For what its worth, open source is en vogue in german government IT at the moment. "Dataport", a government-owned IT-company, has an open-source based project "Phoenix", as a first step in this shift of paradigm. This is interesting because Dataport used to be pretty much a windows-shop; despite old and established hierarchies and its special place in the public domain, change is happening.
(Source: I'm working in that project as a consultant)
Please keep it that way! We need open source in government - it's the only way to hold people accountable and make sure that citizens aren't being shafted :)
This is why I made the distinction "open-source based". The project isn't simply rebranding though, it builds solutions for customers based on open source components (which is a step in the correct direction). I would like all the repositories to be public, too, but we're not there yet.
I saw on phoenix-werkstatt.de that there are actual contributions back upstream. Even if it appears to not be a Dataport employee, at least some of the funds of the government are going towards improving the projects for everyone. Good stuff.
Unfortunately, at the moment even code access for other public institutions is buried behind many layers of bureaucracy but I have been promised they will start to open up soon enough.
Well, they could still have opted for something proprietary, weird and broken. See for example the De-Mail desaster[0] and the beA desaster[1]. Both supposedly better and secure email/messenger replacements with huge problems like lacking end-to-end encryption, design problems, laughably lacking security, high cost, low adoption (except were required by law), no usability, etc.
I'm really glad that at least someone here might have learned from those mistakes.
E2EE isn't forbidden per se. But if you are a public communication provider over a certain size you need to provide access upon request if technically possible. It isn't really clear even in the case of Tutanota if they fall into that regulation, however, they had to preliminarily comply anyways: https://www.heise.de/news/Gericht-zwingt-Mailprovider-Tutano...
Healthcare providers operating a Matrix server won't be communication providers to the public, and if they aren't using a web client or some similar crap, breaking E2EE won't be possible. Webmail providers claiming E2EE like Tutanota are imho liars anyways, because Javascript on a website isn't a secure "end" for the encryption.
So use client software that isn't attacker controlled easily, keep your keys private, only encrypt to trustworthy keys and you'll be fine. Matrix ticks all those boxes if you don't use the web client. And the only legal way in for German law enforcement would be to infect your device with some trojan ("Bundestrojaner", like e.g. NSO Pegasus).
German government IT is far removed from being a monolithic entity. There are a lot of different actors involved with different priorities.
In this case law enforcement can simply request the data (as long as such a request is legal) at either end. No need to attack the connection in between.
It's the opposite, actually - it seems to be the Ministers and establishment pushing it. e.g:
> [Bundesdatenschutzbeauftragte Ulrich] Kelber verweist auf die Entwicklungen in Frankreich. Dort wird eine Whatsappalternative auf Basis des Open-Source-Team-Messengers Matrix und dessen Client Riot entwickelt. In Frankreich "geht man aktuell einen hervorragenden Weg, um sich aus der faktisch in weiten Bereichen der Verwaltung bestehenden Abhängigkeit von Produkten großer amerikanischer IT-Firmen zu lösen", sagte Kleber.
or in English:
> Federal Data Protection Officer, Ulrich Kelber refers to the developments in France. A Whatsapp alternative based on the open source team messenger Matrix and its client Riot is being developed there. In France, "there is currently an excellent way to free oneself from the fact that many areas of administration are actually dependent on the products of large American IT companies," said Kleber.
Ulrich Kelber may be the coolest higher german official, but he keeps complaining about not being listened to (on Mastodon, in meme form).
I tend to think the political machinery isn’t afraid of proprietary/monopoly dependency in general, the issue is rather with those companies not being domestic.
A shift to open source is sanctioned from the very top. For example, in the area of OZG (broad digital access to public services, coming soon) the explicit decision is (my translation):
> Open standards must be used in the implementation and operation of digital offerings. The source code from the realization of digital offerings by the administration (in-house development) is made available as open source, i.e., in reusable form, wherever possible.https://www.it-planungsrat.de/fileadmin/beschluesse/2020/Bes...
This isn't necessarily an endorsement of one protocol/ecosystem over the other, nor do I have direct experience with integrating Matrix or XMPP (though I run the latter on my home-server for family), but XMPP has seen a few large deployments, including in healthcare (in the UK)[0][1] and in Germany[2].
The consumer-facing client ecosystem for XMPP has indeed seen less rapid development than Matrix (the latter probably benefits from a more cohesive approach), but the server ecosystem for XMPP is very mature, and servers such as Ejabberd are known to scale to hundreds of thousands of connections on a single, modest host[3]. Obviously, that's only one part of the puzzle, hence why Matrix was chosen here.
Still, it'd be interesting to see how the two evolve and compare down the line.
Matrix is looked after the Matrix.org Foundation which is non-profit and doesn't collect venture capital either: https://matrix.org/foundation.
(It's true that many contributions to Matrix come from Element, though, the VC-funded for-profit founded by the original Matrix team in order to pay for us to keep the lights on and keep working on Matrix. Just as VC-funded Jabber Inc contributed massively to XMPP, back in the day).
I’m working on a project management app for small businesses using Matrix. I’ve been inspired by your work and the transparency with which the team operates and the business model you have pursued and succeeded at. I’m also stunned by the technology recently being deployed in Dendrite.
Is one of the best ways to support Matrix and grow the influence to hire Element’s team as consultants to build custom implementations and use cases?
Realistically there weren't a lot of choices other than Matrix though, looking at what the law demands.