Jeffrey Paul

Ok, then I've got my answer. Riot is an official client of the service offered by `matrix.org`, and I cannot recommend use of Riot to people with which I want...

I don't understand the need to communicate with any server *prior* to the user clicking "sign up" or "log in", because they are not performing a registration or a login...

> Don't assume the user wants auto-updating until the user explicitly approves it (most users click away on any such asks so would end up never updating) You can make...

Adding silent, unwanted third-party network requests without an opt-in is a hard deterrent to those that just want to use a piece of client software to talk to a server...

Changing the default to 10y to avoid this completely unnecessary footgun is also advisable. I'd have just deployed a ticking time bomb if I'd not just stumbled across this issue....

That doesn't fix the problem. Change the default. A documented footgun is still a footgun.

If CA private keys are leaked, 1 year is too long. If they are not leaked, 1 year is too short.

A much better default would be 24 hours so your users get bitten by this while their configuration is still fresh in their minds, then they fix the problem (by...

I'd be interested in helping! I'd like to work on breaking out the list into subsets; I want a mac that doesn't speak to Apple except for OS updates.

It would appear this has been implemented for the gear on the profile avatar (something people do occasionally/rarely) but not for the main photo upload dialog? Very strange to me...