Daniel Gultsch

Daniel Gultsch's response is also worth reading: https://gultsch.de/objection.html

> Would love to be pointed to the best counterarguments, but again the focus on product was the interesting take for me. I attempted to summarize the trade-offs in this post: https://snikket.org/blog/products-vs-protocols/ There are also a number of responses written by others, such as: - An Objection to "The Ecosystem is Moving": https://gultsch.de/objection.html - "Re. The Ecosystem is Moving": https://blog.jabberhead.tk/2019/12/29/re-the-ecosystem-is-moving/ - "Have you considered the alternative?" https://homebrewserver.club/have-you-considered-the-alternative.html

Moxie's argument can be found in its essay "the ecosystem is moving"[1], which is highly fallacious. Moxie's Signal is about control and building for himself the same kind of monopoly as others currently enjoy. You can find evidence of that through the libresignal issue tracker on GitHub where he rationalizes barring access to 3rd party clients or servers[2]. He sees federation as the technically superior approach (and as beneficial for privacy and security), but also as a threat to himself, which makes the point that he doesn't have your best interests at heart. [1]: https://gultsch.de/objection.html [2]: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-2172…

Moxie Marlinspike, of Open Whisper Systems, had some pretty pessimistic things to say about how stagnant federated protocols become, and why they avoided that approach with Signal. https://signal.org/blog/the-ecosystem-is-moving/ End result: Signal is a real, usable tool, the recommendation of which is fully actionable security and privacy advice you can share with anyone who is capable of using WhatsApp. Here's some HN discussion on the post, and a piece with counter arguments. The latter, I feel, misses the entire point of how urgent the need for usable privacy and security tools is. https://news.ycombinator.com/item?id=11668912 https://gultsch.de/objection.html

> I mean we have XMPP and companies use it to build products but if they prefer they prefer standards and protocols that work well in the smartphone era. As late as 2016 XMPP had next to zero support for features expected in a mobile-first world: https://gultsch.de/xmpp_2016.html. Most XEPs in the article were at experimental stage or draft at the time, and are still in the same status nearly three years later. Some of them like XEP 0352 are "Implementation of the protocol described herein is not recommended for production systems".

> it didn't happen before (at least for XMPP). It was the niche of niches but the Nokia n900's standard built in xmpp client could do voice/video/filetransfer with a gnome desktop's standard messaging infrastructure (telepathy or something?) in what, like 2010 ? But, besides that, I get what you're saying about "normal" messengers and conversations nowadays. So good. Thanks Mr. Gultsch[0] ! [0] https://gultsch.de/

I wouldn't subscribe to the "15 years ago" statement, but we have figured out mobile battery use pretty well, and the respective solutions are avialable in both server and client implementations. Have a look at [0] and [1] for (slightly biased but more detailed) elabortations. simply declaring it a myth is, I suspect, unlikely to convince remaining skeptics It's hard to provide specific counter-arguments to anecdotal evidence repeated since back when gtalk was a thing. [0] https://gultsch.de/xmpp_2016.html [1] https://wiki.xmpp.org/web/index.php?title=Myths#Myth_Three:_It.27s_too…

Conversations is great, but there's nothing comparable on iOS except Chatsecure which isn't yet beta quality. Then you need to pair it with a server that actually has all the recent XEP's installed (for push is XEP357, usually missing), see: https://gultsch.de/compliance_ranked.html My current 'solution' is to use ZNC connected to Bitlbee (supporting OTR). On Bitlbee I use the jabber.fr service. ZNC has a push script for Mutter (great iOS IRC client) that I modified to redact my notification content from Apple's push service. I connect to the ZNC with TLS, so in theory everything should be ok. NOT USER FRIENDLY but allows me to keep all my chats in one client and not tied to some shitty walled garden. Everyone less savvy I just tell them to use Signal.

> some reasonable (against forks using their servers) (...) justifications How is that reasonable in a centralized client-server model? That's precisely what we find unreasonable with Twitter and others shutting down or making life hard for 3rd party clients. Why would it be more acceptable from a free-software service? The network effect says a centralized protocol like Signal has "zero" value without reusing the same servers. All this because Signal maintainers have an ideological argument against decentralization, which received many great responses including this one from a Jabber/XMPP client developer: https://gultsch.de/objection.html In all cases, Signal servers control who has an account, what permissions and what can be posted. You can't just extend the protocol to enrich your client by abusing Signal's servers, but you can make your client compatible with Signal protocol (interoperability). Preventing that is rather user-hostile.

> I'd wager to say the protocol/backend is the easy part. And yet, in 2016, 9 years after the first iPhone, XMPP still struggled to provide any of the modern conveniences on the protocol level: https://gultsch.de/xmpp_2016.html (at the time most of the links marked as "solution available" were going to experimental and beta proposals) The protocol/backend can be, and often is, as much hindrance as the clients.

