6 ms·

Depending on when you last tried xmpp you might have experienced the OTR hell, which was never really codified 100% and spawned subtle incompatibilities between

Depending on when you last tried xmpp you might have experienced the OTR hell, which was never really codified 100% and spawned subtle incompatibilities between clients leading to weird and nondescript errors that never got addressed. Nowadays the popular clients support omemo (https://conversations.im/omemo/ https://conversations.im/omemo/), which makes encryption just work™ out of the box and without hassle. The only exception to this is xabber, who are apparently afraid of law enforcement destroying their lifes should they implement proper encryption and also feel no need to support it anyways: https://github.com/redsolution/xabber-android/issues/540 https://github.com/redsolution/xabber-android/issues/540

Semaphor 5y ago
> just work™ YMMV™ We have yet to manage not getting any OMEMO issues in a 2 users, 5 clients situation (2 Conversations on android, 1 Gajim on win, 2 Pidgin on linux)
- southerntofu 5y ago
  If you care to elaborate, i'm sure that'll be of interest to maintainers. Although to be fair Pidgin doesn't exactly have the reputation to be maintained (despite recent efforts to start again) so i would strongly recommend to try again without that specific client in the equation.
  - tialaramex 5y ago
    > Although to be fair Pidgin doesn't exactly have the reputation to be maintained (despite recent efforts to start again) so i would strongly recommend to try again without that specific client in the equation. Quality of Implementation matters. If Pidgin "doesn't exactly have the reputation" and yet it's still notionally part of your ecosystem, then your whole ecosystem doesn't exactly deserve the reputation you thought it did. Here's my unsolicited recommendation: Block Pidgin. Not just Pidgin, any time the XMPP community finds itself having to explain that oops, that client doesn't work so good, please use a different one, just block the client, permanently instead, from all popular and well known servers, tell anybody who will listen that's not a real XMPP client, not any more. Any time the community just can't bring itself to block a client, cross off the features that don't work across the ecosystem due to that client. Those aren't really XMPP features any more since they exist only for some users and the community is apparently OK with that. And each year, stand back and look at the resulting two steps forward three steps back juddering "Progress" and reconsider - was this the way to get where you wanted to go? Or are you all wasting your time on an exercise that would be easier done a different way.
    - f1refly 5y ago
      Since there is nothing one can do to identify a specific client, you cannot just block them. If they violate the spec that should be reason enough to consider them not real clients. I personally have no experience with pidgin and xmpp, but I can recommend https://dino.im https://dino.im for linux. It uses omemo by default and works like a charm.
      - southerntofu 5y ago
        Of course you can identify clients (although they could lie, it's just a user-agent string). You can even have nice graphs on some servers about it: https://stats.jabberfr.org/d/000000002/jabberfr?orgId=1&refresh=1m https://stats.jabberfr.org/d/000000002/jabberfr?orgId=1&refr...
    - southerntofu 5y ago
      Pidgin is not listed as supporting OMEMO [0] and is not recommended for newcomers on joinjabber.org [1]. There may be reasons you want to use Pidgin and i don't want to block you: also pidgin is not exactly abandoned so there's hope it will continue to improve. When a web browser fails to display a certain page, would you recommend the site operator to block it? Maybe we could allowlist specific clients and send a warning message to others just in case they're not aware they're using something niche. [0] https://omemo.top/ https://omemo.top/ [1] https://joinjabber.org/ https://joinjabber.org/
      - gkdr 5y ago
        the omemo support in pidgin is just through a plugin, as with many recent XEPs. i think people tend to forget that pidgin's focus is being a multi-protocol messenger. it ships with XMPP support, but that mostly includes the base. i wrote that omemo plugin and tbh I am pretty burned out. so many moving parts, it's hell to debug and i'm not even sure where to go next with it. (plus people keep talking badly about pidgin anyway and i am not sure if it's even worth continuing.) i am very thankful for all the contributions so far, especially the help with packaging it. sorry if someone feels let down. i feel like this is the right moment to ask: if anyone reading has an idea how to improve the state of things, i'd be happy about some suggestions. the project page is https://github.com/gkdr/lurch https://github.com/gkdr/lurch
  - doctor_lollipop 5y ago
    Not the OP, but I also keep running into issues with OMEMO. It's bad enough that I usually just disable it for all conversations. My problem is that I'm using several clients (mostly profanity on several machines, occasionally dino) for the same account and it seems that my contacts keep forgetting some of my OMEMO keys, so I often receive messages that some of my clients can't decrypt and I have to start multiple machines just to find one that can decrypt the message. So far I haven't figured out how to debug this.
    - southerntofu 5y ago
      XMPP is based on XML exchange so opening the XML debugger of your client should answer all your questions. Notably, if your server replies with an incomplete list of keys, it may be that a client of yours overwrote the list dismissing previous keys? Just a wild guess, but don't hesitate to drop by XMPP chatrooms if you need help debugging that one!
  - rw_grim 5y ago
    Pidgin maintainer here... I would love to hear what you mean by this...
    - southerntofu 5y ago
      Hello, sorry i don't mean to be rude, i'm only judging by reputation. I heard from various hearsay that the codebase is in shambles and full of security holes, and i know for sure despite being one of the top3 most popular XMPP client OMEMO encryption is still not fully supported more than 5 years after the first spec was published (2015). This is why some security-oriented distros such as Tails are looking for Pidgin replacements (Pidgin is arguably the widest attack surface for Tails RCE), and why in most public channels i hang around in people recommend to stay away from Pidgin if you're looking for an XMPP client that supports "modern" extensions. Personally, i have a lot of admiration for Pidgin as a concept but i can only imagine how hard it is to interoperate with so many networks in a memory-unsafe language. I wish the situation keeps on improving thanks to devoted people like you and i'm interested if you have some more detailed reads (blogposts, issues) about the future of Pidgin or other such multi-network clients. Thanks for your hard work and take care!

