5 ms·

Wow, that was submitted here quicker than we could do it! UnifiedPush has been a thing for a while, see the official website: https://unifiedpush.org/ https://

Wow, that was submitted here quicker than we could do it! UnifiedPush has been a thing for a while, see the official website: https://unifiedpush.org/ https://unifiedpush.org/ With this blog post, we† tried to clarify a few names. Feel free to point out things that are still unclear, the documentation is pretty much a WIP. UnifiedPush aims at replacing the push notifications mechanism provided by Google services with something independent, that anyone can self-host or any OS can provide without compatibility issues. It does require small adjustments server-side and client-side for applications assuming Google services. There is also a Matrix room at #unifiedpush:matrix.org and a Mastodon account at https://fosstodon.org/@unifiedpush https://fosstodon.org/@unifiedpush Note: we'll be monitoring this topic for a while, you don't have to reply to this thread. † karmanyaahm and S1m are main authors

ajvs 4y ago
Thanks for your great work creating this protocol. Hope more app developers add support for it, especially for privacy focused apps like Signal which by relying on Google servers are leaking metadata.
- MayeulC 4y ago
  Regarding Signal, I don't think they have been approached yet... https://github.com/UnifiedPush/wishlist/issues/8 https://github.com/UnifiedPush/wishlist/issues/8 I think the consensus was that we wanted to wait for UnifiedPush to be more mature before approaching them, but it's probably about time. S1m made an interesting implementation for the (compatible) Signal fork Molly: https://github.com/mollyim/mollyim-android/pull/152 https://github.com/mollyim/mollyim-android/pull/152 The implementation is quite interesting: it adds a linked device that does not receive encryption keys, but sends push notifications to the client.
- seizethegdgap 4y ago
  The team has been working to get UP support added to Molly, a fork of Signal for Android. https://molly.im/ https://molly.im/ https://github.com/mollyim/mollyim-android/pull/152 https://github.com/mollyim/mollyim-android/pull/152
- EGreg 4y ago
  If you deliver notifications, you are always leaking metadata around timing. A police unit parked outside a guy’s house and confirmed it was him in the real time chatroom, by cutting his internet and seeing him drop off. If you want real anonymity on the Internet, never use push notifications. Always “pick up your mail” periodically from random endpoints on the Web.
  - michaelmior 4y ago
    In theory, if you were worried about this, I think you could get around that problem by just constantly send fixed sized encrypted messages large enough to hold any potential notifications. When a notification needs to get sent, you add it to the next outgoing encrypted message. Of course, now the delay for notifications is now coupled to the rate of these messages being sent.
    - EGreg 4y ago
      The messages can still be traced to the client picking them up. Cut their networking and the client doesn’t receive the messages anymore… this shows up as a bounced message. You can accumulate encrypted messages at random urls instead
      - michaelmior 4y ago
        I guess I initially misunderstood what you meant by timing, but that makes sense.
      - skybrian 4y ago
        If nobody in the chat room can know that you lost connectivity, that means you can't do real time chat and might as well use email instead. Note that a similar thing happens with any two-way conversation; if an immediate reply is expected and there's no reply, it's not a conversation anymore. (For more possible reasons, though.) Disappearances can't have good error messages if you want plausible deniability. This will make any UI much less user-friendly.
  - dismalpedigree 4y ago
ilyt 4y ago
Uh, the site doesn't load...
- MayeulC 4y ago
  Looks like IPv6 is broken :/ The AAAA record was temporarily removed to try to mitigate.
  - miyuru 4y ago
    Interested to know what happened here. Shouldn't Happy eyeballs fall back to IPv4 when IPv6 is broken?
    - MayeulC 4y ago
      They should, which is why nobody noticed it was broken. Someone told us IPv6 was broken after we submitted here, as they use an IPv6-only network, apparently. I just posted that up there in case that was the actual issue encountered by the commenter. We're not sure why it broke yet, but we'll fix it when there's less traffic.
dncornholio 4y ago
Does the user require to install a separate app to receive UnifiedPush messages?
- MayeulC 4y ago
  Yes, they need to have a UnifiedPush distributor on their device, that acts like Google services. OS makers could install a default UnifiedPush distributor though. Lastly, the Embedded FCM UnifiedPush library (to be embeded into a client app) handles UnifiedPush over FCM (Google-provided push notifications), so that a server only has to handle the UnifiedPush API (with a rewrite proxy for UP->FCM). https://unifiedpush.org/developers/embedded_fcm/ https://unifiedpush.org/developers/embedded_fcm/
- ehutch79 4y ago
  We can't get users to understand that the ceo isn't sending them mail from giftcards563@gmail.com to go and buy giftcards, and not to ask any questions. What's the actual likely hood that the average end user is going to install a random service?
  - karmanyaahm 4y ago
    > What's the actual likely hood that the average end user is going to install a random service? For now, UnifiedPush is targeted towards De-Googlers, self-hosters and FOSS enthusiasts, not average users.
    - ehutch79 4y ago
