Hacker Newsnew | past | comments | ask | show | jobs | submit | dotdi's commentslogin

The funny part is that I never heard a professional tell me I should use WD40 for a specific task. It's been developed for (W)ater (D)isplacement, it's really good for that; and it's passable at other tasks too. For DIYers, it's fine.

For professional use-cases, targeted products are preferred, whether they be lubricants, penetrating oils, rust remover, etc.


> We move money, so mistakes are costly and quality is contractually non-negotiable. We build on a twelve-year-old monorepo with structural bottlenecks: bloated test suites, manual code review, unstable CI, and deploy infrastructure not made for the pace we need.

In my experience, each single item on this list already is a major hurdle for AI agents. The unholy union of all of them together is something I couldn't personally be responsible for - period.

Working on that codebase - I'm sure - is already difficult and often frustrating. Having a horde of short-term-memory-only agents without any real institutional knowledge is a recipe for disaster. I'm sure the rollout looks great on paper, and long-term effects are - conveniently - not the scope of this article.


I read a moderate amount I'd say, about 2 weeks average for a book, and I was using a very old and very beat-up but still functioning 4th gen Kindle until recently.

However, I woke up from my stupor when Micro$oft's eBook store closed and purged their library from under everybodies butts. Giving Amazon complete control over my library is a horrible thought, so I'm out.

I am now a happy Boox Go 10.3 + BookFusion user. Crisp screen, great battery life, full android with play store underneath. It syncs to my phone, has most of the bells and whistles I need in terms of reading, and it supports writing handwritten notes (albeit not onto the ebook itself; that's apparently too sci-fi even for 2026), and Bookfusion can sync notes into Obisidian vaults via an Obsidian plugin. I feel in control. I buy books from alternative sites with either no DRM to begin with, or where I'm confident I can remove it. Bookfusion costs me 20EUR a year.

I'm fairly happy with my setup.

EDIT: yes, I'm aware Boox are not the good guys in this story. I have not signed up to any of their services - the device is perfectly usable without that. I turned their book shop off immediately, and I do monitor+block the Chinese IPs it's trying to reach on my router.


Note that Boox does not release the sources for the GPL software they redistribute.

Its obsolete anyway.

Important bit of information is further down in the article: OnlyOffice is Russian. I would therefore view any collaboration as a risk. It's not adequate for strategic reasons as well as sovereignty.


If you need Docx compatibility to interface with the rest of the world, are you better off with the at-least open source option or the sign-your-life-in-eula-and-O365-subscription option.

This isn't rhetorical. I don't know which is worse. I lean disliking Microsoft more, because jazz hands at Windows11, and OnlyOffice at least runs on Linux, but it's still not a fun position to be in.

LibreOffice and other alts definitely don't have as good of Docx compat.


Not sure why you were downvoted; it's quite possible that Nextcloud was more concerned about the political independence/potential sanctions aspect.


Several ideas from this blog post are factually wrong.

Additionally, I cannot confirm the more subjective ideas - and I've been running Macbooks for almost 20 years, and specifically working with Python both for hobby, for research, professionally, for cybersecurity, etc.

I have an old 2013 laptop that is the "couch machine". It still works adequately. No issues with sleep/wake. Time machine outlasted the external HDD it was running on. I am writing this on an M1 Max, which will be 5 years old this year, and I hope I get 5 more years, it's just that good.


Yeah - the sleep/wake one is crazy to me. I have had numerous mac's and windows machines over the last 20 years as well and Sleep/Wake has been perfectly consistent on the mac. In 2026 on year old hardware from Microsoft (Surface Pro) I have regular issues with waking from sleep, or more commonly, the battery will just be completely dead in the morning when it had a full charge the night before.

The python complaint I get, but it is because they ship an old python version with the OS and you have to work around that to install a different version.

Security settings can be set via the Settings app and don't require the terminal like the author stated. They can be changed via the terminal, but the golden path is just tapping a button in settings to allow the unauthorized app and typing in your password. Granted - it isn't obvious, and I only know this because over the years as notarization was added the dialogs became slowly less helpful in guiding you to the right spot, I think now in Tahoe they don't even make a mention of where you should go to allow it.


My work MacBook pro refused to wake from sleep exactly as described in the article on average twice per week until i convinced my boss to buy me a PC


> I have an old 2013 laptop that is the "couch machine". It still works adequately.

Sure, because it is from when Apple still was good.

