11 ms·

Products vs. Protocols: What Signal got right

145 points by MattJ100 6y ago

harryf 6y ago
This really shouldn’t come as a surprise. The average mobile user will give you app less than 30 seconds of their attention after first install so you’d better deliver some kind of result in that time or they’re gone, probably for good. Also chat users care more about GIFs than security. So the product better be good.
- zie 6y ago
  And none of the XMPP clients or any of the Matrix clients get the on-boarding step idiot-proof. Matrix tries harder at it, maybe they will eventually succeed. I have zero hope for XMPP, but I'm happy to be surprised.
  - MattJ100 6y ago
    I actually am quite proud of what we've done for Snikket onboarding. To eliminate the "argh, what server?" step we focus on invites which guide you through the process, and ensure you have an initial contact or group, not an empty contact list. I tested it on many people while working on it. The vast majority (with no familiarity with XMPP or decentralized systems) were signed up in just a couple of minutes.
    - zie 6y ago
      Good to hear! I haven't tried Snikket, but the more idiot-proof you can make it, the better. Invites seems overly complicated. Can you make it 1 question? what's your email address? Then you just sign them up for a server and tell them after the fact, hey look, you are all setup with server SpiffyXMPPServer Tell your friends to contact you at: <full xmpp address here>
      - jssfr 6y ago
        Who would be operating that server? For how many people? With which privacy policy and which SLAs? Is it just one server (= centralisation and SPOF) or many servers? The idea behind Snikket (as I understand it) is more along the lines of having a tech-savvy person in your environment who’ll set up a Snikket instance for you and where they all invite the folks important to them. That means reduced centralisation while providing a lean user experience. The invites are (especially on android) super low-friction (you are presented with a nearly-complete signup after app install; you only have to enter a username (not a domain name, that’s included in the invite; just a username)). Thanks to being federated with the entire XMPP ecosystem, it can still interoperate with users who are on Quicksy or any other XMPP service out there, which is nice. I think an invite-based approach is a good middle-way to avoid encouraging centralisation (think matrix.org, jabber.org, or worse) and keeping the onboarding friction as low as possible.
        zie 6y ago
        I didn't say it was easy :) I think you could sign up across a set of servers, whoever is willing to put their server in the list. But you are correct, there are a host of issues, since it's all decentralized. That's the cost of decentralization, but there are solutions. One would be to be put on the list your SLA/privacy policies/etc must meet some min. standards(1) exist 2) be found at a .well-known/ etc. that way the client can easily show them to the curious user. The problem with just a username, is that's not what you need to converse with ANYONE in XMPP land, you need the full XMPP address, and last I checked, no client makes that easy for you to figure out. The full XMPP address should be easy to find as that's what you actually need. Just a username doesn't work, give up on only a username being all you need, it isn't. I think doing invites from a tech savvy snikket server instance makes sense FOR THAT USE CASE. For Tito's Grandma, where Tito & Grandma are not tech savvy people.. that's not easy. Tito gets setup on server Y and Grandma gets setup on server Z, and neither of them can talk to each other because the client only shows the 'username'. Again, I haven't knowingly used Snikket, but last time I played in XMPP, it was non-trivial, even for a tech savvy person.
        6y ago
  - southerntofu 6y ago
    Onboarding some services is surprisingly easy. Like MattJ mentioned there is now prosody's mod_invites. For phone-based users, quicksy.im is doing a very good onboarding job. It's a fork of conversations (by the same maintainers) with phone-number based contact discovery like Signal and others do. Also worth mentioning, when you have privacy in mind, Jabber/XMPP is very easy to join as most operators don't have any problem with Tor users, and Tor support (also other proxies) is well supported in most clients.
- dylan604 6y ago
  >Also chat users care more about GIFs than security. This is why it is so important that the devs care about the security and just make it part of the app without needing the user to do anything other than use the app.
dugite-code 6y ago
I think the biggest reason we don't see a bigger adoption of federated XMPP is because unlike email chat wasn't seen as a serious communication tool or essential for business until recently. I feel like it was seen as a nice to have "toy", almost something for the kids growing up on the internet to use to talk where as "real" adults used the phone or wrote "digital letters". For that reason it was never bundled with your internet connection like email and so the main stream masses never learned how the federation worked. So when stripped down versions with no out of the box federation (see Google and Facebook's early chat offerings) started to became popular it was easier to pull up the walled garden with impunity. As they were able to introduce the new bells and whistles faster because they could safely ignore federation issues they could then have nice differentiation's from other competing chat networks
