Set all the URLs in config.xml to localhost

[afonari]

This closes #31.

I tested it on my phone. Seems to work fine. Integrations are missing, as expected.

[hrj]

Are integrations opt-in or opt-opt?

If they are opt-in at the user-level, I don't want to meddle with it.

If they are opt-out, what are the privacy concerns? Is there any upstream issue tracking it? Given that upstream has planned to address recent privacy concerns, I would rather wait for those changes to land, assuming it is in the near future.

[afonari]

If they are opt-in at the user-level, I don't want to meddle with it.

Nothing changed, nothing is opt-in. You can see the list of privacy issues here: https://vector-im.github.io/feature-dashboard/#/plan?label=privacy-sprint&repo=vector-im%2Friot-web&repo=vector-im%2Friot-ios&repo=vector-im%2Friot-android&repo=vector-im%2FriotX-android&repo=matrix-org%2Fmatrix-doc&repo=matrix-org%2Fsydent

And also this topic: https://github.com/privacytoolsIO/privacytools.io/issues/1049

I think this change is easy to revert (just one file) that it would be good to have until riot fixes it.

[hrj]

By changing the URLs we are breaking functionality for those who want these features.

We could wait for upstream to fix these things, or help upstream fix them, since they are open to listening. It would benefit a larger set of users, while keeping this fork minimal.

If they are not ready to listen, even then, it might make more sense to disable the integration manager by default rather than changing the URLs.

Please correct me if I am wrong; I am not following this topic closely.

[afonari]

By changing the URLs we are breaking functionality for those who want these features.

Yes as always privacy vs. convenience.

We could wait for upstream to fix these things

If you read the linked thread from the privacytools, they don't fix privacy bugs very fast. And also their integration server will remain closed source (labeled wontfix): https://github.com/vector-im/riot-web/issues/7757. Thus, no one else is able to run it, thus for them it doesn't make sense to make it opt-in.

it might make more sense to disable the integration manager

Currently I don't know how to do it.

[hrj]

Ok. I will merge this in for now, and will revert it if it becomes a maintenance burden.

[afonari]

Thanks!

[hrj]

I am inclined to revert these changes in the next version, for two reasons.

If you read the linked thread from the privacytools, they don't fix privacy bugs very fast.

They seem to have improved in this dept now. The recent release (0.9.7) closes 10 privacy issues. And of the total 32 issues identified as privacy related, only 8 remain open.

Secondly, these changes are in a string array in an xml file. I had a merge conflict yesterday, which I have fixed for the moment. But this is likely to fail in subtle ways and make mV unusable in some scenarios.

[afonari]

Sounds good, let's do it.