[Sanzig]

Let's not forget the shock image spam issue. Public Matrix channels are plagued with horrendous shock images (including CSAM). The development team seems to not care, they have a proposal for "policy servers" which is still incomplete and not supported by all server implementations.

[teekert]

Let's not forget a team making a great free product. Yeah we can complain about filthy materials but imagine you working hard to build something as nice as Matrix/Element only for these low-lifes to do these horrible things to it. How annoying it must be to have to spend time battling such things.

[Aurornis]

> Let's not forget a team making a great free product.

I am fully appreciative of the work that goes into making a product like this, but I’m also tired of this mentality that nobody is allowed to talk about the problems with the product. Even simple comments from people who tried to use the product but encountered show-stopping issues are getting downvoted into gray text in this thread.

This mentality that we must only speak praise and cannot speak of problems because a product is free is further off putting. I’ve given Matrix/Element an honest try many times because some of the OSS projects I’m involved with use it, but month after month it’s the most troublesome of all of the apps in this space that I use, and it’s not even close. If I’ve gone a month without dealing with Matrix and I have to open it again it feels like there’s a 50:50 chance something is going to either be inexplicably broken or cause problems even though I thought I finally had it all working last time.

The contrast between how hard we’re told that Matrix is the great and superior option and the reality of what it’s like to use it as a casual or occasional user is really wearing me out on the project.

[eredengrin]

> I’m also tired of this mentality that nobody is allowed to talk about the problems with the product

I think there's a pretty big difference between constructive criticism vs statements like "The development team seems to not care". To me, it seems pretty clear that the team absolutely cares, but they are also a small and very underfunded team, and things take time. Assuming the worst intentions of a team is the problem and is disappointing to see here.

> I’ve given Matrix/Element an honest try many times because some of the OSS projects I’m involved with use it, but month after month it’s the most troublesome of all of the apps in this space that I use, and it’s not even close.

I don't doubt that, but it does not resonate with me. There have been a few hiccups over the years, eg the database corruption earlier this year (unrelated to the protocol or synapse) resulting in stuck invites, but overall I've had quite a good experience. Far less problems than Teams, and even slack has had issues (mainly, notifications not happening) that I have somehow avoided with Element, although I am aware others have had issues in this area. There are even some things I do with matrix that are simply not possible/practical with the others to begin with.

[jacquesm]

It is super annoying but you have to be very naive to not understand that anything that can be abused will be abused so you need to bake in countermeasures from day #1 or you might as well not bother with the launch.

[teekert]

Aren't there any moderators in those channels? I have 0 issues in the channels I am in (some podcasting channels, some tech, some FOSDEM.)

I find a lot of value in Element as is, I'm glad they bothered.

[Saris]

A lot of the spam I got was from being sent room invites, and the room names were really nasty stuff. And their client doesnt let you mass delete invites, I tried to do it one at a time but gave up and deleted the account instead.

Their server clearly doesnt care that a single federated server was sending out thousands of invites, and there's no way to avoid the spam.

In general using matrix was always a pain in the rear for one reason or another.

[tcfhgj]

with that strategy you won't launch ever if you have limited budget, especially because Matrix isn't exactly a system/protocol off the self

[wkat4242]

It's free for us but not for businesses. I think this is why they are ruining the UX, because they're adapting it to their target market, like making it more like MS Teams.

[gmerc]

A product as unsuitable for the adversarial internet as ChatGPT and coding agents

[whatevaa]

If you make anything public, you will have to deal with it. You should be mentally prepared for that from the start.

[kldg]

in defense of this comment, you do need to do a heck of a lot of preparation (including psychologically) to do anything publicly anymore. wild west days are long gone, at least for US-based servers. I spend a lot of time thinking about how to stop users from interacting too freely, to censor and moderate them so I don't wind up on some news site in 20 years being accused of hosting a site *Widely Used* by pedophilic narcoterror jihadists; I would like to not, but user content (and especially their information) is a huge liability to host... unless you're Equifax or Facebook or Google or some other large corporation -- then you can accidentally dump out everyone's sensitive financial information and only pay them $9 in compensation (or whatever the amount was; I keep throwing the cards they send me in the trash).

(yes I'm salty about that still)

[johnisgood]

I mean I could just as easily say you as an user should be mentally prepared.

Matrix is developing a privacy IM, you do not really moderate that now, do you? Leave the rooms that raise your cortisol level.

[Teever]

Wait a minute, doesn't receiving child porn even if unintentionally like the situation above open up the receiver to legal liability?

It isn't reasonable to expect users to be 'mentally prepared' to have their devices download child porn because they visited a chat room for support about the chat app they're using.

[johnisgood]

As someone else have said, then that is an issue with the law.

Imagine someone sending you a link that you open and then now you have child porn or whatever else on your hard drive, cached. Quite a shitty situation to be in.

Perhaps avoid non-technical rooms or rooms in which you do not trust people.

[lukan]

"Imagine someone sending you a link that you open and then now you have child porn or whatever else on your hard drive, cached. Quite a shitty situation to be in."

I guess the correct legal approach would be to go to police with this.

And the correct technical approach to keep online spaces clean, is the ability to kick, mute or ban people who violate the rules.

Saying, "just be mentally prepared" sounds to me like accepting it. Well, I don't. I go somewhere else.