- paulryanrogers 6y ago
  While rarely seen that way my employer was using XMPP in 2006. It was great for compliance when one couldn't be leaking client data into AOL instant messenger.
TheJoYo 6y ago
It looks like Snikket is trying to pull together the popular opensource implementations of XMPP ecosystem as one product. It would be a lot easier to tell people to connect to a Snikket server for their Snikket messenger rather than Element messenger to connect to a Matrix server where I've completely lost their attention.
- olah_1 6y ago
  A lot of matrix clients are designing it how you mention. As an example, the app would be called Snikket and when a user makes an account, they’re on the Snikket matrix server by default. They don’t even know they’re using matrix protocol.
  - TheJoYo 6y ago
    Nice, which clients?
    - olah_1 6y ago
      Fluffy Chat, Element, Syphon, etc. You actually have to go out of your way to customize the server part
nexthash 6y ago
This post promotes Snikket, a chat app built on top of XMPP. It talks a lot about decentralization and protocol development, but I doubt it will be able to best Matrix in this regard. Matrix has bridges connecting it to other apps like Facebook Messenger. XMPP, meanwhile, seems to have been shuffling along slowly for 20 years without many users or features that appeal to a mass audience (GIFs, etc). So while Matrix could potentially (or already does) link up with Signal, this app doesn't seem like it could get traction/expand because of the dubious base that it stands on.
- Mediterraneo10 6y ago
  > So while Matrix could potentially (or already does) link up with Signal Matrix doesn't link up with Signal. The Signal devs have emphasized time and time again that they don’t want any third-party applications talking to their servers. While there does exist some outside software that connects to Signal’s own infrastructure without Signal’s permission (e.g. signal-cli), that is only tolerated because those third-party apps have very few users.
  - 3np 6y ago
    While you’re very correct about Signal’s hostility to third-party clients, there is a decently well-functioning Signal bridge for Matrix (using signald under the hood). They very well might sabotage that, but it does link up today.
- TheJoYo 6y ago
  If they can undercut the resource consumption of Matrix then I'm already sold.
- upofadown 6y ago
  >Matrix has bridges connecting it to other apps like Facebook Messenger. XMPP is traditionally all about intercommunication with other systems. Here is a XMPP transport for Whatsapp for an example: * https://git.theta.eu.org/eta/whatsxmpp https://git.theta.eu.org/eta/whatsxmpp Such gateways eventually get banned/blocked by the siloed IM systems. So the XMPP people have over the years tired of the game. The same will happen in the case of Matrix.
sequoia 6y ago
In the authors table: - Building an ecosystem: building for developers - Building a product: building for users This and this alone explains why people flocked to Signal rather than matrix or xmpp, which the average user couldn’t “flock to” even if they wanted to. Signal made a conscious choice to be user friendly rather than nerdy/wonky and that is why tons of people have more secure chat now. The single “point of failure/compromise” point is valid and I like the authors idea of “balancing” the two approaches, though it sounds a bit like “we’re building a new protocol,” practically speaking. If I send a threaded reply and your XMPP client doesn’t support that, then what?
- blendergeek 6y ago
  > If I send a threaded reply and your XMPP client doesn’t support that, then what? I don't know how XMPP works, but a well designed protocol would be backwards compatible such that threaded messages would simply be normal messages in older clients. Here, those with the old clients would still get something useful while those with new clients get the full experience.
  - MattJ100 6y ago
    That's exactly how it works, yes.
- atoav 6y ago
  I tried matrix lately. It created a security passphrase for me. I copied it into my password manager and made sure about surrounding whitespace etc. Then when it asked me for the first time to enter this passphrase I pasted it. It told me it was wrong. I had to go to the web version to reset the passphrase because the desktop variant would ask me for the passphrase to reset the passphrase. I created a new passphrase stored it in my password manager, this time making painstakingly sure it was exactly as displayed. Guess what. I was asked to enter it immidiately after. It was wrong again. Even if I am convinced of a decentralized, federated concept, software just needs to work. If I, as a programmer with a ton of patience can't get it to work, asking my non-programmer friends to use it is something I won't do.
wicket 6y ago
A very well written comparison of XMPP and Signal, but one thing that the author seems to overlook is the significance of Signal using phone numbers as user IDs. This is what users have come to expect and what makes Signal a drop-in replacement for WhatsApp.
