4 ms·

XMPP and Metadata

77 points by todsacerdoti 10mo ago

buttocks 10mo ago
I always liked XMPP and SIP as messaging protocols. So easy to read and understand and implement. Both are extensible and can be made secure.
- rootnod3 10mo ago
  Yes. Unfortunately it seems that Matrix is the winner, but I think Matrix is over-engineered. XMPP was nice. Especially in the old times when Google Hangouts and Facebook Chat were also XMPP based. Being able to talk to people on another service without needing an account there was a nice thing to have for a few months.
  - ge0rg 10mo ago
    The interop was a nice feature implemented by their engineers, but it violated the lock-in operational principles of the gatekeeper services, so it had to be abandoned. Let's see if the EU Digital Markets Act will bring back XMPP interfaces to the big ones... ;)
  - tcfhgj 10mo ago
    So far it looks more like walled gardens are the real winners. What you maybe see as overengineering, I see as a prerequisite for wider adoption. These days aren't the old days any more, when you only ever used a native app without e2ee on a computer.
  - syhol 10mo ago
    My main problem with matrix is that it feels sluggish. I'm told the experience can be improved by running your own homeserver so I'll be trying that sometime this year.
    - jszymborski 10mo ago
      In my limited experience, running a homeserver sucked. Really hard to do on limited resources. Then again, that was a long time ago so maybe things have improved and perhaps Dendrite has come along. But Synapse sucked to run IME.
      - Arathorn 10mo ago
        Synapse has improved; Dendrite has stagnated due to lack of funding; meanwhile there are also rust-native homeservers like Conduit which are beta but smaller footprint. The plan on the Element side is to keep optimising Synapse - the main win to be had is https://docs.google.com/presentation/d/1pKtLl4vCV3-8xz8crvxWL1GLAZtpeQovGBpakqAiugI https://docs.google.com/presentation/d/1pKtLl4vCV3-8xz8crvxW...
        jszymborski 10mo ago
        Those slides were interesting! And I use Claude similarly... kinda like Rubber Duck debugging except it's like Rubber Human debugging.
    - ekjhgkejhgk 10mo ago
      LOL if using a chat app requires running a server maybe better just use something that doesn't suck like XMPP?
      - nosrepa 10mo ago
        I am vaguely reminded of running my own irc bouncer...
  - Lammy 10mo ago
    Pardon my pedantry, but Facebook Chat was never XMPP-based. They ran an XMPP gateway into their proprietary messaging system, but there was no S2S.
  - RadiozRadioz 10mo ago
    What are the reasons Matrix is the winner? Are they inherent to the protocol itself or something else?
    - rootnod3 10mo ago
      Just by what people seem to use.
    - Arathorn 10mo ago
      Matrix has a pretty comprehensive featureset with clients across a broad range of platforms. The accusations of it being overengineered come typically due to the Synapse server implementation being slow. This is basically an artefact of Matrix being quite complicated to provide a byzantine fault tolerant decentralised equivalent to WhatsApp or Slack etc - and time has gone into fixing stability and usability rather than performance. Meanwhile performance is getting better, but progress is slow due to tragedy-of-the-commons related funding challenges. We will get there in the end, though.
      - RadiozRadioz 10mo ago
