Comment by _ps6d | Hacker News Reader

Comment by _ps6d | Hacker News Reader

(Disclaimer: self-promotion)

This article echoes a lot of the reasons I'm working on Tildes (https://tildes.net) and specifically founded it as a non-profit. My announcement post from last year discusses how the current approach to community-based sites -- specifically the dependence on venture capital and advertising -- makes companies chase goals that are harmful for the users themselves: https://blog.tildes.net/announcing-tildes (HN discussion at the time: https://news.ycombinator.com/item?id=17103093)

I believe that a non-profit model is the only way to break out of the current cycle of sites starting out as "too good to be true" (as they burn through their VC), and inevitably devolving into privacy-invading, advertising-heavy sites dominated by lowest-common-denominator content when they need to keep forcing growth and monetize their users.

Tildes has been publicly visible for a while now, but still requires an invite to register an account. If you're interested in registering and participating just send me an email, the address is in the announcement post linked above. It's not intended to be difficult to get invites, I mostly just want to keep the growth rate under control while more features and the early site culture continue building up.

Quick thought: this looks like a clone of Reddit, or maybe more loosely HN, Lobsters, or Metafilter. I think the most important aspect of social media to most people is that it allows for people who are friends "in real life" to share text / media with a circle of friends in a semi-private forum.

This is why such an apparently unlikely candidate as Discord has become the medium of choice for a lot of young people. It's basically group chat with a few extra features like history search, different "channels", and easy media sharing. It's also why I think a lot of the current open source attempts are likely doomed to failure for this purpose - they're basically decentralized Twitter.

Do you have plans for Tildes to fill this kind of role? Admittedly, I didn't look all that closely at it, and so what you're getting from me is my surface impression.

Yes, Tildes is a link-aggregator-style site that's similar to reddit, HN, etc. There's no capability for setting up private groups (though the site is open-source and someone could certainly run their own private instance if they wanted to).

I usually think of the distinction as something like being "subject-based" instead of "people-based". Some sites focus on one or the other, and some try to do both. Tildes is definitely on the subject-based end.

I use that distinction as well and find it really helpful. I am just sad that it seems many efforts these days are more focused on the people than the subject side. What I really think is missing is a discussion centered Platform. Reddit style is alright, I guess, but what I really miss is a modern, federated version of phpbb.

> I think the most important aspect of social media to most people is that it allows for people who are friends "in real life" to share text / media with a circle of friends in a semi-private forum.

I agree with this. In all of the decentralized social media iterations I've seen, the main two things I've always missed were the "personal aspect," and appealing visual design.

It's worth asking, though, how possible it is to achieve that in a truly decentralized fashion, while still providing a good user experience. From a user's perspective, it doesn't make much sense to have separate sites with limited interoperability when you can simply just one (centralized) site. I guess that for the Fediverse to truly take off, there really needs to be a concept that simply cannot be implemented without de-centralization. Until then, it'll be an uphill battle.

I agree that that's a problem. If Discord is "good enough" for social media, then Matrix is trying to be an open source, decentralized Discord. It's also (in my personal experience) unbelievably crappy, even if you stick to 1-1 conversations on the "default" matrix.org instance that Riot.im uses.

Some security experts have indicated that it's not up to par with Signal for those who need the strongest confidentiality guarantees. (I wouldn't fully trust Signal either if my adversary was the NSA, but there might also be no better alternative you could get people to use.)

So it's really telling to me that years of work on decentralized "personal" social media hasn't come up with anything that's fully functional, let alone a replacement to existing social media sites.

suprising and depressing that riot feels unbelievably crappy; lots of people seem to be able to use it ok. would be helpful to know what bits sucked most if you can face it.

Okay, so maybe "unbelievable crappy" was a bit of an exaggeration. After all, I do use it. But I'll try to explain. It starts with the fact that so many of the features still aren't up to par with what e.g. Discord provides. It feels like a knock-off.

The biggest problem I've faced is dealing with the encryption. Every new device in a conversation has to be verified with every other, which means you need n(n-1)/2 pairings for a room with n devices. That's right, if you're trying to set up a chat with 10 people who have an average of three devices, you're going to need to do 435 pairings. The pairings themselves are a huge pain: there are different pairing "methods" to use, and different clients will make guesses about the method the other client supports, and the whole thing falls apart if it guesses wrong (there's no negotiation, as far as I can tell) or if the person with the device doesn't immediately respond. There's no notion of a web of trust or trusting a person instead of a specific device. Even if everything goes right (it usually doesn't) it's going to take about 30 seconds per person to do each pairing, which means your group chat with just 10 people is going to take over 7 hours to set up. You could just ignore the verification stuff, but presumably the reason you wanted to use Matrix (instead of a centralized service) in the first place was because you thought it was more secure / private.