- dylan604 6y ago
  Seems like the @username identifier seems to be pretty well accepted, and most people would probably prefer that rather than a phone number. Similar to how the mass user base only cares about a domain name rather than an IP address. You personally my feel that the phone number makes a great user ID, but I'd venture you're old enough to remember knowing people's phone numbers. I am too, but I couldn't tell you any of the phone numbers that I interact with on a daily basis today. In a few more generations, phone numbers may be even less understood by the younger users.
  - miki123211 6y ago
    The thing about phone numbers, though, is that you already have a lot of them in your contacts. Centralized apps can leverage that. Usernames are nice, but you probably don't know whether your dentist uses Discord, or what is their username if they do. With Signal, however, you would probably notice (or be informed) when they sign up.
- southerntofu 6y ago
  I'm not a fan of discovery via phone number for privacy reasons, but if that's your thing quicksy.im is doing just that on Jabber/XMPP.
deleted 6y ago
[deleted]
theamk 6y ago
I think the flexibility of XMPP is also it's big problem. All the features are optional, so you cannot even answer a simple question like: - Hey, my friend says she uses XMPP. If I send her a picture to a phone, can she later print it on the computer? - So if I install that XMPP app I found on the internet, do I get offline messages? The "compliance suites" are nice, but they are usually not shown in the program description. I mean, even conversations.im lists individual XEPs [0] -- this is not user-friendly at all! What XMPP needs a nice, catchy name for "compliant" software which one can use to search for apps, and which can be used to communicate. Maybe "XMPP-2020"? Or even all-new name like "Snikket"? Something that will clearly tell users: "yes, this is a modern chat programs with all the features you'd expect from others" [0] https://play.google.com/store/apps/details?id=eu.siacs.conversations&hl=en_US&gl=US https://play.google.com/store/apps/details?id=eu.siacs.conve...
- MattJ100 6y ago
  That's pretty much what Snikket is aiming to be. "XMPP" is a term for developers, and at most informing users that it's compatible with other XMPP software. Users don't even really want to keep track of annual compliance suites, let alone XEPs. "Snikket" can stand for a consistent set of the latest XMPP features.
- southerntofu 6y ago
  Yes that's precisely what the Snikket project is about. There also joinjabber.org (disclaimer: i'm part of it) which is just getting started: we don't build an XMPP distribution, but part of our mission is to evaluate and/or recommend clients based on high-level features and usability for end-users.
tptacek 6y ago
This piece kind of misses the point of the "Ecosystem is Moving" post. It's not that XMPP, the protocol, can't develop new features like OMEMO (I guess it's easier when you have Signal to crib from, but whatever). It's that you can't guarantee most mainstream clients will support those features, and so you're stuck at a lowest common denominator --- not of the protocol, but of the installed base.
- MattJ100 6y ago
  This was touched upon - the point is that XMPP's extensibility means we aren't "stuck at the lowest common denominator". One of the burdens of the ecosystem, for example, is Pidgin. I don't want to pick on the project too hard, I know they're working on various things including a big refactor for Pidgin 3.0. But the reality is that Pidgin has implemented few (if any) of the XMPP features introduced in the past decade. Yet it's still an amazingly popular client. That means the experience for Pidgin users is getting progressively worse as the rest of the XMPP ecosystem moves on, but we don't add new features to XMPP and think "but no, because Pidgin!". We do consider backwards compatibility in general. And while it's surely slower and more effort than just rolling out an update to a single app on the app store, it's not "stuck". I appreciate the path Signal took (possibly more than many in the decentralized protocol communities), but simply believe that what was lost in pursuing a centralized model is not something I'm okay with losing.
  - tehjoker 6y ago
    I think the real problem isn't that some clients support emojis and some don't, it's that Signal is a security product and lowest common denominator in the installed base can mean broken security. I can see why Moxie makes this tradeoff, but I am also pleased by the way the encryption system is making its way into other platforms. Hopefully, this will over time result in some kind of useful ecosystem, but you might only want to trust the part of it that is more strictly controlled for "serious business".
    - upofadown 6y ago
      There is no interoperability between systems that use ideas from Signal Protocol and it is unlikely that there will ever be. There is no published standard. The best you can do is transiterate existing source code. It is a very complicated protocol with lots of state. It requires a server infrastructure to work. To be interoperable clients need access to information on the same server. The protocol is simply not designed for interoperability...