I am writing this right now on a 2014 Mac Mini (running 10.13). Works perfect! Great machine.

The newer stuff, not so much.

I have a 2021 15"? MacBook Pro, highest end very expensive, where the battery randomly goes into rundown and drains in no time, some days it is fine. This one also can't sleep, so must do a full shutdown if I need to close the lid for more than ~10 minutes. If I close it and put it on my backpack for longer, it heats up like an oven and drains the battery. The USBC ports only work half the time at best. It's been like this since 2023, so it really only lasted two years.

I have a 2022 13" MacBook Pro where the screen is completely dead and the trackpad no longer clicks. Using it as a desktop with an external monitor and mouse, but what a disappointment. Made the mistake of buying it without Apple Care shakedown money, so can't be fixed. (Apple wanted ~$1500 to fix it, obviously not worth it).

I have a 2023 MacBook Air which is my current portable. Works ok for now, but the USBC ports are super flaky. External monitors work on a whim, sometimes, or not, which is massively annoying.

Apple quality is just pretty terrible in the 2020s. When this MacMini dies, I'm going back to a Linux desktop.


The last time my Time Machine backup was corrupt was in 2013 when I was writing to a SMB share over a PPTP VPN through a 4G connection. I don’t blame Apple for my own crappy infrastructure, corruption was bound to happen.


I guess this image generation feature should never have been continvoucly morged back into their slop machine


The real story here is not how stupid the responses are - it's to show that on a question that even a young child can adequately answer, it chokes.

Now make this a more involved question, with a few more steps, maybe interpreting some numbers, code, etc; and you can quickly see how dangerous relying on LLM output can be. Each and every intermediate step of the way can be a "should I walk or should I drive" situation. And then the step that before that can be one too. Turtles all the way down, so to say.

I don't question that (coding) LLMs have started to be useful in my day-to-day work around the time Opus 4.5 was released. I'm a paying customer. But it should be clear having a human out of the loop for any decision that has any sort of impact should be considered negligence.


I think models don't treat is as riddle, rather a practical question. With latter, it makes sense that car is already at the car wash, otherwise the question makes no sense.

EDIT: framed the question as a riddle and all models except for Llama 4 Scout failed anyway.


> And what's happening at CISA right now should terrify every American who depends on running water, electricity, and the ability to vote in free elections.

The answer is right at the beginning. Current administration has the explicit goal to not have free elections going forward. It has been stated plainly, on TV. The rest is collateral damage, and an attack on critical infrastructure will be a good excuse to invade the next country, declare state of emergency or outright war and get rid of elections completely.


"You will only have to vote once more. Then we'll fix it"


Apparently that's where you stopped reading. If you continue reading, with a little be of logical reasoning and comprehension, you will learn that Plankey has been nominated by Trump, has bipartisan support, and even that Trump started the CISA agency. The only thing holding it up are 2 republicans and 1 democrat over some contract that probably has something to do with their buddies getting some contract deal. This isn't about "this administration", it's about your everyday political favors behind closed doors that has been happening since governments have been a thing.


That doesn't account for the ~1,000 employees being gutted from the agency and leaving a maliciously incompetent acting director in place. Both of which are directly caused by the current admin and won't be remedied by Plankey getting a confirmation, possibly for years.


For what it’s worth CISA built upon previous work in the DHS (basically rebranded NPPD as CISA) which evolved from NCSD which itself merged NCS and other cybersecurity teams in the wake of 9/11. America has been doing cybersecurity longer than any other country I think but presenting a rebranding as somehow something Trump is leading the charge on is a weird take.


[flagged]


> You really thing the adminstration's goal is for Americans to not have running water & electricity,

Their goal is to stay in power at all costs. Again, they themselves have stated this plainly enough.

If there is collateral damage to the American people as a consequence of their ambition, well, that's a sacrifice they are willing to make.


> Their goal is to stay in power at all costs.

How, then, do you explain their frequent retreat, e.g. on ICE, on tariffs, etc.?

I think they are pushing very very hard on many fronts, but even they are limited by what Americans will allow and we see it as they fret and adjust when there’s strong pushback.


> even they are limited by what Americans will allow and we see it as they fret and adjust when there’s strong pushback.

But that doesn't change their goal. They have openly stated what they want, the fact that courts have sometimes intervened or that fig leaves have been given doesn't change the long-term goal.

Were they retreating on ICE when they said they want them at polling stations? It seems like an escalation to me.


