12 ms·

> But: why bother? Email is just one of dozens of messaging systems available to Internet users. No, it's not. It's the only widely available, decentralized sy

by pmlnr 10y ago

> But: why bother? Email is just one of dozens of messaging systems available to Internet users. No, it's not. It's the only widely available, decentralized system, with which you can send to anyone, if you know the address. None of the big ones is this open. XMPP tried to address this and failed; now Matrix is trying again.

mrfregg 10y ago
Forgive my ignorance, but what caused XMPP to fail? Simply the lack of uptake or is there some other reason?
- pmlnr 10y ago
  I've been running my email server for a decade without serious glitches. Setting up my own federated XMPP instance is much more problematic and people are already complaining about how hard email is. I'd love to see an up-to-date tutorial that opposes my statement, eg. setting up prosody (or something lightweight) on debian (or similar) with multiple domains for multiple accounts, sending and receiving test messages from another XMPP hub, so if you know one, please link it.
  - drdaeman 10y ago
    > Setting up my own federated XMPP instance is much more problematic Actually, I believe it's the contrary. With email you have to obtain a valid TLS certificate, set up SPF, DKIM, and keep eye on the DNSRBLs so you're in good standing. And if Big Company's mail service suddenly decides they don't like you, it won't help. Oh, and spamassasin/rspamd/milter/greylisting/etc stuff so your email server doesn't get thousands of emails per day few weeks after some bot detects your host is listening on tcp/25. XMPP has less adoption, spam exists but is much rare, so there's less stuff to do. Install a package, get a TLS cert, publish an SRV record (IIRC that's not even strictly required), and that's it. A bit fewer steps. Not to say email is MTA+MDA combo (+some fancier LDA, +Sieve if you want more that a simple system) while XMPP is a single piece of software (unless you want transports or external extra services).
    - pmlnr 10y ago
      > XMPP has less adoption, spam exists but is much rare, so there's less stuff to do. Install a package, get a TLS cert, publish an SRV record (IIRC that's not even strictly required), and that's it. A bit fewer steps. That's what I thought as well. Please link tutorial on this.
      - problems 10y ago
        Just install prosody and open up the config file. It includes lots of comments and I believe there's even a web admin interface you can enable. XMPP SRV record documentation can be found here, if you need to use it: https://wiki.xmpp.org/web/SRV_Records https://wiki.xmpp.org/web/SRV_Records If you're finding the documentation to be insufficient, let me know, I might write something more detailed up.
      - drdaeman 10y ago
        Personally, I'm using ejabberd, but I wouldn't recommend it. Don't have any good tutorial links at hand, sorry. I'd agree with /u/problems suggestion to try Prosody. http://prosody.im/doc/install http://prosody.im/doc/install + http://prosody.im/doc/configure http://prosody.im/doc/configure + http://prosody.im/doc/dns#srv_records http://prosody.im/doc/dns#srv_records + http://prosody.im/doc/certificates http://prosody.im/doc/certificates are probably all you have to do to get it up and running.
  - SamWhited 10y ago
    This one's a bit minimal since it's designed to fit on a flyer, but it does contain what you need to know; install server of choice, get a TLS cert from somewhere, set DNS records if you want them, done. https://xmpp.org/images/promo/xmpp_server_guide_2017.pdf https://xmpp.org/images/promo/xmpp_server_guide_2017.pdf
- RyanZAG 10y ago
  Google's embrace-extend-extinguish destroyed XMPP. They made their chat system XMPP compatible for a short time which caused many people to swap to their solution. When they ended support, most users simply stopped using XMPP.
  - problems 10y ago
    Did you also notice that Google's messaging system pretty much died out around that point in favor of Skype and similar? I used to see people mention GTalk all the time, but I haven't seen anything similar in years. No one has mentioned G+ or Allo. That decision by Google may have been the thing that killed its user base.
    - ryanbrunner 10y ago
      Hangouts (which I think GTalk turned into) still has some usage - certainly as a quick video conf call solution, and somewhat for text messaging. It definitely doesn't seem to have much of a future though since Google released a bunch of other competing chat applications.
      - gregmac 10y ago
