For what its worth, open source is en vogue in german government IT at the moment. "Dataport", a government-owned IT-company, has an open-source based project "Phoenix", as a first step in this shift of paradigm. This is interesting because Dataport used to be pretty much a windows-shop; despite old and established hierarchies and its special place in the public domain, change is happening.

(Source: I'm working in that project as a consultant)

Please keep it that way! We need open source in government - it's the only way to hold people accountable and make sure that citizens aren't being shafted :)

Thanks for your work!

Independently of gematik's work, Phoenix also uses Matrix as its communication backplane (source: the Matrix team is also consulting on it :)

I've had the pleasure of working with Ben for a while, cheers from team mav! Wearing my matrix hoodie writing this :)

Can you get a Matrix hoodie without working on Matrix? :D

https://shop.matrix.org :D

(and yay for Ben - he gets everywhere!)

Thank you so much!

Isn't Phoenix merely rebranding already existing projects like Jitsi Meet and matrix.org?

If not, where can this project be publicly inspected?

This is why I made the distinction "open-source based". The project isn't simply rebranding though, it builds solutions for customers based on open source components (which is a step in the correct direction). I would like all the repositories to be public, too, but we're not there yet.

I saw on phoenix-werkstatt.de that there are actual contributions back upstream. Even if it appears to not be a Dataport employee, at least some of the funds of the government are going towards improving the projects for everyone. Good stuff.

Unfortunately, at the moment even code access for other public institutions is buried behind many layers of bureaucracy but I have been promised they will start to open up soon enough.

Well, they could still have opted for something proprietary, weird and broken. See for example the De-Mail desaster[0] and the beA desaster[1]. Both supposedly better and secure email/messenger replacements with huge problems like lacking end-to-end encryption, design problems, laughably lacking security, high cost, low adoption (except were required by law), no usability, etc.

I'm really glad that at least someone here might have learned from those mistakes.

[0] https://de.wikipedia.org/wiki/De-Mail https://netzpolitik.org/2015/de-mail-das-tote-pferd-wird-wei...

[1] https://de.wikipedia.org/wiki/Besonderes_elektronisches_Anwa...

Didn't they force a backdoor on tutanota e2ee? Why do they suddenly allow matrix?

E2EE isn't forbidden per se. But if you are a public communication provider over a certain size you need to provide access upon request if technically possible. It isn't really clear even in the case of Tutanota if they fall into that regulation, however, they had to preliminarily comply anyways: https://www.heise.de/news/Gericht-zwingt-Mailprovider-Tutano...

Healthcare providers operating a Matrix server won't be communication providers to the public, and if they aren't using a web client or some similar crap, breaking E2EE won't be possible. Webmail providers claiming E2EE like Tutanota are imho liars anyways, because Javascript on a website isn't a secure "end" for the encryption.

So use client software that isn't attacker controlled easily, keep your keys private, only encrypt to trustworthy keys and you'll be fine. Matrix ticks all those boxes if you don't use the web client. And the only legal way in for German law enforcement would be to infect your device with some trojan ("Bundestrojaner", like e.g. NSO Pegasus).

German government IT is far removed from being a monolithic entity. There are a lot of different actors involved with different priorities.

In this case law enforcement can simply request the data (as long as such a request is legal) at either end. No need to attack the connection in between.

I wouldn't be surprised if this flew under the radar of the people at the top.

> Secretary: "IT said we should use matrix".

> Minister: "Whatever. I'm busy with other things. Do I need to sign something?"

It's the opposite, actually - it seems to be the Ministers and establishment pushing it. e.g:

> [Bundesdatenschutzbeauftragte Ulrich] Kelber verweist auf die Entwicklungen in Frankreich. Dort wird eine Whatsappalternative auf Basis des Open-Source-Team-Messengers Matrix und dessen Client Riot entwickelt. In Frankreich "geht man aktuell einen hervorragenden Weg, um sich aus der faktisch in weiten Bereichen der Verwaltung bestehenden Abhängigkeit von Produkten großer amerikanischer IT-Firmen zu lösen", sagte Kleber.

or in English:

> Federal Data Protection Officer, Ulrich Kelber refers to the developments in France. A Whatsapp alternative based on the open source team messenger Matrix and its client Riot is being developed there. In France, "there is currently an excellent way to free oneself from the fact that many areas of administration are actually dependent on the products of large American IT companies," said Kleber.

from https://www.golem.de/news/whatsapp-matrix-oder-xmpp-bmi-such...

