I love it. It's elegantly simple piece of electronics, while also being an amazing audiovisual spectacle. For the whole office.

Hello!

With the recent news about Discord, I've seen several people starting to consider Matrix as an alternative. That's why I wanted to share my experience with self-hosting it, because the whole hosting and upkeep of the server can be extremely simplified (and kind of cheap), if you choose the right tools for the job.

tl;dr - You can host Matrix with 2 very simple config changes and around 4 commands through this ansible project.

A little disclaimer - my use-case for Matrix is mostly to just bridge other messanging platforms, in my case it's Discord (text only), WhatsApp, FB Messenger and Telegram. I have set up voice support but never properly stress-tested it, and the user count of my server is 2 users. While the setup process will mostly be the same, I can't vouch for the chosen VM to handle higher traffic.

The main project I wanted to talk about is the matrix-docker-ansible-deploy, because it makes self-host the whole Matrix stack, along with a metric ton of optional services, extremely easy. For those that don't know, ansible is a tool that allows you to write "playbooks" of steps to run on a specified server that will set up whatever you need. In this case, the playbook is set up to install Matrix and any of the dozens of services, install it and their requirements, configure it, and all you have to do is set up config options telling it what you want and run the playbook, making it super easy.

So, how does the self-hosting actually looks like? I'm assuming knowledge about setting up hosting, ssh, domain, and basic work with docker.

You need to get a domain, and get a VPS. I've chosen Hetzner cloud CAX11 (ARM, 2 VCPU, 4GB RAM, 40Gb storage), which goes for ~7$ a month including storage and IP.

Get your private key and IP, and don't forget to set up firewall. You also need to set up Ansible and Just on your computer, here's the docker I'm using for the job. Make sure to run it from the matrix-docker-ansible-deploy folder (so from inside the repo):

docker run -it --rm -w /work -v `pwd`:/work -v $HOME/Work/Matrix-server/hetzner.key:/root/.ssh/id_rsa:ro --entrypoint=/bin/sh docker.io/devture/ansible:2.16.1-r0-0

Once you're there, you just pull the ansible project and can start with a Quickstart. This is the most difficult step - you have to set up and configure two files, one with your server host IP, and one with config vars.yml.

But, the basic config is extremely simple. You just give it a domain, and generate a few DB passwords, and you'll have a working matrix server. If you want other services, like bridges, it's usually also simple, and the documentation is clear. For example, adding voice support was literally just adding matrix_rcp_enabled: true into the vars.yml file.

Once you have that set up, the whole install process is literally running (from inside the ansible docker mentioned above)

just update (to update the playbook)

and then

ansible-playbook -i inventory/hosts setup.yml --tags=install-all,ensure-matrix-users-created,start

And that's it. Assuming you have your server SSH key set up properly, it should simply run and install whatever you have configured. It might throw some errors, but so far every one I've seen was extremely clear.

Also, don't forget to update often! I'm using this command from the ansible docker (with ssh key setup) mentioned above that does it:

git config --global --add safe.directory /work && git pull && just roles && just setup-all

I've never had the ansible fail in a way I couldn't figure out, even when I was updating after more than half a year - the script is so robust it even told me to remove depreciated config options. It's one of those rare projects that is so extremely robust it can handle a lot of situations. The only difficult issue I had in the two years was running out of space, since that made random things fail, and Matrix is pretty data heavy (because it saves all images).

As for my experience with matrix, I've been using it as my only message app for two years, and most of the time, it has been fine.

There are a few caveats:

• WhatsApp bridge requires me to log in to WhatsApp app every two weeks. I just have it in a separate quarantine profile on my GrapheneOS, and log it from time to time.
• Messenger bridge has stopped logging in after two years of usage without issues last week. I haven't solved it yet, but it looks like Meta has upped their bot detection.
• Discord bridge works great for chat, including servers, but AFAIK you can't join voice.
• Telegram had issues with logging out when I used a new account, but after using my personal, it's all right. Topics don't work AFAIK, though.
• And of course - all of the apps still get my data and my messages.

But, I was tired of not being able to convince my friends to switch, and by bridging it all to Matrix, I can at least avoid having their apps and visiting their sites, which is an OK compromise for me.

If you have any questions, feel free to ask. I wanted to share some visibility for this project, because just by watching the gazzilion of steps the playbook is doing, I can imagine that trying to actually self-host Matrix manually might be pretty long edeavour, but this project has so far done everything perfectly in a matter of three commands and a config change.

Hello!

I've been following the discourse about the recent ChatControl update that has passed few days ago, and I have been wondering if it changes anything for the majority of people who were ok with the first version from 2021.

First a disclaimer - I'm vehemently against it, because it does affect me since I do use the alternative services affected, and I'm not trying to downplay the impact. I know that it's an issue for people already invested in privacy, but this question focuses on general population and services that reportedly already do the scanning anyway.

