• 0 Posts
  • 14 Comments
Joined 1 year ago
cake
Cake day: June 9th, 2023

help-circle
  • The factor that is keeping me on Matrix is that I have all diffrent chats with people on different platforms in one client that is cross platform.

    yeah, as I wrote above, that’s no different in XMPP (but probably much more secure and better maintained: till recently most of the bridging in matrix-world was leveraged by libpurple, which has an horrendous security track-record).
    If you are getting into bridging in XMPP, I recommend giving slidge a try: https://sr.ht/~nicoco/slidge/

    that is is against ToS for most apps

    https://slidge.im/core/user/low_profile.html#keeping-a-low-profile

    google kinda “killed it”.

    And yet it has hundred folds more users than Matrix :) XMPP is ubiquitous (it props up google cloud/nintendo switch push notifications, if your online game has a chat system with million users that’s it, WhatsApp is using it, you have billions of IoT devices running it, …) so just like Linux it can’t really be “killed” at this point as a critical piece of software infrastructure. On the user-facing side, things are alive and kicking with great and well-maintained clients (which is more than can be said about matrix, being a single-source implementation held together by a single company constantly fighting financing issues).


  • Interesting, but I got past that hurdle…

    I was thinking more of the “day to day admin” side of things rather than “getting it running for the first time”: ejabberd really runs like clockwork, demands no effort, no attention, packs all the features you need, and uses close to no resource.
    By that time, I’ve been hosting services for communities for decades, and a good argument in favour of keeping XMPP, no matter how much adoption it would eventually get was that ejabberd is one of most “fire & forget” software I’ve ever deployed. Right now I have an instance running with 500 users and it barely ticks above 150MB RSS.

    In comparison to that, synapse for a dozen users, especially in the early days, was a burning hot mess. The whole stack is rather fragile and I was always worried about something breaking up, or resources going wild. If you are solo admin with users across timezones depending on you, that might matter a lot.


  • You should definitely give XMPP a chance, but not feel bad about ending-up with whichever feels better: they are mostly fine, and largely preferable to the non-standard/non-federated alternatives.
    XMPP is orders of magnitude lighter weight so that might factor in if you have associated costs to running in the cloud.
    If you want to get started the easy way, go with ejabberd, it has sane defaults and lots of convenience (e.g. it embarks a stun/turn server to facilitate calling through NAT, acts as a ACME client to renew certificates automagically, …).
    On Android, Cheogram is a good client to recommend for power-users, Quicksy/Conversations for those who want to use their phone number for contacts auto-discovery. Desktop has Dino/Gajim, (i)OS(X) has SiskinIM, BeagleIM.

    Regarding the libera.chat drama, you can read more here: https://libera.chat/news/temporarily-disabling-the-matrix-bridge
    IMO that tells a lot about the people behind Matrix and their overall attitude (I had the same “trust us”, “it’s gonna be soon, I swear!”, “that was bad luck but it’s gonna be fine!” vibes when interacting with the Matrix team members in the early days).




  • No privacy nightmares compared to WhatsApp

    My whole point was that between Signal and WhatsApp, none is intrinsically better than the other in this regard. Both are centralized and collect the same amount of privacy-sensitive data about you (your online presence and patterns, your IP, your network graph, the routing of your messages and their nature…), because they need that to function. Whether they log it (irrespective of what they advertise) is one thing nobody but themselves can verify and where opensource plays no role.

    Matrix/XMPP are only better because you can self-host if you trust no one, or choose whom to trust, or change whom to trust along the way without incurring a total loss of your contacts, histories, assets, …

    IMO, the sales pitch for XMPP/Matrix shouldn’t be “we are better/more secure/more privacy focused by design” (and it’s pretty clear that the tech-illiterate majority doesn’t care anyway), it should be “with us, you will no longer have to jump ship every 5 years in avg. because facebook/google/amazon/some oligarch/… broke their promise/used their absolute power over your account to their discretion”.


  • I’m selfhosting a Matrix server and have all my Chats from other apps also bridged to there.

    Same here, but with XMPP in place of Matrix. For historical context, XMPP was invented about 25 years ago on the premise that people were already tired of having their instant messaging scattered over multiple protocols (rather than Signal, Telegram, WhatsApp, Discord, iMessage now, it was Yahoo, MSN, AIM, ICQ, … then), so bridging is very much front and center in the XMPP world. Over time, people also realized that bridging sucks in general (you either dumb down your client to the lowest common denominator which sucks for yourself, or your client isolates itself from the source protocol enough that it sucks for everyone else).
    To add insult to injury, most modern protocols also forbid, by their ToS, the use of alternative clients (which very much includes bridges), and to the best of my knowledge WhatsApp, Signal and Discord will eventually suspend your account on this basis.
    Matrix is still trying to carve a niche for itself in this space, and is failing IMO (judging by the quality/security of the bridges they have come-up with, and the recent libera.chat fiasco). I’d say that the situation in this regard in XMPP is only marginally better due to the fact that XMPP had a decade headstart to fail and try over, and I would not recommend using bridges on either of them if that can be avoided.

    It XMPP better for group VC?

    I’d say “it depends”. Fun fact, Matrix uses jitsi-meet under the hood (which is XMPP + a media transcoding/multicasting component that doubles as a relay), and jitsi-meet is my recommendation for this use-case: as long as the central server has good bandwidth, you can really scale up your VC to many attendees. On top of that, XMPP has support for peer-to-peer group VC, with the benefit that hosting is simpler, it doesn’t require any central component/relay (but the bandwidth cost is incurred on all participants and you won’t go beyond a handful of attendees that way).





  • What Matrix metadata leakage are you talking about? Regarding XMPP, I am not aware of anything like it, and I suspect that this leakage you are talking about is just standard client-server signaling, where in federated protocols like Matrix and XMPP you can chose whom to trust (or self-host) whereas in all other cases your metadata isn’t just centralized and consolidated, you have no recourse and knowledge about what’s being done with it.

    On the side of XMPP, OMEMO (which is XMPP’s take on double ratchet encryption à la Signal) is standard across the board of all maintained clients, so you wouldn’t be less secure there than on e.g. Signal or Telegram, so your take on XMPP’s security isn’t factual.


  • Why use Signal over XMPP and Matrix? Signal is centralized and wants you to stay in check, using their crappy client, giving away your phone number, and all your presence, social graph and other privacy sensitive information to a single actor (which can’t be yourself, because you can’t self host signal) and that has nothing to back it up other than “trust me bro, I’m gonna do no harm, but also I control all your communications under my own terms and conditions and there’s nothing you can do about it”.