Comment by dlmetcalf | Hacker News Reader

Comment by dlmetcalf | Hacker News Reader

Parent Full thread

Leaving people no option but to use Google's infrastructure (if they want to participate with anything better than a browser) seems an ENORMOUS gap, given the rest of the project's goals. If you want to use it on mobile, it IS still centralised around Play Store and GCM (where Google can collect all your metadata).

You can't even install the Matrix mobile app on open source Android phone that doesn't have all the Google bloatware installed (which you can't do on decent OS's like Copperhead yet while keeping a signed & verified boot loader).

You've done some great work, so I don't want to be too critical (I don't have time to implement the fix for a start!) - but this is almost like how Signal claims to be open source, but you can't ACTUALLY USE the iOS version, because GPL is incompatible with Apple Store.

You claim to be open source and decentralised, but you can't actually use it on an open source and decentralised platform. So I kinda don't see the point.

Have you actually tried using it on a phone with no Google Play Services? I'm involved with the project and I remember someone reporting it works just fine. Vector for Android falls back to polling if GCM isn't supported/working afaik.

I hadn't tried it, no. Was just going on what others had said here. That's great to hear it has at least some sort of fallback! Polling however is typically too battery draining to be practical. Battery drain was one of the biggest reasons XMPP lost traction.

If Matrix adds something like XEP-0357 Push Notifications, enables verifiable builds & FDroid distribution, plus gets full featured XMPP bridge implementations done, then I think you're onto a winner. It gets extremely hard to convince people to install N+1 different IM clients once N>5, let alone the >10 that're becoming common. The XMPP Push XEP is working fantastically in Conversations IM and extremely fast too BTW (much snappier than Signal at least).

Congratulations on your work on the Olm implementation too!!! Now that Signal Protocol has been locked up in legalese (turns out Open Whisper WEREN'T really open), you guys are THE leading E2E implementation. It's really a fantastic contribution to the community and we owe Matrix devs a huge thank you!

We do have a similar equivalent to XEP-0357: http://matrix.org/docs/spec/push_gateway/unstable.html. We can and will make Matrix do smarter than polling though, especially for the case that GCM isn't available. For instance you could use the websocket transport that's available today.

Glad you like Olm :) I think OWS are trying to find a way for their impl to be appstore compatible too, so hopefully the user wins twice over!

Nice! I really am excited for you (and us)!

Re OWS; yes, I still keep some small hope that they've just been too preoccupied and not completely thought/worked things through. People are human and they've clearly had a lot going on! Their position as stated really did surprise a lot of people. Matrix.org's views on decentralisation certainly sounds FAR closer to the future I'd like to see for the net. Being able to evolve or change clients and integrate new technologies, without cutting off the entire network, seems clearly a very good thing indeed.

FWIW, my understanding is websocket connections isn't robust under all mobile carriers, as most drop connections when you try to upgrade to a websocket, since they assume http upgrade is for ssl, and also there are problems with periodic disconnects.

> THE leading E2E implementation Wait, Matrix has E2E encryption?

Yes, see https://matrix.org/docs/spec/olm.html. An implementation of that spec is in final testing and expected to land into master within a couple of weeks.

It's a double-ratchet, very similar to Signal protocol, but unencumbered by the GPL/iOS licensing issues that Signal's implementation has.

Yup, fallback to polling should work fine. In future, when folks implement more efficient transports for Matrix than HTTP+JSON then Matrix itself could be quite a compelling open alternative to GCM for push notifs :)

What about using a GCM implementation like microg?

Microg is not an option as it requires signature spoofing, which requires security to broken in various ways. Forces rooting the device or running Xposed, or applying dodgy kernel hacks and prevents using verified boot, which is a sensible security requirement.

https://github.com/microg/android_packages_apps_GmsCore/wiki...

Reply on news.ycombinator.com