#xmpp #omemo #conversations #psi #gajim #zom #chatsecure #dino #jsxc #federation #encryption
Why it took us more than two years to enable End-to-End encryption by default: The first in a series of essays leading up to the release of Conversations 2.0
The other big hurdle we had to overcome was the adoption rate in clients. If you send OMEMO encrypted messages by default you should have a reasonable expectation that your contact will be able to decrypt the message. Reasonable expectation doesn’t mean that every single client out there has to support it—In an ecosystem with hundreds of small, badly maintained clients that’s just not feasible—but the major clients should at least have a plugin available.
In March 2018 we finally reached the point where every plattform has one or more clients with OMEMO support. Conversations and Zom on Android, ChatSecure on iOS, Psi and Gajim on the desktop. The up and coming desktop client Dino—despite not having had an initial release—already has support for OMEMO as well. And even the webclient JSXC has a plugin available.
Considering the complexity of OMEMO and the fact that most of these clients are developed by people in their spare time, this is actually quite an impressive adoption rate.
Moxie Marlinspike, in his 2016 propaganda piece ignorantly bashing XMPP, had one valid point: Enabling end-to-end encryption in a homogenous environment is easier than introducing it in a heterogenous one like Jabber. Nobody is denying that. However, if something is hard to achieve there are two possible approaches: Either try your best and don’t give up, or put your head in the sand and create yet another walled garden that is no different from other proprietary solutions.
Admittedly it has taken us a while to get to a point where we can enable end-to-end encryption by default, but it was worth the effort in that we ended up with something that is different from WhatsApp in more than just marketing.
#slack #xmpp #federation #surveillancecapitalism
When we talk about "federation" in networks, we mean the ability to communicate between different service providers.
For example, email is federated. You can set up your own email server, and then send emails to people with their own email servers, or to people with Gmail or Yahoo! accounts.
You can email any other email address in the world, regardless of where that email address is hosted.
If email never existed, and a company like Slack today would come out with this brand new concept of "Electronic Mail", let's call it
digimail, do you think they would standardise the digimail protocol and allow you to send messages to other digimail purveyors?
We all know the answer to that. They won't, and neither would Google, Microsoft or Facebook.
Heck, Facebook is actively trying to replace email since years.
The reason email is federated, is because it was developed before surveillance capitalism was a thing and because it was established and entrenched long before these companies came around.
There's a reason why your email address is still the de facto way to sign up for any service on the web (sometimes with one or two degrees of separation), and it's because of federation.
XMPP is designed to allow federation. Think about that. Instead of having to sign up to various different chat providers, all which try to lock you in and monetize your conversations, you could instead have one chat account, and use that to chat with anybody else, regardless of which chat provider they are using.
Alas, that's the dream, but because XMPP came much later to the scene, it didn't develop the critical mass as email has, and here we are. With dozens of chat apps, all non-interoperable and closed off.
IRC is a communication mode (technically a communication protocol) used by many Free Software projects for communication and collaboration. It is serving these projects well even 30 years after its inception. Though I'm pretty much okay with IRC I had a problem of not able to use IRC from the mobile phones. Main problem is the inconsistent network connection, where IRC needs always to be connected. This is where I came across Biboumi.He then explains in detail how to configure Ejabberd with Biboumi and how to actually use Biboumi from the XMPP client, e.g. Conversations. Worth a read!
Biboumi by itself does not have anything to do with mobile phones, its just a gateway which will allow you to connect with IRC channel as if it is a XMPP MUC room from any XMPP client. Benefit of this is it allows to enjoy some of XMPP feature in your IRC channel (not all but those which can be mapped).
I have grudgingly joined three Slack workspaces, due to me being part of proejects that use it as a communications center for their participants. Why grudgingly? Because there is very little that it adds to well-established communications standards that we have had for long ~~years~~ decades.See also @Carl Chenet, another Debian developer, post The Slack Threat.
On this topic, I must refer you to the talk and article presented by Megan Squire, one of the clear highlights of my participation last year at the 13th International Conference on Open Source Systems (OSS2017): «Considering the Use of Walled Gardens for FLOSS Project Communication». Please do have a good read of this article.
Thing is, after several years of playing open with probably the best integration gateway I have seen, Slack is joining the Embrace, Extend and Extinguish">-minded companies. Of course, I strongly doubt they will manage to extinguish XMPP or IRC, but they want to strengthen the walls around their walled garden...
So, once they have established their presence among companies and developer groups alike, Slack is shutting down their gateways to XMPP and IRC, arguing it's impossible to achieve feature-parity via the gateway.
