5 ms·

If you care to elaborate, i'm sure that'll be of interest to maintainers. Although to be fair Pidgin doesn't exactly have the reputation to be maintained (despi

If you care to elaborate, i'm sure that'll be of interest to maintainers. Although to be fair Pidgin doesn't exactly have the reputation to be maintained (despite recent efforts to start again) so i would strongly recommend to try again without that specific client in the equation.

tialaramex 5y ago
> Although to be fair Pidgin doesn't exactly have the reputation to be maintained (despite recent efforts to start again) so i would strongly recommend to try again without that specific client in the equation. Quality of Implementation matters. If Pidgin "doesn't exactly have the reputation" and yet it's still notionally part of your ecosystem, then your whole ecosystem doesn't exactly deserve the reputation you thought it did. Here's my unsolicited recommendation: Block Pidgin. Not just Pidgin, any time the XMPP community finds itself having to explain that oops, that client doesn't work so good, please use a different one, just block the client, permanently instead, from all popular and well known servers, tell anybody who will listen that's not a real XMPP client, not any more. Any time the community just can't bring itself to block a client, cross off the features that don't work across the ecosystem due to that client. Those aren't really XMPP features any more since they exist only for some users and the community is apparently OK with that. And each year, stand back and look at the resulting two steps forward three steps back juddering "Progress" and reconsider - was this the way to get where you wanted to go? Or are you all wasting your time on an exercise that would be easier done a different way.
- f1refly 5y ago
  Since there is nothing one can do to identify a specific client, you cannot just block them. If they violate the spec that should be reason enough to consider them not real clients. I personally have no experience with pidgin and xmpp, but I can recommend https://dino.im https://dino.im for linux. It uses omemo by default and works like a charm.
  - southerntofu 5y ago
    Of course you can identify clients (although they could lie, it's just a user-agent string). You can even have nice graphs on some servers about it: https://stats.jabberfr.org/d/000000002/jabberfr?orgId=1&refresh=1m https://stats.jabberfr.org/d/000000002/jabberfr?orgId=1&refr...
- southerntofu 5y ago
  Pidgin is not listed as supporting OMEMO [0] and is not recommended for newcomers on joinjabber.org [1]. There may be reasons you want to use Pidgin and i don't want to block you: also pidgin is not exactly abandoned so there's hope it will continue to improve. When a web browser fails to display a certain page, would you recommend the site operator to block it? Maybe we could allowlist specific clients and send a warning message to others just in case they're not aware they're using something niche. [0] https://omemo.top/ https://omemo.top/ [1] https://joinjabber.org/ https://joinjabber.org/
  - gkdr 5y ago
    the omemo support in pidgin is just through a plugin, as with many recent XEPs. i think people tend to forget that pidgin's focus is being a multi-protocol messenger. it ships with XMPP support, but that mostly includes the base. i wrote that omemo plugin and tbh I am pretty burned out. so many moving parts, it's hell to debug and i'm not even sure where to go next with it. (plus people keep talking badly about pidgin anyway and i am not sure if it's even worth continuing.) i am very thankful for all the contributions so far, especially the help with packaging it. sorry if someone feels let down. i feel like this is the right moment to ask: if anyone reading has an idea how to improve the state of things, i'd be happy about some suggestions. the project page is https://github.com/gkdr/lurch https://github.com/gkdr/lurch