ashton314 6y ago
If I had a wish, I’d love to see a user-focused Matrix client from a big company that’s not too evil like Mozilla. Heck, if Apple changed iMessages to speak Matrix, that’d be amazing. One can only dream…
- will0 6y ago
  Have you seen beeper? https://www.beeperhq.com/ https://www.beeperhq.com/
  - ashton314 6y ago
    Yes I have, and it looks really cool. Only problem is that to bridge iMessage, you need a jail broken phone or always-on Mac. I’d love something native.
ximm 6y ago
Interesting aside: Instant messaging on the desktop seems to be practically dead. The signal desktop client is only meant as a companion to the phone app. And now Snikket doesn't even list a desktop client. I still don't really understand how we got here and why nobody is talking about it.
- ComodoHacker 6y ago
  Not sure what you mean by "dead", but what do you use to communicate with colleagues at work?
  - oblio 6y ago
    He's not talking about corporate messengers, that's for sure. He's talking about the most used apps in the world, the ones you use to keep in touch with friends and family. Most of their apps are either websites on top of a bundled browser.
- pgt 6y ago
  I have four messaging clients running on my desktop: Signal, Telegram, WhatsApp & Slack. It's not dead.
  - hoseja 6y ago
    How many of those have full functionality? I know that WhatsApp is just a client for the mobile app, without voice and video.
    - adsche 6y ago
      It has voice and video now (marked 'beta' and only for 1-to-1 calls). But I agree, all of these clients suck in their own way. :(
    - Nux 6y ago
      Signal and Telegram include audio/video functionality on the desktop. Also, not sure what they do to it (no Electron?), but Telegram feels super fast, really pleasant experience.
shmerl 6y ago
"The Ecosystem is Moving" was wrong then and is still wrong today. Abandoning the goal of decentralization and federation for selfish gains is a slippery slope. Those who want to go back to the dark ages of AOL and Compuserve will always find some new excuse why to do so. Matrix approach seems to be better than XMPP though, because it actually works well in the browser.
- goffi 6y ago
  XMPP does work well in the browser, you can connect using websocket nowadays, and we have some really good web clients (Converse.js or Movim for instance).
- southerntofu 6y ago
  > Matrix (...) actually works well in the browser. Jabber/XMPP has standardised XMPP over HTTP back in 2014. https://xmpp.org/extensions/xep-0206.html https://xmpp.org/extensions/xep-0206.html Arguably clients were not that good at the time, but nowadays there are pretty good web clients. ConverseJS and JSXC focus on chat usecases and implement OMEMO encryption (standard based on Signal protocol). Movim et Salut-à-Toi develop more usecases (social networking, federated forging, etc) though they are less polished at the moment.
gyger 6y ago
The only anectotal experience I have with Matrix and with XMPP, there is always some message that does not immediately arrive at the recipient on mobile. Signal works just as reliable as WhatsApp in that regards.
- southerntofu 6y ago
  This may be because of how push notifications work on those platforms, that is applications have to contact a centralized platform (Google/Apple) to notify users instead of relying on traditional methods. There are standards in the XMPP ecosystem (XEPs) to do that right though it's not enabled by default on most servers yet (see prosody's mod_{muc_,}cloud_notify).
0xdky 6y ago
This looks very similar to the Android eco system suffering from fragmentation. It has become impossible to ensure updates across OEMs and this could be affecting some of the feature work - in the name of compatibility. With Apple owning the spec and implementation and with no fragmentation, they can move very fast. As long as there is no authority to mandate certain communication protocols (messaging, email, video) during certification, unified messaging unfortunately will remain a dream.
- southerntofu 6y ago
  > It has become impossible to ensure updates across OEMs This is not entirely true anymore, with Google pushing for Project Treble and Generic System Images. I am angry at them for not worrying about this (or mainline kernel support) in the early days of Android, but the fact is the situation has much improved already. > As long as there is no authority to mandate certain communication protocols Established authorities have been using Jabber/XMPP for years (though mostly not free-software solutions), and the french State has recently settled for Matrix's Element who received an extensive security audit for the occasion. I believe it's also possible to advance an ecosystem without authority. That's what compliance suites/checkers have been doing over the years: TLS testers, DKIM checkers, and more recently in the Jabber/XMPP ecosystem the Conversations and XMPP Compliance Suites have really helped guide the ecosystem forward. Simply outlining what's done right and what's done wrong for specific usecases helps end-users make a choice in their clients/servers, and guides sysadmins/developers in making things right when they want to.