        It's unfortunate because Hangouts is still really awesome. It works really well for video chat (including group chat), but more importantly it works great with multiple devices. I can get a message on my phone, laptop or PC, and reply anywhere, with the conversation and notifications synchronized. I nearly always have my phone with me, but it's really nice to be able to just send someone a link from my PC, for example. It looks like Telegram has multi-device support, but then this kind of thing scares me: > Q: How are you going to make money out of this? > We believe in fast and secure messaging that is also 100% free. > Pavel Durov, who shares our vision, supplied Telegram with a generous donation, so we have quite enough money for the time being. If Telegram runs out, we will introduce non-essential paid options to support the infrastructure and finance developer salaries. But making profits will never be a goal for Telegram. That's not very compelling in terms of investing my effort to switch.
    - 10y ago
- JustSomeNobody 10y ago
  Google, Apple, Facebook, WhatsApp. Everyone[0] is using one of these. None are XMPP or compatible with XMPP. [0] I don't technically mean the entire planet.
  - b2600 10y ago
    Curious why you tossed Apple in there. In worldwide usage it's a fraction compared to the other three. (I feel compelled to state I use an iPhone in order to avoid this comment being interpreted incorrectly).
    - deleted 10y ago
      [deleted]
- cpach 10y ago
  See this essay for some insights: https://whispersystems.org/blog/the-ecosystem-is-moving/ https://whispersystems.org/blog/the-ecosystem-is-moving/
tptacek 10y ago
WhatsApp has over a billion users. There are big places where its market share exceeds that of SMS --- another big centralized service that has a userbase comparable to that of email. My conclusion is that the people who care about "decentralized" systems are a rounding error. I care about non-technologists managing to send asynchronous messages to each other that are well-encrypted by default. That's a solved problem.
- pmlnr 10y ago
  > My conclusion is that the people who care about "decentralized" systems are a rounding error. I care about non-technologists managing to send asynchronous messages to each other that are well-encrypted by default. That's a solved problem. You don't understand the problem: if you rely on a service like this, two things can - and by the laws of probability, will - happen: a, a centralized service goes down and suddenly no one can talk to nobody b, you're unable to send a message to someone and never realize it Imagine if there was _one_ ISP. One single mobile provider. If it goes down, it goes down everywhere, for everyone. Not fun. As for b, I can't remember, but there's a term when a provider let's you post but it won't get show to others. They can also alter messages - see the Whatapp signal implementation issues that certificates can be silently re-issued. You are, unfortunately right though: very few of us realizes how important this is. Thankfully the smarter elders of the internet seem to do. https://www.decentralizedweb.net/ https://www.decentralizedweb.net/
  - tptacek 10y ago
    No, I fully understand the problem. If Google Mail vanished tomorrow, a pretty large number of people would probably stop emailing altogether. The number of people for whom that's true increases every year. If you find that unthinkable, consider the bubble you might be living in. I appreciate that there are people that require a decentralized service for messaging and understand where they're coming from. I don't deny their existence. I simply think their numbers are much smaller than they appear on nerd message boards.
    - problems 10y ago
mxuribe 10y ago
As a happy user of matrix (via riot.im), I sure hope matrix takes off!
- tr1ck5t3r 10y ago
  Matrix is just a mirror paradigm for messaging. Its nothing new except in name.
NoGravitas 10y ago
I feel like Matrix may be the way forward; it also looks like it's possible to build an email-like interface on top of it. But currently, federated Matrix leaks metadata, so that's a problem.
- fgpwd 10y ago
  Agree about Matrix. You get addresses such as @username:example.com , which work somewhat like email addresses. The example.com part is the homeserver, analogous to gmail.com or yahoo.com in emails. Users can communicate across homeservers. It's also fast to setup. Took me about 30 minutes to set up a homeserver and host a customized riot client to use it. It's not completely decentralized yet, and you can only use from a fixed list of identity servers. Although you can set up your own synapse node, you can't yet use it along with the centralized identity servers. The reason they give for not decentralizing the identity servers yet is to avoid spam. But they plan to make them decentralized in the future, so at that point it would completely be like email.
  - Arathorn 10y ago
