julian

This is my POSSE copy of the announcement posted in This Week in Matrix (TWIM) 2024-03-29.

This is my POSSE copy of the announcement posted in This Week in Matrix (TWIM) 2024-03-29.

I wanted to write “please matrix me!” with “matrix me” being a hyperlink to my matrix identity. Why should this be hard?

I wrote (in markdown mode, using Element-web/desktop): please [matrix me](https://matrix.to/#/@julian:foad.me.uk "@julian:foad.me.uk")!

This was formatted into HTML (by Element-web/desktop) as: please <a href=\"https://matrix.to/#/@julian:foad.me.uk\">matrix me</a>! (losing my “title” text from the markdown).

How did clients render it? Ordered roughly best to worst.

good?	client	rendered	notes
☑	Hydrogen		a pill with my given text “matrix me” inside it, and my initial in place of avatar.
☑	Nheko		a plain hyperlink
☑	matrix-static/view.m.o		a plain hyperlink
!	Element (web/desktop) edit mode		a pill with my avatar and my given text “matrix me” inside it. Different from view mode!
-	Element (web/desktop, Android)		a pill with my avatar and username, losing the link text that I specified.
-	Fluffychat (desktop, Android)		a pill with my avatar and username, losing the link text that I specified.
-	Syphon		plain text, losing the hyperlink.

Why should this be hard? Sigh.

---

#matrix

I put up a web site with details of my PubHubs work:

https://www.ph.trax.im

Under Moderation, there are subsections for the main work areas of the project: Draupnir+Pantalaimon, Disclosure of Identity Attributes, and Civilised Discourse.

That last area is the one I am currently working on.

---

#PubHubs #matrix #awesomeFOSS

“How can I transfer photos between my PC and my phone?”

• perhaps to get a digital camera photo from the PC into a phone app
• perhaps to get a few phone photos onto the PC for editing
• perhaps any other kinds of files, not only photos
• perhaps Internet access is slow

Here we are not looking at ways to manage our whole photo collection, we are looking at simple ways to transfer files between our devices.

Towards Matrix, Properly Decentralised

One of matrix's key properties is decentralised communication.

No single party controls the whole system, there is not a single service provider of whom everybody is a customer, anyone can choose who provides their service or run it themself.

When I install a Matrix client app, I expect it to connect to my Matrix server. What happens currently: most matrix client apps invite me to connect to one particular de-facto “central” server called “matrix.org”. As a user, connecting to my own server is a chore. In Element's flagship “Element X” preview, for example, currently I have to choose the less obvious buttons to skip past screens inviting me to choose the “matrix.org” server, twice, and input my server's domain on a “search” screen separate from where I enter my “username”.

What matrix client apps should do: discover my local server automatically, make a reasonable suggestion for my username (e.g. from my computer's or phone's user account details, address-book, etc.), and move on to asking me for my password.

It would be nice if we could standardise a way for a local matrix homeserver to advertise itself on the local network, and for a client to detect the local homeserver(s) automatically. Home media servers do this, and some other kinds of home servers. Technically there are a few different ways to achieve Zero-configuration networking, like UPnP, mDNS, DNS-SD.

A different and complementary approach is to integrate with the accounts already configured in the phone's settings (on Android for example). I should be able to configure one matrix account in one place, and then any matrix client app I install should pick up the settings from there.

Which technique(s) we use is not as important as that it should Just Work, for ordinary low-tech people who have not set up their own infrastructure but are perhaps subscribing to a matrix server provider.

(Traditional “enterprise” deployment techniques are still valid in an enterprise setting, for example where the enterprise IT department configures the employees' devices. But that is something they have the resources to develop and deploy. I am interested in what we can do for ordinary individuals at home.)

It seems to me that's the way things should Just Work, everywhere from homes to enterprises, if we care about decentralisation.

---

#matrix #awesomeFOSS

New web standard proposed by Google for slicker Sign-In-With buttons props up Big Tech and undermines the independent social net. Let's fix that.

TL;DR: Web identity and open-tech activists needed to steer new Sign-In-With standard FedCM to support user choice of identity provider.

For the attention of federated systems developers, including Matrix, Fediverse and others.

It may be good to know about an issue going on with FedCM “Federated Credential Management” draft spec. Liquid Surf brings it to the attention of all federated systems fans in their blog post: Can FedCM improve the user experience of decentralized ecosystem ? . In short, the spec aims to make a slicker browser flow for the Sign-In-With-Xxx buttons.

To us who care about federated computer infrastructure, introduction of a new standard to streamline the sign-in flow might seem minor and remote, but there is a catch.

What Is FedCM?

FedCM, short for Federated Credential Management, is a new draft specification for web browsers, published by the Federated Identity Community Group and strongly driven by teams from Google. It represents an advancement in how websites manage user logins, when logging in through different identity providers (such as “Sign in with GitHub/Google/etc.”) while preserving user privacy... — Liquid Surf: Can FedCM improve the user experience of decentralized ecosystem ?

