A German school forked FluffyChat, a Matrix messenger | Hacker News Reader

A German school forked FluffyChat, a Matrix messenger

hermannschule.de

83 pointsdoener30 comments

I do think a fork was the right decision, after reading their reasoning and what changes they made. The client-changes sound great for young children in a school context and not federating is imo a necessety in this case to protect the users — we are talking about children in elementary school!

They also clearly stated which software to use and where the upstream is. Other schools/uiversity pay for a proprietary system, which can't be used the moment the company goes out of business (Happened to my uni — now we are using a 8 years old web-interface which can't be updated because the company no longer exists.

NOT good is, that they are still using 0.26.1, instead of 0.40+ or the new 1.0. There version is 10 months old, which is bad because FluffyChat developed extremely fast all this time. Hopefully they will make a big upgrade every year, else they won't profit from incoming changes like native voice calls, like in Discord, instead of using jitsi. I just hope they updated synapse properly...

Edit: typo

Their Gitlab repo might just be behind, because the latest change to the source code was about 11 months ago. I think they stopped maintaining the application.

The Google Play link 404s for me, but that may just be a region restriction causing confusing Google error messages rather than a maintenance problem.

There's a separate Gitlab project for a more recent version that saw more changes since: https://gitlab.com/hermanncoders/hermannpost-0-41-4

Edit: the CI/CD refers to this F-Droid repository: https://fdroid.nordgedanken.dev/ where seemingly more recent versions of the fork can be found. I don't know where the source for those versions is, though, I suppose the most recent version is not open sourced as of yet. It's GPL-3 software so you could ask for the source if you really want it, of course.

We've done some small changes in the last months which I didn't merge yet, but we are indeed stuck in 0.26.1 - I was working on an update to 0.41 but got stuck with some navigation stack errors and notifications not working. Hopefully the interview will help us find someone more savvy than me who can tackle this - I guess someone who knows flutter could solve those problems in a matter of minutes.

And yes, synapse is being updated properly by someone who knows what he is doing :-)

" synapse is being updated properly by someone who knows what he is doing" - you are lucky to have such help (or the knowledge to do so if it's you!)!

I've perused the needed changes a few times as I try to prepare for an upgrade from 1.26 to current.. I'd love to have some mercenary help with the process - especially if it could be not just upgraded synapse, but also transfer to a new server and made to work with Debian 11 - (mine is currently on Debian 9) -

If nothing else I'll be exploring the porting / moving of the postgres DB to a new datacenter with larger HDs and trying to connect the syanpse from the old DO drop.. then try to move the rest -

My first three experiences with installing synapse makes me worry that I'll give up and nuke the whole thing and try to start with a fresh new install and see if that even works on the new box.

Looks like they forked _a_ Matrix messenger (FluffyChat, which I haven't heard of before and which doesn't seem to be "the" official Matrix messenger, if such a thing exists) and are running a non-federated Synapse server on the school premises.

That sounds like an overall good idea to me. The client fork might be questionable, but it's clearly targeting a non-technical audience (or, not necessarily technical), so having a low barrier of entry makes sense to me. Kudos to them, hope they can keep it maintained.

there is no "official" client, thats the whole idea.

There is actually an official client called Element

and it is official exactly why?

Because it was created by the same people who created the Matrix protocol.

Looks like one of the big features they added in their fork was the ability to login via a QR code. This is a really nice feature that I have enjoyed using on Nextcloud. I hope they upstream the change!

Curious that they needed to fork their messengers and servers rather than apply a custom policy layer to instruct Matrix to disable federation and restrict registration/room creation. I can see why the fork was necessary, but perhaps the folks over at Matrix might use this as inspiration for management features that some institutions clearly require.

Most of their changes are client changes, making the client more friendly to elemetary school children, by taking aeay options, using other graphics and a sign in using QR Codes. According to the Golem article they are in contact with the upstream developers, who currently don't want to integrate these things, but support them to some degree.

One thing that reads a bit weird are passages like "We hid state messages […] from our client" or "We also hid the option to create groups".

So if I grab the token from the client (or extract the implementation for decrypting their QR codes), I can still do it through the API? Hmm…

I'd say a dedicated hacker could walk through their system like a laser through butter anyway. After all, it's just a random school, lacking expertise as also manpower for proper quality. Their long term goal should be to get the same experience from a proper managed project. The problem is that official projects have just started to move into that space. German Public IT is insanely far behind in that regard.

...a honeypot to discover technically minded students?

As it is an elementary school it is unlikely that a pupil will "hack" it, however some parents or big brothers might. But I wondered the same, especially as they state they also want to block parents from talking to anybody, except the teachers.

But maybe that can be augmented by serverside configuration and the change in the client is about taking away the options, which would be blocked by the server anyways.

State messages like "x has entered/left the room" or "x has changed his/her avatar" reveal identities present in a room, which we wanted to keep private. That information is sent by the server, but not displayed by the client. Quite probably there might be a better solution for this, but we looked for a (quick) solution that worked for us, since the combination client-server is supposed to be a closed ecosystem. We were (and are still) in the middle of a pandemic, and just wanted to get it to work in an acceptable manner.

You probably will be able to rip the app appart and get the keys, but why would you, we are just a little primary school. It's up to real experts to find an elegant solution for all of this, if there is demand for it on a bigger scale.

That's what "hide" usually means. It's not like all hell would break loose if someone ever found a way to start an unscheduled group, it's just UX streamlining, don't distract people work options they don't need.

Via https://www.golem.de/news/matrix-grundschule-forkt-messenger...

How did this happen? A tech/code affine teacher with contacts?

The schools in my district in Germany can't even manage to set up reliable wired internet, and the few rooms with projectors all are stocked with Apple TVs to ensure that only students with rich parents can participate in classes.

In theory there's the Netzwerk Freie Schulsoftware https://digitalcourage.de/netzwerk-freie-schulsoftware which is supposed to help schools make use of free software instead of proprietary solutions, but in practice the people most likely to know that it even exists are also those who are least likely to need the help.

Playstore listing for the client

https://play.google.com/store/apps/details?id=de.hermannschu...

This title is incorrect, the German school forked the FluffyChat client specifically, not "the Matrix messenger" - "a Matrix messenger" would be more correct, but just name FluffyChat directly.

English translation: https://hermannschule-de.translate.goog/hermannpost.html?_x_...

But they forked a Matrix server as well to limit it to a standalone server and to limit who can access what information for the reason of privacy of the kids.

(They likely didn't fork it to make it standalone, you can do that from the config. The article doesn't mention that as a reason, either.)

They changed the login, so that you can't use anyother client.

They changed the contact possibilities, so that conact can only be made on invite only.

I read an interview with the responsible vicr-principal of the school today [1]. From my understanding the only created QR Codes that included login and password (minus last 4 digits) and the client used this info to send the request to a standard matrix server. The users only had to type in the last 4 digits manually.

Everything else can be configured via the matrix server config

[*]https://www.golem.de/news/matrix-grundschule-forkt-messenger...

Doing that is supported in synapse and just a matter of setting federation_whitelist = []

Thanks, I edited the title.

Best translator German/English in my experience is https://www.deepl.com/en/translator

Unfortunately, I don't believe that DeepL yet has a way to translate entire web pages on the fly (if it does I'm not sure how to use it) as I shared above.

Here's a corresponding Yandex translation for those who are adverse to Google, their translation service is pretty good in my experience: https://translate.yandex.com/translate?url=https%3A%2F%2Fher...

Reply on news.ycombinator.com