• drkt@scribe.disroot.org
    link
    fedilink
    English
    arrow-up
    46
    arrow-down
    1
    ·
    4 months ago

    The protocol is bloated to hell so third-party clients stand no chance, and the foundation spends more time bikeshedding or pissing away money than they do developing. It’s a doomed project.

      • ProdigalFrog@slrpnk.net
        link
        fedilink
        English
        arrow-up
        18
        ·
        4 months ago

        Slrpnk hosts an XMPP/Jabber for our users, mods and admins to communicate. Its worked pretty darn well for the past couple years, with very low resource needs.

        The clients are pretty slick now too, such as Cheogram or Monocles for mobile, and movim is an excellent web app with support for group calls.

        I’d certainly recommend it over Matrix/element.

          • poVoq@slrpnk.net
            link
            fedilink
            English
            arrow-up
            13
            ·
            4 months ago

            Significant improvements to certificate pinning and validation have been added to all major XMPP clients as a result of this incident, but it should also be clear that hosting a server on infrastructure under control by an antagonist government (see also Signal) is a very bad idea and hard to mitigate against.

            • eleitl@lemmy.zip
              link
              fedilink
              English
              arrow-up
              3
              ·
              4 months ago

              End to end encryption between clients (also for groups) seems to partly address the issue of a bad server. As for self-hosting, any rented or cloud sevices are very vulnerable to an evil maid. So either in-house hosting or locked cages with tamper-proof hardware remain an option.

            • rottingleaf@lemmy.world
              link
              fedilink
              English
              arrow-up
              3
              arrow-down
              1
              ·
              4 months ago

              Signal doesn’t suffer anything worse than DoS if a hostile party controls the central service. That’s its point and role. It’s based on the assumption that such hostile parties as governments don’t like DoS’ing central services, they prefer to be invisible.

              For other points and roles other solutions exist. One can’t make an application covering them all, that never happens.

              Briar again (I’ve finally read on it and installed it, and I love how it works and also the authors’ plans on the future possibilities based on the same protocols, but not for IM, say, there’s an article discussing possibility of RPC over those, which, for example, can give us something like the Web ; I mean, those plans are ambitious and if I want them to succeed so much, I should look for ways to defeat my executive dysfunction and distractions and learn Java). Except it would be cool if it allowed to toss data over untrusted parties, say, now if two Briar users in the same group are not in each other’s range, but there’s a third Briar user not in that group between them, their group won’t synchronize (provided they don’t have Internet connectivity). If one could allow allocating some space for such piggybacked data, or create some mesh routing functionality, then it would become a bit cooler.

          • ProdigalFrog@slrpnk.net
            link
            fedilink
            English
            arrow-up
            5
            ·
            4 months ago

            I’m afraid that’s quite outside my field of expertise. I can only report how my experience on XMPP has been as a user, though perhaps @poVoq@slrpnk.net, who hosts it, may be able to weigh in on that. Edit: ah, I see you already have 😄

            Though from my untrained eye, it seems that Jabber.ru was compromised due to not enabling a particular feature on their server

            “Channel binding” is a feature in XMPP which can detect a MiTM even if the interceptor present a valid certificate. Both the client and the server must support SCRAM PLUS authentication mechanisms for this to work. Unfortunately this was not active on jabber.ru at the time of the attack.

            And it seems that hosting it externally on paid hosting service (hetzner and linode) left them particularly vulnerable to this attack, and tgat it could’ve been mitigated by self hosting the XMPP locally, as well as activating that feature.

      • Telorand@reddthat.com
        link
        fedilink
        English
        arrow-up
        10
        arrow-down
        1
        ·
        4 months ago

        Depends what your goal is. Revolt seems pretty cool, but I don’t think it has any kind of encryption. It is based in Europe, though, so it gets GDPR protection, and it’s open source, so it could be forked to fit other needs and uses.

  • edent@lemmy.world
    link
    fedilink
    English
    arrow-up
    32
    ·
    4 months ago

    I agree with all this. The thing which caused me to uninstall was suddenly being pushed lots of abusive message with disturbing contents.

    When I complained about it, Matrix told me that my public complaints were hurting the ecosystem and I should be quiet.

    • brunoqc@piefed.ca
      link
      fedilink
      English
      arrow-up
      5
      ·
      4 months ago

      When I complained about it, Matrix told me that my public complaints were hurting the ecosystem and I should be quiet.

      Weird. I think they did some improvement to prevent those abusive messages but it took a while and it was embarrassing. Maybe it’s hard to prevent them with a federated network but still, the abusive messages where basically a copy paste.

