Hacker News Reader

I also wanted - and still want - matrix to succeed! But, i've also semi-given up. I still use it because there a small number of folks i still chat with; though that's dying off. I managed a synapse home server very early in matrix's life, for a few years, and yeah it was complex back then...and for me the security is fine. Sure, there are gaps and things to be address for security...but, overall the thing that grinds my gears are the heavy resources needed. I started returning to xmpp. Is xmpp "simpler" or "more secure"? I would reply: no. But, you know where xmpp is really great? Ridiculously low needs for resources for a server! I understand that in this day and age we have far more access to so much more computing power...But, why should we allow bloat just because we can? Sorry, nowadays if I'm just trying to provide for chat, I'm looking into xmpp. I have no experience with simplex, but i think i'll wait til it bakes a bit more (and also see the resources usage story in a year or so).

Its funny, I was such a matrix fan boy, and now i'm looking at a chat tech (xmpp) that has been around for tons of years - figure that!

At this point I just want them to die off completely so we could get something better. They have been unable to make real improvements that make using Matrix a nice experience. And their existence somehow inhibits other solutions from emerging in the OSS community chat space.

> And their existence somehow inhibits other solutions from emerging in the OSS community chat space.

How?

People new to the system think that Matrix can work. So FLOSS devs spend time trying to lipstick the pig. Takes time away from other areas.

Matrix is completely busted, for the article's aforementioned reasons, and others.

My complaints is that ive seen child sexual assault imagery on your primary servers, hours later (and thousands of CSAM images) finally the user banned. And still does it cause some federated server they are connected to still allows them to be half-joined to a room.

The only safer way to federate is to disable image caching and preloading, and ideally defed from matrix.org.

And combined are the laughable moderation tools. I'm sure for some gov deployment, they're not going to spread child sex images. But on the public internet, even basic tooling is a joke.

I recommend all Matrix admins to discontinue. Its frankly too legally dangerous to run it, given all the various failure modes and E2EE failures.

Its 1 size doesnt fit at all. And it being gone would allow others to potentially succeed.

This is an astute comment, despite "Arathorn" CEO of Matrix LLC's downvote ring pushing down the score. (Hey bud you know you can just read without commenting, right? Sit and listen for awhile)

ActivityPub has the same problem. Browse a Japanese MissKey server and it'll start loading yours up with questionable drawings. I turned off my server FAST

This is a big, big problem for federated software that I have not seen addressed or even frequently discussed. Arbitrary file upload by the public is not something small operators can reasonably allow on their servers.

Even large operators of non federated systems with controlled access like Facebook struggle with this. It's impossible to protect yourself as a server operator on Matrix or ActivityPub from malicious actors that want to use your server to distribute illegal material, and you'll be the one found liable!

No thanks!

Hosting any publicly uploaded content is a bad decision and a problem since e-mail. IRC and MQTT with QoS 0 do not have this problem. They have others though. At least criminals won't use them because of how easy is to snoop.

> People new to the system think that Matrix can work. So FLOSS devs spend time trying to lipstick the pig. Takes time away from other areas.

What I don't understand is how multiple governments and militaries are able to make it work. Are they using a reduced core-features-only version?

They're typically operating in private or semi-private federations, and so aren't so worried about spam/abuse issues like the one in question here. They may also not care as much about serverside metadata footprint (or indeed they may actually require serverside metadata in order for the server admins to enforce who can talk to who).

As a result, the popularity of Matrix in public sector has resulted in focus there - which is somewhat different to the expectations of folks looking for a Discord replacement or a privacy-at-any-cost solution.

> As a result, the popularity of Matrix in public sector has resulted in focus there - which is somewhat different to the expectations of folks looking for a Discord replacement or a privacy-at-any-cost solution.

Unfortunately, a Discord replacement is the sort of thing that the free software world actually needs, because in its absence people are just using Discord, even for free software projects.

Do you know Cinny?

cinny.in

Rocket Chat, Mattermost, Zulip

These don't offer the core UX of Discord, which is being able to jump between many communities from a single app/login.

No open thing can ever do that. By virtue of openness, there are many copies of open things whereas your requirement requires there to be just one.

I think you could get pretty close with OAuth2. You could also have the frontend be a centralized app, but allow people to host their own servers. If the entity controlling the frontend goes off the rails you still have a pretty simple exit strategy.

OAuth2 is a failed protocol - it's more of a set of guidelines for vendors to implement proprietary authentication systems, all incompatible with each other.

There's nothing stopping you from building interoperable protocols on top of OAuth2. I've done it a couple times.

OpenID Connect is another example.

OAuth2 has some worts, but I think it's worth the tradeoffs.