> But that doesn't change their goal.

OK, let's assume that.

Goal is one thing. How far they're willing and able to go (and hence be effective in getting that goal) is a different matter. That's my argument.

The current adminitration has shown that their ego (adoration) is a limiting factor in what they're willing to do for power.

To wit, top Republicans warn GOP will face midterm election ‘bloodbath’. Why bother caring? Is it just political theater?


Here’s a recent example of him stating the lack of need for elections:

“He boasted that he had accomplished so much that ‘when you think of it, we shouldn't even have an election.‘“

https://www.reuters.com/world/us/five-takeaways-reuters-inte...


But you left out:

The president expressed frustration that his Republican Party could lose control of the U.S. House of Representatives or the Senate in this year’s midterm elections, citing historical trends that have seen the party in power lose seats in the second year of a presidency.

“It's some deep psychological thing, but when you win the presidency, you don't win the midterms,” Trump said. He boasted that he had accomplished so much that “when you think of it, we shouldn't even have an election.”

There's a difference between what he believes or wishes for and what you know the reality. He is self-aware enough to know that Americans will only put up with so much. When you look at his rhetoric in totality and actions, you quickly realize he is paying attention to where the voter is and knows that he cannot do just whatever he wants, no matter what he might wish for.


Re-read what you wrote. Nothing you said helps your point. We are talking about his desires. And yes, he’s not a complete idiot - of course he realizes that he can’t implement whatever he wants to right now. But his stated and implied desire is to end elections, which is the point of this thread.


> But his stated and implied desire is to end elections, which is the point of this thread.

We're debating two different things. I'm arguing that the adminstration's goal is not to get absolute power no matter the cost. The thread started because I pushed back agains the assertion that the administration is willing to inflict unlimited pain on Americans (no electricity, no water) to get and maintain power. The evidence points in the other direction.

You, and others, have latched narrowly on "goal".


> the assertion that the administration is willing to inflict unlimited pain on Americans (no electricity, no water) to get and maintain power.

The assertion was that the administration is ok with collateral damage that might further their stated goals. Did anyone use the term "unlimited pain on Americans" or just you?

You latched narrowly on "American who depends on running water, electricity" and turned it into them doing things "no matter the cost." Nobody was making that argument. The entire country doesn't even run on the same water or electricity services. It's a made up scenario you created to paint the people using the President's own words as overreacting.


> the administration is willing to inflict unlimited pain on Americans (no electricity, no water) to get and maintain power.

You haven't done anything to cast doubt on this premise. The administration has already taken drastic action that inflicts pain on Americans (unconstitutional searches and detentions, tariffs, disabling or dismantling important agencies) in the name of the keeping power. It's not hard to imagine that they are willing to continue to inflict pain on Americans. If you're quibbling about whether that pain can be "unlimited," I would argue that yes, it can be, insofar as that pain doesn't stop them from getting power.

I can hedge this by saying that Trump still needs some support from the American people, as I described in another comment. In particular, he needs support of wealthy donors and local officials, and especially in purple states. But he has proven he will hurt people in solidly blue states [1] [2] because he's already decided he doesn't need them.

Concrete example: would Trump turn off the entire electrical grid? Yes, if he thought it would help him. Whether it helps him depends on weighing the pain that it causes his supporters against its benefits.

In other words: yes, he is willing to inflict unlimited pain, including for utterly petty reasons, but not if he thinks it will stop him from holding power.

[1] https://www.nytimes.com/2026/02/04/climate/wind-solar-projec... [2] https://www.cbsnews.com/newyork/news/gateway-tunnel-project-...


The administration realizes that they need some goodwill to get power. They can’t simply say “no more elections” and start executing political enemies. While that maybe what they want to do, they realize that this would actually hamper their goal of accumulating power.


> The administration realizes that they need some goodwill to get power.

You mean, they know they need to be voted in! I.e. elections.


No. They know they currently don’t have enough power to end elections. But they are working on it and started this as a desire.


> You mean, they know they need to be voted in! I.e. elections.

They know that they don't need to legitimately win elections to stay in power. All they need to do is keep the support of their base sufficiently to prevent any investigation into their election manipulation. They've already lost the good will of the majority, so they have to find a way to win with a minority.

That means placating their wealthy supporters with giveaways, i.e. the recent NLRB decision that conveniently solves Elon Musk's union problem. [1]

That means helping pliant local officials stay in power, by gerrymandering among other methods.