145 points by MattJ100 6y ago

This really shouldn’t come as a surprise. The average mobile user will give you app less than 30 seconds of their attention after first install so you’d better deliver some kind of result in that time or they’re gone, probably for good. Also chat users care more about GIFs than security. So the product better be good.

zie 6y ago
And none of the XMPP clients or any of the Matrix clients get the on-boarding step idiot-proof. Matrix tries harder at it, maybe they will eventually succeed. I have zero hope for XMPP, but I'm happy to be surprised.
- MattJ100 6y ago
  I actually am quite proud of what we've done for Snikket onboarding. To eliminate the "argh, what server?" step we focus on invites which guide you through the process, and ensure you have an initial contact or group, not an empty contact list. I tested it on many people while working on it. The vast majority (with no familiarity with XMPP or decentralized systems) were signed up in just a couple of minutes.
  - zie 6y ago
    Good to hear! I haven't tried Snikket, but the more idiot-proof you can make it, the better. Invites seems overly complicated. Can you make it 1 question? what's your email address? Then you just sign them up for a server and tell them after the fact, hey look, you are all setup with server SpiffyXMPPServer Tell your friends to contact you at: <full xmpp address here>
    - jssfr 6y ago
      Who would be operating that server? For how many people? With which privacy policy and which SLAs? Is it just one server (= centralisation and SPOF) or many servers? The idea behind Snikket (as I understand it) is more along the lines of having a tech-savvy person in your environment who’ll set up a Snikket instance for you and where they all invite the folks important to them. That means reduced centralisation while providing a lean user experience. The invites are (especially on android) super low-friction (you are presented with a nearly-complete signup after app install; you only have to enter a username (not a domain name, that’s included in the invite; just a username)). Thanks to being federated with the entire XMPP ecosystem, it can still interoperate with users who are on Quicksy or any other XMPP service out there, which is nice. I think an invite-based approach is a good middle-way to avoid encouraging centralisation (think matrix.org, jabber.org, or worse) and keeping the onboarding friction as low as possible.
      - zie 6y ago
        I didn't say it was easy :) I think you could sign up across a set of servers, whoever is willing to put their server in the list. But you are correct, there are a host of issues, since it's all decentralized. That's the cost of decentralization, but there are solutions. One would be to be put on the list your SLA/privacy policies/etc must meet some min. standards(1) exist 2) be found at a .well-known/ etc. that way the client can easily show them to the curious user. The problem with just a username, is that's not what you need to converse with ANYONE in XMPP land, you need the full XMPP address, and last I checked, no client makes that easy for you to figure out. The full XMPP address should be easy to find as that's what you actually need. Just a username doesn't work, give up on only a username being all you need, it isn't. I think doing invites from a tech savvy snikket server instance makes sense FOR THAT USE CASE. For Tito's Grandma, where Tito & Grandma are not tech savvy people.. that's not easy. Tito gets setup on server Y and Grandma gets setup on server Z, and neither of them can talk to each other because the client only shows the 'username'. Again, I haven't knowingly used Snikket, but last time I played in XMPP, it was non-trivial, even for a tech savvy person.
        6y ago
- southerntofu 6y ago
  Onboarding some services is surprisingly easy. Like MattJ mentioned there is now prosody's mod_invites. For phone-based users, quicksy.im is doing a very good onboarding job. It's a fork of conversations (by the same maintainers) with phone-number based contact discovery like Signal and others do. Also worth mentioning, when you have privacy in mind, Jabber/XMPP is very easy to join as most operators don't have any problem with Tor users, and Tor support (also other proxies) is well supported in most clients.
dylan604 6y ago
>Also chat users care more about GIFs than security. This is why it is so important that the devs care about the security and just make it part of the app without needing the user to do anything other than use the app.

dugite-code 6y ago

I think the biggest reason we don't see a bigger adoption of federated XMPP is because unlike email chat wasn't seen as a serious communication tool or essential for business until recently. I feel like it was seen as a nice to have "toy", almost something for the kids growing up on the internet to use to talk where as "real" adults used the phone or wrote "digital letters". For that reason it was never bundled with your internet connection like email and so the main stream masses never learned how the federation worked. So when stripped down versions with no out of the box federation (see Google and Facebook's early chat offerings) started to became popular it was easier to pull up the walled garden with impunity. As they were able to introduce the new bells and whistles faster because they could safely ignore federation issues they could then have nice differentiation's from other competing chat networks

paulryanrogers 6y ago
While rarely seen that way my employer was using XMPP in 2006. It was great for compliance when one couldn't be leaking client data into AOL instant messenger.

