You're taking a new thing and assuming it's the same forever. His point was that upgrading all clients/servers on a federated network is difficult/impossible and you end up with compatibility issues.

Matrix/Riot is too new to have those, they have never deprecated a cipher yet.

While I love Signal for its simplicity and Matrix/Riot for its features. I regularly train high risk activists/journalists/aid workers on both and they always default to Signal. Matrix unfortunately suffers because it has too many features - and by far the biggest one we hear about is key exchange. I love the granular options but the vast majority of people just looking to communicate don't.

I'm going to be working on some UX improvements to Matrix/Riot and agree with you on feature bloat, or at least hiding complexity for most users.

Would love to have a chat with you about the issues the people you train have come across with Matrix

Cool. Hit me up on the mail in my bio! :)

We have a matrix chatroom for three colleagues. The list of keys and devices we have to verify against each other does not fit anyone's screen, it is insane.

> His point was that upgrading all clients/servers on a federated network is difficult/impossible and you end up with compatibility issues.

I think that he exaggerates the problem. Right now, it's possible for someone to install the Signal client, and then never upgrade it: the Signal servers must have a way, eventually, to refuse service to that client (upon which it will receive a message from the server stating something to the effect of 'your client is too outdated; please update it').

With a federated system, eventually some servers will be so out of date that other servers will refuse service to them. They'll have to send a message to those servers to the effect of 'you are too outdated; please update yourself'; the server can forward that message to its administrator. The clients of such servers might also receive a message stating 'your server is too outdated; please ask your administrator to upgrade or switch servers.'

A similar pattern exists with respect to client updates in a federated network.

Moxie's just wrong on this, I think: it's not significantly worse; the pattern with federation is very similar to the pattern with centralisation; and there are real benefits to federation & decentralisation.

If we are going to make the argument that updating all servers and clients on a federated network to follow the latest and securest crypto is a big issue, we also have to pull the argument that the crypto of a non-federated network can be manipulated at any time without your consent.

In other words, you are at the mercy of whoever owns the chat platform. To me, this is a bigger privacy issue than the issue with updating servers/clients on a non-federated network.