Comment by kragen | Hacker News Reader

Comment by kragen | Hacker News Reader

This is wonderful! I've been using Matrix for the last several months for work, and it's mostly a huge improvement over that vile ransomware Slack. Especially Gomuks is a huge improvement.

One drawback I've been suffering is that I can't figure out how to keep logs. Our server had a failure and was down for a day, so Element on my phone decided it should forget all its keys (and also my password). Now I've lost access to all the past channel logs on our E2E channels, and it seems like nobody on the channel has a version they can usably copy and paste; Element in particular doesn't allow you to copy and paste large chunks of chat history because, when you scroll back a lot, the chunks that are scrolled out of view cease to exist (from the point of view of the copy-paste buffer).

Also gomuks deleted all my session information when my local disk got full. Maybe I should try Bitlbee?

So, there are still a lot of rough edges! But there's a path to getting them fixed, since it's free software and an open protocol spec. Hopefully the German government will be a good collaborator in contributing improvements!

https://github.com/russelldavies/matrix-archive is your best bet for exporting conversations right now. There's a GSoC project ongoing to build something like this into Element Web too so you can just hit "download" on a room and export it all nicely.

Thank you! Should I report the fact that Element on my phone deleted all its session keys due to some kind of server hiccup (the server was incorrectly reporting incorrect-password stuff, probably because A. was reinstalling it and hadn't restored the user database yet) as a bug? Certainly deleting all my past conversations and my encryption keys when there's a temporary server failure, is not the behavior I desire, but maybe it's by design?

(In that particular case, it resulted in me losing the address where I had to go that afternoon, which was in a Matrix chat message on my phone, before Element peremptorily deleted all my past messages with no confirmation. Fortunately I was able to remember enough of the address to get close enough...)

I've filed https://github.com/matrix-org/matrix-doc/issues/3290; unfortunately this is a spec issue (the current spec mandates that any 401 error is treated as the server telling the client to do a hard logout. i propose it should do a soft logout by default instead, thus preserving local data).

Why would a server failure 401? The spec seems reasonable to me. This looks like some kind of proxy setup mistake, maybe?

I haven't asked A., but as I said, I suspect she was reinstalling the server from scratch, and hadn't yet gotten to the part where she restored the database from backups. So all login attempts were failing. I didn't yet realize there was a server problem, myself. I thought Element on my phone was failing and that I was misremembering the password when I tried to log in from the browser.

Generally, though, regardless of how it happened, from my perspective it's a security vulnerability if there's anything the server can send that will wipe data from the client. So the spec doesn't seem reasonable to me. I want to use a client that keeps my data safe from server malfunctions, whether accidental or intentional.

Thanks! Yeah, it was an extremely rude awakening, and I've lost months of logs of conversations that I thought were securely in my possession. From my point of view, if there's anything the server that can do that will cause my client to delete data, that's a security hole in the client that should be fixed—I want to run a client that is a user agent, serving my interests as a user, not a server agent, acting on behalf of the server. It seems like the authors of the spec had the opposite perspective on this?

Of course a DHTML web page is a server agent; it's just a convenient way for the server to get better responsiveness and resilience against network failures. It relies on the server completely for its integrity—the server can inject whatever code it wants. So the server-agent mindset is understandable for a team that started out developing a DHTML web page. But a phone or desktop app doesn't have to work that way; it can protect the user from malicious servers. And, I think, it should.

I have been having this issue as well with the exporting of data and it looks like it was just solved below. Thanks!

The crazy thing is how happy lots of companies seems to be to giving slack access to all of their communication and API access to all of their other tools. And I’m very excited for when the tool that connects all these tools, which matrix should be, can be owned by the people using it rather than the company providing the service.

I wished more open source projects used it, everyone and their cat is using discord :(

It's ridiculous! Discord isn't not only non-open-source—you can't even run your own server! (They pretend you can, but a Discord "server" is really just a virtual server running on somebody else's computer.)

Well, for GNU Wget, we've moved to Matrix since two years now. The public room is bridged to IRC.

Reply on news.ycombinator.com