    Just to clarify: identity servers are strictly optional and are used just for mapping 3rd party IDs (3PIDs) such as phone numbers and email addresses to matrix IDs so you can be discovered or discover other users by 3PID. They are only centralised atm because we haven't really started to attack the problem of decentralising them. What we really need is a decentralised equivalent of Keybase, but nobody has really built a suitable one yet. Blockstack is close, as are a few others, but we'd rather wait until we found something which nailed the problem and stuck with the jury-rig until then. I spoke about this at FOSDEM the other weekend: https://fosdem.org/2017/schedule/event/matrix_future/ https://fosdem.org/2017/schedule/event/matrix_future/ There's also renewed community interest in fixing this over the last few days: #matrix-identity:matrix.org is a thing. I would argue that Matrix itself is fully decentralised; it's just that some of the solutions to the optional identity discovery problem happen to be centralised. Just as some folks publish their Matrix E2E pubkeys on keybase etc. In terms of Matrix revealing metadata: yes, it does so to the servers participating in the convo. This is really not very unusual; the problem of protecting metadata for realtime comms is very much still an open area of research (see Alpenhorn etc from CSAIL)! Hopefully it's not really a reason to turn anyone off Matrix though. I also briefly spoke about this at FOSDEM: https://fosdem.org/2017/schedule/event/encrypting_matrix/ https://fosdem.org/2017/schedule/event/encrypting_matrix/
alkonaut 10y ago
> No, it's not. It's the only widely available, decentralized system, with which you can send to anyone, if you know the address. They have to be email users to have an address. Granted, it's so widespread that even signing up for one of the other messengers often requires an email address, so even the non-email users have email addresses. But I still think email is going to go the way of usenet, non-internet phone calls and the dodo. Perhaps it's too hard fixing email, compared to just moving to something else. Email is obviously hard to solve since it hasn't been solved already.
- NoGravitas 10y ago
  I'm more interested in seeing something that maintains the desirable properties of email while dropping backward compatibility with SMTP. But the 'encrypted messenger' community isn't interested in working on that because they think (apparently?) that email does not have any desirable properties compared to siloed IM systems.
joecool1029 10y ago
> No, it's not. It's the only widely available, decentralized system, with which you can send to anyone, if you know the address. None of the big ones is this open. SS7 is internet connected and federated and it's arguably as big as email. > XMPP tried to address this and failed; now Matrix is trying again. Oh, agreed on XMPP. Encryption was a very much after the fact addition to it though. I haven't heard about Matrix and plugging in 'matrix encrypted email' into search gets 0 relevant results on DDG and is bottom of the page for Google. Maybe the ranking sucks cause the page takes 20s to load the JS shit and it has zero content aside from a bouncing fucking shitball above the fold.
- corv 10y ago
  http://matrix.org/ http://matrix.org/ is a promising decentralized communications protocol. The popular https://riot.im https://riot.im is built on top.
  - joecool1029 10y ago
    > The popular https://riot.im https://riot.im is built on top. Thanks, so it's basically a opensource and federated slack? How does this solve the email encryption use case? (longer form text not requiring presence)
    - NoGravitas 10y ago
      As is, it doesn't. It should be possible to build an app with the email nature on top of the Matrix protocols though, and I'm led to understand there are people working on it.
- ryanmarsh 10y ago
  What is SS7?
  - joecool1029 10y ago
    https://en.wikipedia.org/wiki/Signalling_System_No._7 https://en.wikipedia.org/wiki/Signalling_System_No._7
m3rc 10y ago
By that logic shouldn't we try to encrypt SMS? Email as a protocol has huge security issues, and email as it is currently used honestly is NOT federated or decentralized.
- Freak_NL 10y ago
  For personal use email is rarely self-hosted, but corporations, governments, and organisations often run their own email infrastructure. That effectively makes email a decentralized federated system. You might argue how a lot of email is either send to or send from Google, Apple, or Microsoft services, and that is thus somewhat centralized, but isn't that stretching the definition?
  - m3rc 10y ago
    Is talking about government organizations hosting their own email servers really a point in email's favor in 2017?
    - Freak_NL 10y ago
      It means email federation is alive and well.
    - detaro 10y ago
      Why would it be a point against it? I generally think my government being in control of its communication infrastructure is a good thing.
Zash 10y ago
> XMPP tried to address this and failed XMPP aint't dead yet ;)
djrogers 10y ago
There is a lower barrier to entry for a new user to download a messaging app vs installing, configuring, and understanding PGP/GPG. This is a real problem that hasn't been solved, and because it hasn't the world has moved on.