That means maintaining the support of ICE, who have proven themselves able to use violence against critics of the administration.

[1] https://www.foxbusiness.com/politics/nlrb-dismisses-spacex-c...


> OK, let's assume that.

No need to assume, they have explicitly stated it!

> To wit, top Republicans warn GOP will face midterm election ‘bloodbath’. Why bother caring?

This isn't about "Top Republicans," it is about the administration. The same administration that is actively trying to nationalize elections to prevent that bloodbath.

Secondly, is it conceivable that Republicans fearing an electoral bloodbath would make them more likely to support aggressive election interference (ICE a polling stations, new election laws, Federal takeover of elections, re-litigating 2020 Georgia results)?


> > OK, let's assume that.

> No need to assume, they have explicitly stated it!

Really honest question... can you point us to that explicit statement?

The Trump administration's official executive orders and fact sheets repeatedly state their goal is to have "free, fair, and honest elections".

They have specific policy proposals around voter ID, citizenship verification, and election integrity measures.

I will concede that what they think is free and fair, others might not, like legal ID requirement, so that's a requirement reasonable people can disagree on.

But I do think, but am very open to be proven wrong, that they explicitly state that they want to do away with free elections.

https://www.whitehouse.gov/presidential-actions/2025/03/pres...

https://www.whitehouse.gov/fact-sheets/2025/03/fact-sheet-pr...


> Really honest question... can you point us to that explicit statement?

Yes, right here:

https://www.reuters.com/world/us/five-takeaways-reuters-inte...


Other people have already shared the multiple statements Trump has made, I've added some below.

> “I won’t say cancel the election, they should cancel the election...”

> "You Won't Have to Vote Anymore"

> "The Republicans should say: 'We want to take over. We should take over the voting in at least 15 places.' The Republicans ought to nationalize the voting,"


That's not the same thing as policy. That's not the same thing as goal. Politicians say lots of things to get elected, or to troll, or symptoms of senility, etc.

To argue against myself, one could take it at face value. If you do, then you are saying you are near 100% confident that's the goal in which case you ought to do something about it. The lack of more urgency or extreme counter action suggests to me that not enough people truly think that that is fact the goal.

You could maybe accuse me of being naïvely hopeful.


> That's not the same thing as policy.

I'm not sure what you're looking for here. Would you like a White House memorandum on official letterhead saying "How We'll Steal the Election"?

A fish rots from the head. The president has made his position clear, and his enablers will work to realize his vision.

If you're looking for concrete steps they've taken to undermine elections, you can see the recent blatantly unconstitutional seizing of Fulton County's voter records [1]. Or any of the illegal and coercive actions taken by the president and his minions between Nov 6, 2019 and Jan 20, 2020. As well as the blanker pardoning of many criminals who helped him in that endeavor.

[1] https://www.npr.org/2026/02/10/nx-s1-5710649/fulton-county-2...


You asked for statements and I provided them. Now you are pivoting to "policy" as if authoritarians would release policy papers about how they want to end free and fair elections. Please cite some of those examples if you can find them.

One the other side, we have many historical examples of authoritarians claiming elections to be free and fair in order to cement power. The rest of the world knows Putin isn't receiving 88.5% of the vote in a free and fair election. Stalin and Mussolini also held elections. None were free, fair, or honest and that is the entire point.

> Politicians say lots of things to get elected, or to troll, or symptoms of senility, etc.

Why ask for the statements in the first place if they don't matter and can be waved away?

> The lack of more urgency or extreme counter action suggests to me that not enough people truly think that that is fact the goal.

This isn't about whether "enough people truly think it is the goal." It is about the stated claims and goals of the administration, which have been shared with you multiple times in this thread. Please stop with the red herrings.


> they are limited by what Americans will allow

Sure. The current administration is more message-focused than policy-focused. That's because most voters have no idea about policies, and know only how it's spun on Fox News.

This fact makes it all the more frustrating that so many business and influential people are failing to push back when their voice could make a difference.


> You really thing the adminstration's goal is for Americans to not have running water & electricity, thinking that will keep them in power? That makes no sense.

The GP post literally said that the goal was not to have free elections, and that the other things you mention were collateral damage, or at worst something that could be exploited to further the main goal. You took their two examples of collateral damage, implied the GP thought those were the goal, and ignored his actual claim that the goal was to end fair elections.

It's dangerous to pattern match what you read to something in your head, rather than paying attention to the claims someone actually made.