Zulip does. It's as easy as discord, if not better!

I looked into Zulip a couple years ago and they didn't support this. Have they implemented OAuth2 or something since then? Specifically being able to log in once and be able to jump between any number of self hosted servers.

Sorry, I'm not sure. Please reach out to their dev team at https://chat.zulip.org

half baked solutions often "crowd out" potential better solutions. If something works enough, someone is less likely to make one that works well. Especially when there's a network effect involved.

As someone who wants to care not at all about the implementation details: last week I tried to sign up and use Matrix. I just want it to die.

It's got all the downsides of both centralized and distributed chat systems. Matrix.org didn't have the username I wanted so I went through four different home servers before giving up.

Tried to install a cli app (Weechat). Homebrew wanted four or five scripting languages, a spell checker, and still no Matrix plugin (need to install an abandoned C library for that and then wrangle python). The web app is shit. I get hijacking Cmd+K (and despise it), but it also hijacks Cmd+`.

Makes me miss IRC really.

> State resolution is just a total mess.

Not since https://matrix.org/blog/2025/08/project-hydra-improving-stat...

> I spoke to a homeserver admin once who found that the DB storage space of just the member list can easily reach multiple gigabytes for larger rooms.

This is nothing to do with state resolution; it's due to Synapse's implementation deliberately cutting corners on storage efficiency while trading off for speed. I showed how it could be fixed a few months ago here: https://youtu.be/D5zAgVYBuGk?t=1853, but we prioritised fixing state resets instead.

> Also years later, we still don't have custom emojis, user statuses, user bios, invite links etc

There are MSCs for all of these now, and implementations are starting to filter through. The reality is that the project has been in a funding crunch since 2023 and we've had to focus on survival by prioritising stuff people pay for (i.e. big servers for govtech deployments) rather than custom emoji.

>trading off for speed

If speed is a concern, why did you all stick with Synapse (essentially single-threaded due to the GIL) over moving to Dendrite? As far as I can tell, Dendrite is, for all intents and purposes, abandoned.

Because we didn't have enough people or cash to do a good job of simultaneously writing two servers, and as Synapse had gone into production across *.gouv.fr and other critical deployments, we instead frantically backported Dendrite's main novelties to Synapse - adding instead worker processes to Synapse so it could easily scale beyond the GIL: https://matrix.org/blog/2020/11/03/how-we-fixed-synapse-s-sc...

The hope was always that we would then get back to Dendrite and be able to invest in it and migrate over, but the cash situation got worse in 2022 due to Matrix being more and more successful (causing the available $ in the industry to be flow to integrators rather than the upstream project), and instead we had to essentially park Dendrite dev in 2023 other than for critical fixes.

Meanwhile, to try to fix the $ situation, we added Rust workers to Synapse as "Synapse Pro" to give customers a reason to actually route money to us as the upstream project, and nowadays Element is actually on a more economically sustainable path. However, at this point the likelihood is that rather than progressing Dendrite we'll instead look to add more Rust to Synapse and fix its resource usage. That said, others are of course very welcome to continue progressing Dendrite forwards, and I personally find it super depressing that we failed to progress both servers at the same time.

Matrix team is doing a solid job of running - Keep it up and keep eating the Slack/Teams marketshare up with competitive features and pricing. Additional business considerations like HQ location costs, tax liabilities, and talent pool availability on paper also affect what you have to work with. London tax, talent, and labor pay versus Austin for example.

Also I got your name wrong last time - I apologize for that.

> nowadays Element is actually on a more economically sustainable path

Good to hear. Keep up the good work.

It sounds like you were stuck between a rock and a hard place there. Hope the Rust integration goes well.

> the likelihood is that rather than progressing Dendrite we'll instead look to add more Rust to Synapse

I thought the goal of Dendrite was decentralization done right? Namely, the ability to run a homeserver from the very phone one is using the client on?

Dendrite did subsequently switch to powering the P2P Matrix work… which also got paused in 2023. We’re currently resurrecting it, but it’s not clear whether Dendrite will be the clientside server impl.

Been loving your well-placed comments for 5 years.

Keep up the great work - your team should be giving you a raise; you’re a great reflection on them.

What’s the best way to fund development of this stuff? I’m aware of donating to the matrix.org foundation, but as far as I can tell none of that goes towards funding server and client implementations since those are Element instead of the foundation.

> This is nothing to do with state resolution; it's due to Synapse's implementation deliberately cutting corners on storage efficiency while trading off for speed.

It's specifically to increase the speed if *state resolution*. If it weren't for the convoluted state resolution system, there wouldn't be a need to store gigabytes worth of state groups in the database.

* https://element-hq.github.io/synapse/latest/usage/administra...