    - southerntofu 5y ago
      > i think people tend to forget that pidgin's focus is being a multi-protocol messenger. That's what's great about it and part of the reasons i think blocking Pidgin would be very wrong. > i wrote that omemo plugin and tbh I am pretty burned out. Thanks for that work! Maybe you could start by writing about your burnout on the README to encourage other people to contribute/maintain, or at least be less demanding of you? > it's hell to debug and i'm not even sure where to go next with it. Do you think this is specific to your plugin? To OMEMO? Or to pidgin plugins in general? Personally, i find it very challenging to write correct code in C, and i can only imagine the pains pidgin developers have to come through to make so many networks/protocols inteoperate. If you have some reading about your experiences, what lessons we can learn, and maybe some project (whether internal to pidgin or not) to implement them, i'd be interested to read. > sorry if someone feels let down. I don't think anyone feels really let down. Some people are not aware of just how experimental certain things are and so they get disappointed but life goes on. You however should take care of your mental health and not let maintenance burden and heartless cyber-ranters like me affect your mood and taste for computing <3
doctor_lollipop 5y ago
Not the OP, but I also keep running into issues with OMEMO. It's bad enough that I usually just disable it for all conversations. My problem is that I'm using several clients (mostly profanity on several machines, occasionally dino) for the same account and it seems that my contacts keep forgetting some of my OMEMO keys, so I often receive messages that some of my clients can't decrypt and I have to start multiple machines just to find one that can decrypt the message. So far I haven't figured out how to debug this.
- southerntofu 5y ago
  XMPP is based on XML exchange so opening the XML debugger of your client should answer all your questions. Notably, if your server replies with an incomplete list of keys, it may be that a client of yours overwrote the list dismissing previous keys? Just a wild guess, but don't hesitate to drop by XMPP chatrooms if you need help debugging that one!
rw_grim 5y ago
Pidgin maintainer here... I would love to hear what you mean by this...
- southerntofu 5y ago
  Hello, sorry i don't mean to be rude, i'm only judging by reputation. I heard from various hearsay that the codebase is in shambles and full of security holes, and i know for sure despite being one of the top3 most popular XMPP client OMEMO encryption is still not fully supported more than 5 years after the first spec was published (2015). This is why some security-oriented distros such as Tails are looking for Pidgin replacements (Pidgin is arguably the widest attack surface for Tails RCE), and why in most public channels i hang around in people recommend to stay away from Pidgin if you're looking for an XMPP client that supports "modern" extensions. Personally, i have a lot of admiration for Pidgin as a concept but i can only imagine how hard it is to interoperate with so many networks in a memory-unsafe language. I wish the situation keeps on improving thanks to devoted people like you and i'm interested if you have some more detailed reads (blogposts, issues) about the future of Pidgin or other such multi-network clients. Thanks for your hard work and take care!