    • AbnormalHumanBeing@lemmy.abnormalbeings.space
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      1
      ·
      4 months ago

      I had a wild ride with matrix, originally wanting to run a node on my server. That did not turn out well, because I was a bit stupid and just assumed there would be more admin/mod tools out of the box. As it turned out, I had inadvertently allowed spam/abuse accounts on my node without even noticing, because naive as I was, I assumed my admin-level account would get informed of stuff like user registrations and abuse reports in the standard Element frontend. As a bonus, when I checked what was supposedly the official matrix support channel, it was repeatedly getting spammed with CSAM and gore at the time. That was when I realised, that it definitely was not the ecosystem for me, and running a node without experience had been a pretty stupid idea on my end.

  • 2910000@lemmy.world
    link
    fedilink
    English
    arrow-up
    20
    ·
    4 months ago

    I just want a self-hostable open-source alternative to the shitty closed-source IM systems I’m forced to use

    I’m sticking with Matrix for now, hopefully some of the issues I’ve had will get ironed out

  • supermurs@kbin.earth
    link
    fedilink
    arrow-up
    15
    ·
    4 months ago

    For me Matrix is fine, I can use IRC, Whatsapp and Discord with it. But Element is not my cup of tea, especially with Firefox as it doesn’t play any videos other users are sharing. The same videos work fine with Cinny.

    • I can use IRC

      The fact that many Discord and IRC channels (servers?) block Matrix connections has drastically reduced its usefulness for me. When I was running my own Matrix server, I could have gotten around it by using a puppet, but Synapse is such a hog I had to shut it down, and most of the IRC rooms I want to use don’t allow Matrix proxies.

  • sk1nnym1ke@piefed.social
    link
    fedilink
    English
    arrow-up
    9
    ·
    edit-2
    4 months ago

    I am still mad that are no mobile clients that supports multiple accounts. So I am ending up installing for each account a different client.

    Edit: added mobile.

    • cmhe@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      4 months ago

      That is what the author said they switch to, but TBH XMPP also has issues with MFA and messages frequently not being decrypted (using OMEMO) and ‘unencrypted metadata’.

      I wouldn’t say that it works better than Matrix, it just has some different strengths and weaknesses.

      • yessikg@fedia.io
        link
        fedilink
        arrow-up
        1
        ·
        4 months ago

        I haven’t had any issues with it, but it all depends of the client and server

  • Trihilis@ani.social
    link
    fedilink
    English
    arrow-up
    9
    arrow-down
    2
    ·
    4 months ago

    The thing is… What alternatives are there? Signal can’t be trusted (on the very same website there is an article about it). I’m not using closed source alternatives, Simplex is kinda shady too tbh and I’m not even sure I could get anyone to use it.

    I don’t like Matrix/Element either but sadly its the best open source chat solution we have.

  • 0xD@infosec.pub
    link
    fedilink
    English
    arrow-up
    2
    ·
    4 months ago

    https://github.com/matrix-construct/tuwunel

    Plug for tuwunnel.

    Easy to set up, and just works. I can’t share any of the OP’s annoyances - everything is fast. Admittedly, I don’t really use the web client. Just the Android app from F-Droid and the linux AUR package element-desktop.

  • Mio@feddit.nu
    link
    fedilink
    English
    arrow-up
    1
    ·
    4 months ago

    I am glad someone can admit it failed and we have to learn from this. I am just wondering what it takes to succeed.

  • brunoqc@piefed.ca
    link
    fedilink
    English
    arrow-up
    1
    ·
    4 months ago

    I wonder if Keet with every be open sourced. They still are missing a lot of features that I personally find important like trying notification, read receipt.

  • AnimalsDream@slrpnk.net
    link
    fedilink
    English
    arrow-up
    0
    ·
    4 months ago

    We really need to stop abandoning existing foss projects and thinking a whole new thing needs to be invented. Free and open-source software is not a product, it doesn’t abide by the same rules and relationships that proprietary tech does.

    It’s more organic. It’s also a commons that we can continue to draw on, and reshape. If I recall correctly, there were something like three different vector graphic editors from the same codebase before Inkscape managed to be the one that gained traction.

    Matrix isn’t perfect, but abandoning it just to reinvent it all over again just because some people really need a thing that works like Discord, even though Discord is absolute hot garbage; is just going to re-create all the same problems. Matrix today is better than it was two years ago. And Matrix in a year will be better from now.

  • kcweller@feddit.nl
    link
    fedilink
    English
    arrow-up
    1
    arrow-down
    2
    ·
    4 months ago

    I tried it, joined a couple rooms. Wanted to leave those public rooms but I kept getting notifications of rooms I already left.

    Very wonky experience, so I dropped it and I use deltaChat now for my Tech-aware contacts