At least based on information on this website, most of the commonly popular services have been doing ChatControl since 2021:

Currently a regulation (that passed in 2021) is in place allowing providers to scan communications voluntarily (so-called “Chat Control 1.0”). So far only some unencrypted US communications services such as GMail, Facebook/Instagram Messenger, Skype, Snapchat, iCloud email and X-Box apply chat control voluntarily (more details here). As a result of the mandatory Chat Control 2.0 proposal, the Commission expected a 3.5-fold increase in scanning reports (by 354%).

My first question is - is this correct? I have not seen it mentioned anywhere else, not even a single comment in any discussion about the new resolution, and I don't want to spread false information. It sounds like an important fact that more people should be aware of, but everyone seemed to conviniently forget right after the first Chatcontrol passed in 2021, and the first round of trying to pass the second one (in 2023 or whenever) failed. If anyone has more information about the current state, I'd love to hear it.

Assuming that's correct, then my question/rant is - what does change for people who are already using these services exclusively? People like that had the last 5 years to do something about the serious privacy violation like this - stop using services that do the scanning. Most of them did not do that, forcing people like me to choose between privacy and being able to contact my friends, because "they don't want to install a new chatting app, and everyone is on Messenger anyway". And I'm pretty sure that they wouldn't stop even if the new resolution did not pass.

I realize it sounds more than a rant that a question, because it kind of is, it has been frustrating screaming about ChatControl to deaf ears for the past few years, but I'm also honestly asking what actually changes. Even though I am frustrated, I still want to have actual arguments, so when I'm convincing people to stop using those services, I'm not lying that "nothing changes for you if you don't switch" (assuming the current resolution does not get finalized and implemented). Plus, since people are now actually listening about ChatControl, telling them that it's already happening does have a greater impact.

Unity has been sounding the alarm about a code execution vulnerability that has been identified in all applications built with vulnerable editor.

EDIT: While the below text kind of still holds for Desktops, I've absolutely forgotten about Android. If you have an Android game, you should definitely patch, since the situation is kind of different there.

Also, if your game is registered as custom URL schema handler, it can lead to privlidge escalation, or maybe even be triggered remotely (through a malicious link), so Update.

While there's definitely no harm in patching, in my personal opinion, the situation is needlessly overblown. I have worked in offensive cybersecurity, and the fact that Unity game allows you to locally run a code that

would be confined to the privilege level of the vulnerable application, and information disclosure would be confined to the information available to the vulnerable application.

is not really exploitable. Since the attack vector is local, the attacker already has to have read/write/execute access to the application and your system, which usually means you have way bigger problems.

Not to mention that since Unity suffers with .dll injection vulnerability (which is what most mods are using), the attacker can do the same by simply replacing a .dll file of the game.

So, patch up if you can, but if you're not able or can't be bothered, in my opinion, it doesn't really matter. But please prove me if I'm wrong.

Hello!

While discussing about privacy on Lemmy and in the Fediverse, I've stumbled upon an idea that would solve some of the issues inherent to the fact that you need to have a home instance, that is under control of someone you have to trust. But my knowledge about ActivityPub is lacking, and I'm not sure if something like this would be possible or not. Also - it possible that something like that already exists, but I didn't manage to find anything.

So, would it be possible to create a Fediverse/ActivityPub app that is just a self-hosted frontend for interacting with other apps, such as Lemmy or Mastodon, that only hosts your own personal data related to your account, but not the content you post to other instances?

The main thing I'm unsure with is how Fediverse works in this regard - who hosts the content. If my home instance is programming.dev, and I create a Post or a Comment on lemmy.ml, who is the source of truth for that post? Does the content get saved on my home instance, and Lemmy.ml only gets an ID that it queries if an user requests it, or do I send the content to Lemmy.ml to live on their server?

Depending on this, it would make such a self-hosted app easier or harder. If the content lives on the instance I post it to, it would mean that you can create a fediverse app that only stores your personal user information and DMs, and you don't have to deal with serving your posts to others - because they live on the other instance you posted it to. Then all that would be left is to create an UI for displaying and querying content from other instances, and you have a way how to interact with the Fediverse without risking any of your personal private data.

On the other hand, if the content would have to live on my instance, I would have to deal with serving it to whoever requests it, which would make it a lot harder to self-host.

I kind of hope it's the first option, because then it would allow for public communities of content-only servers while also letting users have their own personal-data only instances that allows them to interact with the rest. And I really like that idea, because it would allow you to for example have reliable E2E for messages, since you have the code that generates and stores the private certificate under absolute control, and only need to share your private key with others.

In general, it seems like a great solution to many privacy problems on the Fediverse, and if something like that would be possible (without having to serve the content, because then it may get too resource-intensive for a regular user), I would definitely try to come up with such a solution.

And now that I think about it - if you actually have to host the content, then it maybe be possible to create a combination of user-data / content servers, where you select a public community run content server to host your data, and have the personal user-data server self-hosted. And if a request comes to your user-data server for content, you just redirect it to the community-ran server. But that's just brainstorming.