      Except, in the threads here, this is called out repeatedly as a replacement for push notifications on phones, replacing webpush, apple push notifications, and whatever google is calling it. Which implies the use case people are seeing is phone apps. Unless people are building one off apps for themselves, you've got end users in the mix. I don't see how this can be positions as much outside of phone apps, as txt messages or emails would be easier and more universal. Being that they're probably going to be supported here. To note, i haven't see anyone talking about this being replacement for the part of webpush that handles registration for notifications or whatnot, but as a whole separate channel/technology. Not 'install this to avoid using google/apple for webpush' but 'use this in your app, and have your users install the service'.
lern_too_spel 4y ago
Congrats! It's always surprised me that Amazon or one of the other Android vendors didn't do this themselves to make porting to FireOS or other services-included Android distributions easier, but I hope you get funding from them for doing their job for them.
- MayeulC 4y ago
  Everyone wants to be Google, and I bet most managers see lock-in to their platform as a good thing, and ease of porting to competitors a bad thing. At least, if they feel big enough to gain initial traction... Huawei is pushing their own thing, alternative to Firebase[1]; Amazon as well[2]. There's a dozen services that provide cloud-based services to send push notifications to various services. I think the incentive to gain subscription revenue was greater than the opportunity to make these partially redundant. I'm not sure why it took so long for something like UnifiedPush to appear. It took a fair bit of debugging, but ultimately, it was mostly up to one dedicated individual (S1m) with Android experience. Before UnifiedPush, there was OpenPush[3], but it never materialized. [1]: https://developer.huawei.com/consumer/en/hms/huawei-pushkit https://developer.huawei.com/consumer/en/hms/huawei-pushkit [2]: https://docs.aws.amazon.com/sns/latest/dg/sns-mobile-application-as-subscriber.html https://docs.aws.amazon.com/sns/latest/dg/sns-mobile-applica... [3]: https://bubu1.eu/openpush/ https://bubu1.eu/openpush/
  - RainaRelanah 4y ago
    I would imagine Huawei is doing that moreso due to sanctions, no?
EGreg 4y ago
Sorry if I’m not understanding something but… Doesn’t Apple and Google on the OS level only allow push notifications to come from its own services? Like, they look for the signature to be compatible with https certificate etc. Otherwise the phone could have a ton of push notifications incoming from anywhere on the Internet. The APN service for instance would only route notifications to a phone if it came from a registered website. How do you get around this? As far as I know, even for VOIP permissions, iOS only wakes your code up if ITS APNS SERVICE sends the notification. How are you able to install a long-lived application in the background on iOS? Similarly, the phone radio is listening for calls from the nearby cell towers in the network, not from absolutely any tower. I guess a Stingray can impersonate one, but they would probably need to fake the attestation, right?
- sandos 4y ago
  I believe the notifications used to be delivered by a very long-lived TCP connection, and there probably is no limit to those on Android. The reason to use the google services is mostly touted as for battery savings, I believe.
  - teknopaul 4y ago
    Afaik Google and Apple just discount their own poller. It still has to wake up and check periodically.
    - est31 4y ago
      They have special deals with the telcos that TCP connections to their servers can have longer TTLs. Plus of course, even if you do polling, if you have 5 different apps that connect every 10 minutes to their own respective services with different offsets, you have the device waking up every 2 minutes, with a potential latency of up to 10 minutes for each individual service. If it uses a central push service, you can set it to 5 minutes, the device would therefore wake up less than half of the time, and maximum latency would be 5 minutes, not 10. Thus, it makes total sense to have one mechanism for push messages for the entire device. It's great to have degoogled alternatives here.
alwayslikethis 4y ago
Is there any plan to have a method available for patching proprietary apps to work with this? Notifications is the only reason I still have Goolag services on my phone's work profile, and having an alternative to that would be great for privacy.
- lern_too_spel 4y ago
  The sender needs to know which push service to send the message to, so no.
- seba_dos1 4y ago
  > Notifications is the only reason I still have Goolag services on my phone's work profile Wouldn't microG be enough for that?
- MayeulC 4y ago
  As a sibling commenter said, those proprietary apps have a server part that sends notifications to Google's server. If UnifiedPush were to gain enough traction (say it would be adopted on FireOS, HuaweiOS and whatever platform don't use Google services), those apps would likely start to support it directly. Another possible avenue is to add UnifiedPush support to push libraries used by these apps both server and client-side. Multiple libraries (Google FCM included, I linked at least two others from Amazon and Huawei in another comment here) abstract push notifications away so the developer gets a single server to talk to, and a unified API across iOS, Android, Web, etc. If these libraries started supporting UnifiedPush, adoption could increase a lot, without involving any developer effort for these proprietary apps.
POPOSYS 4y ago
Thank you very much for your hard and important work! And a special thanks for not forcing us to use a slack channel! Hopefully other OS projects will follow. Good health and all the best for 2023!
12907835202 4y ago
The home page you've given is a little confusing to me and I'm not sure if it's confusing or just not aimed at me. Is this just for mobile (android only?) developers, or is it for any push notifications e.g. browser. Could I use this with PHP or JavaScript for example?

ajvs 4y ago

Thanks for your great work creating this protocol. Hope more app developers add support for it, especially for privacy focused apps like Signal which by relying on Google servers are leaking metadata.

