RTC/Riot: warn about media and centralization on matrix.org?

[Mikaela]

Currently the warning links to element-hq/element-web#6779 on the E2EE being experimental.

I think there are other issues that should be mentioned together with it, mainly:

• When we redact events, any mxc content they refer to should be redacted too (SYN-216) matrix-org/synapse#1263 - media never removed
• Neither Try Matrix Now or Clients mention that there are other homeservers than Matrix.org matrix-org/matrix.org#586 - only matrix.org is named, and we should probably address it due to https://github.com/privacytoolsIO/privacytools.io/issues/987
• Options to strip EXIF metadata from media uploads. element-hq/element-web#4426 - exif medata removal (in our previous tracker it was nice to have, but I think it deserves getting up as Discord, Signal and Wire have it)
• 20191011: Allow users to disconnect from an integration manager entirely in the same way that we support doing this for identity servers element-hq/element-web#10696 - allow disabling integration manager entirely

The list is shorter than I thought while I was reading my complaints from #1389, I guess I am over-eager at judging what is a team chat application (with my rare use-case) and what a private chat.

This will likely be resolved by https://github.com/privacytoolsIO/privacytools.io/issues/1377#issuecomment-540152967. Maybe it should go directly to upstream privacy tracker? https://vector-im.github.io/feature-dashboard/#/plan?label=privacy-sprint&repo=vector-im/riot-web&repo=vector-im/riot-ios&repo=vector-im/riot-android&repo=vector-im/riotX-android&repo=matrix-org/matrix-doc&repo=matrix-org/sydent

[jonaharagon]

only matrix.org is named

Notably, other homeservers are somewhat prominently displayed in Riot (which is what we link to, not the two pages in that issue) during registration, at least in a way that makes it clear to the end-user that other homeservers are available IMO.

I don't think these issues warrant warning badges in the same fashion that other warning badges have been implemented, but I do think if we rework the instant messenger page entirely like in #1377 they should be mentioned 👍

[Mikaela]

Notably, other homeservers are somewhat prominently displayed in Riot

Where? I opened riot.im/app and wanted to register and I am offered only matrix.org for free, modular.im for a pay (both by New Vector) or if I am advanced, then I can enter something (what?) by myself.

[dngray]

Where? I opened riot.im/app and wanted to register and I am offered only matrix.org for free, modular.im for a pay (both by New Vector) or if I am advanced, then I can enter something (what?) by myself.

I would say the characterization of this #1395 is disingenuous:

Most email clients don't list every email server you could possibly use.

They have taken a pragmatic approach of suggesting "a server": matrix.org for people to use. You could also purchase a subscription to Modular if you want to use your own domain and cannot be bothered maintaining a server yourself.

This serves to do two things, generate some money for the project, (developers need to eat) and something as complex as Matrix requires full time development. Additionally it provides businesses who may not have their own IT staff a ready-to-go system they can use. Many small businesses rely on SaSS options to minimize costs.

I can see the reason why they may not want to endorse any particular server, that could be due to unknowns about the reliability of their hosting. There is the Hello Matrix project and there are a number of servers on there listed, perhaps we could make a suggestion the user selects one of those?

If I recall correctly XMPP did a similar thing to this with jabber.org.

[dngray]

When making a suggestion of what server to use, this isn't a one size fits all;

We should educate the user to select a choice appropriate to their needs. A server locally close to their origin may provide better performance but may be less desirable if that country has poor privacy protections.

[Mikaela]

I can see the reason why they may not want to endorse any particular server, that could be due to unknowns about the reliability of their hosting. There is the Hello Matrix project and there are a number of servers on there listed, perhaps we could make a suggestion the user selects one of those?

Sure.

If I recall correctly XMPP did a similar thing to this with jabber.org.

I am not aware of any client pointing to jabber.org though.

[ilmaisin]

Can matrix/riot be even considered a privacy tool at all? They seem to promote decentralization, which is great too at least if done properly, but that's not really the same thing. I mean, not only they still haven't got e2ee by default, but until very recently they snooped a lot of data even when the user was using a third-party server.

[Mikaela]

They have imoroved and will hopefully keep on improving and I guess they are important to list as an alternative to Discord.

[dngray]

There is the Hello Matrix project and there are a number of servers on there listed, perhaps we could make a suggestion the user selects one of those?

There is also this list public homeserver list.

[lrq3000]

E2EE by default and cross-signing are being rolled out for 1on1 and private group chats: element-hq/element-web#6779 (comment)