• 0 Posts
  • 18 Comments
Joined 2 years ago
cake
Cake day: June 9th, 2023

help-circle




  • Good question! Your perspective on that might differ a lot depending on how long you’ve been on the internet.
    In recent years, every major messenger (WhatsApp, Telegram, Signal, …) has been doing it this way, linking your phone number to your identity, so your contacts are automatically discovered from your address book (and reciprocally, people who have your phone number already will find you easily and as soon as they install the app you recommended to them). If that’s all you’ve ever known, not only is that not a bug (or rather, a major privacy and identity linkage breach), that’s a convenient feature, and you kind of expect things to work that way. I personally don’t like that (and I’m aware of being a dying species).

    Now, regarding Prav, please don’t use it (for the time being, at least). As far as I can tell, this is a fork of the Conversations/quicksy.im XMPP clients (Conversations being the original work, and Quicksy being a derivative by the same author using the phone number discovery / easy onboarding approach discussed here). Unlike the original which is very safe and reputable, whose author is known and very active within the XMPP/security communities, and whose hosted service has years and years of excellent service and uptime under its belt, this one comes out of nowhere, from an unknown contributor (afaict), has no funding model to suggest it being sustainable, and worse, no rationale as to why it exists in the first place (why would it be chosen over the original). So, my recommendation is to stick to those.

    Back to the original question, thanks to Quicksy.im having been around for several long years already, the debate of having phone numbers being used for identification on XMPP is not really something new. Having been there for a very long time and seen the before/after, indeed this has enabled some of my current contacts (who were already users of other services like WhatsApp and certainly didn’t mind) to get on board a bit more easily. They are not the majority, so, and in all, I’m glad that the option exists, it’s not as big a deal as it might seem for XMPP in general.


  • The factor that is keeping me on Matrix is that I have all diffrent chats with people on different platforms in one client that is cross platform.

    yeah, as I wrote above, that’s no different in XMPP (but probably much more secure and better maintained: till recently most of the bridging in matrix-world was leveraged by libpurple, which has an horrendous security track-record).
    If you are getting into bridging in XMPP, I recommend giving slidge a try: https://sr.ht/~nicoco/slidge/

    that is is against ToS for most apps

    https://slidge.im/core/user/low_profile.html#keeping-a-low-profile

    google kinda “killed it”.

    And yet it has hundred folds more users than Matrix :) XMPP is ubiquitous (it props up google cloud/nintendo switch push notifications, if your online game has a chat system with million users that’s it, WhatsApp is using it, you have billions of IoT devices running it, …) so just like Linux it can’t really be “killed” at this point as a critical piece of software infrastructure. On the user-facing side, things are alive and kicking with great and well-maintained clients (which is more than can be said about matrix, being a single-source implementation held together by a single company constantly fighting financing issues).


  • Interesting, but I got past that hurdle…

    I was thinking more of the “day to day admin” side of things rather than “getting it running for the first time”: ejabberd really runs like clockwork, demands no effort, no attention, packs all the features you need, and uses close to no resource.
    By that time, I’ve been hosting services for communities for decades, and a good argument in favour of keeping XMPP, no matter how much adoption it would eventually get was that ejabberd is one of most “fire & forget” software I’ve ever deployed. Right now I have an instance running with 500 users and it barely ticks above 150MB RSS.

    In comparison to that, synapse for a dozen users, especially in the early days, was a burning hot mess. The whole stack is rather fragile and I was always worried about something breaking up, or resources going wild. If you are solo admin with users across timezones depending on you, that might matter a lot.


  • You should definitely give XMPP a chance, but not feel bad about ending-up with whichever feels better: they are mostly fine, and largely preferable to the non-standard/non-federated alternatives.
    XMPP is orders of magnitude lighter weight so that might factor in if you have associated costs to running in the cloud.
    If you want to get started the easy way, go with ejabberd, it has sane defaults and lots of convenience (e.g. it embarks a stun/turn server to facilitate calling through NAT, acts as a ACME client to renew certificates automagically, …).
    On Android, Cheogram is a good client to recommend for power-users, Quicksy/Conversations for those who want to use their phone number for contacts auto-discovery. Desktop has Dino/Gajim, (i)OS(X) has SiskinIM, BeagleIM.

