dessalines@lemmy.ml 2 years ago
You can "trust" it, because its self hostable, and buildable from source, unlike other not self hostable services. Its origins and funding are important, but less so because of those two attributes.
The metadata leaking is a problem with every federated system, xmpp included. You could even call the metadata leaking a feature, not a bug, since its what makes federation possible.
Whats important is that the metadata being leaked, isn't linked to your identity, unlike with signal. Matrix doesn't require phone numbers, or emails to sign up.
The cloudflare concerns aren't an issue as long as you run your own instance, or join one that doesn't use cloudflare. There's nothing requiring cloudflare built into the software or the protocol.
The metadata leaking is a problem with every federated system, xmpp included. You could even call the metadata leaking a feature, not a bug, since its what makes federation possible.
The problem is not mainly the leaking metadata, but that the Matrix protocol is designed to indefinitely store and freely share this metadata with every home-server joining (which even gets a full copy of everything retro-actively). XMPP does not do this.
How does xmpp not store information about federated users joining a room?
XMPP only does this on the single server the room resides on and does not share this info with other participating servers except for the bare minimum needed to show the user's nick names.
I recommend you hosting your own Matrix home server and after joining a few rooms look at your database what kind of historical metadata ends up on your new server. It's honestly appalling from a privacy point of view.
Yes this is needed for room persistence across multiple servers, but IMHO that is a solution looking for a problem and IMHO also a highly over-engineered one.
There's ongoing work to encrypt the metadata too. https://github.com/matrix-org/matrix-doc/pull/3414
Yes this is needed for room persistence across multiple servers, but IMHO that is a solution looking for a problem and also a highly over-engineered one.
Without this solution the transition to p2p would be much more complicated, would it not?
coconuteclair@lemmy.ml 2 years ago
Yeah, but the vast majority of non-technical users don't bother to change homeservers, or even clients, so it could affect them. What puzzles me is why the Matrix/Element team chose Cloudflare for app.element.io, (matrix.org uses LetsEncrypt), when CF aims to centralize the web and is a privacy nightmare. It's more of an ethics thing, in my opinon. But sure, like I mentioned too, could be solved by switching homeservers/clients but the vast majority of users won't bother.
dessalines@lemmy.ml 2 years ago
I understand it even though I also hate cloudflare, as ddos attacks are extremely difficult to thwart otherwise. But of course it stands that nothing in the code of any of the homeservers, apps, or protocol requires cloudflare.