        Thanks for the response Matthew! But please go to sleep! Yes it's unfortunate how much Synapse's unperformant implementation has decreased general confidence in the protocol itself. I'm confident it will get better
    - leetnewb 10mo ago
      Funding and centralization. Matrix has a for-profit, venture funded company (Element) that is effectively behind the reference/flagship server and client implementations. xmpp is far less centralized. Virtually all of the modern clients are single developer projects that live off day jobs and grants. There are different ways to look at it. Matrix has done a great job at organizing resources to push the platform forward. xmpp has an impressive ecosystem and some incredible client implementations on a shoe string budget, that would probably look/function better and have lots more features given funding parity. I think as we've seen with other projects like Immich, organizing and recruiting resources is an important part of delivering the modern experiences that users expect today from open source projects. Open source and self-hostable can't be an excuse for missing features.
ekjhgkejhgk 10mo ago
Watch the most popular clients[1] gain traction as countries (e.g. UK) pass laws mandating that tech companies backdoor their apps/encryption. [1] Conversations for Android and Gajim for Debian.
- deleted 10mo ago
  [deleted]
giancarlostoro 10mo ago
I'm slowly building my own XMPP client, one key thing I'm running into trouble with is there seems to be no standard library for End to End Encryption other than Signal's own, I don't want to have to relicense my entire project for one dependency, I would rather keep my project Apache licensed. The other problem is voice and video options seem to be married to some Java specific library (Jingle) which is fine if you're using Java, but I'm not, seems nobody has implemented a solution to this in other languages that I'm interested in as well. For the End to End I could try my best to implement it using existing libraries as pieces I can use, but I'm not comfortable doing that.
- F3nd0 10mo ago
  I’m not 100% sure on this in the case of AGPL, but I think you don’t need to relicense your project if you include AGPL code; you only need to make sure your project respects all the freedoms the AGPL requires it to (in a suitable way). So your own code would still be under Apache, and people could follow only the Apache conditions if they only use your code. But combined with the APGL part, the project as a whole would of course have to follow the APGL conditions.
  - giancarlostoro 10mo ago
    GPL and AGPL typically imply that your entire project is licensed under those conditions is my understanding. I find it silly to licensed something MIT or BSD but pull in some GPL code, since now the entire thing needs to comply. GPL is about end-user freedom by force against the developer. Don't get me wrong I love the GPL, but if I want to use a specific license I rather stick to that license.
  - singpolyma3 10mo ago
    > you don’t need to relicense your project if you include AGPL code; you only need to make sure your project respects all the freedoms the AGPL requires it to (in a suitable way). correct
- MarsIronPI 10mo ago
  Maybe someday the Snikket SDK[0] will be ready for use. I suppose you could look at it now anyway. Honeybee[1] is already using it for voice. [0]: https://github.com/snikket-im/snikket-sdk https://github.com/snikket-im/snikket-sdk [1]: https://git.sr.ht/~anjan/honeybee https://git.sr.ht/~anjan/honeybee