* https://github.com/matrix-org/rust-synapse-compress-state

Maybe there's a way to calculate state without state groups, but I sure don't see one that I can use if I were to run a matrix server.

> Not since https://matrix.org/blog/2025/08/project-hydra-improving-stat...

Simply fixes some of the many ways that rooms can explode or be bricked. Zero confidence that room brickings are totally fixed once and for all.

> There are MSCs for all of these now, and implementations are starting to filter through. The reality is that the project has been in a funding crunch since 2023 and we've had to focus on survival by prioritising stuff people pay for (i.e. big servers for govtech deployments) rather than custom emoji.

A funding crunch since 2023 yet those features have been necessary for many years before 2023.

The room state is cached to not need to recompute the current room state from the beginning of time.

You probably would do that even if there was no state resolution at all

> Simply fixes some of the many ways that rooms can explode or be bricked.

How many other ways are there? Afaik none is known

> Afaik none is known

Before project hydra people didn't know about the room exploit either. They just knew that rooms exploded somehow every once in a while.

Most people actually working on Matrix have been aware of state resets for quite a while. Hydra is just the name of the project which addresses them. There are 3 phases, of which the 1st covers the most serious ones; the 2nd and 3rd phases should drop next year.

As an analogy, it's not dissimilar to how Git has added various different merge resolution approaches over the years in order to come up with more predictable and more "do what i mean" algorithms (resolve, recursive, ORT, octopus, etc). It's slightly different in that a bad merge in Matrix feels very unexpected and problematic, whereas manually unpicking collisions in a VCS is just part of the territory.

> It's specifically to increase the speed if state resolution. If it weren't for the convoluted state resolution system, there wouldn't be a need to store gigabytes worth of state groups in the database.

No, it's specifically to increase the speed of state retrieval. One of the uses for that is state resolution, but it could equally well just be calling the /messages API or any other point you need to know historical state. But what do I know :)

> it could equally well just be calling the /messages API or any other point you need to know historical state.

State groups aren't really a thing for messages in a timeline, there are many easier ways of doing it, for example, simply storing the message sequentially (impossible in matrix though, due to the convoluted tree structure it uses)

But when it comes to state (where state groups are actually needed) who actually needs a snapshot of the state at literally every point in history? Any other messaging app just needs to know the current state and maybe also an audit log of the change history for audit log purposes.

In any sane messaging app (e.g. discord, slack, telegram etc.) there is exactly zero relevance in knowing the member list, room configuration, permissions and room title at exactly 2024-06-19T15:23:45Z. Who the heck cares??? Yet the design of matrix somehow makes this an integral part of every single operation.

Perhaps just watch the video and see that the proposed solution is just doing a temporal state table - just as Slack and Discord etc must have in order to know what the state of a room was at some point in time.

Slack and discord don't know the state of the room at any given time in the past. Show me anywhere in slack or discord where you can see the membership of a room at 2024-06-19T15:23:45Z. Or anywhere where you can see the historical profile picture and nickname of everyone in the room at 2024-06-19T15:23:45Z. You can't, because they don't know.

I am pretty confident that slack and discord know who has permission to read a message at a given point in time, which is all that state groups are achieving here.

I am pretty confident they only know who has permission to read it right now.

No, they all need to know who had permission to read a message which was sent at a given point in the timeline. This is all state groups is: a track of the room state at the point a message was sent: e.g. who has permission to read it.

I repeat: I am pretty confident they only know who has permission to read it right now.

It works like this: their server gets a request to read messages, and checks if the client currently has permission to read messages. If so, it reads the messages. If not, it returns a permission error. If you don't have permission, it doesn't attempt to analyze history to figure out whether you had permission in the past.

In fact, Discord is pretty explicit about not letting you have any interaction with things you don't have permission to view. It doesn't even tell you you don't have permission. It just silently removes them from your menu, and if you try to access them with a link, it tells you "unknown error".

> A funding crunch since 2023 yet those features have been necessary for many years before 2023.

But before 2023, the funding was going to things like solving state resolution, a VoIP system that was not dependent on Jitsi, getting rid of "could not decrypt message" errors, and so on.

https://kashmirlife.net/14-messaging-apps-blocked-in-jk-3163...

You guys gave up on the national security threat and caved.

Dont want authorities knocking my door down for using an app

Custom emoji also stood out to me as “who cares”,

when compared with the other concerns throughout the thread.

Have you tried XMPP?

I used it for a year or so, with the default servers, worked just fine. We tried to get a group chat over from Signal to SimpleX but were unsuccessful in the end for unknown reasons. It just petered out and I didn't reinstall it on a new phone.

Maybe there was no migration?

I have a room going on multiple years now.