The Catch

The critical issue is, at present, the draft standard is likely to cement the monopolies of the big providers (like Google and Facebook) and leave out small providers. In short, the problem is the draft spec says the site we're logging into (called the RP) solely dictates what list of identity providers should be offered to the user. What will happen in that case? Most sites will offer only the BigTech identity providers. Read the blog post and the issue Allow IDP registration #240 for details.

... End Users looking to opt out of the limited federated identity login options available today are required to significantly compromise convenience because they are forced to manage a new set of credentials directly with the relying party, creating friction and usability challenges.

... Currently the proposed FedCM API ... assumes the relying party specifies a set of IDPs it supports login from. This model is largely a continuation of that described above and in many respects is just a browser mediated version of what we see most commonly on the web today.

What to do about it?

The proposal in Allow IDP registration #240 is, in short, not to have the RP site solely dictate what list of identity providers should be offered, but also to let the browser register the user's chosen identity providers and present those as options when a new login is requested.

... instead of the Relying Party specifying the IDPs it supports in the federation request, it communicates the capabilities it supports such as signature schemes, assertion formats and response modes. End-Users can then register providers they wish to use with the browser, which are then available as options to present to the End-User ...

Why Do We Need to Help?

(As I responded to '@thhck' in #fediverse:pixie.town)

The proposing team are saying lack of feedback from developers is holding back the acceptance of this extension.

Decentralising ID providers is key to the whole decentralised movement, including Fediverse, Matrix, self-hosters as well as the ability for independent businesses to provide comprehensive IT services without one of the tech giants playing gatekeeper.

We, all of us who care about federated/decentralised infrastructure, now need to push the draft Federated Credential Management “FedCM” standard to support “Sign In With” the user's choice of identity provider (which may be small, local, independent, hosted by one's school or enterprise or self, and so on). If this extension to the proposal does not get enough support to be accepted, we might get a standard that perpetuates the status quo of sites only offering Sign In With the giants like Google/Github/Facebook, ugh. That would be another death blow for user agency and privacy and variety.

Get Involved

Fedi devs, let's demo this truly user-centric version of FedCM, show us how awesome it is! Fedi fans, this might seem remote from our viewpoint but it's important for our future. Let's share this issue more widely among Fedi projects!

Please join us to discuss this: #fedcm-user-choice:trax.im on Matrix

See contributing to FedCM and the Meetings of W3C Federated Identity CG. Agendas and minutes are public, and interested parties are being invited to present their case for making this extension.

---

Read more:

• FedCM “Federated Credential Management” draft spec. — central place for development of the spec — on Microsoft-Github
• Allow IDP registration #240 — the extension we need to drive forward for user choice
• Federated Credential Management API — W3C Draft Community Group Report, 19 January 2024
• issue #240 comment mentioning lack of feedback from developers
• The Downside of Conveniently Signing In With Google, Facebook, Twitter, or Apple — for context about (lack of) user choice — gizmodo, 2020-09
• On FedCM's (un)suitability in Research and Education federations — Jisc Trust & Identity Services Blog, 2024-01

[EDITS: removed announcement of past meetings; added logo, quotes, TL;DR, call-outs, links; many text edits]

[Image source file, as Inkscape SVG: fedcm-my-choice-1.svg]

As I wrote before, My smart watch is open source. Awesome!

Let's make this fun — for children in particular — and show how we can bend the device to our will because FOSS means it's truly ours, fully under our control.

• PubHubs-moderation live demo: central.ph.s.trax.im/client
  • TODO: instructions; basically you need Yivi app with dev mode enabled and two sets of demo credentials (one as moderator, one as recipient)
• disclosure UI live prototype: on qx.trax.im

Disclosure Flow

A moderator asks someone to disclose an attribute of their real identity. The recipient provide the requested attribute, using Yivi to attach a cryptographic proof.

In the last update I introduced a demo of attribute disclosure. I have since completed the main TODO there, making the disclosure flow happen on the recipient's account. (In the first demo the moderator's role and the recipient's role both took place in the same login session in the same account.)

This week I have been thinking about how we will need to improve the user experience, or flow, of this disclosure request and response.

Writing the dialogue boxes and associated logic by hand was tedious and buggy. Rapid prototyping would be helpful. I decided it's time for me to learn a better way. Being new to UI design and fervently open-source principled, I searched for a FOSS solution and found Quant-UX.

This month I have been building a PubHubs-specific feature, the ability for a moderator to ask a someone to disclose an attribute of their real identity.

When a person signs in to PubHubs hub through the Yivi verified credentials system, initially they are allocated a pseudonymous user identifier, for example @123-321:testhub.matrix.host. From this pseudonym, not even an operator or moderator of the hub can discover the user's real identity.

A moderator may wish to ask a user to confirm their real identity, to some degree. Through Yivi it is possible to ask a user to reveal a cryptographic proof [1] of one or more of their identity attributes. Some common attributes are one's real name, physical address, or email address. An attribute could also be something like “age is at least 18 years”.

First Demo Version