[cuillevel3]

For everyone not reading the post:

> Practically speaking, that means that people and organisations running a Matrix server with open registration must verify the ages of users in countries which require it. Last summer we announced a series of changes to the terms and conditions of the Matrix.org homeserver instance, to ensure UK-based users are handled in alignment with the UK’s Online Safety Act (OSA).

At least you can self-host matrix and messages are end to end encrypted, unlike IRC.

[drnick1]

> Practically speaking, that means that people and organisations running a Matrix server with open registration must verify the ages of users in countries which require it.

Practically speaking, I would just ignore this requirement. The UK government has no jurisdiction on this side of the pond.

[digiown]

Oops your plane had some issue on its way to a different European country and now has to make an emergency landing at Heathrow.

https://en.wikipedia.org/wiki/Ryanair_Flight_4978

[drnick1]

That's assuming UK authorities can even identify who is operating the Matrix instance. At the very least this assumes that a warrant is served to the registrar and/or the owner of the server/VPS in the correct jurisdiction, and that obfuscation measures were not taken by the operator. All of this will probably go nowhere.

[digiown]

I'm sure your server will be fine. Now if you put up a big declaration like that on your website, some bureaucrat might just decide to pick on you when they get the chance like France with Durov.

[ThrowawayTestr]

That's fine if you never intend to visit the UK

[phyzome]

You can try to self-host. Neither Synapse nor Dendrite is in a good state for running a server. I tried Dendrite for a while and it was always playing catchup to Synapse, despite being the supposed successor, and is now not even under development? I can't even tell what's going on over there.

Anyway, my main experience of Matrix is "failed to decrypt message". It's... not great. I wish it were better.

[iknowstuff]

You did it wrong. The correct approach is to flip a coin and let it decide between tuwunel and continuwuity, then self hold that until it dies along with its database format

[LorenzoGood]

Ah yes, tuwunnel, the successor to continuity which is the successor to conduit. All of which have non depricated repositories and recent commits.

[tcfhgj]

> It's... not great. I wish it were better.

Unable to decrypt has improved quite a bit fwiw

[Bender]

unlike IRC

There are a few IRC clients that support OTR. irssi-otr is one [1] weechat-otr is another [2]. Pidgin though I have not used it in a very long time. Hexchat using an always work in progress plugin. There may be others.

OTR could use some updates to include modern ciphers similar to the recent work of OpenSSH but probably good enough for most people.

E2EE aside having chat split up into gazillions of self hosted instances makes it much harder for chat to be hoovered up all in one place. It takes more effort to target each person and that becomes a government scalability issue. Example effort: [3]

[1] - https://github.com/cryptodotis/irssi-otr

[2] - https://github.com/mmb/weechat-otr

[3] - https://archive.ph/4wi5t

[progval]

Links 1 and 2 have not had updates in 10 and 8 years respectively, they probably don't even compile anymore. They implement OTRv3 which was published in about 2005 and uses 1536-bits primes. As far as I know, neither the protocol nor the implementations were audited (and especially not audited recently). This is not good encryption at all.

Additionally, OTRv3 does not allow multiple clients per account, which makes it unusable for anyone who wants to chat from two devices.

[Bender]

I use link [1] all the time. It comes pre-compiled for many Linux distributions but not installed by default. And yeah like I said it needs cipher updates like was recently performed in OpenSSH. HN has a handful of cryptographic nerds that could update OTR in their sleep if they so desired maybe even rewrite in Rust but being cryptographic nerds they probably have no need. If the same is true with cryptographers as is with car mechanics and plumbers they probably only use plain text as mechanics have broken down cars in their yards and some plumbers have old leaky pipes due to burn out.

[queenkjuul]

As a mechanic-minded person, all the broken down junk i plan to fix someday has no bearing on the state of the tools i actually use day to day

(In my case, all the old broken guitar pedals and vintage computers littering my house have no bearing on the state of my workstations and gigging setup)

[1vuio0pswjnm7]

To what is [3] pointing

Why not provide the URL

Some people cannot access archive.today sites

These sites also serve CAPTCHAs. They block users who prefer not to use Javascript for non-interactive www use, e.g., reading documents

[Bender]

Some have reported not being able to browse .ru sites.

The source URL is at the top of the page as is for every archive.{is|ph|today} snapshot.

[notepad0x90]

Those are all opportunistic. being able to talk to anyone secure, even if they haven't setup a special client with special plugins is important.

[kkfx]

IMVHO these days chats serve two purposes:

- notes left there for work, family organization, etc basically things for which an email is "too much" but a small scrap of text seen by some serve the purpose well

- calls, whether audio-only or audio + video

For social use, I see Lemmy or Nostr/Habla more than Matrix. But for all of this, there's a major lack of a single app that is easy go install-able, pip install-able, or cargo build-able without a gazillion dependencies and a thousand setup problems, to the point that most people just choose Docker, using stuff made by others that they know almost nothing about because setting up and maintaining these solutions is just too complex.

[wolvoleo]

IRC is also most commonly used for open servers where anyone can join whenever they want to without as much as needing to register for an 'account'! You just pick a nickname out of thin air and off you go.

In that kind of environment, end to end encryption really doesn't add value.

[cuillevel3]

The IRC admins can read all your messages, be it to a channel or to another user.

Even without registering my nick, I would expect a modern protocol to keep my pm communication private by default.

[direwolf20]

How will you verify who you're talking to?

[bandrami]

You verify identity over the now-encrypted channel, just like SSL should have done 30 years ago but refused to for doctrinal reasons. And in the (frequent) cases where you don't actually care about the other party's identity you just don't verify it at all.

[vonunov]

Are we talking about with OTR? You're meant to verify fingerprints out of band as usual. Without, I guess you check if they've authenticated to nickserv if there are services. Or do your own checks or heuristics.

[Woodi]

Imagine joining IRC channel and all messages are as meanningfull as reading base64 strings aloud aka all are somehow encrypted messages.

Now you can cryptographically check to who you are talking.

No other party can read your plain text.

You can pick any cryptographic property you like future proofing or deniability, etc.

Becouse IRC is just very nice transport.

And clients can be very easily scrypted to encrypt and display just human readable text.

You can even relay messages to wherever you want, HR lady, video player, anywhere.

Try that with Matrix or Discord ;)

[Anon1096]

That is indeed how Matrix works already. And Discord is also doable with https://gitlab.com/An0/SimpleDiscordCrypt

[Woodi]

O, didn't know that. I think I had in mind triviality of adding client-side encryption to IRC messages.

However server side... :) Looked probably twice to hosting Matrix server and Java part was fat no no. And Discord one-click "servers" ? :)

Edit:

Ok, can't find any Java in Matrix servers context... Must be I messed it with Signal server.

[vonunov]

or what