TheJoYo 6y ago

It looks like Snikket is trying to pull together the popular opensource implementations of XMPP ecosystem as one product. It would be a lot easier to tell people to connect to a Snikket server for their Snikket messenger rather than Element messenger to connect to a Matrix server where I've completely lost their attention.

olah_1 6y ago
A lot of matrix clients are designing it how you mention. As an example, the app would be called Snikket and when a user makes an account, they’re on the Snikket matrix server by default. They don’t even know they’re using matrix protocol.
- TheJoYo 6y ago
  Nice, which clients?
  - olah_1 6y ago
    Fluffy Chat, Element, Syphon, etc. You actually have to go out of your way to customize the server part

nexthash 6y ago

This post promotes Snikket, a chat app built on top of XMPP. It talks a lot about decentralization and protocol development, but I doubt it will be able to best Matrix in this regard. Matrix has bridges connecting it to other apps like Facebook Messenger. XMPP, meanwhile, seems to have been shuffling along slowly for 20 years without many users or features that appeal to a mass audience (GIFs, etc). So while Matrix could potentially (or already does) link up with Signal, this app doesn't seem like it could get traction/expand because of the dubious base that it stands on.

Mediterraneo10 6y ago
> So while Matrix could potentially (or already does) link up with Signal Matrix doesn't link up with Signal. The Signal devs have emphasized time and time again that they don’t want any third-party applications talking to their servers. While there does exist some outside software that connects to Signal’s own infrastructure without Signal’s permission (e.g. signal-cli), that is only tolerated because those third-party apps have very few users.
- 3np 6y ago
  While you’re very correct about Signal’s hostility to third-party clients, there is a decently well-functioning Signal bridge for Matrix (using signald under the hood). They very well might sabotage that, but it does link up today.
TheJoYo 6y ago
If they can undercut the resource consumption of Matrix then I'm already sold.
upofadown 6y ago
>Matrix has bridges connecting it to other apps like Facebook Messenger. XMPP is traditionally all about intercommunication with other systems. Here is a XMPP transport for Whatsapp for an example: * https://git.theta.eu.org/eta/whatsxmpp https://git.theta.eu.org/eta/whatsxmpp Such gateways eventually get banned/blocked by the siloed IM systems. So the XMPP people have over the years tired of the game. The same will happen in the case of Matrix.

sequoia 6y ago

In the authors table: - Building an ecosystem: building for developers - Building a product: building for users This and this alone explains why people flocked to Signal rather than matrix or xmpp, which the average user couldn’t “flock to” even if they wanted to. Signal made a conscious choice to be user friendly rather than nerdy/wonky and that is why tons of people have more secure chat now. The single “point of failure/compromise” point is valid and I like the authors idea of “balancing” the two approaches, though it sounds a bit like “we’re building a new protocol,” practically speaking. If I send a threaded reply and your XMPP client doesn’t support that, then what?

blendergeek 6y ago
> If I send a threaded reply and your XMPP client doesn’t support that, then what? I don't know how XMPP works, but a well designed protocol would be backwards compatible such that threaded messages would simply be normal messages in older clients. Here, those with the old clients would still get something useful while those with new clients get the full experience.
- MattJ100 6y ago
  That's exactly how it works, yes.
atoav 6y ago
I tried matrix lately. It created a security passphrase for me. I copied it into my password manager and made sure about surrounding whitespace etc. Then when it asked me for the first time to enter this passphrase I pasted it. It told me it was wrong. I had to go to the web version to reset the passphrase because the desktop variant would ask me for the passphrase to reset the passphrase. I created a new passphrase stored it in my password manager, this time making painstakingly sure it was exactly as displayed. Guess what. I was asked to enter it immidiately after. It was wrong again. Even if I am convinced of a decentralized, federated concept, software just needs to work. If I, as a programmer with a ton of patience can't get it to work, asking my non-programmer friends to use it is something I won't do.

wicket 6y ago

A very well written comparison of XMPP and Signal, but one thing that the author seems to overlook is the significance of Signal using phone numbers as user IDs. This is what users have come to expect and what makes Signal a drop-in replacement for WhatsApp.

