Hacker News Reader

Comment by unbolted3032 | Hacker News Reader

I decommissioned my server 3 months ago and migrated my community back to IRC. I still had the IRC Podman containers kicking around, so that was easy.

I dealt with ~monthly issues around my devices not being correctly verified, messages not correctly decrypting, and various other rough UX edges. There seemed to be a lot of velocity in the beginning but the last couple of years have addressed approximately nothing in terms of the UX and it's a crying shame as Matrix/Element (I no longer fully understand the difference/relationship between these entities) had a lot of potential.

View on HN

Let's not forget the shock image spam issue. Public Matrix channels are plagued with horrendous shock images (including CSAM). The development team seems to not care, they have a proposal for "policy servers" which is still incomplete and not supported by all server implementations.

Let's not forget a team making a great free product. Yeah we can complain about filthy materials but imagine you working hard to build something as nice as Matrix/Element only for these low-lifes to do these horrible things to it. How annoying it must be to have to spend time battling such things.

> Let's not forget a team making a great free product.

I am fully appreciative of the work that goes into making a product like this, but I’m also tired of this mentality that nobody is allowed to talk about the problems with the product. Even simple comments from people who tried to use the product but encountered show-stopping issues are getting downvoted into gray text in this thread.

This mentality that we must only speak praise and cannot speak of problems because a product is free is further off putting. I’ve given Matrix/Element an honest try many times because some of the OSS projects I’m involved with use it, but month after month it’s the most troublesome of all of the apps in this space that I use, and it’s not even close. If I’ve gone a month without dealing with Matrix and I have to open it again it feels like there’s a 50:50 chance something is going to either be inexplicably broken or cause problems even though I thought I finally had it all working last time.

The contrast between how hard we’re told that Matrix is the great and superior option and the reality of what it’s like to use it as a casual or occasional user is really wearing me out on the project.

> I’m also tired of this mentality that nobody is allowed to talk about the problems with the product

I think there's a pretty big difference between constructive criticism vs statements like "The development team seems to not care". To me, it seems pretty clear that the team absolutely cares, but they are also a small and very underfunded team, and things take time. Assuming the worst intentions of a team is the problem and is disappointing to see here.

> I’ve given Matrix/Element an honest try many times because some of the OSS projects I’m involved with use it, but month after month it’s the most troublesome of all of the apps in this space that I use, and it’s not even close.

I don't doubt that, but it does not resonate with me. There have been a few hiccups over the years, eg the database corruption earlier this year (unrelated to the protocol or synapse) resulting in stuck invites, but overall I've had quite a good experience. Far less problems than Teams, and even slack has had issues (mainly, notifications not happening) that I have somehow avoided with Element, although I am aware others have had issues in this area. There are even some things I do with matrix that are simply not possible/practical with the others to begin with.

It is super annoying but you have to be very naive to not understand that anything that can be abused will be abused so you need to bake in countermeasures from day #1 or you might as well not bother with the launch.

Aren't there any moderators in those channels? I have 0 issues in the channels I am in (some podcasting channels, some tech, some FOSDEM.)

I find a lot of value in Element as is, I'm glad they bothered.

A lot of the spam I got was from being sent room invites, and the room names were really nasty stuff. And their client doesnt let you mass delete invites, I tried to do it one at a time but gave up and deleted the account instead.

Their server clearly doesnt care that a single federated server was sending out thousands of invites, and there's no way to avoid the spam.

In general using matrix was always a pain in the rear for one reason or another.

with that strategy you won't launch ever if you have limited budget, especially because Matrix isn't exactly a system/protocol off the self

It's free for us but not for businesses. I think this is why they are ruining the UX, because they're adapting it to their target market, like making it more like MS Teams.

A product as unsuitable for the adversarial internet as ChatGPT and coding agents

If you make anything public, you will have to deal with it. You should be mentally prepared for that from the start.

in defense of this comment, you do need to do a heck of a lot of preparation (including psychologically) to do anything publicly anymore. wild west days are long gone, at least for US-based servers. I spend a lot of time thinking about how to stop users from interacting too freely, to censor and moderate them so I don't wind up on some news site in 20 years being accused of hosting a site *Widely Used* by pedophilic narcoterror jihadists; I would like to not, but user content (and especially their information) is a huge liability to host... unless you're Equifax or Facebook or Google or some other large corporation -- then you can accidentally dump out everyone's sensitive financial information and only pay them $9 in compensation (or whatever the amount was; I keep throwing the cards they send me in the trash).

(yes I'm salty about that still)

I mean I could just as easily say you as an user should be mentally prepared.