MayeulC 4y ago
Regarding Signal, I don't think they have been approached yet... https://github.com/UnifiedPush/wishlist/issues/8 https://github.com/UnifiedPush/wishlist/issues/8 I think the consensus was that we wanted to wait for UnifiedPush to be more mature before approaching them, but it's probably about time. S1m made an interesting implementation for the (compatible) Signal fork Molly: https://github.com/mollyim/mollyim-android/pull/152 https://github.com/mollyim/mollyim-android/pull/152 The implementation is quite interesting: it adds a linked device that does not receive encryption keys, but sends push notifications to the client.
seizethegdgap 4y ago
The team has been working to get UP support added to Molly, a fork of Signal for Android. https://molly.im/ https://molly.im/ https://github.com/mollyim/mollyim-android/pull/152 https://github.com/mollyim/mollyim-android/pull/152
EGreg 4y ago
If you deliver notifications, you are always leaking metadata around timing. A police unit parked outside a guy’s house and confirmed it was him in the real time chatroom, by cutting his internet and seeing him drop off. If you want real anonymity on the Internet, never use push notifications. Always “pick up your mail” periodically from random endpoints on the Web.
- michaelmior 4y ago
  In theory, if you were worried about this, I think you could get around that problem by just constantly send fixed sized encrypted messages large enough to hold any potential notifications. When a notification needs to get sent, you add it to the next outgoing encrypted message. Of course, now the delay for notifications is now coupled to the rate of these messages being sent.
  - EGreg 4y ago
    The messages can still be traced to the client picking them up. Cut their networking and the client doesn’t receive the messages anymore… this shows up as a bounced message. You can accumulate encrypted messages at random urls instead
    - michaelmior 4y ago
      I guess I initially misunderstood what you meant by timing, but that makes sense.
    - skybrian 4y ago
      If nobody in the chat room can know that you lost connectivity, that means you can't do real time chat and might as well use email instead. Note that a similar thing happens with any two-way conversation; if an immediate reply is expected and there's no reply, it's not a conversation anymore. (For more possible reasons, though.) Disappearances can't have good error messages if you want plausible deniability. This will make any UI much less user-friendly.
- dismalpedigree 4y ago

ilyt 4y ago

Uh, the site doesn't load...

MayeulC 4y ago
Looks like IPv6 is broken :/ The AAAA record was temporarily removed to try to mitigate.
- miyuru 4y ago
  Interested to know what happened here. Shouldn't Happy eyeballs fall back to IPv4 when IPv6 is broken?
  - MayeulC 4y ago
    They should, which is why nobody noticed it was broken. Someone told us IPv6 was broken after we submitted here, as they use an IPv6-only network, apparently. I just posted that up there in case that was the actual issue encountered by the commenter. We're not sure why it broke yet, but we'll fix it when there's less traffic.

dncornholio 4y ago

Does the user require to install a separate app to receive UnifiedPush messages?

MayeulC 4y ago
Yes, they need to have a UnifiedPush distributor on their device, that acts like Google services. OS makers could install a default UnifiedPush distributor though. Lastly, the Embedded FCM UnifiedPush library (to be embeded into a client app) handles UnifiedPush over FCM (Google-provided push notifications), so that a server only has to handle the UnifiedPush API (with a rewrite proxy for UP->FCM). https://unifiedpush.org/developers/embedded_fcm/ https://unifiedpush.org/developers/embedded_fcm/
ehutch79 4y ago
We can't get users to understand that the ceo isn't sending them mail from giftcards563@gmail.com to go and buy giftcards, and not to ask any questions. What's the actual likely hood that the average end user is going to install a random service?
- karmanyaahm 4y ago
  > What's the actual likely hood that the average end user is going to install a random service? For now, UnifiedPush is targeted towards De-Googlers, self-hosters and FOSS enthusiasts, not average users.
  - ehutch79 4y ago
    Except, in the threads here, this is called out repeatedly as a replacement for push notifications on phones, replacing webpush, apple push notifications, and whatever google is calling it. Which implies the use case people are seeing is phone apps. Unless people are building one off apps for themselves, you've got end users in the mix. I don't see how this can be positions as much outside of phone apps, as txt messages or emails would be easier and more universal. Being that they're probably going to be supported here. To note, i haven't see anyone talking about this being replacement for the part of webpush that handles registration for notifications or whatnot, but as a whole separate channel/technology. Not 'install this to avoid using google/apple for webpush' but 'use this in your app, and have your users install the service'.

lern_too_spel 4y ago

Congrats! It's always surprised me that Amazon or one of the other Android vendors didn't do this themselves to make porting to FireOS or other services-included Android distributions easier, but I hope you get funding from them for doing their job for them.