And another response from another person who worked on a federated protocol (Daniel Gultsch, the main developer of the Conversations XMPP client): https://gultsch.de/objection.html

That is a situation documented by people years ago, and has been wrong for years. See https://gultsch.de/xmpp_2016.html. Unfortunately the legend lives on because "it doesn't work" is a better soundbite than "it works"

The mobile problem for XMPP is solved since 2016 : https://gultsch.de/xmpp_2016.html

This talk is basically an elaboration of Moxie's blog post from 2016 with the same name [1]. See also a response to this blog post by Daniel Gultsch, developer of the popular Android XMPP app Conversations [2]. [1]https://signal.org/blog/the-ecosystem-is-moving/ [2]https://gultsch.de/objection.html

As someone who has worked extensively with XMPP in the last ~6 years let me tell you that it works fine with network hopping, multiple devices and everything else you'd come to expect from a modern IM experience in the likes of WhatsApp and Signal. I have written a lengthy article in 2016 in the state of mobile XMPP: https://gultsch.de/xmpp_2016.html The situation has only improved from there.

For those who want to know why it still should be federated: https://gultsch.de/objection.html

You mean OTR? 1. OTR is some old hack and not really usable 2. OTR has nothing to do with XMPP at all OMEMO only really needs XEP-0163, the thing which also gives you avatars and such, supported nearly anywhere. There is some problem that you can't access the key of someone who did not add you yet to the contact list on older implementations [1] but that does not make it unusable. > I am not inclined to positively review a chat protocol that frequently fails to deliver messages. XMPP delivers, if you encrypt them with the wrong key it can do nothing about. [1] https://gultsch.de/omemo_by_default.html

Actually, I think it is wrong to call it TOFU as it simply doesn't require the user to opt-in to anything. Instead, it seems more like the thing the XMPP people call 'blind trust before verification' [1]. I am not quite sure if it is exactly the same as 'blind trust before verification' changes its behavior as soon as you explicitly verified the keys. That way everybody can use somehow e2e encrypted messages, but if you really care about the security you validate your keys and get a real trusted e2e encryption. [1] https://gultsch.de/trust.html

It's good to compare this with views on the other side: https://gultsch.de/objection.html

IIRC, the main criticism was against federation, and not XMPP itself. Daniel Gultsch, the author Conversations (XMPP Android App), wrote a response: https://gultsch.de/objection.html

> awkward key exchange/setups of XMPP clients What do you mean by that? Conversations.im establishes e2e secure session without any fingerprint approving interaction whatsoever. Of course you can manually scan barcodes for paranoid mode but that's not necessary. For me it's a perfect balance between convenience and security. Read more at https://gultsch.de/trust.html

Well, if the server and the client support the required extensions the battery impact is very low: https://conversations.im/#optimizations Those extensions are pretty standard stuff nowadays. Here you can find an explanation with a few more details (section "Battery drain"): https://gultsch.de/xmpp_2016.html

Fragmented is not the right word, it is federated. Many clients suck, not all. Be sure to choose a good server: https://gultsch.de/compliance_ranked.html And a good client: https://omemo.top Dino is a new Linux client. It's nice and simple.

The maintainer of the "Conversations" XMPP client wrote an interesting response to that article: https://gultsch.de/objection.html

Most public servers are pretty bad in terms of modern XMPP features [1]. Trust is also a big issue, but one of our goals is to solve this problem by making it much easier to run your own server. We currently default to Dukgo for new registrations but they don't support many of the XEPs required for a good mobile experience (0198, 0313, 0357). 1. https://gultsch.de/compliance.html

It's fairly new, but OMEMO was just officially published (now that there are free specs available to reference and everyone can be sure there won't be weird legal trouble later), and Conversations (an XMPP client for Android) has just started using a new Trust model (https://gultsch.de/trust.html). It's early days, but I can see this being a good compromise between security and ease of use (like Signal). We'll see.

The claim that XMPP on mobile can only result in lots of bandwith and battery usage is false, according to Daniel Gultsch, developer of the Android XMPP client conversations: https://gultsch.de/xmpp_2016.html Money quote: “XMPP is not suited for mobile devices. That’s a myth that has been around for ages. It is mostly spread by people who want to sell you their own proprietary instant messaging solution.” From my own experience, high battery usage is the fault of the XMPP client. Regarding bandwith, I have been chatting over throttled 3G and regular 2G connections. The initial connection takes noticeably longer, otherwise everything except file transfers seems fine.

I still use XMPP to connect to google talk and converse with people who are using hangouts. I use "Conversations" on Android, which works well and also supports OMEMO (the XMPP version of the encryption behind Signal/Whatsapp/etc). I'm effectively doing the equivalent of your facebook+xmpp+otr setup today, but it's googlechat+xmpp+omemo. The author of Conversations recently wrote up the state of XMPP in 2016: https://gultsch.de/xmpp_2016.html So, though you may not be using it anymore, XMPP is far from a dead end.

Ok so a few problems, on every network I've tried. DuckDuckGo: Adding people doesn't seem to work via QR code, at all. And the client gets weird when trying to delete the account. evil.im: Adder never gets notified that they have been "accepted", so can't view the conversation except via notification. null.pm: Adding works fine, but OMEMO just stays at yellow exclamation marks. dismail.de (supposedly has a fully green bar): No QR code adding, no notification of accepted contact request, OMEMO is fucked. talker.to Basically the same as dismail.de. So is there an actual server that is reliable and supports the requisite features set to make this a usable experience? Are these client bugs? Because otherwise this is going nowhere. I'm sitting next to my mate and cannot actually find a server that allows us to communicate normally. I'm trying to set up a Jabber prosody server and I think it's working. I have no idea how to test if it is really. I got A/A on the server test thing. How do they compile a list like this? https://gultsch.de/compliance_ranked.html Do they have a suite that I can run against my own server?