by pmlnr 10y ago

mrfregg 10y ago

Forgive my ignorance, but what caused XMPP to fail? Simply the lack of uptake or is there some other reason?

pmlnr 10y ago
I've been running my email server for a decade without serious glitches. Setting up my own federated XMPP instance is much more problematic and people are already complaining about how hard email is. I'd love to see an up-to-date tutorial that opposes my statement, eg. setting up prosody (or something lightweight) on debian (or similar) with multiple domains for multiple accounts, sending and receiving test messages from another XMPP hub, so if you know one, please link it.
- drdaeman 10y ago
  > Setting up my own federated XMPP instance is much more problematic Actually, I believe it's the contrary. With email you have to obtain a valid TLS certificate, set up SPF, DKIM, and keep eye on the DNSRBLs so you're in good standing. And if Big Company's mail service suddenly decides they don't like you, it won't help. Oh, and spamassasin/rspamd/milter/greylisting/etc stuff so your email server doesn't get thousands of emails per day few weeks after some bot detects your host is listening on tcp/25. XMPP has less adoption, spam exists but is much rare, so there's less stuff to do. Install a package, get a TLS cert, publish an SRV record (IIRC that's not even strictly required), and that's it. A bit fewer steps. Not to say email is MTA+MDA combo (+some fancier LDA, +Sieve if you want more that a simple system) while XMPP is a single piece of software (unless you want transports or external extra services).
  - pmlnr 10y ago
    > XMPP has less adoption, spam exists but is much rare, so there's less stuff to do. Install a package, get a TLS cert, publish an SRV record (IIRC that's not even strictly required), and that's it. A bit fewer steps. That's what I thought as well. Please link tutorial on this.
    - problems 10y ago
      Just install prosody and open up the config file. It includes lots of comments and I believe there's even a web admin interface you can enable. XMPP SRV record documentation can be found here, if you need to use it: https://wiki.xmpp.org/web/SRV_Records https://wiki.xmpp.org/web/SRV_Records If you're finding the documentation to be insufficient, let me know, I might write something more detailed up.
    - drdaeman 10y ago
      Personally, I'm using ejabberd, but I wouldn't recommend it. Don't have any good tutorial links at hand, sorry. I'd agree with /u/problems suggestion to try Prosody. http://prosody.im/doc/install http://prosody.im/doc/install + http://prosody.im/doc/configure http://prosody.im/doc/configure + http://prosody.im/doc/dns#srv_records http://prosody.im/doc/dns#srv_records + http://prosody.im/doc/certificates http://prosody.im/doc/certificates are probably all you have to do to get it up and running.
- SamWhited 10y ago
  This one's a bit minimal since it's designed to fit on a flyer, but it does contain what you need to know; install server of choice, get a TLS cert from somewhere, set DNS records if you want them, done. https://xmpp.org/images/promo/xmpp_server_guide_2017.pdf https://xmpp.org/images/promo/xmpp_server_guide_2017.pdf
RyanZAG 10y ago
Google's embrace-extend-extinguish destroyed XMPP. They made their chat system XMPP compatible for a short time which caused many people to swap to their solution. When they ended support, most users simply stopped using XMPP.
- problems 10y ago
  Did you also notice that Google's messaging system pretty much died out around that point in favor of Skype and similar? I used to see people mention GTalk all the time, but I haven't seen anything similar in years. No one has mentioned G+ or Allo. That decision by Google may have been the thing that killed its user base.
  - ryanbrunner 10y ago
    Hangouts (which I think GTalk turned into) still has some usage - certainly as a quick video conf call solution, and somewhat for text messaging. It definitely doesn't seem to have much of a future though since Google released a bunch of other competing chat applications.
    - gregmac 10y ago
      It's unfortunate because Hangouts is still really awesome. It works really well for video chat (including group chat), but more importantly it works great with multiple devices. I can get a message on my phone, laptop or PC, and reply anywhere, with the conversation and notifications synchronized. I nearly always have my phone with me, but it's really nice to be able to just send someone a link from my PC, for example. It looks like Telegram has multi-device support, but then this kind of thing scares me: > Q: How are you going to make money out of this? > We believe in fast and secure messaging that is also 100% free. > Pavel Durov, who shares our vision, supplied Telegram with a generous donation, so we have quite enough money for the time being. If Telegram runs out, we will introduce non-essential paid options to support the infrastructure and finance developer salaries. But making profits will never be a goal for Telegram. That's not very compelling in terms of investing my effort to switch.
  - 10y ago
JustSomeNobody 10y ago
Google, Apple, Facebook, WhatsApp. Everyone[0] is using one of these. None are XMPP or compatible with XMPP. [0] I don't technically mean the entire planet.
- b2600 10y ago
  Curious why you tossed Apple in there. In worldwide usage it's a fraction compared to the other three. (I feel compelled to state I use an iPhone in order to avoid this comment being interpreted incorrectly).
  - deleted 10y ago
    [deleted]
cpach 10y ago
See this essay for some insights: https://whispersystems.org/blog/the-ecosystem-is-moving/ https://whispersystems.org/blog/the-ecosystem-is-moving/