[gosub100]

And then imagine you have windows with recall enabled (that you repeatedly disabled but keeps enabling after updates), and/or cloud backup with automatic CSAM detection. You're screwed

[Teever]

The issue with the law could be rectified and I'd still be in a scenario where I'm exposed to hideous child pornography when I wake up and check my phone messages with bleary eyes because I'm a member of an official support channel for Matrix.

This is unacceptable.

[jasonvorhe]

I don't know. I've read of this alleged nightmare scenario in hundreds of forum posts, mailing lists and threads and it's not something that's actually being followed up on in any capacity. The opposite is the case in that law enforcement doesn't have the resources to get as many perpetrators as they would like to. They're not going to raid your home because you idled in a channel that got spammed or because you received and email or because some service you hosted briefly cached a csam jpg on disk. If you've made political enemies and are under observation already than perhaps this might work as a way in but even then it would be easier to just do something illegal and construct the evidence to point to another cause.

I mean, when does this actually end up with consequences for anyone? Even on managed and surveilled company devices I'm not expecting this to cause any harm to anyone involved. IT staff at previous employers and clients had other things to worry about.

Maybe I'm just not familiar with some legal jurisdictions or cases where this was a cause of concern. Let me know.

[tcfhgj]

I'd blame the law if it does.

[jacquesm]

> I mean I could just as easily say you as an user should be mentally prepared.

Users tend to be less aware of these things than the operators of such servers (or at least, that's how it should be).

> Matrix is developing a privacy IM, you do not really moderate that now, do you?

No, but you can create mechanisms for the users to flag problematic accounts.

> Leave the rooms that raise your cortisol level.

The filth will follow the users. That's the whole game plan here: to cause grief.

[johnisgood]

I have been in many rooms that are completely fine; technical rooms.

As for flagging problematic accounts: how would that work in a decentralized E2EE system, and do you think it cannot be abused? What would you want them to do if I flag your account a million times? Keep in mind they probably may not be able to keep up with it, nor do I expect them to. Additionally, you still should be able to use the service due to its decentralized, privacy-preserving nature, so the worst thing that may happen is getting banned from a Matrix instance, or a room.

[jasonvorhe]

It's not just their servers, it's the architecture, the difficulties in self hosting, the meh origins of protocol, the resource hogging official clients, multiple implementations with differing protocol support. It's just a mess and I've given up on it this year.

[BrenBarn]

It's kind of wild to me that they haven't prioritized this more. This issue has been open for almost exactly 6 years: https://github.com/matrix-org/matrix-spec/issues/565 . This one even longer: https://github.com/matrix-org/matrix-spec/issues/836 . The Matrix permission system still doesn't even have a way to say "sending images is not allowed" (either per room or per user).

[tcfhgj]

maybe because of limited budget and more urgent issues? who knows

[chrisjj]

And what could be more urgent than this?

[Arathorn]

building a more flexible solution for blocking content, rather than hardcoded rules like "no images": https://matrix.org/blog/2025/04/introducing-policy-servers/

[Teever]

Is there something fundamental to the matrix architecture and permissions system that makes it impossible or difficult to allow room/server operators the ability to limit certain users from posting multimedia content?

[tcfhgj]

having a usable technical foundation, staying financially afloat

[joecool1029]

It’s terrible. I had to leave most channels on the matrix.org namespace because they won’t properly moderate their own server from CSAM. I dropped to 7 day media retention to lower legal liability on my own server, since there’s no way to know when one of my users will be in a channel hit with abuse.

At this point the majority use case I have for matrix is to bridge to IRC with heisenbridge and be able to use signal on my laptop through mautrix-signal and nheko. The number of native channels I’m in continues to shrink.

[mystraline]

I know the matrix honeserver I use has taken our recommendations to NOT cache images from matrix.org due to their non-existent moderation. And the admin put out a bulletin to also recommend disable downloading images as well.

There's also the split room bug (feature?) that allows banned users to still be in rooms where the honeserver doesnt ban them. And then, distributes connection shows ongoing banned content (primarily, you guessed it, CSAM) and the better-moderating admins can't do anything about it.

I'm basically in a few well moderated rooms (Gnuradio, other topics). They do extraordinarily well in not getting many trolls, and for garbage collection.

The only one we're seeing spammed is for some cryptocurrency site Liquid something. But its just commercial spam.

[indolering]

Have they done anything to mitigate this? Like client side filters or message scanning for new direct messages?

[Arathorn]

The main things are https://matrix.org/blog/2025/04/introducing-policy-servers/ (for flexible serverside moderation) and the rest of the stuff in https://matrix.org/blog/2025/02/building-a-safer-matrix/. Clientside filters already existed, but given they only apply per client and there are a lot of different clients, we focused on serverside filtering.

[BrenBarn]

What are the plans to improve the moderation experience for room admins who do not run their own server (of any kind)?

[irusensei]

Considering the thread context I'm curious how would IRC help with that other than people running command line or TUI clients?

Also do you want the development team to moderate self hosted chat servers? How would that work?

[Macha]

Must irc clients do not automatically download or show images which means joining a room and spamming a bunch of them is less impactful on recipients and so less appealing to trolls, so it doesn’t happen.

[Saris]

The image spam I got was on their official server.

[selfmodruntime]

I still can not blacklist homeservers by domain instead of ever changing IPs. Great stuff.

[tcfhgj]

policy servers show that they indeed do care