it might be confusing at first for users to understand that they have to sign their devices. Currently, you have to login with a username/password and afterwards (optionaly) get one of your other devices to sign your new device. Which the UI does clearly ask you to do though.
Sometimes it got resolved all on its own, sometimes it stayed like that. No biggie in the end but you can find some bug reports like that on github. Most probably it's getting worked out or was but it definitely happened.
> Try double checking that you did not mix up your security key, security phrase and login password as explained above.
- My connection flaked out (duh, I closed the laptop lid).
- Connection for one of my contacts flaked out (?!).
- Something in the signatures changed.
I get how any of that might be a sign of compromise. But I really don't care, I don't use this for anything sensitive. And with only about 20% of notifications being about an actual message, I've developed a blindness towards it.
Edit: having written that, I've noticed it is not doing this right now. Come think of it, it might have stopped a while ago and I simply didn't notice (c.f. developed blindness).
Downloaded client on Windows. Fine. Installed fine.
Hit the button to make an account, everything went fine. It sent a verification email. I clicked the link. It said "something" was wrong with my setup. I JUST installed it, with the default options.
On a hunch, I went back to the client, and was able to log in. The failure message was entirely spurious. If I hadn't been tech savvy I likely would have been scared off and not bothered, assuming it was just broken.
People start getting tired and look for alternatives.
Element is kind of the official full feature, basic client implementation but there are lighter clients with different flavors out there.
What fascinates me the most about matrix is that an org could setup their own federation bubble. Like a big game company would setup a new synapse instance for each studio they purchase and just federate them all together for a sort of DIY MS Teams alternative.
Here's a blog post with the changes they made: https://matrix.org/blog/2020/11/03/how-we-fixed-synapses-sca...
The UX is pretty good, but certain oddities stand out.
1. When visiting rooms, it spends a very great amount of time displaying a spinner instead of postings. It displays a banner offering to scroll back to the last read posting, but forgets that you have already seen later ones. It often displays a banner indicating some bot is operating, but no indication what it is for, or any way to control it or find out more.
2. Messages in the scrollback for private rooms are very often replaced with a note, "cannot get key"; and sometimes appear again, much later.
3. Element advertises an ability to conduct audio and video calls, but I have not succeeded in getting the other end to ring, in recent months.
4. There are supposed to be gateways available to direct Signal and SMS traffic to/from one's Matrix client, but I did not succeed in getting them to work--probably just because their documentation was wholly inadequate.
I spent quite a few months on a subscription to Purism's LibremOne homeserver, but abandoned it when it became clear they had no intention ever to maintain it.
I have not been able to determine whether 1, 2, or 3 above are the fault of my homeserver, or matrix.org, or the protocol.
A Matrix client should be able to work in multiple accounts / homeservers at once, as is done with e-mail clients, but I don't know of any that can.
It seems like it should be possible to run a homeserver on local equipment, tunneling to ports on a cheap VPS, but I have not found anything suggesting how.
Enlightenment on any of the above welcome.
I've been developing software for 20 years so I know something about buggy software and different stages of completeness so I usually give open source projects more slack but after 30 minutes I just gave up and uninstalled the app.
I really hope these kind of projects get more funding and wind behind them to get a bit more mature so there would be serious alternatives for the likes of Whatsapp.
He is black.
They probably don't need to be expensive either.
Synapse is the reference implementation currently, but also the most resource hungry. For 100k users I would be looking at 24gb RAM and 256GB+ storage space. Along with multiple cores.
If you don't need as much features, then you can try Dendrite which can have 5x to 10x less resource usage than Synapse.
They rebranded in July 2020 - https://element.io/blog/welcome-to-element/