tialaramex 5y ago

> Although to be fair Pidgin doesn't exactly have the reputation to be maintained (despite recent efforts to start again) so i would strongly recommend to try again without that specific client in the equation. Quality of Implementation matters. If Pidgin "doesn't exactly have the reputation" and yet it's still notionally part of your ecosystem, then your whole ecosystem doesn't exactly deserve the reputation you thought it did. Here's my unsolicited recommendation: Block Pidgin. Not just Pidgin, any time the XMPP community finds itself having to explain that oops, that client doesn't work so good, please use a different one, just block the client, permanently instead, from all popular and well known servers, tell anybody who will listen that's not a real XMPP client, not any more. Any time the community just can't bring itself to block a client, cross off the features that don't work across the ecosystem due to that client. Those aren't really XMPP features any more since they exist only for some users and the community is apparently OK with that. And each year, stand back and look at the resulting two steps forward three steps back juddering "Progress" and reconsider - was this the way to get where you wanted to go? Or are you all wasting your time on an exercise that would be easier done a different way.

f1refly 5y ago
Since there is nothing one can do to identify a specific client, you cannot just block them. If they violate the spec that should be reason enough to consider them not real clients. I personally have no experience with pidgin and xmpp, but I can recommend https://dino.im https://dino.im for linux. It uses omemo by default and works like a charm.
- southerntofu 5y ago
  Of course you can identify clients (although they could lie, it's just a user-agent string). You can even have nice graphs on some servers about it: https://stats.jabberfr.org/d/000000002/jabberfr?orgId=1&refresh=1m https://stats.jabberfr.org/d/000000002/jabberfr?orgId=1&refr...
southerntofu 5y ago
Pidgin is not listed as supporting OMEMO [0] and is not recommended for newcomers on joinjabber.org [1]. There may be reasons you want to use Pidgin and i don't want to block you: also pidgin is not exactly abandoned so there's hope it will continue to improve. When a web browser fails to display a certain page, would you recommend the site operator to block it? Maybe we could allowlist specific clients and send a warning message to others just in case they're not aware they're using something niche. [0] https://omemo.top/ https://omemo.top/ [1] https://joinjabber.org/ https://joinjabber.org/
- gkdr 5y ago
  the omemo support in pidgin is just through a plugin, as with many recent XEPs. i think people tend to forget that pidgin's focus is being a multi-protocol messenger. it ships with XMPP support, but that mostly includes the base. i wrote that omemo plugin and tbh I am pretty burned out. so many moving parts, it's hell to debug and i'm not even sure where to go next with it. (plus people keep talking badly about pidgin anyway and i am not sure if it's even worth continuing.) i am very thankful for all the contributions so far, especially the help with packaging it. sorry if someone feels let down. i feel like this is the right moment to ask: if anyone reading has an idea how to improve the state of things, i'd be happy about some suggestions. the project page is https://github.com/gkdr/lurch https://github.com/gkdr/lurch
  - southerntofu 5y ago
    > i think people tend to forget that pidgin's focus is being a multi-protocol messenger. That's what's great about it and part of the reasons i think blocking Pidgin would be very wrong. > i wrote that omemo plugin and tbh I am pretty burned out. Thanks for that work! Maybe you could start by writing about your burnout on the README to encourage other people to contribute/maintain, or at least be less demanding of you? > it's hell to debug and i'm not even sure where to go next with it. Do you think this is specific to your plugin? To OMEMO? Or to pidgin plugins in general? Personally, i find it very challenging to write correct code in C, and i can only imagine the pains pidgin developers have to come through to make so many networks/protocols inteoperate. If you have some reading about your experiences, what lessons we can learn, and maybe some project (whether internal to pidgin or not) to implement them, i'd be interested to read. > sorry if someone feels let down. I don't think anyone feels really let down. Some people are not aware of just how experimental certain things are and so they get disappointed but life goes on. You however should take care of your mental health and not let maintenance burden and heartless cyber-ranters like me affect your mood and taste for computing <3

doctor_lollipop 5y ago

Not the OP, but I also keep running into issues with OMEMO. It's bad enough that I usually just disable it for all conversations. My problem is that I'm using several clients (mostly profanity on several machines, occasionally dino) for the same account and it seems that my contacts keep forgetting some of my OMEMO keys, so I often receive messages that some of my clients can't decrypt and I have to start multiple machines just to find one that can decrypt the message. So far I haven't figured out how to debug this.

southerntofu 5y ago
XMPP is based on XML exchange so opening the XML debugger of your client should answer all your questions. Notably, if your server replies with an incomplete list of keys, it may be that a client of yours overwrote the list dismissing previous keys? Just a wild guess, but don't hesitate to drop by XMPP chatrooms if you need help debugging that one!

rw_grim 5y ago

Pidgin maintainer here... I would love to hear what you mean by this...

southerntofu 5y ago
Hello, sorry i don't mean to be rude, i'm only judging by reputation. I heard from various hearsay that the codebase is in shambles and full of security holes, and i know for sure despite being one of the top3 most popular XMPP client OMEMO encryption is still not fully supported more than 5 years after the first spec was published (2015). This is why some security-oriented distros such as Tails are looking for Pidgin replacements (Pidgin is arguably the widest attack surface for Tails RCE), and why in most public channels i hang around in people recommend to stay away from Pidgin if you're looking for an XMPP client that supports "modern" extensions. Personally, i have a lot of admiration for Pidgin as a concept but i can only imagine how hard it is to interoperate with so many networks in a memory-unsafe language. I wish the situation keeps on improving thanks to devoted people like you and i'm interested if you have some more detailed reads (blogposts, issues) about the future of Pidgin or other such multi-network clients. Thanks for your hard work and take care!