tptacek 10y ago

WhatsApp has over a billion users. There are big places where its market share exceeds that of SMS --- another big centralized service that has a userbase comparable to that of email. My conclusion is that the people who care about "decentralized" systems are a rounding error. I care about non-technologists managing to send asynchronous messages to each other that are well-encrypted by default. That's a solved problem.

pmlnr 10y ago
> My conclusion is that the people who care about "decentralized" systems are a rounding error. I care about non-technologists managing to send asynchronous messages to each other that are well-encrypted by default. That's a solved problem. You don't understand the problem: if you rely on a service like this, two things can - and by the laws of probability, will - happen: a, a centralized service goes down and suddenly no one can talk to nobody b, you're unable to send a message to someone and never realize it Imagine if there was _one_ ISP. One single mobile provider. If it goes down, it goes down everywhere, for everyone. Not fun. As for b, I can't remember, but there's a term when a provider let's you post but it won't get show to others. They can also alter messages - see the Whatapp signal implementation issues that certificates can be silently re-issued. You are, unfortunately right though: very few of us realizes how important this is. Thankfully the smarter elders of the internet seem to do. https://www.decentralizedweb.net/ https://www.decentralizedweb.net/
- tptacek 10y ago
  No, I fully understand the problem. If Google Mail vanished tomorrow, a pretty large number of people would probably stop emailing altogether. The number of people for whom that's true increases every year. If you find that unthinkable, consider the bubble you might be living in. I appreciate that there are people that require a decentralized service for messaging and understand where they're coming from. I don't deny their existence. I simply think their numbers are much smaller than they appear on nerd message boards.
  - problems 10y ago

mxuribe 10y ago

As a happy user of matrix (via riot.im), I sure hope matrix takes off!

tr1ck5t3r 10y ago
Matrix is just a mirror paradigm for messaging. Its nothing new except in name.

NoGravitas 10y ago

I feel like Matrix may be the way forward; it also looks like it's possible to build an email-like interface on top of it. But currently, federated Matrix leaks metadata, so that's a problem.