> The GP post literally said that the goal was not to have free elections

OK, let's assume that.

Goal is one thing. How far they're willing and able to go (and hence be effective in getting that goal) is a different matter. That's my argument.

The current adminitration has shown that their ego (adoration) is a limiting factor in what they're willing to do for power.

To wit, top Republicans warn GOP will face midterm election ‘bloodbath’. Why bother caring? Is it just political theater?



What makes no sense is to be able to observe the last 13 months and then to think that this is 'business as usual'.


Did I imply “business as usual”? I don’t think so.

At the same time, I actually think that characterization lacks usefulness. For instance, in some cases there’s clearly breaking norms (most poeple would porobably mostly for the worse, and in some limited cases for better).

In other cases it is just more overt (or in some cases, more extreme) expression of typical American policy.


You're smack in the middle of accepting the unacceptable because of normalization of deviance. None of this is 'typical American policy'.

It is utter chaos, both internal and external. Your calibration point should not be Trump 1 but the Obama or Clinton administrations which were if not super popular at least competent.


> You're smack in the middle of accepting the unacceptable because of normalization of deviance.

To get a little personal, I will just say that you don't know what's in my heart or on my mind.

To get back on point:

> None of this is 'typical American policy'.

Mabye you will say I'm being pedantic, but I think that's a categorically false statement.

> Your calibration point should not be Trump 1 but the Obama or Clinton administrations which were if not super popular at least competent.

Why cherry pick those two? What about more recent (Biden) or further back? I think you will find that there's a lot of things that are persistent over the last 250 years, including political violence, xenophobia, detaining people without due process, invading other countries, tarriffs, rhetoric that Europe should pay for its own defense, etc.

To be clear, I'm not saying any of these are OK. There are also other positive dynamics that persist, like Americans pushing back and the administration needing to retreat and adjust.


> To get a little personal, I will just say that you don't know what's in my heart or on my mind.

No but you are making statements here and those are indicative.

> Mabye you will say I'm being pedantic, but I think that's a categorically false statement.

That's your privilege.

> Why cherry pick those two?

Because the US economy and the US status in the world under those two sets of administrations was doing well compared to many of the alternatives.


Selection pressure can work like a conspiracy without anyone actively conspiring.

Lots of people are just incompentent, not malicious. This made Hanlon's razor, "assume incompentence not malice," memetically fit in many walks of life, so it spread till millions of Americans followed it when processing news.

As a result, incompetent politicians got more leeway to do malicious things. It turned out that in electoral politics, if you are already an a-hole, leeway to be evil without being called on it is more useful than compentence. Incompetence is hard to fake, so our electoral system now demands that you be both incompetent and an asshole to get elected. The only fix is to change the incentives, which means calling out malice in our politicians when it looks like malice, even if we can't prove that it's malice and not just incompetence, and ESPECIALLY even if the person is incompetent too.


I've come to the conclusion that it is a distinction without a difference. It doesn't matter whether someone is incompetent or malicious, the outcomes are what matter so we may as well treat both the same: as malice. That solves a lot of problems and it will hopefully dissuade the incompetents from seeking office. Anybody who still behaves malicious then deserves what they've got coming to them.

All of this pussyfooting is only making matters (much) worse.


It's a "theory". The term "conspiracy theory" is always bad faith. And don't try to "but they're theorizing that people are conspiring!".


> The term "conspiracy theory" is always bad faith.

Hard disagree.

The term serves a legitimate purpose: distinguishing between evidence-based claims about actual conspiracies (which do happen) and unfounded or poorly-supported theories. Watergate was a real conspiracy. The tobacco industry really did conspire to hide health risks. But not every claim of hidden coordination is equally credible.

Legitimate uses include describing theories that rely on unfalsifiable reasoning ("any evidence against it is planted"), highlighting lack of credible evidence for extraordinary claims, distinguishing speculation from established facts.

Bad faith uses includ dismissing inconvenient questions without engaging the evidence, shutting down legitimate skepticism of official narratives, or using it as a thought-terminating cliche to avoid debate.

Now, reasonable people can disagree on whether my characterization is in bad faith or legitimate. I think we could agree on that.


No, the word has long lost that purpose. You unfortunately don't influence whether it has or hasn't. Once upon a time "gay" only meant "happy". You can claim "Well when I call a random person enormously gay, I just mean they're enormously happy", but it doesn't matter. You're in a community that uses English, not andsoitislish.