Matrix is developing a privacy IM, you do not really moderate that now, do you? Leave the rooms that raise your cortisol level.

Wait a minute, doesn't receiving child porn even if unintentionally like the situation above open up the receiver to legal liability?

It isn't reasonable to expect users to be 'mentally prepared' to have their devices download child porn because they visited a chat room for support about the chat app they're using.

As someone else have said, then that is an issue with the law.

Imagine someone sending you a link that you open and then now you have child porn or whatever else on your hard drive, cached. Quite a shitty situation to be in.

Perhaps avoid non-technical rooms or rooms in which you do not trust people.

"Imagine someone sending you a link that you open and then now you have child porn or whatever else on your hard drive, cached. Quite a shitty situation to be in."

I guess the correct legal approach would be to go to police with this.

And the correct technical approach to keep online spaces clean, is the ability to kick, mute or ban people who violate the rules.

Saying, "just be mentally prepared" sounds to me like accepting it. Well, I don't. I go somewhere else.

I did not use the term "mentally prepared" because I thought it was appropriate, I was just quoting the other guy. I find it silly, too. I will not "accept" child porn or other degeneracies.

> Saying, "just be mentally prepared" sounds to me like accepting it. Well, I don't. I go somewhere else.

Exactly! You should be going somewhere else. Another Matrix instance, or at the very least another room, and you will be fine.

"You should be going somewhere else. Another Matrix instance, or at the very least another room, and you will be fine."

Well, but I never decided to hang around for longer. Maybe it is because the moderation tools are simply lacking? I would miss the option of not restricting certain users to send pictures in a group.

I am not sure if it is currently possible in Matrix, but it is not a bad idea to be able to restrict sending pictures (among other things), I agree.

I just read some complaints with links in sibling comments and sadly no, not possible. Maybe even hard to implement, because of the protocol.

And then imagine you have windows with recall enabled (that you repeatedly disabled but keeps enabling after updates), and/or cloud backup with automatic CSAM detection. You're screwed

Yes, and we are screwed either way if we use Windows with Recall, or even in general.

I would not consider Windows secure at all, and it seems futile to use a privacy-oriented IM on Windows, it really defeats the purpose.

Imagine using Windows with Recall enabled that takes screenshots of your conversations all the time. You can be using the most effective IM for privacy but it would not help.

So what is the moral of the story? We have shitty laws, and you should not use Windows. :P

The issue with the law could be rectified and I'd still be in a scenario where I'm exposed to hideous child pornography when I wake up and check my phone messages with bleary eyes because I'm a member of an official support channel for Matrix.

This is unacceptable.

I don't know. I've read of this alleged nightmare scenario in hundreds of forum posts, mailing lists and threads and it's not something that's actually being followed up on in any capacity. The opposite is the case in that law enforcement doesn't have the resources to get as many perpetrators as they would like to. They're not going to raid your home because you idled in a channel that got spammed or because you received and email or because some service you hosted briefly cached a csam jpg on disk. If you've made political enemies and are under observation already than perhaps this might work as a way in but even then it would be easier to just do something illegal and construct the evidence to point to another cause.

I mean, when does this actually end up with consequences for anyone? Even on managed and surveilled company devices I'm not expecting this to cause any harm to anyone involved. IT staff at previous employers and clients had other things to worry about.

Maybe I'm just not familiar with some legal jurisdictions or cases where this was a cause of concern. Let me know.

I'd blame the law if it does.

> I mean I could just as easily say you as an user should be mentally prepared.

Users tend to be less aware of these things than the operators of such servers (or at least, that's how it should be).

> Matrix is developing a privacy IM, you do not really moderate that now, do you?

No, but you can create mechanisms for the users to flag problematic accounts.

> Leave the rooms that raise your cortisol level.

The filth will follow the users. That's the whole game plan here: to cause grief.

I have been in many rooms that are completely fine; technical rooms.

As for flagging problematic accounts: how would that work in a decentralized E2EE system, and do you think it cannot be abused? What would you want them to do if I flag your account a million times? Keep in mind they probably may not be able to keep up with it, nor do I expect them to. Additionally, you still should be able to use the service due to its decentralized, privacy-preserving nature, so the worst thing that may happen is getting banned from a Matrix instance, or a room.

It's not just their servers, it's the architecture, the difficulties in self hosting, the meh origins of protocol, the resource hogging official clients, multiple implementations with differing protocol support. It's just a mess and I've given up on it this year.