MayeulC 4y ago
Everyone wants to be Google, and I bet most managers see lock-in to their platform as a good thing, and ease of porting to competitors a bad thing. At least, if they feel big enough to gain initial traction... Huawei is pushing their own thing, alternative to Firebase[1]; Amazon as well[2]. There's a dozen services that provide cloud-based services to send push notifications to various services. I think the incentive to gain subscription revenue was greater than the opportunity to make these partially redundant. I'm not sure why it took so long for something like UnifiedPush to appear. It took a fair bit of debugging, but ultimately, it was mostly up to one dedicated individual (S1m) with Android experience. Before UnifiedPush, there was OpenPush[3], but it never materialized. [1]: https://developer.huawei.com/consumer/en/hms/huawei-pushkit https://developer.huawei.com/consumer/en/hms/huawei-pushkit [2]: https://docs.aws.amazon.com/sns/latest/dg/sns-mobile-application-as-subscriber.html https://docs.aws.amazon.com/sns/latest/dg/sns-mobile-applica... [3]: https://bubu1.eu/openpush/ https://bubu1.eu/openpush/
- RainaRelanah 4y ago
  I would imagine Huawei is doing that moreso due to sanctions, no?

EGreg 4y ago

Sorry if I’m not understanding something but… Doesn’t Apple and Google on the OS level only allow push notifications to come from its own services? Like, they look for the signature to be compatible with https certificate etc. Otherwise the phone could have a ton of push notifications incoming from anywhere on the Internet. The APN service for instance would only route notifications to a phone if it came from a registered website. How do you get around this? As far as I know, even for VOIP permissions, iOS only wakes your code up if ITS APNS SERVICE sends the notification. How are you able to install a long-lived application in the background on iOS? Similarly, the phone radio is listening for calls from the nearby cell towers in the network, not from absolutely any tower. I guess a Stingray can impersonate one, but they would probably need to fake the attestation, right?

sandos 4y ago
I believe the notifications used to be delivered by a very long-lived TCP connection, and there probably is no limit to those on Android. The reason to use the google services is mostly touted as for battery savings, I believe.
- teknopaul 4y ago
  Afaik Google and Apple just discount their own poller. It still has to wake up and check periodically.
  - est31 4y ago
    They have special deals with the telcos that TCP connections to their servers can have longer TTLs. Plus of course, even if you do polling, if you have 5 different apps that connect every 10 minutes to their own respective services with different offsets, you have the device waking up every 2 minutes, with a potential latency of up to 10 minutes for each individual service. If it uses a central push service, you can set it to 5 minutes, the device would therefore wake up less than half of the time, and maximum latency would be 5 minutes, not 10. Thus, it makes total sense to have one mechanism for push messages for the entire device. It's great to have degoogled alternatives here.

alwayslikethis 4y ago

Is there any plan to have a method available for patching proprietary apps to work with this? Notifications is the only reason I still have Goolag services on my phone's work profile, and having an alternative to that would be great for privacy.

lern_too_spel 4y ago
The sender needs to know which push service to send the message to, so no.
seba_dos1 4y ago
> Notifications is the only reason I still have Goolag services on my phone's work profile Wouldn't microG be enough for that?
MayeulC 4y ago
As a sibling commenter said, those proprietary apps have a server part that sends notifications to Google's server. If UnifiedPush were to gain enough traction (say it would be adopted on FireOS, HuaweiOS and whatever platform don't use Google services), those apps would likely start to support it directly. Another possible avenue is to add UnifiedPush support to push libraries used by these apps both server and client-side. Multiple libraries (Google FCM included, I linked at least two others from Amazon and Huawei in another comment here) abstract push notifications away so the developer gets a single server to talk to, and a unified API across iOS, Android, Web, etc. If these libraries started supporting UnifiedPush, adoption could increase a lot, without involving any developer effort for these proprietary apps.

POPOSYS 4y ago

Thank you very much for your hard and important work! And a special thanks for not forcing us to use a slack channel! Hopefully other OS projects will follow. Good health and all the best for 2023!

12907835202 4y ago

The home page you've given is a little confusing to me and I'm not sure if it's confusing or just not aimed at me. Is this just for mobile (android only?) developers, or is it for any push notifications e.g. browser. Could I use this with PHP or JavaScript for example?