Of course, I guess all of us recognize and understand there has long not been feature parity. But that's a feature, not a bug! I expressly dislike the abuse of emojis and images inside what's supposed to be a work-enabling medium. Of course, connecting to Slack via IRC, I just don't see the content not meant for me.
The real motivation is they want to control the full user experience.
Well, they have lost me as a user. The day my IRC client fails to connect to Slack, I will delete my user account. They already had record of all of my interactions using their system. Maybe I won't be able to move any of the groups I am part of away from Slack – But many of us can help create a flood.
Say no to predatory tactics. Say no to Embrace, Extend and Extinguish. Say no to Slack.
Language will probably be English or German. Or Volapük. Let's see.
Let's talk about Movim, and about the XMPP Summit!
This time, we will talk about Movim (the "kick ass social network"!), and about the latest XMPP Summit, which took place in Brussels a few weeks ago. Hope to see you all on Monday!
Version 0.3, 2017-12-30#xmpp #jabber #spam #spim #yaxim #draft #federation #abuse #server #s2s #manifesto
The Jabber network (a federated set of thousands of servers with many
tens or hundreds thousands of users) is under a continuous flood of spam
messages for multiple years. Similar to the open email relays of the
mid-1990s, public (and often abandoned) XMPP servers are being abused to
deliver those messages.
We, as the operators of public XMPP servers, commit to the following
Server Policies to fight spam on our servers, and we announce our intent
to block incoming communication from public servers that distribute spam
messages and do not adhere to the Server Policies. Furthermore, we
will inform other Public Server operators and the general public of
domains sending spam and not reacting to abuse reports.
A Public Server is an XMPP server that allows both the registration of
accounts by third parties (either via [In Band Registration][XEP-0077]
or by other means, like a web form), and federation to other XMPP
servers, making it possible for its users to reach out to other XMPP
The operators of a Public Server shall perform the following actions to
* Implement [XEP-0157: Contact Addresses for XMPP Services][XEP-0157] and
react to incoming abuse reports in a timely fashion.
* Limit the number of new user registrations per IP address and hour.
* Monitor or block registrations from IP addresses with bad reputation
(open proxy servers, Tor exit nodes), or enforce additional checks on
those users, like a CAPTCHA or a valid phone number.
* Throttle the traffic from local clients, especially unsolicited
subscription requests and messages.
With our signature under this Manifesto, we assure that our servers are
already following the above stated Server Policies.
Starting with July 1st, 2018, we will start blocking incoming server
connections from Public Servers not following the Server Policies above,
if those are forwarding spam messages to our users. The blocking message
will contain a reference to this Manifesto.
Georg Lukas, yax.im (https://yaxim.org/yax.im/)
Converse.js is a web based XMPP/Jabber instant messaging client.Converse.js can be integrated into Ruby on Rails, Django, Plone, Roundcube, Wordpress, Alfresco, Friendica and many more.
It enables you to add chat functionality to your website, independent of any specific backend. You will however need an XMPP server to connect to, either your own, or a public one.
What's in the release?(I would not enjoy working too much in the "JS ecosystem". Ecosystem? Is this the new term for hazardous waste site?)
No more jQuery
The last straw for me was when jQuery 3 came out, and half of Converse.js's ~240 tests failed once I plugged it in.
After spending some time trying to figure out what backward incompatible changes they made and how I should update the code, I decided to instead rip jQuery out entirely.
* Ported to GTK3 / Python3Congratulations!
* Flatpak support
* Lots of refactoring
* New Emoji support
* New Chat Window design
* New StartChat Window (Ctrl+N)
* New ServerInfo Window
* AccountWindow Redesign
* Moved some encryption code out into Plugins (see PGP Plugin, Esessions Plugin)
* OTR Plugin was not ported, use OMEMO
* Added mam:1 and mam:2 support (mam:0 was removed)
* Added MAM for MUCs support
* Added support for showing XEP-0084 Avatars
* Added xmpp URI handling directly in Gajim
* Removed Gajim-Remote
* Removed XEP-0012 (Last Activity)
* Removed XEP-0136 (Message Archiving)
* Added XEP-0156 (Discovering Alternative XMPP Connection Methods)
* Added XEP-0319 (Last User Interaction in Presence)
* Added XEP-0380 (Explicit Message Encryption)
* Added Jingle FT:5 support
Q: What motivated you to develop Conversations?#conversations #freesoftware #xmpp #android #interview #pgp #otr #omemo #forwardsecrecy #xda
A: I am using Jabber/XMPP for many many years. Even back in 2009 I was able to use Jabber on my Nokia e71. Sometime around the year 2012 I switched to an Android phone, so I suddenly was unable to use Jabber. [...]