For reference, I wish you were right, it would be great if indeed the word still served that purpose - but it doesn't.


Not that the objective is institutional rot, nessessarily. More that this administration views institution as fundamentally unimportant.Its the curse of the maintainer. When things are going well bad management thinks that maintenance is a useless expense.


>More that this administration views institution as fundamentally unimportant

Politicians and their lackeys prioritize what makes them popular with the electorate. "Institutions" are not exactly something the electorate holds in high (relative to the recent past decades) esteem these days. And it's only gonna get worse as the boomers croak and are replaced by younger people who've seen institutions do a lot less good in their lifetimes.


The problem is that these institutions are still doing massively useful things. They've been doing them so long that they are invisible. People think the gains that we've made in air quality, consumer rights, labor rights, etc to infinity are natural features of the universe. They are not. They are hard fought and require focused, driven people to keep them. Institutions serve a useful function.


Obviously, this doesn't require a conspiracy. But it's easier to rules over ashes than it is to build a functional country.


> Current administration has the explicit goal to not have free elections going forward.

Where do you get this from?


Some people have eyes and ears.


Vibes, gut feelings, a general understanding of the history of authoritarian movements. But no, let's wait and see if He goes all the way.


from the actual words said by the president???


No no no you don't understand, he was joking. You see, when trump says something I like it's earnest, but if he says something that makes me look bad then he's joking.


https://www.usatoday.com/story/news/politics/2025/10/25/trum...

https://www.huffpost.com/entry/donald-trump-laura-ingraham-f...

Repeated statements by Trump and his circle claiming he’ll run in 2028. Statements by Trump that his supporters won’t ever need to vote again. That little insurrection they tried on January 6th 2021. Their current weaponization and staffing of ICE by people with questionable backgrounds and morals and deploying them against their political enemies under the pretext of illegal immigration (Texas has a bigger problem than Wisconsin For what it’s worth). Constantly praising dictatorial leaders like Putin and Xi while threatening and talking shit about Democratic allies.

So whether or not metastasizes to that point, pretending like this concern has no grounding in actual actions taken and statements uttered is wild, because this playbook isn’t new and the intended direction seems more clear than not.


I was on a team that evaluated moving a significant portion of a product that should be used for government/healthcare onto Matrix. There were several drawbacks that made us NOT go this route:

- Olm/Megolm does not offer forward secrecy for group messaging

- Olm/Megolm does ensure end-to-end encryption for message data, but not for metadata.

- Federation makes it challenging to be GDPR compliant

- Synapse is very heavy, other implementations are less production ready

- For better or worse, the matrix foundation is under UK jurisdiction.

I'm sure I forget some of the nuance, but these were some of the major points. However, there are several government entities in Germany, France, Poland, etc, that can live with the limitations and DO self-host Matrix servers.

I won't go into the pair of high-severity vulns in 2025 (and the somewhat difficult mitigation) because that could hit anyone.


> Olm/Megolm does not offer forward secrecy for group messaging

Megolm does provide forward secrecy - just in blocks of messages. If a message key gets stolen, an attacker could decrypt subsequent messages from that sending device until the next session begins: by default this happens either after 100 msgs have been sent, a week has elapsed, or if the room membership changes. Most folks consider this to be adequate perfect secrecy.

In terms of the Matrix Fdn being incorporated in the UK… I guess that means one shouldn’t use the Internet, given IETF is US incorporated? :)


Re. security of old keys/sessions/messages after compromise of some current state (i.e. notions like forward security):

Do Matrix clients still keep the oldest version of the Megolm ratchet they have ever received? When I last looked (around 2024), the libraries maintained by the Matrix.org core team did.

This means that, while Megolm has a ratchet that can be used to provide forward security, no Matrix implementation that I am aware of does this. This seems to me to be because other features of the Matrix specification rely on continued access to these old keys (like Megolm key backups and history sharing).

Re. security of new keys/sessions/messages after compromise of some current state (i.e. notions like post-compromise security, future secrecy):

My understanding is that, while a _sender_ will rotate Megolm sessions every 100 or so messages, recipients tend not to: clients will accept ciphertexts sent from those old sessions for an indefinite period of time. Again, I haven't been following developments in the Matrix world for a little while, so please correct me if I'm wrong.

This seems (to me) to be for similar reasons to the above: recipients keep around the recipient sessions so they can be backed up and shared with new devices (for history sharing). But (!) Matrix could get way better authentication guarantees if they just _disabled accepting messages_ from these old sessions at the same schedule as the sender stops using them.