It's kind of wild to me that they haven't prioritized this more. This issue has been open for almost exactly 6 years: https://github.com/matrix-org/matrix-spec/issues/565 . This one even longer: https://github.com/matrix-org/matrix-spec/issues/836 . The Matrix permission system still doesn't even have a way to say "sending images is not allowed" (either per room or per user).

maybe because of limited budget and more urgent issues? who knows

And what could be more urgent than this?

building a more flexible solution for blocking content, rather than hardcoded rules like "no images": https://matrix.org/blog/2025/04/introducing-policy-servers/

Is there something fundamental to the matrix architecture and permissions system that makes it impossible or difficult to allow room/server operators the ability to limit certain users from posting multimedia content?

having a usable technical foundation, staying financially afloat

It’s terrible. I had to leave most channels on the matrix.org namespace because they won’t properly moderate their own server from CSAM. I dropped to 7 day media retention to lower legal liability on my own server, since there’s no way to know when one of my users will be in a channel hit with abuse.

At this point the majority use case I have for matrix is to bridge to IRC with heisenbridge and be able to use signal on my laptop through mautrix-signal and nheko. The number of native channels I’m in continues to shrink.

I know the matrix honeserver I use has taken our recommendations to NOT cache images from matrix.org due to their non-existent moderation. And the admin put out a bulletin to also recommend disable downloading images as well.

There's also the split room bug (feature?) that allows banned users to still be in rooms where the honeserver doesnt ban them. And then, distributes connection shows ongoing banned content (primarily, you guessed it, CSAM) and the better-moderating admins can't do anything about it.

I'm basically in a few well moderated rooms (Gnuradio, other topics). They do extraordinarily well in not getting many trolls, and for garbage collection.

The only one we're seeing spammed is for some cryptocurrency site Liquid something. But its just commercial spam.

Have they done anything to mitigate this? Like client side filters or message scanning for new direct messages?

The main things are https://matrix.org/blog/2025/04/introducing-policy-servers/ (for flexible serverside moderation) and the rest of the stuff in https://matrix.org/blog/2025/02/building-a-safer-matrix/. Clientside filters already existed, but given they only apply per client and there are a lot of different clients, we focused on serverside filtering.

What are the plans to improve the moderation experience for room admins who do not run their own server (of any kind)?

Considering the thread context I'm curious how would IRC help with that other than people running command line or TUI clients?

Also do you want the development team to moderate self hosted chat servers? How would that work?

Must irc clients do not automatically download or show images which means joining a room and spamming a bunch of them is less impactful on recipients and so less appealing to trolls, so it doesn’t happen.

The image spam I got was on their official server.

I still can not blacklist homeservers by domain instead of ever changing IPs. Great stuff.

policy servers show that they indeed do care

You did better than I did. I installed the recommended Element app, created an account on matrix.org, tried to send a message to another user, and… gave up. Every try got stuck and eventually created an empty room or whatever they call it. I have literally never succeeded in sending or receiving a single message.

There really is no winning in the org comms/chat apps space when it comes to OSS. Matrix+element, rocket, mattermost, Zulip and so on.. feels like there’s either massive gotchas on free/self hosted or it’s wildly complicated to configure and set up. I’ve been thinking about this a lot. Hosting a private irc server and you lose out on rich embeds and will need your own pastebin-like service to use, video conferencing is probably a big challenge, the need for a mobile app at many workplaces. Bleh. I look at something like slack and I’m like damn that is literally irc+ and I just hate that I don’t have the skills to build up something completely free that I could host at my org. Teams literally owned everyone when they started bundling it in and rug pulling slack. Ofc the execs at my workplace were like “hell yeah this is great” but so did my IT dept. I was so pissed. Out of the box it’s just instantly compliant which was a major driver then of course at the time it was seen as a free offering (I know they’ve since had to decouple that) which completely nuked slack at our org. I can’t even believe I’m saying this but teams actually makes collaborating slower. No one on my team uses the channels we all pin chat groups and exclusively use that. It’s literally garbage. I guess I’m just venting, I really hoped I could find something in the oss world to supplant this and I think the bar for organizations is: compliance, chat, video conf and sigh the ability to schedule in outlook.

What do you see as the gotchas with Zulip for community use? Zulip is 100% open-source, and we sponsor our hosted services (mobile notifications, etc.) free for OSS projects.