fgpwd 10y ago
Agree about Matrix. You get addresses such as @username:example.com , which work somewhat like email addresses. The example.com part is the homeserver, analogous to gmail.com or yahoo.com in emails. Users can communicate across homeservers. It's also fast to setup. Took me about 30 minutes to set up a homeserver and host a customized riot client to use it. It's not completely decentralized yet, and you can only use from a fixed list of identity servers. Although you can set up your own synapse node, you can't yet use it along with the centralized identity servers. The reason they give for not decentralizing the identity servers yet is to avoid spam. But they plan to make them decentralized in the future, so at that point it would completely be like email.
- Arathorn 10y ago
  Just to clarify: identity servers are strictly optional and are used just for mapping 3rd party IDs (3PIDs) such as phone numbers and email addresses to matrix IDs so you can be discovered or discover other users by 3PID. They are only centralised atm because we haven't really started to attack the problem of decentralising them. What we really need is a decentralised equivalent of Keybase, but nobody has really built a suitable one yet. Blockstack is close, as are a few others, but we'd rather wait until we found something which nailed the problem and stuck with the jury-rig until then. I spoke about this at FOSDEM the other weekend: https://fosdem.org/2017/schedule/event/matrix_future/ https://fosdem.org/2017/schedule/event/matrix_future/ There's also renewed community interest in fixing this over the last few days: #matrix-identity:matrix.org is a thing. I would argue that Matrix itself is fully decentralised; it's just that some of the solutions to the optional identity discovery problem happen to be centralised. Just as some folks publish their Matrix E2E pubkeys on keybase etc. In terms of Matrix revealing metadata: yes, it does so to the servers participating in the convo. This is really not very unusual; the problem of protecting metadata for realtime comms is very much still an open area of research (see Alpenhorn etc from CSAIL)! Hopefully it's not really a reason to turn anyone off Matrix though. I also briefly spoke about this at FOSDEM: https://fosdem.org/2017/schedule/event/encrypting_matrix/ https://fosdem.org/2017/schedule/event/encrypting_matrix/

alkonaut 10y ago

> No, it's not. It's the only widely available, decentralized system, with which you can send to anyone, if you know the address. They have to be email users to have an address. Granted, it's so widespread that even signing up for one of the other messengers often requires an email address, so even the non-email users have email addresses. But I still think email is going to go the way of usenet, non-internet phone calls and the dodo. Perhaps it's too hard fixing email, compared to just moving to something else. Email is obviously hard to solve since it hasn't been solved already.

NoGravitas 10y ago
I'm more interested in seeing something that maintains the desirable properties of email while dropping backward compatibility with SMTP. But the 'encrypted messenger' community isn't interested in working on that because they think (apparently?) that email does not have any desirable properties compared to siloed IM systems.

joecool1029 10y ago

> No, it's not. It's the only widely available, decentralized system, with which you can send to anyone, if you know the address. None of the big ones is this open. SS7 is internet connected and federated and it's arguably as big as email. > XMPP tried to address this and failed; now Matrix is trying again. Oh, agreed on XMPP. Encryption was a very much after the fact addition to it though. I haven't heard about Matrix and plugging in 'matrix encrypted email' into search gets 0 relevant results on DDG and is bottom of the page for Google. Maybe the ranking sucks cause the page takes 20s to load the JS shit and it has zero content aside from a bouncing fucking shitball above the fold.

corv 10y ago
http://matrix.org/ http://matrix.org/ is a promising decentralized communications protocol. The popular https://riot.im https://riot.im is built on top.
- joecool1029 10y ago
  > The popular https://riot.im https://riot.im is built on top. Thanks, so it's basically a opensource and federated slack? How does this solve the email encryption use case? (longer form text not requiring presence)
  - NoGravitas 10y ago
    As is, it doesn't. It should be possible to build an app with the email nature on top of the Matrix protocols though, and I'm led to understand there are people working on it.
ryanmarsh 10y ago
What is SS7?
- joecool1029 10y ago
  https://en.wikipedia.org/wiki/Signalling_System_No._7 https://en.wikipedia.org/wiki/Signalling_System_No._7

m3rc 10y ago

By that logic shouldn't we try to encrypt SMS? Email as a protocol has huge security issues, and email as it is currently used honestly is NOT federated or decentralized.

Freak_NL 10y ago
For personal use email is rarely self-hosted, but corporations, governments, and organisations often run their own email infrastructure. That effectively makes email a decentralized federated system. You might argue how a lot of email is either send to or send from Google, Apple, or Microsoft services, and that is thus somewhat centralized, but isn't that stretching the definition?
- m3rc 10y ago
  Is talking about government organizations hosting their own email servers really a point in email's favor in 2017?
  - Freak_NL 10y ago
    It means email federation is alive and well.
  - detaro 10y ago
    Why would it be a point against it? I generally think my government being in control of its communication infrastructure is a good thing.

Zash 10y ago

> XMPP tried to address this and failed XMPP aint't dead yet ;)

djrogers 10y ago

There is a lower barrier to entry for a new user to download a messaging app vs installing, configuring, and understanding PGP/GPG. This is a real problem that hasn't been solved, and because it hasn't the world has moved on.