5 ms·

This is so disappointing. Especially Jabber/XMPP was created to fix that issue by standardizing the protocol. The idea is that IM would be like email - no cent

by takeda 11y ago

This is so disappointing. Especially Jabber/XMPP was created to fix that issue by standardizing the protocol. The idea is that IM would be like email - no central server. Others (GTalk, Facebook, WhatsApp, HipChat to name few) started implementing it but did not enable server to server communication (ok GTalk did, but as soon as they became popular they intentionally broke it with Hangouts). So now we have bunch of services that use same protocol but still can't communicate with each other, the XMPP seems like it is dying. A while ago there were plenty of server-side transports to help migrate to XMPP, but it doesn't seem like they are no longer being developed. I don't understand why no one cares anymore about decentralizing and standardizing IM.

rekoros 11y ago
I think because it's a "nice-to-have", not a "must-have". (We have SMTP, a must-have.) There is no such thing as a "nice-to-have" universal protocol.
zanny 11y ago
People do care. I'm working on a Qt Matrix client for KDE / maybe eventually Telepathy. The problem is non-techies do not understand why email is good while messaging is bad. There is no indication as to where these problems would come from, and they have no insight into why the problem happens in the first place, while they gleefully eat up iMessage / Facebook Messenger / Skype / Hangouts / Whatsapp.
- teekert 11y ago
  Because to a non-techy, running a messaging server is just as out of reach as running a mail server. It's just too difficult.
  - iheartmemcache 11y ago
    Lots easier than before. Off the top of my head: 1: You have more than enough 'power users' who keep their machines on 24/7 for torrent seeding. VirtualBox is free & those guys are fairly security conscious as a result of the inherent defensive nature of torrenting (MPAA litigation, etc). Give them a VBox server they can run and they'd happily do it. Now grandma can use his server no problem, in the same way that you only needed 1 techie in your group (pre-AOL) to host an SMTP server. The real difficulty is convincing grandma that she needs to leave "AOL".
    - teekert 11y ago
      That is oversimplifying, for example what happens when Microsoft seems to make your email to your brother in-law disappear and they tell you they have no control over their spam filters? Or when you sent out birthday invites and every Yahoo user you know presents you with an automated message that your server has been banned forever from sending them mail? So you set out to get SPF records, get DKIM working, get certs... and it doesn't help. Also, running torrents is different from getting all the DNS set up and forwarding all the ports. And even then, where I live, out of the 10 or so fiber providers I can choose, I know that only 2 allow me to do anything with port 25. It can be a Pita.
  - takeda 11y ago
    One doesn't need to run own server, they can use one of the public ones: https://xmpp.net/directory.php https://xmpp.net/directory.php Similarly how it's done with mail.
zamalek 11y ago
The problem is that the IM protocol space seems very opinionated. "XMPP? XML sucks!" "Web sockets? Web sockets suck!" "JSON? JSON sucks!" "Binary? That prevents telnet, binary sucks!" People do care, it just seems as though they care about their pet peeves more.
- iheartmemcache 11y ago
  That "XML" sucks thing is why we don't have single-sign on (YuBiKey is doing a great job getting half way there though). We keep on reinventing the wheel re: authorization & authentication despite the fact that there are well-defined, cryptographicly secure[0]. SAML2[1] has been standardized, implemented, operates in a similar fashion to SMTP/Kerberos (i.e., your identity is established (i.e. authentication) purely through a trusted-source), after which you can proceed. * This eliminates the whole issue for users (I don't want to have to remember 40 million passwords, and I don't want to rely on Google as my SSO). * It helps the developer because all he has to do is implement one protocol (rather than make 8 different accounts to register passport.js with). * It helps the tin-foil hatters like me, because I can revoke access from any source at any time & if my account gets compromised I call my buddy Bill hosting the IDP and invalidate my credentials. It's SMTP mail back in the late 90s when your buddy ran his own server as your primary MX, and his buddy as a secondary MX (i.e., you host an IdP similarly to hosting a mail server). I've been working on this problem on and off for about 10 months, the last 4 of which have been fairly rigorous. I've got a solution for the "buddy" willing to host the IdP. https://github.com/bergie/passport-saml https://github.com/bergie/passport-saml is a low friction add-on to your node app for the developers. The last piece of the puzzle is dev adoption (i.e., getting traction on par with LetsEncrypt) to actually spend 5 minutes for that passport-saml stuff. The other issue is developing an easy solution (easier than SSO with Google) done by mobile App authentication. User-flow is basically: you click "Login with <name>", the IdP forwards the message to your mobile via APN, and you swipe left or right to auth. That's the last technical barrier (user adoption is 80% of the problem). I need to take ~3 mo off and pony up high-five, low-sixes in fees re: getting a great UX guy (I'm abysmal [[if you're great at UX, contact me]]), lawyers, liability insurance, a security firm to audit, etc (there's already a monetization model for this venture, though the whole thing will be GNU AGPL[3] / free for universities / research institutions, etc.) [0] Like, in the formal mathematically proven sense, both in concept, and implementation (though which one slips my mind). [1] http://wso2.com/library/articles/2010/07/saml2-web-browser-based-sso-wso2-identity-server/ http://wso2.com/library/articles/2010/07/saml2-web-browser-b... [2] Encryption is basically a subset of privacy, which I think we have a constitutional right to, though other people object. [3] The whole point is to do this first as a human good, but profiteer off expensive licenses a la Exchange modules, et al. I don't really want to shop around Sandy Hill but if any of you successful Angels (who are historically privacy advocates, I'd give Karsten Nohl or DJB (or hell, PG if you're reading this message haha, 30% and 2 seats in a second, but Larry Ellison could offer 3MM for .1% and that meeting would conclude rapidly) are interested, e-mail me me -- we'd be able to go to market a lot quicker with 2 or 3 FTE's. I'm going to complete this anyways, but we're fighting cryptowars again so there might be a rush.
pjc50 11y ago
GTalk did, but as soon as they became popular they intentionally broke it This is the thing. If nobody owns it, nobody can exploit it; if nobody can exploit it, it can't get VC funding.