77 points by todsacerdoti 10mo ago

I always liked XMPP and SIP as messaging protocols. So easy to read and understand and implement. Both are extensible and can be made secure.

rootnod3 10mo ago
Yes. Unfortunately it seems that Matrix is the winner, but I think Matrix is over-engineered. XMPP was nice. Especially in the old times when Google Hangouts and Facebook Chat were also XMPP based. Being able to talk to people on another service without needing an account there was a nice thing to have for a few months.
- ge0rg 10mo ago
  The interop was a nice feature implemented by their engineers, but it violated the lock-in operational principles of the gatekeeper services, so it had to be abandoned. Let's see if the EU Digital Markets Act will bring back XMPP interfaces to the big ones... ;)
- tcfhgj 10mo ago
  So far it looks more like walled gardens are the real winners. What you maybe see as overengineering, I see as a prerequisite for wider adoption. These days aren't the old days any more, when you only ever used a native app without e2ee on a computer.
- syhol 10mo ago
  My main problem with matrix is that it feels sluggish. I'm told the experience can be improved by running your own homeserver so I'll be trying that sometime this year.
  - jszymborski 10mo ago
    In my limited experience, running a homeserver sucked. Really hard to do on limited resources. Then again, that was a long time ago so maybe things have improved and perhaps Dendrite has come along. But Synapse sucked to run IME.
    - Arathorn 10mo ago
      Synapse has improved; Dendrite has stagnated due to lack of funding; meanwhile there are also rust-native homeservers like Conduit which are beta but smaller footprint. The plan on the Element side is to keep optimising Synapse - the main win to be had is https://docs.google.com/presentation/d/1pKtLl4vCV3-8xz8crvxWL1GLAZtpeQovGBpakqAiugI https://docs.google.com/presentation/d/1pKtLl4vCV3-8xz8crvxW...
      - jszymborski 10mo ago
        Those slides were interesting! And I use Claude similarly... kinda like Rubber Duck debugging except it's like Rubber Human debugging.
  - ekjhgkejhgk 10mo ago
    LOL if using a chat app requires running a server maybe better just use something that doesn't suck like XMPP?
    - nosrepa 10mo ago
      I am vaguely reminded of running my own irc bouncer...
- Lammy 10mo ago
  Pardon my pedantry, but Facebook Chat was never XMPP-based. They ran an XMPP gateway into their proprietary messaging system, but there was no S2S.
- RadiozRadioz 10mo ago
  What are the reasons Matrix is the winner? Are they inherent to the protocol itself or something else?
  - rootnod3 10mo ago
    Just by what people seem to use.
  - Arathorn 10mo ago
    Matrix has a pretty comprehensive featureset with clients across a broad range of platforms. The accusations of it being overengineered come typically due to the Synapse server implementation being slow. This is basically an artefact of Matrix being quite complicated to provide a byzantine fault tolerant decentralised equivalent to WhatsApp or Slack etc - and time has gone into fixing stability and usability rather than performance. Meanwhile performance is getting better, but progress is slow due to tragedy-of-the-commons related funding challenges. We will get there in the end, though.
    - RadiozRadioz 10mo ago
      Thanks for the response Matthew! But please go to sleep! Yes it's unfortunate how much Synapse's unperformant implementation has decreased general confidence in the protocol itself. I'm confident it will get better
  - leetnewb 10mo ago
    Funding and centralization. Matrix has a for-profit, venture funded company (Element) that is effectively behind the reference/flagship server and client implementations. xmpp is far less centralized. Virtually all of the modern clients are single developer projects that live off day jobs and grants. There are different ways to look at it. Matrix has done a great job at organizing resources to push the platform forward. xmpp has an impressive ecosystem and some incredible client implementations on a shoe string budget, that would probably look/function better and have lots more features given funding parity. I think as we've seen with other projects like Immich, organizing and recruiting resources is an important part of delivering the modern experiences that users expect today from open source projects. Open source and self-hostable can't be an excuse for missing features.

ekjhgkejhgk 10mo ago

Watch the most popular clients[1] gain traction as countries (e.g. UK) pass laws mandating that tech companies backdoor their apps/encryption. [1] Conversations for Android and Gajim for Debian.

deleted 10mo ago
[deleted]

giancarlostoro 10mo ago

I'm slowly building my own XMPP client, one key thing I'm running into trouble with is there seems to be no standard library for End to End Encryption other than Signal's own, I don't want to have to relicense my entire project for one dependency, I would rather keep my project Apache licensed. The other problem is voice and video options seem to be married to some Java specific library (Jingle) which is fine if you're using Java, but I'm not, seems nobody has implemented a solution to this in other languages that I'm interested in as well. For the End to End I could try my best to implement it using existing libraries as pieces I can use, but I'm not comfortable doing that.

F3nd0 10mo ago
I’m not 100% sure on this in the case of AGPL, but I think you don’t need to relicense your project if you include AGPL code; you only need to make sure your project respects all the freedoms the AGPL requires it to (in a suitable way). So your own code would still be under Apache, and people could follow only the Apache conditions if they only use your code. But combined with the APGL part, the project as a whole would of course have to follow the APGL conditions.
- giancarlostoro 10mo ago
  GPL and AGPL typically imply that your entire project is licensed under those conditions is my understanding. I find it silly to licensed something MIT or BSD but pull in some GPL code, since now the entire thing needs to comply. GPL is about end-user freedom by force against the developer. Don't get me wrong I love the GPL, but if I want to use a specific license I rather stick to that license.
- singpolyma3 10mo ago
  > you don’t need to relicense your project if you include AGPL code; you only need to make sure your project respects all the freedoms the AGPL requires it to (in a suitable way). correct
MarsIronPI 10mo ago
Maybe someday the Snikket SDK[0] will be ready for use. I suppose you could look at it now anyway. Honeybee[1] is already using it for voice. [0]: https://github.com/snikket-im/snikket-sdk https://github.com/snikket-im/snikket-sdk [1]: https://git.sr.ht/~anjan/honeybee https://git.sr.ht/~anjan/honeybee