Ulrich Kelber may be the coolest higher german official, but he keeps complaining about not being listened to (on Mastodon, in meme form).

I tend to think the political machinery isn’t afraid of proprietary/monopoly dependency in general, the issue is rather with those companies not being domestic.

A shift to open source is sanctioned from the very top. For example, in the area of OZG (broad digital access to public services, coming soon) the explicit decision is (my translation):

> Open standards must be used in the implementation and operation of digital offerings. The source code from the realization of digital offerings by the administration (in-house development) is made available as open source, i.e., in reusable form, wherever possible. https://www.it-planungsrat.de/fileadmin/beschluesse/2020/Bes...

They are also starting a project to host public, open source code which is backed by the federal CIO and many state and local governments: https://www.cio.bund.de/SharedDocs/Kurzmeldungen/DE/2021/pm_...

This is not something sneaked in by some techies. Every decision maker is probably aware by now what "open source" means.

they could have opted for XMPP, which is clearly a better and more mature alternative.

It sounds like they are going to end up with their own standard starting from Matrix as a base that will do more than just messaging.

If they had of just set up XMPP as a messaging system we would of never heard of it. It would of been an entirely routine thing to do.

What experience in the field do you have implementing or managing Matrix or XMPP solutions?

I used to run an XMPP server (Prosody). I now run a Matrix server (Synapse - the one everyone uses).

Synapse feels like a bloated monster that I'm afraid to touch in case it goes bang and I can't recover.

Prosody felt like a simple light weight service that I could easily recover no matter how much I broke it.

Synapse is indeed very bad but it should by replaced soonish

Hopefully with a simple migration path

This isn't necessarily an endorsement of one protocol/ecosystem over the other, nor do I have direct experience with integrating Matrix or XMPP (though I run the latter on my home-server for family), but XMPP has seen a few large deployments, including in healthcare (in the UK)[0][1] and in Germany[2].

The consumer-facing client ecosystem for XMPP has indeed seen less rapid development than Matrix (the latter probably benefits from a more cohesive approach), but the server ecosystem for XMPP is very mature, and servers such as Ejabberd are known to scale to hundreds of thousands of connections on a single, modest host[3]. Obviously, that's only one part of the puzzle, hence why Matrix was chosen here.

Still, it'd be interesting to see how the two evolve and compare down the line.

[0]: https://www.erlang-solutions.com/case-studies/pando-health-c... [1]: https://medium.com/miquido/successful-migration-to-a-custom-... [2]: https://twitter.com/iNPUTmice/status/1203611711967813633 [3]: https://www.process-one.net/blog/ejabberd-nintendo-switch-np...

Does the development of an XMPP client with a few million downloads count as sufficient experience in the field?

Hey, why not IRC?

It's also the IETF Internet standard and does not collect venture capital.

Matrix is looked after the Matrix.org Foundation which is non-profit and doesn't collect venture capital either: https://matrix.org/foundation.

(It's true that many contributions to Matrix come from Element, though, the VC-funded for-profit founded by the original Matrix team in order to pay for us to keep the lights on and keep working on Matrix. Just as VC-funded Jabber Inc contributed massively to XMPP, back in the day).

I’m working on a project management app for small businesses using Matrix. I’ve been inspired by your work and the transparency with which the team operates and the business model you have pursued and succeeded at. I’m also stunned by the technology recently being deployed in Dendrite.

Is one of the best ways to support Matrix and grow the influence to hire Element’s team as consultants to build custom implementations and use cases?