Someone adds a new device, or logs out of a device, or there's some glitch (it's happened to me)? Everyone in the room gets to do another pairing. With every one of their devices.

Another issue has been the unreliability of the service itself. Sometimes it breaks, logging you out. (Hope everyone backed up their keys!) Or they get hacked and the server goes down for days: https://matrix.org/blog/2019/05/08/post-mortem-and-remediati...

And then there's just the random client bugs. I literally just opened the tab for Riot to remind myself of other issues and was greeted with this: https://i.imgur.com/8Rgebfr.png They don't seem to be keeping up with them, either. Riot Web alone has almost 4000 open issues: https://github.com/vector-im/riot-web/issues

Having a searchable history is supposed to be one of the major advantages of a Discord-like interface, but I just did a search for a word that I'm looking at in the chat and got no results.

So basically, it's a mess right now. I'm using it with one person because they're the only person who wants a Discord-like chat with me and are willing to put up with the amount of nonsense needed to use an alternative that doesn't siphon off your data to a private company.

So, firstly - huge thanks for taking the time to list the problems :) I'm the project lead for Matrix & Riot hence my interest.

Totally agreed that the lack of cross-signing for key verification is our single biggest problem. It turns out that this is not an easy problem to solve, but after a few rethinks we finally have a design (https://github.com/matrix-org/matrix-doc/pull/1756) and an implementation (https://scitech.video/videos/watch/d1ef04a8-397a-4570-a9a9-c...) which works. The only bit that remains is wiring it into the Riot's UI itself, which we started a few weeks ago and is looking promising. The TL;DR is that it optimises the number of verifications to the absolute bare minimum. You verify your new device once when you log into it (a bit like WhatsApp), and then everyone else will transitively trust the new device.

In terms of the unreliability of the matrix.org server: we added encrypted key backup about a year ago to solve the whole "if you get logged out you lose your keys" problem, but agreed it used to be a massive problem. And yes, the matrix.org security breach was a nightmare - apologies.

For the i18n bug: if the request to load the i18n file for your language fails for whatever reason, you get that ugly error - it's similar to getting an ugly page if the CSS didn't load. We can make the i18n req retry, though - i just filed https://github.com/vector-im/riot-web/issues/10965 for this.

In terms of the number of bugs - yes, we have 3775 open, and 5871 closed. This is because we deliberately try to track each and every possible suggestion & feature request & bug of every severity in the issue tacker; trying to use it as the main knowledge store for the project. I wouldn't judge the quality of a project by the number of bugs - it's like judging the quality of a book by the number of pages. It doesn't tell you much beyond how big a book it is.

Search should work, but delegates straight through to postgres's FTS engine. We need to tune it better, for sure.

> So basically, it's a mess right now

Hopefully key verification will fix the biggest issue here. Thanks for persevering with it in the interim.

Hey, I didn't know you were the project lead. Thanks for taking the time to reply! By the way, when I said

> If Discord is "good enough" for social media, then Matrix is trying to be an open source, decentralized Discord. It's also (in my personal experience) unbelievably crappy

it was sort of a loving complaint. I brought up Matrix in the first place because to me it is one of the few attempts to solve the personal social media problem with decentralized open source software. So I really want to see it succeed, and my quick rant about how the state of it now was in that light. Kind of like complaining about your favorite sports team. You forget sometimes what a range of people are on HN, and so I hope you / others who work on Matrix aren't too disheartened by complaints.

I've been following the cross-signing bug for a while now. I had hoped to see it implemented earlier, but it's good that it's being worked on. I wonder if an encrypted copy of the keys could be stored in the browser's local storage, so that logging out doesn't reset the client. It would also be great to have all my devices store encrypted backups of each other's keys, so that unless all my devices get signed out everything just works without requiring a backup or re-verifying devices. I think Signal works like that, and I thought Matrix was supposed to do this partially, but it didn't work last time I was signed out. From the user's point of view, you want one identity / set of keys / backup for all your devices, even if that's not what's happening at a lower level.

> the i18n bug

Since you already have the pre-translation English text, wouldn't it make sense to fall back to showing that instead of "translation failed" on every line of text? Plus, my locale is en_US so especially in my case failing to fetch the i18n files shouldn't result in such an ugly bug.

> Search should work, but delegates straight through to postgres's FTS engine.

If I'm understanding you, this means the search is always done server-side. Doesn't this mean that search will never work on encrypted chats, since the Matrix server doesn't have the text of my chats to search? If that's expected, some user-facing way of making this obvious would help.

Thanks again for the detailed reply.

Looks cool. What's your censorship policy?

Reply on news.ycombinator.com