dylan604 6y ago
Seems like the @username identifier seems to be pretty well accepted, and most people would probably prefer that rather than a phone number. Similar to how the mass user base only cares about a domain name rather than an IP address. You personally my feel that the phone number makes a great user ID, but I'd venture you're old enough to remember knowing people's phone numbers. I am too, but I couldn't tell you any of the phone numbers that I interact with on a daily basis today. In a few more generations, phone numbers may be even less understood by the younger users.
- miki123211 6y ago
  The thing about phone numbers, though, is that you already have a lot of them in your contacts. Centralized apps can leverage that. Usernames are nice, but you probably don't know whether your dentist uses Discord, or what is their username if they do. With Signal, however, you would probably notice (or be informed) when they sign up.
southerntofu 6y ago
I'm not a fan of discovery via phone number for privacy reasons, but if that's your thing quicksy.im is doing just that on Jabber/XMPP.

deleted 6y ago

[deleted]

theamk 6y ago

I think the flexibility of XMPP is also it's big problem. All the features are optional, so you cannot even answer a simple question like: - Hey, my friend says she uses XMPP. If I send her a picture to a phone, can she later print it on the computer? - So if I install that XMPP app I found on the internet, do I get offline messages? The "compliance suites" are nice, but they are usually not shown in the program description. I mean, even conversations.im lists individual XEPs [0] -- this is not user-friendly at all! What XMPP needs a nice, catchy name for "compliant" software which one can use to search for apps, and which can be used to communicate. Maybe "XMPP-2020"? Or even all-new name like "Snikket"? Something that will clearly tell users: "yes, this is a modern chat programs with all the features you'd expect from others" [0] https://play.google.com/store/apps/details?id=eu.siacs.conversations&hl=en_US&gl=US https://play.google.com/store/apps/details?id=eu.siacs.conve...

MattJ100 6y ago
That's pretty much what Snikket is aiming to be. "XMPP" is a term for developers, and at most informing users that it's compatible with other XMPP software. Users don't even really want to keep track of annual compliance suites, let alone XEPs. "Snikket" can stand for a consistent set of the latest XMPP features.
southerntofu 6y ago
Yes that's precisely what the Snikket project is about. There also joinjabber.org (disclaimer: i'm part of it) which is just getting started: we don't build an XMPP distribution, but part of our mission is to evaluate and/or recommend clients based on high-level features and usability for end-users.

tptacek 6y ago

This piece kind of misses the point of the "Ecosystem is Moving" post. It's not that XMPP, the protocol, can't develop new features like OMEMO (I guess it's easier when you have Signal to crib from, but whatever). It's that you can't guarantee most mainstream clients will support those features, and so you're stuck at a lowest common denominator --- not of the protocol, but of the installed base.

MattJ100 6y ago
This was touched upon - the point is that XMPP's extensibility means we aren't "stuck at the lowest common denominator". One of the burdens of the ecosystem, for example, is Pidgin. I don't want to pick on the project too hard, I know they're working on various things including a big refactor for Pidgin 3.0. But the reality is that Pidgin has implemented few (if any) of the XMPP features introduced in the past decade. Yet it's still an amazingly popular client. That means the experience for Pidgin users is getting progressively worse as the rest of the XMPP ecosystem moves on, but we don't add new features to XMPP and think "but no, because Pidgin!". We do consider backwards compatibility in general. And while it's surely slower and more effort than just rolling out an update to a single app on the app store, it's not "stuck". I appreciate the path Signal took (possibly more than many in the decentralized protocol communities), but simply believe that what was lost in pursuing a centralized model is not something I'm okay with losing.
- tehjoker 6y ago
  I think the real problem isn't that some clients support emojis and some don't, it's that Signal is a security product and lowest common denominator in the installed base can mean broken security. I can see why Moxie makes this tradeoff, but I am also pleased by the way the encryption system is making its way into other platforms. Hopefully, this will over time result in some kind of useful ecosystem, but you might only want to trust the part of it that is more strictly controlled for "serious business".
  - upofadown 6y ago
    There is no interoperability between systems that use ideas from Signal Protocol and it is unlikely that there will ever be. There is no published standard. The best you can do is transiterate existing source code. It is a very complicated protocol with lots of state. It requires a server infrastructure to work. To be interoperable clients need access to information on the same server. The protocol is simply not designed for interoperability...

