• 0 Posts
  • 10 Comments
Joined 4 years ago
cake
Cake day: June 28th, 2020

help-circle

  • What do you mean? Matrix supports E2EE.

    Its not used with e2ee, is it though? At least it’s not the default and I doubt it can even be enabled.

    So what is the security flaw assuming we weren’t using e2ee to begin with?

    Unless you mean that the simple client should still provide other people that have non-simple clients URL previews, which would only be accomplished if the server generated them.

    Yes, like RSS bots, bridges, webhook-bots etc all can produce links the recipient might want to see previews for.

    Another thing is that e.g. spammers might choose to use a misleading preview. Though I suppose that’s a minor point, probably server-side previews can be tricked as well.


  • What is the security/privacy flaw if the server does it? No point thinking a non-encrypted would be very secret in the first place.

    I guess the idea is that this works with simpler clients as well. Other nessaging networks with initiator-side previews usually have single-provider clients, as far as I know.

    Initiator-generated previews would be a nice feature, though, and they would work with e2ee.





  • Just keeping a single frame buffer image can take tens of megabytes nowadays, so 100MB isn’t all that much. Also 64-bit can easily double the memory consumption, given how pointer-happy the ELISP data structures can be (this is somewhat based on my assumptions, I don’t actually know the memory layouts of the different Emacs data structures ;)).

    But I don’t truly know, though. If I start a terminal-only Emacs without any additional lisp code it takes “only” 59232 kilobytes of resident memory. Still more than I’d expect. I’d expect something like 2 MB. But I’ll survive.




  • One other thing is that you can bulk create your own instances, and that’s a lot more effort to defederate. People could be creating those instances right now and just start using them after a year; at least they have incurred some costs during that…

    I believe abuse management in openly federated systems (e.g. Lemmy, Mastodon, Matrix) is still an unsolved problem. I doubt good solutions will arrive before they become popular enough to attract commercial spammers.