[sneak]

> I'm puzzled by this comment. Can you elaborate on what you mean by phoning home?

On first launch, it connects to multiple centralized servers before you have a chance to select your homeserver.

The issue was with the default client, in the default config.

Not sure if it's still happening, but it was concerning enough that it happened in the first place.

https://github.com/vector-im/element-web/issues/13942

https://github.com/vector-im/element-web/issues/12712

https://github.com/vector-im/element-web/issues/11655

https://github.com/vector-im/element-web/issues/11655#issuec...

It would also appear that it intends to maintain a Solarwinds-style remote code execution vulnerability on the machine on which it is installed:

https://github.com/vector-im/element-web/issues/11655#issuec...

[Arathorn]

As per my comment at https://github.com/vector-im/element-web/issues/11655#issuec..., we'll switch auto-update checks to require user confirmation.

[HotHotLava]

Did you maybe post the wrong link?

The comment you're linking to says that there are no current plans to change the default request to matrix.org from the login page, and that you explicitly plan to keep the current auto-updating behavior.

(also, of course "we will fix that" implies that it is currently still broken, which is what the original commenter was pointing out)

[Arathorn]

The comment i linked is me saying:

> we're going to fix this, and yes, imo, autoupdates need an opt-in.

i'm not sure how clearer i can be.

[HotHotLava]

The comment you linked says:

> As should be pretty clear from #11655 (comment), we're going to fix this, and yes, imo, autoupdates need an opt-in.

The comment #11655 says:

> Auto-updating for default Riot distributions will continue as before to ensure security fixes are delivered quickly

So at this point already it becomes unclear to the reader which of these has precedence.

So, assuming you're asking in good faith, if you wanted to be clearer you should have written something like:

"*Despite* what's written #11655 (comment), I disagree with the product teams assessment and think autoupdates need an opt-in, therefore I will make sure this is implemented."

(not sure if the content is 100% what you wanted to express in the comment, but you get the idea)

[sneak]

When can I install and run a matrix client without it connecting to you? I want to use your software but want to self-host it and not use any services whatsoever from your organization.