ashton314 6y ago

If I had a wish, I’d love to see a user-focused Matrix client from a big company that’s not too evil like Mozilla. Heck, if Apple changed iMessages to speak Matrix, that’d be amazing. One can only dream…

will0 6y ago
Have you seen beeper? https://www.beeperhq.com/ https://www.beeperhq.com/
- ashton314 6y ago
  Yes I have, and it looks really cool. Only problem is that to bridge iMessage, you need a jail broken phone or always-on Mac. I’d love something native.

ximm 6y ago

Interesting aside: Instant messaging on the desktop seems to be practically dead. The signal desktop client is only meant as a companion to the phone app. And now Snikket doesn't even list a desktop client. I still don't really understand how we got here and why nobody is talking about it.

ComodoHacker 6y ago
Not sure what you mean by "dead", but what do you use to communicate with colleagues at work?
- oblio 6y ago
  He's not talking about corporate messengers, that's for sure. He's talking about the most used apps in the world, the ones you use to keep in touch with friends and family. Most of their apps are either websites on top of a bundled browser.
pgt 6y ago
I have four messaging clients running on my desktop: Signal, Telegram, WhatsApp & Slack. It's not dead.
- hoseja 6y ago
  How many of those have full functionality? I know that WhatsApp is just a client for the mobile app, without voice and video.
  - adsche 6y ago
    It has voice and video now (marked 'beta' and only for 1-to-1 calls). But I agree, all of these clients suck in their own way. :(
  - Nux 6y ago
    Signal and Telegram include audio/video functionality on the desktop. Also, not sure what they do to it (no Electron?), but Telegram feels super fast, really pleasant experience.

shmerl 6y ago

"The Ecosystem is Moving" was wrong then and is still wrong today. Abandoning the goal of decentralization and federation for selfish gains is a slippery slope. Those who want to go back to the dark ages of AOL and Compuserve will always find some new excuse why to do so. Matrix approach seems to be better than XMPP though, because it actually works well in the browser.

goffi 6y ago
XMPP does work well in the browser, you can connect using websocket nowadays, and we have some really good web clients (Converse.js or Movim for instance).
southerntofu 6y ago
> Matrix (...) actually works well in the browser. Jabber/XMPP has standardised XMPP over HTTP back in 2014. https://xmpp.org/extensions/xep-0206.html https://xmpp.org/extensions/xep-0206.html Arguably clients were not that good at the time, but nowadays there are pretty good web clients. ConverseJS and JSXC focus on chat usecases and implement OMEMO encryption (standard based on Signal protocol). Movim et Salut-à-Toi develop more usecases (social networking, federated forging, etc) though they are less polished at the moment.

gyger 6y ago

The only anectotal experience I have with Matrix and with XMPP, there is always some message that does not immediately arrive at the recipient on mobile. Signal works just as reliable as WhatsApp in that regards.

southerntofu 6y ago
This may be because of how push notifications work on those platforms, that is applications have to contact a centralized platform (Google/Apple) to notify users instead of relying on traditional methods. There are standards in the XMPP ecosystem (XEPs) to do that right though it's not enabled by default on most servers yet (see prosody's mod_{muc_,}cloud_notify).

0xdky 6y ago

This looks very similar to the Android eco system suffering from fragmentation. It has become impossible to ensure updates across OEMs and this could be affecting some of the feature work - in the name of compatibility. With Apple owning the spec and implementation and with no fragmentation, they can move very fast. As long as there is no authority to mandate certain communication protocols (messaging, email, video) during certification, unified messaging unfortunately will remain a dream.

southerntofu 6y ago
> It has become impossible to ensure updates across OEMs This is not entirely true anymore, with Google pushing for Project Treble and Generic System Images. I am angry at them for not worrying about this (or mainline kernel support) in the early days of Android, but the fact is the situation has much improved already. > As long as there is no authority to mandate certain communication protocols Established authorities have been using Jabber/XMPP for years (though mostly not free-software solutions), and the french State has recently settled for Matrix's Element who received an extensive security audit for the occasion. I believe it's also possible to advance an ecosystem without authority. That's what compliance suites/checkers have been doing over the years: TLS testers, DKIM checkers, and more recently in the Jabber/XMPP ecosystem the Conversations and XMPP Compliance Suites have really helped guide the ecosystem forward. Simply outlining what's done right and what's done wrong for specific usecases helps end-users make a choice in their clients/servers, and guides sysadmins/developers in making things right when they want to.