    Regarding the libera.chat drama, you can read more here: https://libera.chat/news/temporarily-disabling-the-matrix-bridge
    IMO that tells a lot about the people behind Matrix and their overall attitude (I had the same “trust us”, “it’s gonna be soon, I swear!”, “that was bad luck but it’s gonna be fine!” vibes when interacting with the Matrix team members in the early days).




  • No privacy nightmares compared to WhatsApp

    My whole point was that between Signal and WhatsApp, none is intrinsically better than the other in this regard. Both are centralized and collect the same amount of privacy-sensitive data about you (your online presence and patterns, your IP, your network graph, the routing of your messages and their nature…), because they need that to function. Whether they log it (irrespective of what they advertise) is one thing nobody but themselves can verify and where opensource plays no role.

    Matrix/XMPP are only better because you can self-host if you trust no one, or choose whom to trust, or change whom to trust along the way without incurring a total loss of your contacts, histories, assets, …

    IMO, the sales pitch for XMPP/Matrix shouldn’t be “we are better/more secure/more privacy focused by design” (and it’s pretty clear that the tech-illiterate majority doesn’t care anyway), it should be “with us, you will no longer have to jump ship every 5 years in avg. because facebook/google/amazon/some oligarch/… broke their promise/used their absolute power over your account to their discretion”.


  • I’m selfhosting a Matrix server and have all my Chats from other apps also bridged to there.

    Same here, but with XMPP in place of Matrix. For historical context, XMPP was invented about 25 years ago on the premise that people were already tired of having their instant messaging scattered over multiple protocols (rather than Signal, Telegram, WhatsApp, Discord, iMessage now, it was Yahoo, MSN, AIM, ICQ, … then), so bridging is very much front and center in the XMPP world. Over time, people also realized that bridging sucks in general (you either dumb down your client to the lowest common denominator which sucks for yourself, or your client isolates itself from the source protocol enough that it sucks for everyone else).
    To add insult to injury, most modern protocols also forbid, by their ToS, the use of alternative clients (which very much includes bridges), and to the best of my knowledge WhatsApp, Signal and Discord will eventually suspend your account on this basis.
    Matrix is still trying to carve a niche for itself in this space, and is failing IMO (judging by the quality/security of the bridges they have come-up with, and the recent libera.chat fiasco). I’d say that the situation in this regard in XMPP is only marginally better due to the fact that XMPP had a decade headstart to fail and try over, and I would not recommend using bridges on either of them if that can be avoided.

    It XMPP better for group VC?

    I’d say “it depends”. Fun fact, Matrix uses jitsi-meet under the hood (which is XMPP + a media transcoding/multicasting component that doubles as a relay), and jitsi-meet is my recommendation for this use-case: as long as the central server has good bandwidth, you can really scale up your VC to many attendees. On top of that, XMPP has support for peer-to-peer group VC, with the benefit that hosting is simpler, it doesn’t require any central component/relay (but the bandwidth cost is incurred on all participants and you won’t go beyond a handful of attendees that way).





  • What Matrix metadata leakage are you talking about? Regarding XMPP, I am not aware of anything like it, and I suspect that this leakage you are talking about is just standard client-server signaling, where in federated protocols like Matrix and XMPP you can chose whom to trust (or self-host) whereas in all other cases your metadata isn’t just centralized and consolidated, you have no recourse and knowledge about what’s being done with it.

    On the side of XMPP, OMEMO (which is XMPP’s take on double ratchet encryption à la Signal) is standard across the board of all maintained clients, so you wouldn’t be less secure there than on e.g. Signal or Telegram, so your take on XMPP’s security isn’t factual.


  • Why use Signal over XMPP and Matrix? Signal is centralized and wants you to stay in check, using their crappy client, giving away your phone number, and all your presence, social graph and other privacy sensitive information to a single actor (which can’t be yourself, because you can’t self host signal) and that has nothing to back it up other than “trust me bro, I’m gonna do no harm, but also I control all your communications under my own terms and conditions and there’s nothing you can do about it”.