Hi ! So zulip is actually probably top of this list as the best self managed solution and I’m sorry if I conveyed that it was even near the same ballpark of some of the others. I actually think it’s pretty neat. Interestingly the thing that made us spin down our zulip instance after ten minutes was the “async conversations”. I understand this is a core differentiator for zulip but it immediately felt like the teams channel threading which none of us can stand. The intentions are noble, and the implementation is way better than teams, but it’s interesting to me that solutioning for preventing things from getting buried became the core UX philosophy at play. Really there is something that just works with an absolutely straight forward chronological list of chat messages used in conjunction with a capable search indexer. It’s not that we aren’t willing to try new paradigms, we have tried this paradigm. For a while now. Our topic’d channels are a ghost town these days, our entire org has just moved to making group chats in teams that serve as channels and pinning them because it’s just way easier to work together with regular chat. Ironically we fail to respond to things and struggle more to find things in a topic/threaded paradigm as it seems to go a little too far in isolating “noise”. A lot of serendipitous participation and aha moments and memes come from just glancing a chat discussion that might not immediately involve your attention, and we just operate way better in the open chat space needing only channels/members for the right amount of organization.

I also found the Zulip UX to be really confusing at first. The issue is messages show up in multiple places which is unintuitive for someone with a spacial brain like me. What I do (because I use Zulip every day) is read messages only in their threads. I click on one thread in the sidebar, get caught up, then move to the next thread. (This is also how I use Discord and Slack.) So I treat it as if channels contain threads which contain messages.

But Zulip’s default view is a list of all messages in all threads in all channels which has no context for the individual messages, like

https://news.ycombinator.com/newcomments

Zulip's product lead here. Yep, reading messages thread by thread is the recommended way for most folks. (There's even a keyboard shortcut for going to the next one.) The inbox view, which lists the threads where you have unread messages, is the default home view (unless your org admins changed that setting).

The combined feed is helpful for some (e.g., in lower-traffic organizations, or if you like to see messages as they come in), and was the default home view many years ago.

“Compliance” with what?

Great question! Next question please.

(I have no idea that’s the BS I was told when we left slack for teams)

I feel they underestimated what the MVP really is and started touting Matrix as great before it was really there, which has backfired and led to disappointment. They also went a bit too overboard on the overgeneralized idea of it being "a decentralized eventually consistent JSON database", which led to a lack of focus on its concrete usability as a chat system. I still use it and it's not bad in some respects, but it's a long, long way away from being able to attract a mass of ordinary users.

If IRC suffices for your purposes, then Matrix, with its encryption and all, is apparently overkill.

If I were to upgrade an IRC-based community to something newer and richer, I'd go with Jabber, well-known, well-established, with a ton of various clients and several servers. Yes, it's not ideal, but it's still a massive upgrade compared to IRC, if your server supports a good list XEPs and your community members agree to use non-esoteric clients that also support them.

> If IRC suffices for your purposes, then Matrix, with its encryption and all, is apparently overkill.

IRC has encryption too. You run it over TLS.

For E2EE there is the very old unofficial and only-partially-secure extension of using Blowfish with a static key.

I guess it's not end-to-end, it's decrypted on the server.

Presumably if you want to send an encrypted message from one literal endpoint to another, you'd use some other technology. I'm prepared to bet there are enough people doing just that, too.

The extension I just mentioned is E2EE.

Unfortunately how I feel about it too. I gave an honest effort at getting into the ecosystem and tested it out with a few close friends. The rough edges brought the experience down compared to other stuff that “just works”, and losing community support for the IRC bridge took a huge use of my own away from it.

The rough edges are too much for even very technical users and admins, so there's no way we're going to get friends and family to adopt this.

> There seemed to be a lot of velocity in the beginning but the last couple of years have addressed approximately nothing in terms of the UX and it's a crying shame as Matrix/Element had a lot of potential.

It still has.

And with Element X they have greatly improved the UX.

Plus utd errors have been reduced by a lot.

That said, I haven't ever had issues with devices not being correctly verified ( I use that feature since it was released - and can still recover the encrypted messages of that time).

Anecdotal but running a server with multiple bridges for multiple years. Had such issues initially but none recently.

It’s that hard even with a user in the loop to press buttons. Verifying bots is even worse and the docs are either non existent or wrong. This is such a shame because element otherwise does exactly what we want but it makes me nervous it’s so badly supported and buggy.

> but the last couple of years have addressed approximately nothing in terms of the UX

This sucks to hear. I thought they had made massive improvements in the last year or so (I don't know because I feel too burnt by past experience).

When I looked into it the complexity of standing up and admin'ing a Matrix server was clearly either a massive "architecture smell" so bad the project was likely long-term doomed, or a deliberate choice to make it terrible to get people to pay for managed hosting.

In either case, that's a no for me dawg.

Reply on news.ycombinator.com