Semaphor 5y ago

> just work™ YMMV™ We have yet to manage not getting any OMEMO issues in a 2 users, 5 clients situation (2 Conversations on android, 1 Gajim on win, 2 Pidgin on linux)

southerntofu 5y ago
If you care to elaborate, i'm sure that'll be of interest to maintainers. Although to be fair Pidgin doesn't exactly have the reputation to be maintained (despite recent efforts to start again) so i would strongly recommend to try again without that specific client in the equation.
- tialaramex 5y ago
  > Although to be fair Pidgin doesn't exactly have the reputation to be maintained (despite recent efforts to start again) so i would strongly recommend to try again without that specific client in the equation. Quality of Implementation matters. If Pidgin "doesn't exactly have the reputation" and yet it's still notionally part of your ecosystem, then your whole ecosystem doesn't exactly deserve the reputation you thought it did. Here's my unsolicited recommendation: Block Pidgin. Not just Pidgin, any time the XMPP community finds itself having to explain that oops, that client doesn't work so good, please use a different one, just block the client, permanently instead, from all popular and well known servers, tell anybody who will listen that's not a real XMPP client, not any more. Any time the community just can't bring itself to block a client, cross off the features that don't work across the ecosystem due to that client. Those aren't really XMPP features any more since they exist only for some users and the community is apparently OK with that. And each year, stand back and look at the resulting two steps forward three steps back juddering "Progress" and reconsider - was this the way to get where you wanted to go? Or are you all wasting your time on an exercise that would be easier done a different way.
  - f1refly 5y ago
    Since there is nothing one can do to identify a specific client, you cannot just block them. If they violate the spec that should be reason enough to consider them not real clients. I personally have no experience with pidgin and xmpp, but I can recommend https://dino.im https://dino.im for linux. It uses omemo by default and works like a charm.
    - southerntofu 5y ago
      Of course you can identify clients (although they could lie, it's just a user-agent string). You can even have nice graphs on some servers about it: https://stats.jabberfr.org/d/000000002/jabberfr?orgId=1&refresh=1m https://stats.jabberfr.org/d/000000002/jabberfr?orgId=1&refr...
  - southerntofu 5y ago
    Pidgin is not listed as supporting OMEMO [0] and is not recommended for newcomers on joinjabber.org [1]. There may be reasons you want to use Pidgin and i don't want to block you: also pidgin is not exactly abandoned so there's hope it will continue to improve. When a web browser fails to display a certain page, would you recommend the site operator to block it? Maybe we could allowlist specific clients and send a warning message to others just in case they're not aware they're using something niche. [0] https://omemo.top/ https://omemo.top/ [1] https://joinjabber.org/ https://joinjabber.org/
    - gkdr 5y ago
      the omemo support in pidgin is just through a plugin, as with many recent XEPs. i think people tend to forget that pidgin's focus is being a multi-protocol messenger. it ships with XMPP support, but that mostly includes the base. i wrote that omemo plugin and tbh I am pretty burned out. so many moving parts, it's hell to debug and i'm not even sure where to go next with it. (plus people keep talking badly about pidgin anyway and i am not sure if it's even worth continuing.) i am very thankful for all the contributions so far, especially the help with packaging it. sorry if someone feels let down. i feel like this is the right moment to ask: if anyone reading has an idea how to improve the state of things, i'd be happy about some suggestions. the project page is https://github.com/gkdr/lurch https://github.com/gkdr/lurch
- doctor_lollipop 5y ago
  Not the OP, but I also keep running into issues with OMEMO. It's bad enough that I usually just disable it for all conversations. My problem is that I'm using several clients (mostly profanity on several machines, occasionally dino) for the same account and it seems that my contacts keep forgetting some of my OMEMO keys, so I often receive messages that some of my clients can't decrypt and I have to start multiple machines just to find one that can decrypt the message. So far I haven't figured out how to debug this.
  - southerntofu 5y ago
    XMPP is based on XML exchange so opening the XML debugger of your client should answer all your questions. Notably, if your server replies with an incomplete list of keys, it may be that a client of yours overwrote the list dismissing previous keys? Just a wild guess, but don't hesitate to drop by XMPP chatrooms if you need help debugging that one!
- rw_grim 5y ago
  Pidgin maintainer here... I would love to hear what you mean by this...
  - southerntofu 5y ago
    Hello, sorry i don't mean to be rude, i'm only judging by reputation. I heard from various hearsay that the codebase is in shambles and full of security holes, and i know for sure despite being one of the top3 most popular XMPP client OMEMO encryption is still not fully supported more than 5 years after the first spec was published (2015). This is why some security-oriented distros such as Tails are looking for Pidgin replacements (Pidgin is arguably the widest attack surface for Tails RCE), and why in most public channels i hang around in people recommend to stay away from Pidgin if you're looking for an XMPP client that supports "modern" extensions. Personally, i have a lot of admiration for Pidgin as a concept but i can only imagine how hard it is to interoperate with so many networks in a memory-unsafe language. I wish the situation keeps on improving thanks to devoted people like you and i'm interested if you have some more detailed reads (blogposts, issues) about the future of Pidgin or other such multi-network clients. Thanks for your hard work and take care!