I've had a few people ask why I didn't post the full Matrix email on my Fedi thread.

[soatok@furry.engineer]

I've had a few people ask why I didn't post the full Matrix email on my Fedi thread. There are two reasons:

1. It wouldn't fit in 1k characters.
2. Listen carefully:

Y'know how "just getting caught cheating on your monogamous partner" isn't the right time to discuss exploring ethical nonmonogamy?

In a similar vein, asking for information while dismissing a report as "no practical security impact" is still dismissing the goddamn report.

I excerpted the part of their email where they dismissed my report. That was the part that initiated the immediate disclosure. The inciting turn of phrase.

It doesn't matter how much you piss on my leg, I'm not going to believe it's raining.

[soatok@furry.engineer]

Matrix has many incentives to lie or mislead. Their leadership includes the CEO of a company whose product is a Matrix client. There's active political talks about the EU investing heavily in Matrix. He's got a vested interest in looking good, even at the expense of doing or even being good.

On the other hand, I have nothing to gain. If everyone switches to Matrix tomorrow, nothing in my life changes. If Matrix self-implodes and everyone goes back to XMPP tomorrow, nothing in my lfie changes.

The only things I want are:

1. End-to-end encryption to be better.
2. End-to-end encryption to become ubiquitous for communication protocols and apps.
3. The large tech companies whose business models involve privacy violations and stealing from artists and other creative workers to burn down so gloriously that society forgets the word "billionaire" in twenty years.

[kirtai@tech.lgbt]

@soatok
You know, it's kinda interesting that Matrix have not once but twice had the kind of security hole that lets outsides decrypt conversations without being detected. And that their reaction to this is to spindoctor it.

It strikes me as the sort of behaviour of a company that has received a court order to open a security hole and a gag order to not talk about it. Especially since they're in the UK which is not exactly known to be crypto friendly.

I have to wonder if the versions they sell to governments have the same flaw or not.