element-web runs offsite javascript from vector.im and riot.im

app = element-web version = 1.7.28

When using a selfhosted element talking to a sellfhosted server, enabling the Spaces feature establishes connections to vector.im, and when trying to view a jitsi video call inline fails with a “JavaScript is disabled. For this site to work you have to enable JavaScript.” error when JS is permitted on the selfhosting domain but denied on others (and it shows it’s trying to exec remote javascript from riot.im and vector.im domains).

What’s the point of having both a server app and a client app that can be selfhosted if it has to phone home to the developers to download remote executable code from an untrusted server to work right?

[t3chguy]

when trying to view a jitsi video call inline fails with a “JavaScript is disabled. For this site to work you have to enable JavaScript.” error when JS is permitted on the selfhosting domain but denied on others (and it shows it’s trying to exec remote javascript from riot.im and vector.im domains).

The Jitsi you are accessing is hosted at jitsi.riot.im - what exactly do you expect here? The javascript being loaded here is loaded inside a sandboxed iframe.

I cannot reproduce any Javascript being loaded from vector.im when making a Jitsi call - unless you go to Edit widgets, bridges & bots which uses the vector.im integrations manager, again in a sandboxed iframe, to provision their bots/bridges/etc

If you don’t want to use the Jitsi configured by the Element/Matrix admin then you can make use of /addwidget though keep in mind if someone else adds a Jitsi call to the room and you opt to join it then obviously you have to join the Jitsi of whatever domain they chose during the setup of the call otherwise you’d be in your very own call and not the one with your peer.

It seems that if this is the config that server admins end up with, then this ecosystem probably isn’t very privacy-friendly

So just because your server admins don’t wish to run their own Jitsi stack that makes the product not privacy-friendly - what? The Jitsi stack can be configured in Element or in the Matrix server, but they obviously did neither given you are connecting to jitsi.riot.im. https://github.com/vector-im/element-web/blob/develop/docs/jitsi.md#configuring-element-to-use-your-self-hosted-jitsi-server

[hex-m]

You can check if your Server defines a custom Jitsi Meet instance to be used by checking the .well-known entries. e.g. https://kif.rocks/.well-known/matrix/client

{
  "m.homeserver": {
    "base_url": "https://matrix.kif.rocks"
  },
  "m.identity_server": {
    "base_url": "https://matrix.kif.rocks"
  },
  "im.vector.riot.jitsi": {
    "preferredDomain": "meet.kif.rocks"
  }
}

If there is none defined the Element clients fall back to https://jitsi.riot.im/.

To avoid that you can use Element-Desktop and change the local config to point to your preferred Jitsi Meet instance.