Email or username:

Password:

Forgot your password?
Sven Slootweg

So one of the major differences between corporate software development and community software development is the difference in transparency.

In corporate projects, the default is secrecy; you don't tell stuff to outsiders unless you have a reason to. In community projects, the default is openness; you always do everything out in the open unless you have a reason *not* to.

And I think that the a lot of the problems people have with Element and - by extension - Matrix are to do with precisely that: Element's projects are run as corporate projects, not as community projects.

I don't mean that there's no spec process, or that it's proprietary, or that there's no work out in the open - I mean that it is not out in the open *by default*. As Element grows, it is becoming increasingly common to hear the word "internal".

"Internal" is the death knell of a community project. Internal projects, internal discussion, internal review, internal priorities. Internal means secrecy; not visible to the community, not taking its input, not *accountable* to that community.

Some things, like actively exploitable vulnerabilities, *need* to be kept internal - but most everything else shouldn't be. Spec changes shouldn't be under internal discussion. Refactoring shouldn't be an internal process.

Or to put it differently: at the very least, the full state of the project must be visible to the whole community at any given time - *without* actively having to ask The Right Person about it. Maybe in some cases read-only, but it must be visible without delay or barrier.

And if you're trying to run a community project as a corporation, yes, that means needing to disclose the internal workings of your corporation. Yes, also the 'company secrets'. Yes, also the internal bureaucratic processes.

And yes, also take feedback on them from the community. If you want to do it right, it needs to be a symbiotic relationship, even if that means not doing the 'standard thing' from a corporate perspective.

Element has failed to do this, and the result is that people are feeling more and more alienated from the process; a process which they increasingly have no visibility into, and zero control over.

It's nominally still a community project, but in practice there's always some unspecified and invisible "internal" roadblock standing in the way of contributions, with no timeline of any sort, and a distinct sense of neglect.

And that's how it ends up taking 7 years to fix a grating notification sound: github.com/vector-im/element-w

Element needs to do better. The Matrix foundation, which Element is still the major contributor to in practice, needs to *demand* better. I think Matrix has real potential, but I would prefer if it didn't require a community fork to get there.

8 comments | Expand all CWs
Normal :jo_2: :v_enby:

@joepie91

> And yes, also take feedback on them from the community.

this is what element pathologically fails to do, as a culture, moving processes internal because the "naggings" of external people became too much to them, or so they say

Sven Slootweg

@ShadowJonathan I mean, I can understand that, and that *is* a legitimate problem - but that's solved by moderating the discussion, not by changing who has access to it.

Stark

@joepie91

Normally, when encryption is involved, security issues, zero-day bugs, and exploits need to be reported internally and fixed. Otherwise, it could lead to exploitation in the wild.

But with projects like and the post-mortem needs to be transparent and a full report needs to be provided to the community to identify and explain the error, how it was fixed and whether it was ever exploited or anything was compromised.

Rodion Borisov

@Stark9837 @joepie91

Well, I recall seeing some reports and how they address those in MSCs. May as well be a workload problem where few cases remain without action, and this fact is not communicated very enthusiastically.

Stark

@vintprox @joepie91

But transparency regarding any exploitation of bugs or compromised data should be communicated. In order to keep users aware of problems and in order to notify users of critical updages and fixes.

So, workload and not caring isn't an excuse. You wouldn't accept the same behavior from your password manager, VPN, or encrypted email service

weirdcore nixcore :trollface:

@joepie91@social.pixie.town Cinny so far has been the most stable and it's community-ran, but it doesn't support calls.

shine

@joepie91 I know about matrix contributors who burned out and stopped contributing because of the "internal process" gatekeeping...

Aks
@joepie91 I don't recommend anyone to use Element after the initial setup, honestly. Use Element to set up your account and use it as an "account dashboard" but never use it as a client. Cinny is way better, for example.
Go Up