by takeda 11y ago

rekoros 11y ago

I think because it's a "nice-to-have", not a "must-have". (We have SMTP, a must-have.) There is no such thing as a "nice-to-have" universal protocol.

zanny 11y ago

People do care. I'm working on a Qt Matrix client for KDE / maybe eventually Telepathy. The problem is non-techies do not understand why email is good while messaging is bad. There is no indication as to where these problems would come from, and they have no insight into why the problem happens in the first place, while they gleefully eat up iMessage / Facebook Messenger / Skype / Hangouts / Whatsapp.

teekert 11y ago
Because to a non-techy, running a messaging server is just as out of reach as running a mail server. It's just too difficult.
- iheartmemcache 11y ago
  Lots easier than before. Off the top of my head: 1: You have more than enough 'power users' who keep their machines on 24/7 for torrent seeding. VirtualBox is free & those guys are fairly security conscious as a result of the inherent defensive nature of torrenting (MPAA litigation, etc). Give them a VBox server they can run and they'd happily do it. Now grandma can use his server no problem, in the same way that you only needed 1 techie in your group (pre-AOL) to host an SMTP server. The real difficulty is convincing grandma that she needs to leave "AOL".
  - teekert 11y ago
    That is oversimplifying, for example what happens when Microsoft seems to make your email to your brother in-law disappear and they tell you they have no control over their spam filters? Or when you sent out birthday invites and every Yahoo user you know presents you with an automated message that your server has been banned forever from sending them mail? So you set out to get SPF records, get DKIM working, get certs... and it doesn't help. Also, running torrents is different from getting all the DNS set up and forwarding all the ports. And even then, where I live, out of the 10 or so fiber providers I can choose, I know that only 2 allow me to do anything with port 25. It can be a Pita.
- takeda 11y ago
  One doesn't need to run own server, they can use one of the public ones: https://xmpp.net/directory.php https://xmpp.net/directory.php Similarly how it's done with mail.

zamalek 11y ago

The problem is that the IM protocol space seems very opinionated. "XMPP? XML sucks!" "Web sockets? Web sockets suck!" "JSON? JSON sucks!" "Binary? That prevents telnet, binary sucks!" People do care, it just seems as though they care about their pet peeves more.

iheartmemcache 11y ago
That "XML" sucks thing is why we don't have single-sign on (YuBiKey is doing a great job getting half way there though). We keep on reinventing the wheel re: authorization & authentication despite the fact that there are well-defined, cryptographicly secure[0]. SAML2[1] has been standardized, implemented, operates in a similar fashion to SMTP/Kerberos (i.e., your identity is established (i.e. authentication) purely through a trusted-source), after which you can proceed. * This eliminates the whole issue for users (I don't want to have to remember 40 million passwords, and I don't want to rely on Google as my SSO). * It helps the developer because all he has to do is implement one protocol (rather than make 8 different accounts to register passport.js with). * It helps the tin-foil hatters like me, because I can revoke access from any source at any time & if my account gets compromised I call my buddy Bill hosting the IDP and invalidate my credentials. It's SMTP mail back in the late 90s when your buddy ran his own server as your primary MX, and his buddy as a secondary MX (i.e., you host an IdP similarly to hosting a mail server). I've been working on this problem on and off for about 10 months, the last 4 of which have been fairly rigorous. I've got a solution for the "buddy" willing to host the IdP. https://github.com/bergie/passport-saml https://github.com/bergie/passport-saml is a low friction add-on to your node app for the developers. The last piece of the puzzle is dev adoption (i.e., getting traction on par with LetsEncrypt) to actually spend 5 minutes for that passport-saml stuff. The other issue is developing an easy solution (easier than SSO with Google) done by mobile App authentication. User-flow is basically: you click "Login with <name>", the IdP forwards the message to your mobile via APN, and you swipe left or right to auth. That's the last technical barrier (user adoption is 80% of the problem). I need to take ~3 mo off and pony up high-five, low-sixes in fees re: getting a great UX guy (I'm abysmal [[if you're great at UX, contact me]]), lawyers, liability insurance, a security firm to audit, etc (there's already a monetization model for this venture, though the whole thing will be GNU AGPL[3] / free for universities / research institutions, etc.) [0] Like, in the formal mathematically proven sense, both in concept, and implementation (though which one slips my mind). [1] http://wso2.com/library/articles/2010/07/saml2-web-browser-based-sso-wso2-identity-server/ http://wso2.com/library/articles/2010/07/saml2-web-browser-b... [2] Encryption is basically a subset of privacy, which I think we have a constitutional right to, though other people object. [3] The whole point is to do this first as a human good, but profiteer off expensive licenses a la Exchange modules, et al. I don't really want to shop around Sandy Hill but if any of you successful Angels (who are historically privacy advocates, I'd give Karsten Nohl or DJB (or hell, PG if you're reading this message haha, 30% and 2 seats in a second, but Larry Ellison could offer 3MM for .1% and that meeting would conclude rapidly) are interested, e-mail me me -- we'd be able to go to market a lot quicker with 2 or 3 FTE's. I'm going to complete this anyways, but we're fighting cryptowars again so there might be a rush.

pjc50 11y ago

GTalk did, but as soon as they became popular they intentionally broke it This is the thing. If nobody owns it, nobody can exploit it; if nobody can exploit it, it can't get VC funding.