Hacker News Reader

Comment by Jnr | Hacker News Reader

At this point I just want them to die off completely so we could get something better. They have been unable to make real improvements that make using Matrix a nice experience. And their existence somehow inhibits other solutions from emerging in the OSS community chat space.

View on HN

> And their existence somehow inhibits other solutions from emerging in the OSS community chat space.

How?

People new to the system think that Matrix can work. So FLOSS devs spend time trying to lipstick the pig. Takes time away from other areas.

Matrix is completely busted, for the article's aforementioned reasons, and others.

My complaints is that ive seen child sexual assault imagery on your primary servers, hours later (and thousands of CSAM images) finally the user banned. And still does it cause some federated server they are connected to still allows them to be half-joined to a room.

The only safer way to federate is to disable image caching and preloading, and ideally defed from matrix.org.

And combined are the laughable moderation tools. I'm sure for some gov deployment, they're not going to spread child sex images. But on the public internet, even basic tooling is a joke.

I recommend all Matrix admins to discontinue. Its frankly too legally dangerous to run it, given all the various failure modes and E2EE failures.

Its 1 size doesnt fit at all. And it being gone would allow others to potentially succeed.

This is an astute comment, despite "Arathorn" CEO of Matrix LLC's downvote ring pushing down the score. (Hey bud you know you can just read without commenting, right? Sit and listen for awhile)

ActivityPub has the same problem. Browse a Japanese MissKey server and it'll start loading yours up with questionable drawings. I turned off my server FAST

This is a big, big problem for federated software that I have not seen addressed or even frequently discussed. Arbitrary file upload by the public is not something small operators can reasonably allow on their servers.

Even large operators of non federated systems with controlled access like Facebook struggle with this. It's impossible to protect yourself as a server operator on Matrix or ActivityPub from malicious actors that want to use your server to distribute illegal material, and you'll be the one found liable!

No thanks!

Hosting any publicly uploaded content is a bad decision and a problem since e-mail. IRC and MQTT with QoS 0 do not have this problem. They have others though. At least criminals won't use them because of how easy is to snoop.

> People new to the system think that Matrix can work. So FLOSS devs spend time trying to lipstick the pig. Takes time away from other areas.

What I don't understand is how multiple governments and militaries are able to make it work. Are they using a reduced core-features-only version?

They're typically operating in private or semi-private federations, and so aren't so worried about spam/abuse issues like the one in question here. They may also not care as much about serverside metadata footprint (or indeed they may actually require serverside metadata in order for the server admins to enforce who can talk to who).

As a result, the popularity of Matrix in public sector has resulted in focus there - which is somewhat different to the expectations of folks looking for a Discord replacement or a privacy-at-any-cost solution.

> As a result, the popularity of Matrix in public sector has resulted in focus there - which is somewhat different to the expectations of folks looking for a Discord replacement or a privacy-at-any-cost solution.

Unfortunately, a Discord replacement is the sort of thing that the free software world actually needs, because in its absence people are just using Discord, even for free software projects.

Do you know Cinny?

cinny.in

Rocket Chat, Mattermost, Zulip

These don't offer the core UX of Discord, which is being able to jump between many communities from a single app/login.

No open thing can ever do that. By virtue of openness, there are many copies of open things whereas your requirement requires there to be just one.

I think you could get pretty close with OAuth2. You could also have the frontend be a centralized app, but allow people to host their own servers. If the entity controlling the frontend goes off the rails you still have a pretty simple exit strategy.

OAuth2 is a failed protocol - it's more of a set of guidelines for vendors to implement proprietary authentication systems, all incompatible with each other.

There's nothing stopping you from building interoperable protocols on top of OAuth2. I've done it a couple times.

OpenID Connect is another example.

OAuth2 has some worts, but I think it's worth the tradeoffs.

Zulip does. It's as easy as discord, if not better!

I looked into Zulip a couple years ago and they didn't support this. Have they implemented OAuth2 or something since then? Specifically being able to log in once and be able to jump between any number of self hosted servers.

Sorry, I'm not sure. Please reach out to their dev team at https://chat.zulip.org

half baked solutions often "crowd out" potential better solutions. If something works enough, someone is less likely to make one that works well. Especially when there's a network effect involved.

Reply on news.ycombinator.com