Q: Can you give three reasons why Conversations protects your privacy better than Whatsapp or Threema?
A: I don’t have to give my private phone number to strangers if I want to chat with them. I could have a private and a business account. I can disable the business account after my shift, to prevent my boss from annoying me during my free time. WhatsApp allows everybody to analyze my app usage patterns any time. (My boss could stalk me to investigate if I am using WhatsApp during my working hours or if I am using WhatsApp at night instead of sleeping and coming well rested to the office.) This is different with Conversations; Conversations also doesn’t upload my entire address book to Facebook.
Q: Is it allowed to compile Conversations on your own from your Github and use it for private use?
A: Of course. Not only private, also for business and everything else you want. It is also allowed to modify the code to meet individual requirements.
Movim is a distributed social networking platform founded in 2010. It can be accessed using existing XMPP clients and Jabber accounts, and is a free and open source software licensed under the AGPL.#movim #ejabberd #socialnetwork #federation #xmpp #agpl #prosody #debian #freesoftware
With version 0.12 released in October, Movim migrated its official server to ejabberd. Before, they were using Metronome, a Prosody fork. Today, we are chatting with Timothée Jaussoin, the founder of Movim, about this very complex migration.
We now have a proper packaging for our Linux distribution – Debian, which certainly makes it easier to maintain. There’s also an improved scalability and more stable CPU and memory consumption, which helps to predict hardware requirements.
Even if I see ejabberd more as a tool that needs integration and tuning to create a proper platform, ejabberd seems to be the more serious solution to build proper messaging systems using the XMPP protocol.
There is also a short demo video. Nice!
- it's decentralized and federated, no need to have X accounts to use X tickets handlers. You can also import tickets from third party projects (e.g. plugins for your project) into your website.
- it's standard: we can handle or fetch tickets in third party servers easily, without proprietary API.
- it's very flexible: any field can be used, and the mechanism can be used for any list (bug tracker, TODO list, shopping list, etc.)
- being based on SàT, it's usable on any platform
- it can be used with gateways, allowing to use transparently tickets from other services (think about Gitlab or Github for instance)
$ echo deb https://deb.debian.org/debian/ experimental main | sudo tee /etc/apt/sources.list.d/experimental.list
$ sudo apt update
$ sudo apt -t experimental install dino-im
deb https://deb.debian.org/debian/ experimental main
Google Search -> DuckDuckGo (free)I understand, that they advertise their own service here. And while I do believe, that DuckDuckGo does not cheat and keeps your searches private, as a user, one cannot prove it. In any case, one just replaces one centralised search machine with another one. Better use a decentralised service, such as meta search engine Searx.
Let's start off with the easiest one! Switching to DuckDuckGo not only keeps your searches private but also gives you extra advantages such as our bang shortcuts, handy Instant Answers, and knowing you're not trapped in a filter bubble.
Android -> iOS (paid)This is certainly the worst recommendation in their list. I had to check the date of the article, when I read this. Aprils Fool's Day? I'm certainly not a fan of Android and I'm not an Android user anymore, but going for a much more restrictive jail is just stupid. Android has at least relatively free versions, e.g. Replicant. iOS, in contrast, is a carcel with beautifully painted walls. Very high walls with perfectly styled barbed wire on top. Even the most proprietary variants of Android let you at least install free software from F-Droid.org.
The most popular alternative to Android is of course iOS, which offers easy device encryption and encrypted messaging via iMessage by default. We also have tips to increase privacy protection on your iPhone or iPad.
Google Allo -> Signal (free)Again, they recommend to leave one centralised service for another one. And one, that even wants your phone number, otherwise you can't use it. And one, that does not yet have a decent client for Linux. There are messengers around that are federated or completely decentralised, that do not force you give them your phone number, and that have native clients for all major operating systems. My recommendation is XMPP. If you are on Linux, use e.g. Gajim, on Android the best app is probably Conversations, for iOS there is ChatSecure and so on. Alternatives to XMPP are Ring, Matrix and more recently Wire.
There are several services offering private messaging but, as we've mentioned before, Signal gets our recommendation. It offers free, end-to-end encryption for both messages and private calls. It's also recommended by Edward Snowden and renowned security expert Bruce Schneier, among others.
Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety.One should also not give up libre software, which is essential in many ways, to purchase a little perceived safety or privacy through non-free or centralised services.