This morning (January 10), I had the wonderful idea to check what was going on with my Matrix chats. I installed nheko,
logged in and then after failing to actually get to let me put in my encryption passphrase, I was hit with a deluge of spam invite notifications. All of these spam room invitations had a stereotype-caricature (usually a wojak) of a trans person, who was usually in the middle of a suicide attempt; or a couple of flavors of illegal photos of children as icons. Nheko is now uninstalled and my Matrix account is now closed.

Terrible behavior is not new in Matrix, but before today all I usually saw was trolls spamming individual channels with nudes or a scam. It was just a nuisance. This ended up distressing, not just because of those poor kids, but because this could be a legal nightmare for the whole network and its users.

I’m also not the only one who’s had this happen to them. Terence Eden made a blog post in July, about ditching Matrix primarily because of this problem. The post has a link to a screenshot of the Element client that he posted on Mastodon.

How did we *waves hands* get …here?

Short answer: Matrix has abysmally bad moderation tools.
Long answer: Matrix has had abysmally bad moderation tools and the developer committee expect users and server admins to make their own tools to the point where they lost track of an issue ticket meant to remind them to implement better ones for years.

How. How do you fuck up this badly? Like, shouldn’t “keep users from seeing baby genitals” be the second priority behind “make sure the thing works”? I swear this isn’t that unreasonable of a demand.

But who am I kidding? Matrix aren’t even making sure their protocol works.

Unable to decrypt message

There’s a reason the above header is a commonly repeated joke in open-source circles. Matrix’s en/decryption was left in an unfinished state, so they could rewrite it from the ground up.
There’s still big bugs in it as of August 2025.

Using the protocol is also slow as molasses, primarily because nothing is pruned. Every single message is synced at once. that could be thousand of messages if you’ve joined more than a few channels. Worse, the messages are sent as JSON responses. The only strong point is how the big-name clients look and some of their functions.

Things that I miss

I miss how nice the clients looked. I miss the stickers and the custom emotes.

But none of those were worth getting sent harassment and spam.

 Conclusion

Thanks for reading this raw, messy post. I hope that you have a better day and we all can find a better way forward. ∎

Palate Cleanser