--

These are not a unreasonable compromises (there aren't too many attempts to square this circle, and most that I'm aware of are quite academic) but it's worth making clear that just because Olm/Megolm/the Matrix spec have particular features, it doesn't mean they are used properly to give the security guarantees we would naively expect from their composition. At least, this is the case for almost all Matrix clients that I'm aware of.


> Do Matrix clients still keep the oldest version of the Megolm ratchet they have ever received? When I last looked (around 2024), the libraries maintained by the Matrix.org core team did.

It entirely depends on the client. There is nothing in the protocol which means that clients have to store old keys, but many do - mainly so they have a copy that can be backed up on the server to support migrating between devices, and for history sharing, as you say. However you absolutely could configure a locked-down Matrix client which discards megolm keys after receipt.

> My understanding is that, while a _sender_ will rotate Megolm sessions every 100 or so messages, recipients tend not to: clients will accept ciphertexts sent from those old sessions for an indefinite period of time. Again, I haven't been following developments in the Matrix world for a little while, so please correct me if I'm wrong.

Yup, this is fair - and agreed that implementations could and should discard unexpected messages in those sessions. There's nothing in the protocol that stops that (but also it's not explicitly covered in the spec).

We can fix this though; thanks for flagging it (and sorry if we missed it in the RHUL research...)


It may have been easy to miss them! IIRC, we didn't discuss these as explicit "problems", per se, just design trade-offs with particular implications. We even discuss at the end of the second paper whether its worth reconsidering PCS and FS altogether in many circumstances. This is because it is quite common to compose messaging with backup/multi-device setups that undermine (some understandings of) PCS and FS (all over the place, not just in the Matrix ecosystem).

On that note, a quick correction from my side. I suggested that: "But (!) Matrix could get way better authentication guarantees if they just _disabled accepting messages_ from these old sessions at the same schedule as the sender stops using them."

But I think this is way easier said than done because (with the history sharing architecture that is currently used) it is difficult for a fresh device to meaningfully distinguish historical Megolm sessions and active ones. Other designs get around this by re-encrypting the plaintexts rather than the session keys, but this would be quite a big change.


> In terms of the Matrix Fdn being incorporated in the UK… I guess that means one shouldn’t use the Internet, given IETF is US incorporated? :)

The outputs of the IETF are RFCs. The Matrix foundation does more directly oversee the "de-facto" Matrix, so has more influence, could bow to government pressure or changing laws, etc. etc.


Hmmm. The main difference between the Matrix Fdn publishing a spec (https://spec.matrix.org) made out of Matrix Spec Changes (https://spec.matrix.org/proposals) versus IETF only publishing RFCs is simply that the Matrix Fdn also maintains a consolidated version of the spec. I'm not sure that makes the protocol governance fundamentally more vulnerable to govt influence?


They said they were sure they forgot some of the nuance. UK company Element took server development from UK company Matrix Foundation would have been forgettable nuance. Or they evaluated Matrix before possibly.


Which tool did you guys end up using?


Thanks for the info, what do you think about Delta chat?


The cryptography is sound, however, it's also frequently changing, in addition to straying from standards more or less. This makes it difficult to give a firm answer.

This ETH (i.e. Zurich) paper[0] identified several exploitable vulnerabilities (bad), which were quickly addressed by delta chat (good).

So overall, I'd see it as a good messenger, but with downsides.

[0]: https://www.usenix.org/system/files/usenixsecurity24-song-yu...


Thank you :)


> - Federation makes it challenging to be GDPR compliant

Can you elaborate? AFAIK when everything is encrypted, GDPR compliance is trivial.


This immediately lost credibility for me with this quote:

> And vibe coding is fun. Even Bret Taylor, OpenAI’s chair, acknowledges it’s become a legitimate development approach.

Color me shocked! Bret, who directly profits by how his product is perceived, thinks it's legitimate???? /s


And if I understand correctly the author is running a business that helps SaaS companies overcome the risk of using their own vibe-coded solutions.


Good point -- removed for being biased and partial. Thanks for the feedback!


> Good point -- removed for being biased and impartial. Thanks for the feedback!

??? Do you mean biased or do you mean impartial?


"biased" and "impartial" are antonyms. Pick one or the other.


Edited, allow me blame it on my ~12 hour workday today :^)


Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: