5 ms·

Jabber/XMPP: How Do We Gain Traction?

97 points by inputmice 13d ago

eimrine 13d ago
I love XMPP, but its OTR plugin is kind of glitchy.
- andix 13d ago
  E2E encryption should be part of the main protocol spec and mandatory. It's 2026 now. Nobody needs a messenger that isn't encrypted.
  - verdverm 13d ago
    > Nobody needs a messenger that isn't encrypted. Businesses want to analyze internal company messages. Chat protocols / platforms need to make inroads with one of the core audiences for online chat. Those are largely taken right now, (slack/teams business, discord gaming/oss). If it is personal/small group messaging, several E2EE options already exist, though I understand Jabber/XMPP is trying to be in the chatroom genre
    - iamnothere 13d ago
      Not every messenger needs to support every use case
      - verdverm 13d ago
        you'll need one major group if traction is the goal, which seems to be what the posted link is really after chat is network effect, so a chat app needs to answer "which network of people" if the creators about traction?
        iamnothere 13d ago
        True, segmentation is already happening with users choosing apps based on geography, age, and sometimes by social group. It’s possible to target and win over a select group of people if you have a compelling feature or an experience that’s geared towards their needs. You just have to decide who you are focusing on. I can easily imagine a future where people switch between three messengers, one for general communications with acquaintances and family, one for work, and one for their social circle. Many already do this with social networks.
        verdverm 12d ago
        text, slack, discord for those three already (for me); none were my choice, unlikely I would chose any of them given better options, yay capitalism!
    - foobiekr 13d ago
      There is literally nothing about enterprise inspecting proxies that requires the client operate without default and always on crypto. That makes no sense at all. The way businesses handle this is by installing a certificate they manage and deploy to their proxies.
      - verdverm 13d ago
        one does not typically do data science on message content by capturing it at the proxy, go to the database and dump the data set
    - OkayPhysicist 13d ago
      You can do E2E encryption for organizations, you just establish all conversations as at least 3-way conversations: the two members of the org, and the org itself. You let the server refuse to host any conversation it isn't privy to, and then apps that support organization mode automatically add the org listener, and users using third-party clients can add it manually.
      - mahboi 13d ago
        The org can just host non-E2EE XMPP, and it'd be the same as this wrt trust, easier to implement too.
      - verdverm 13d ago
        E2EE has well known issues for scaling, which is why it's found primarily in small group / personal chat
  - aboardRat4 13d ago
    E2EE will never be the default, because people lose their devices all the time, and don't want to lose message history.
    - jeroenhd 13d ago
      WhatsApp doesn't even have the option to disable e2ee anymore and it's doing just fine, despite their best efforts to screw over their customers.
      - mahboi 13d ago
        WhatsApp depends heavily on centralization.
    - codedokode 13d ago
      Who are those people having lot of time to re-read their old message history? I assume most people only read last several messages in a chat. This matches the real life conversations which are not stored anywhere. However, police will definitely be happy to discover that your many years messaging history is intact. I would rather want a feature, like Telegram has, where you can set auto-delete of all messages older than N days.
      - jprjr_ 13d ago
        For me searching my old messages is really useful. I don't scroll back through history but I'll search for things like "plumber" to find the number of a plumber a friend texted me a while back.
      - aboardRat4 12d ago
        >Who are those people having lot of time to re-read their old message history? Everyone who has to, say, prove that they kept paying their rent for a year without interruptions. You sent a photo of your money transfer from the bank app to your landlord, and he sends the "received" screenshot from his bank app. Moreover, a lot (even most) people make personal notes by sending messages to themselves.
      - 12d ago
  - mahboi 13d ago
    I disagree. XMPP wasn't designed for it, and there are already others that have done E2EE better, while still having some downsides. The only way XMPP has an edge is by not doing E2EE.
- gatlin 13d ago
  OMEMO has superseded xmpp for a while now.
- ValdikSS 13d ago
  Everybody has switched to OMEMO. It's the same encryption standard which Signal uses. It supports multiple devices and encrypted group chats as well.
ruined 13d ago
traction? the xmpp moment was 20 years ago. it's over now
- mahboi 13d ago
  The software playing field is different with AI. Like making nice mobile/desktop apps used to be a serious barrier.
- SoftTalker 13d ago
  Yep. He's dead, Jim. If reviving XMPP is the battle you want to fight, best of luck but I'd encourage you to take a step back, face reality, and spend your energy on something with a better chance of success. And I say that as someone who used Jabber all day long 20 years ago.
  - ezst 13d ago
    I really don't understand this attitude. The landscape has changed in 25 years, XMPP was built from the ground-up for extensibility. And that was the right approach, since it managed to improve continuously, and is now on par with the dominant alternatives. In that timespan, it survived 2 or 3 generations of messengers. It will survive Facebook, WhatsApp, Telegram and others (which, by their proprietary and centralized nature, are prone to enshittification). For anyone paying attention, it should be the clear "safe bet" for what to try next/keep at hand somewhere.
  - yosamino 13d ago
    > spend your energy on something with a better chance of success. but what ?
- jeroenhd 13d ago
  So was RCS, until Google resurrected its rotting corpse and made it the default messenger for billions. All we need is for a billion dollar company to build their own implementation and XMPP can be back once more. Exactly the way it gained popularity back in the day.
jprjr_ 13d ago
Make a single cross-platform client that implements every non-humorous XEP. If you tell people "on Android you should use this app, on iOS use that app" - you lose regular people fast. If you have a feature that only exists in one app on one platform, you also really lose people. People don't really sign up for protocols, they download apps. Like I often refer to the fediverse as "Mastodon" even though I know that's not entirely correct, because it's the fastest, easiest way to communicate what I'm talking about - microblogging. So you really need a single, good app you can just tell people to download.
- dd8601fn 13d ago
  It doesn’t appear to be honestly asking. It’s mostly whining that the world is too unfair because capitalism and people are dumb for choosing Signal, etc.
- cyberrock 13d ago
  Also a self-hosted server with opinionated defaults. The year is 2026, and most users expect persistent history without having to add mod_mam themselves. Discord won from zero because it's IRC with history. I cannot believe that chat history, mentions, etc. is still not settled.
  - pona-a 13d ago
    This is effectively settled. Every client worth using has standardized on certain extensions, and there are server capability testers for it [0]. There are still a LOT of things very much up in the air, such as message deletion, which work inconsistently from client to client, but message history is not it. [0] https://compliance.conversations.im/ https://compliance.conversations.im/
    - tcfhgj 13d ago
      call me out if I am wrong, but isn't history dependent on the server of the chatroom creator, and doesn't every server have different history settings and does it not handle encrypted messages fully?
pkthunder 13d ago
I think the article brushes over something that adds (IMO) a ton of friction to Jabber/XMPP: self-hosting your own server. About 6 months ago, I tried to go down the awesome selfhosted XMPP servers list and it was just so painful I ended up finding an alternative stack.
- verdverm 13d ago
  What stack did you land on?
  - pkthunder 13d ago
    Just a self-hosted Zulip instance for family members, exposed externally via Tailscale. I wanted to try Mongoose and Snikket (possibly Prosody as well, but can't recall), but I guess my infrastructure didn't want to line up directly with what they want for a quick start. shrug
- seszett 13d ago
  On the contrary I found hosting an xmpp server extremely easy and very light in maintenance with prosody. I've been doing it for years and it's the part of my infrastructure that I spend the least time on certainly.
- ezst 13d ago
  I'm just a hobbyist sysadmin, but I did get a ton of exposure over the decades deploying some pretty random stuff, often taking the long and painful way as a learning experience (rarely using containers, often compiling from source, …). I vividly remember deploying ejabberd for the first time in disbelief: for all it was doing, it was just a fire and forget/good defaults/good logging/self-healing experience. Highly recommend.
- regularfry 13d ago
  Snikket claims to solve this but assumes it's got a routable IP address. If you've got it on a VM somewhere cloudy you're probably fine but I had to really jump through hoops to get it working behind NAT on my own hardware.
neilalexander 13d ago
My attempts to use XMPP mostly start and end very quickly with the fact that there isn't a single good native XMPP client for Mac or iOS. None of Monal, Siskin or Beagle are a good experience, ChatSecure appears to be abandonware and Prose is Yet Another Web App.
theshrike79 13d ago
There’s no official way to “tag” people on Jabber. Clients do it but the protocol doesn’t. This is (to me) a big issue when using bots, for example. I need a non-ambiguous trigger for them.
- jprjr_ 13d ago
  There is a XEP for it but as per usual, it's experimental and not widely implemented: https://xmpp.org/extensions/xep-0513.html https://xmpp.org/extensions/xep-0513.html https://xmpp.org/software/?category=clients&xeps=0513 https://xmpp.org/software/?category=clients&xeps=0513
  - theshrike79 12d ago
    Yep :( I wanted to self-host a chat service where I can control my bots and AIs, but with no native tagging functionality makes it really janky to work with. Discord and Telegram Just Work, but I'd much rather have the whole thing in my control. Buzz[0] seems nice, but for one person an 5 bots having a full-ass postgres+redis+s3 setup seems completely bonkers. [0] https://github.com/block/buzz https://github.com/block/buzz
harvie 13d ago
Jabber/XMPP started to suck at the moment we've started using smartphones that keep reconnecting between wifi and mobile networks as i move around. relying on that single persistent TCP connection does not make sense anymore. This is huge pain with IRC as well... And no, i will not run server-side proxy irc client that is supposed to keep me reachable while im reconnecting. Also sending media (or even rich text) never really worked as each client implemented it differently. While whatsapp just works...
- jszymborski 13d ago
  So, my understanding is that while XMPP has historically sucked on mobile, it's gotten better? Does anyone know about the current experience? I don't know if it's due to new XEPs or if it's just better client implementation...
  - jkxyz 13d ago
    If you're talking about the push notifications experience, then XEP-0357 solves this, but app developers have to host the infrastructure which the XMPP server calls back to and dispatches the notifications to Apple or Google. Last time I used Monal on iOS this was solved and worked well. On Android I think most apps still prefer to keep their own background connection open. https://xmpp.org/extensions/xep-0357.html https://xmpp.org/extensions/xep-0357.html
    - Leonard_of_Q 13d ago
      > On Android I think most apps still prefer to keep their own background connection open Many Android apps give the option of using either FCM (Firebase Cloud Messaging, Google's push service), UnifiedPush or polling.
      - ezst 13d ago
        Of note, Conversations and some other XMPP clients can act as UnifiedPush Distributors (i.e. they use their own reliable persistent connection to proxy notifications for other apps). Some mastodon (tusky, fedilab, …), matrix (fluffy chat, element x, …) clients use it¹ ¹: https://unifiedpush.org/users/apps/ https://unifiedpush.org/users/apps/
mococa 13d ago
I think the main problem was the fragmentation & extensions
est 13d ago
I hope more people realize, protocol is not the problem, user experience is. The Telegram client leads in every aspect by far. It's just easy to use.
- encom 13d ago
  As long as the Signal desktop app is a 420 MB[1] pile of Electron, I refuse to install it. I may be a dinosaur, but a good desktop app is a requirement. I hate typing on a touch screen. [1] $ curl -s https://updates.signal.org/desktop/apt/dists/xenial/main/binary-amd64/Packages | awk '/^Package: signal-desktop$/{p=1} p{print} /^$/{if(p) exit}'
  - mrweasel 13d ago
    Same, it might conflicts a little with the desire to have a single application, but I want a native application for each platform which uses native UI and libraries. There's no reason a messaging app should be more than e.g. 40MB.
  - codedokode 13d ago
    I am ok with Electron if it is needed for Matrix. Also, Telegram has a C++ desktop client. Also, I would not advise to add proprietary repositories as you grant them root access to your system which is against security practices such as the principle of minimum privileges and defence-in-depth.
  - pixelschubsi0 13d ago
    As a dinosaur, maybe dino.im is something for you ;)
  - Markoff 12d ago
    I would rather prefer browser app like Whatsapp/Telegram, I am not going to install extra app and switching windows to see chat when I spend most of the day in browser on desktop
- Aldipower 13d ago
  This is true. Telegram is fast, stable and has some leading and meaningful features. On mobile AND desktop.
zajio1am 13d ago
I use XMPP (with OMEMO) extensively and my main problem with it is absence of some basic key trust chains and bad handling of group chats 1) With OMEMO, each client/device of a user has its own key, but there is no trust relationship between them or some common master key. I can verify and trust counterparty key, but then counterparty adds another client/device and i have to do manual verification again. 2) Group chats do not have group key, but one encrypt messages for each group member (pairwise), which means that everybody has to do key exchange with everybody. This does not scale, especially with 1), which means that even if membership is stable, new keys may appear. Some clients (Conversations) do not allow to send message to a group when they do not know some keys of some group members/devices, which is fail situation that happen pretty often.
- mahboi 13d ago
  I've tried designing an E2EE group chat system before and ran into all of these. They're not impossible to solve but are very hard. Telegram's official docs shrug off multi-device E2EE too, calling it a "mess."
- ezst 13d ago
  1) I think that's by design: you've got two ways to use OMEMO, the "friendly (default)-way" (with BTBV, Blind Trust Before Verification), and the "paranoid-way" (where you verify each and every device). In the latter, you don't want your messages to be encrypted for a new, unverified device (as it could potentially be that of an attacker): you can either verify the new device yourself, or your contact can verify theirs and you verify them again. Like I said, that's not for everyone. And if you are not that paranoid, then verification is an afterthought anyway and you don't lose or gain much with verification anyway. 2) That's where MLS¹ kicks in, essentially a new encryption scheme that's suitable for large group chats. There are projects² for its adoption in XMPP. I have no strong opinion about MLS, but I tend to think that it's more for the gimmick and having XMPP score well in random protocol benchmarks: if you've got such a large groupchat that OMEMO doesn't scale anymore, you have a groupchat with so many participants that it is only private in name and more or less encryption doesn't matter. ¹: https://en.wikipedia.org/wiki/Messaging_Layer_Security https://en.wikipedia.org/wiki/Messaging_Layer_Security ²: https://nlnet.nl/project/XMPP-MLS/ https://nlnet.nl/project/XMPP-MLS/
armchairhacker 13d ago
Is it worth it to overcome network effect? Maybe just make something so useful that it is even if only people who listen to you use it, which XMPP is, and recommend it to people who are willing to try (not only because of vague curiosity, which fades very quickly, but because it's useful to them).
- ezst 13d ago
  I've been self-hosting XMPP for slightly more than 10 years now. I started out of necessity with 2/3 family members, so I would have reliable messaging while travelling on a tight bandwidth, and/or to places that would censor the usual alternatives. This turned into 20+ family members over time. Old friends, then colleagues, joined in about similar proportions. I'm experienced enough to never have "pitched it" or tried to "sell it" to them. I only tell them that this is what I use, and that, unlike the other commercial things they may be familiar with, it will keep working for as long as I'm alive to pay the hosting bills. That generally gets them curious-enough to try. About colleagues, some eventually start using it among themselves because it's a more "relaxed" experience than using Teams on their phone. I won't change the world that way (nor do I intend to), I just think that there is room for more than just one monopolistic and slowly-enshittifying network, and plenty for XMPP.
foobiekr 13d ago
Most of the critique in the post is about the low quality of Signal's app, which has zero to do with the protocol. And frankly almost every XMPP client was vastly worse in quality terms than Signal is and OTR regularly just produced garbage. It had a chance. Signal is not widespread because the only reason to use it is high privacy consciousness or being in the government and wanting secure chat with automatic deletion for conversations you're not supposed to be having. It's a little like asking "Carburetors: How do we gain traction?" XMPP is not a well designed protocol in many ways. There's no particular reason for anyone to care.
NietTim 13d ago
Sounds like the same issue as with Mastodon. The vast majority of people are not interested in a 'protocol' (or even know what that is), they do not care what protocol powers their _app_, they just care about their app
mtkniazi 13d ago
[flagged]
larrysalibra 13d ago
Jabber/XMPP is now over 25 years old. Its peak was back when Google Talk and Facebook Chat adopted it in the late 2000s and when Whatsapp launched using XMPP under the hood. And it largely died when those two large companies went fully proprietary around 2015. The fact that 25 years later it's still being described as two completely different names with a slash between them ("Jabber" SLASH "XMPP" ) makes me pretty confident it's not coming back. Don't get me wrong...I'd love open, interoperable chat that everyone is reachable by as much as anyone, but it's important to recognize when one approach isn't working and why it isn't. There's a lot of lessons to be learned from the death of jabber which I outlined in a post back on 2019: https://larrysalibra.com/the-death-of-jabber/ https://larrysalibra.com/the-death-of-jabber/
- ezst 13d ago
  It doesn't matter as much as you think. Office workers around the world are using email(/IMAP) just fine. Jabber/XMPP was used today to the satisfaction of everyone when I video-called my 90 years-old relative. All she had to do was to scan some QRCode a decade or so ago when I on-boarded her. XMPP isn't going anywhere. As I wrote in a sibling post, it survived 2 or 3 generations of commercial messengers, and only got better and more relevant in that timespan. It's far from dead. I'll probably be dead myself long before it does.
Aldipower 13d ago
I remember when I connected my XMPP client, Pidgin I think, to the Facebook XMPP server and all my Facebook "friends" appeared in Pidgin as chat contacts. That were the times. Eventually Facebook turned this possibility off... Probably the Facebook chat is still XMPP internally even today.
- ezst 13d ago
  And Google Talk. And WhatsApp. https://www.process-one.net/blog/whatsapp-facebook-erlang-and-realtime-messaging-it-all-started-with-ejabberd/ https://www.process-one.net/blog/whatsapp-facebook-erlang-an...
  - rw_grim 13d ago
    and AIM even had an XMPP bridge for a _very_ short time.
- mahboi 13d ago
  At some point I had iChat with AIM, Facebook, and Google all set up, and actually talking to all my friends that way. It was sweet.
testaccount156 13d ago
[flagged]
mahboi 13d ago
"Signal doesn’t actually suck. It’s fine. It gets the job done. It lets me communicate with my friends." The beginning was complaining about Signal! What is XMPP needed for then? Also, doesn't seem like many people have friends on either of them.
rickydroll 13d ago
The fundamental question is: why should I use Jabber? What's the use case that makes it better than WhatsApp, Signal, et cetera? My most-used messaging app is SMS because if you have a cell phone, you have SMS. Example this morning is I made a connection with a handyman recommended by a friend. Text message, and it just worked. So what's the compelling reason to move to Jabber? Why should my 92-year-old mother use it?
- regularfry 13d ago
  You don't need to ask anyone else's permission. The thing that got me over the hump was wanting secure chat with an AI agent running on my own hardware. Asking WhatsApp for an API key just rubbed me up the wrong way.
mahboi 13d ago
I'd like Jabber to establish itself as the federated, non-E2EE chat platform. OMEMO is too little too late. You want E2EE so badly, you use Signal which has figured it out better than anyone else and is still glitchy. There's a reason Telegram is more popular; most people take stability and features over security. Some use cases like business chat actually can't have E2EE, and that'd probably be Jabber's foot in the door because no other open solution has taken off in business, and businesses don't need so much network effect. This was a main Jabber use case back in the day too. Make decent official Jabber clients, called Jabber and not something else like a bird, and server that implements the right spec with default settings. Now is the time, you can AI slopcode entire native apps if you want to. If someone really want to put extensions on a server, it's called XMPP and isn't compatible with Jabber; the X stands for excommunicated.
- ezst 13d ago
  > Some use cases like business chat actually can't have E2EE, and that'd probably be Jabber's foot in the door because no other open solution has taken off in business So, Cisco Jabber (now Webex)? You can't really compete against Microsoft and its bundling strategy. Even Slack is dying, unfortunately.
  - mahboi 13d ago
    Yes, you can't beat Microsoft at this, at best you can be a choice for those who want in-house instead of trusting Microsoft. Webex can't be run on-prem, can it? I vaguely know about the old Cisco Jabber.
  - theshrike79 12d ago
    If Slack is dying, what's replacing it?
    - ezst 12d ago
      Teams. Your CFO keeps telling your head of Projects/Engineering that he's already paying for it anyway. And your helpdesk loves it because it's sharepoint all the way down and up, and they can shine their "Microsoft Certified Kung-Fu level Sharepoint Master Accreditee" certification.
cadamsdotcom 13d ago
> There are only two features people actually care about: reliable message delivery and the ability to reach their friends. Sorry to be a pain, and with full recognition that I don't probably represent the majority, but I care about emoji reactions, reply support, ability to send & receive images and video, ability to see that video later, a reasonable set of access control features for group chats; reply-privately for group chat messages, and a dozen other things. And I care about not making someone download an app I've never used that talks the protocol, because I can't support them getting started. So a single cross platform UX is needed too before you can hope for traction. Some of this is UX; some requires infra (eg. storing & forwarding media) But to produce a "complete" messaging tool is harder than it looks and the protocol layer, while important, should not be the focus of discussion. There needs to be a holistic conversation that includes UX, infrastructure capabilities, branding, and network effects.
- theshrike79 12d ago
  Yep, the baseline for "messaging" has changed. Without first party emoji support, preferably custom emojis too, images, reaction gifs etc the majority of non old-nerd people won't even consider the system. And it can't just be an optional feature in some clients, it needs to be something that just works everywhere.
Markoff 12d ago
implement SMS into your whatever Android app I am using Whatsapp and I MUST have some SMS app in phone, if your app will support SMS and on top of that will provide Jabber/XMPP messages over data I will be more than happy to replace my SMS app with your app. Sadly seems there is pretty much NONE apps where dev would bother to implement support for simple SMS. And if your app doesn't support SMS I am not going to install any other obscure app since I need SMS to receive 2FA codes/delivery notifications/doctor appointments, etc. Signal used to be liek this until 2022, not many people used it, but at least you could use it for SMS and if there was Signal contact you could use their network, in their wisdom they removed SMS feature, so Signal was removed from phones of my whole extended family since we need SMS and not going to have extra Signal without SMS, if anyway majority use Whatsapp.
cykros 12d ago
Bitlbee + irssi. It'll ensure the wrong people don't end up in your chats. For use on mobile, run it in a tmux or screen session and reconnect over ssh.

97 points by inputmice 13d ago

eimrine 13d ago

I love XMPP, but its OTR plugin is kind of glitchy.

andix 13d ago
E2E encryption should be part of the main protocol spec and mandatory. It's 2026 now. Nobody needs a messenger that isn't encrypted.
- verdverm 13d ago
  > Nobody needs a messenger that isn't encrypted. Businesses want to analyze internal company messages. Chat protocols / platforms need to make inroads with one of the core audiences for online chat. Those are largely taken right now, (slack/teams business, discord gaming/oss). If it is personal/small group messaging, several E2EE options already exist, though I understand Jabber/XMPP is trying to be in the chatroom genre
  - iamnothere 13d ago
    Not every messenger needs to support every use case
    - verdverm 13d ago
      you'll need one major group if traction is the goal, which seems to be what the posted link is really after chat is network effect, so a chat app needs to answer "which network of people" if the creators about traction?
      - iamnothere 13d ago
        True, segmentation is already happening with users choosing apps based on geography, age, and sometimes by social group. It’s possible to target and win over a select group of people if you have a compelling feature or an experience that’s geared towards their needs. You just have to decide who you are focusing on. I can easily imagine a future where people switch between three messengers, one for general communications with acquaintances and family, one for work, and one for their social circle. Many already do this with social networks.
        verdverm 12d ago
        text, slack, discord for those three already (for me); none were my choice, unlikely I would chose any of them given better options, yay capitalism!
  - foobiekr 13d ago
    There is literally nothing about enterprise inspecting proxies that requires the client operate without default and always on crypto. That makes no sense at all. The way businesses handle this is by installing a certificate they manage and deploy to their proxies.
    - verdverm 13d ago
      one does not typically do data science on message content by capturing it at the proxy, go to the database and dump the data set
  - OkayPhysicist 13d ago
    You can do E2E encryption for organizations, you just establish all conversations as at least 3-way conversations: the two members of the org, and the org itself. You let the server refuse to host any conversation it isn't privy to, and then apps that support organization mode automatically add the org listener, and users using third-party clients can add it manually.
    - mahboi 13d ago
      The org can just host non-E2EE XMPP, and it'd be the same as this wrt trust, easier to implement too.
    - verdverm 13d ago
      E2EE has well known issues for scaling, which is why it's found primarily in small group / personal chat
- aboardRat4 13d ago
  E2EE will never be the default, because people lose their devices all the time, and don't want to lose message history.
  - jeroenhd 13d ago
    WhatsApp doesn't even have the option to disable e2ee anymore and it's doing just fine, despite their best efforts to screw over their customers.
    - mahboi 13d ago
      WhatsApp depends heavily on centralization.
  - codedokode 13d ago
    Who are those people having lot of time to re-read their old message history? I assume most people only read last several messages in a chat. This matches the real life conversations which are not stored anywhere. However, police will definitely be happy to discover that your many years messaging history is intact. I would rather want a feature, like Telegram has, where you can set auto-delete of all messages older than N days.
    - jprjr_ 13d ago
      For me searching my old messages is really useful. I don't scroll back through history but I'll search for things like "plumber" to find the number of a plumber a friend texted me a while back.
    - aboardRat4 12d ago
      >Who are those people having lot of time to re-read their old message history? Everyone who has to, say, prove that they kept paying their rent for a year without interruptions. You sent a photo of your money transfer from the bank app to your landlord, and he sends the "received" screenshot from his bank app. Moreover, a lot (even most) people make personal notes by sending messages to themselves.
    - 12d ago
- mahboi 13d ago
  I disagree. XMPP wasn't designed for it, and there are already others that have done E2EE better, while still having some downsides. The only way XMPP has an edge is by not doing E2EE.
gatlin 13d ago
OMEMO has superseded xmpp for a while now.
ValdikSS 13d ago
Everybody has switched to OMEMO. It's the same encryption standard which Signal uses. It supports multiple devices and encrypted group chats as well.

ruined 13d ago

traction? the xmpp moment was 20 years ago. it's over now

mahboi 13d ago
The software playing field is different with AI. Like making nice mobile/desktop apps used to be a serious barrier.
SoftTalker 13d ago
Yep. He's dead, Jim. If reviving XMPP is the battle you want to fight, best of luck but I'd encourage you to take a step back, face reality, and spend your energy on something with a better chance of success. And I say that as someone who used Jabber all day long 20 years ago.
- ezst 13d ago
  I really don't understand this attitude. The landscape has changed in 25 years, XMPP was built from the ground-up for extensibility. And that was the right approach, since it managed to improve continuously, and is now on par with the dominant alternatives. In that timespan, it survived 2 or 3 generations of messengers. It will survive Facebook, WhatsApp, Telegram and others (which, by their proprietary and centralized nature, are prone to enshittification). For anyone paying attention, it should be the clear "safe bet" for what to try next/keep at hand somewhere.
- yosamino 13d ago
  > spend your energy on something with a better chance of success. but what ?
jeroenhd 13d ago
So was RCS, until Google resurrected its rotting corpse and made it the default messenger for billions. All we need is for a billion dollar company to build their own implementation and XMPP can be back once more. Exactly the way it gained popularity back in the day.

jprjr_ 13d ago

Make a single cross-platform client that implements every non-humorous XEP. If you tell people "on Android you should use this app, on iOS use that app" - you lose regular people fast. If you have a feature that only exists in one app on one platform, you also really lose people. People don't really sign up for protocols, they download apps. Like I often refer to the fediverse as "Mastodon" even though I know that's not entirely correct, because it's the fastest, easiest way to communicate what I'm talking about - microblogging. So you really need a single, good app you can just tell people to download.

dd8601fn 13d ago
It doesn’t appear to be honestly asking. It’s mostly whining that the world is too unfair because capitalism and people are dumb for choosing Signal, etc.
cyberrock 13d ago
Also a self-hosted server with opinionated defaults. The year is 2026, and most users expect persistent history without having to add mod_mam themselves. Discord won from zero because it's IRC with history. I cannot believe that chat history, mentions, etc. is still not settled.
- pona-a 13d ago
  This is effectively settled. Every client worth using has standardized on certain extensions, and there are server capability testers for it [0]. There are still a LOT of things very much up in the air, such as message deletion, which work inconsistently from client to client, but message history is not it. [0] https://compliance.conversations.im/ https://compliance.conversations.im/
  - tcfhgj 13d ago
    call me out if I am wrong, but isn't history dependent on the server of the chatroom creator, and doesn't every server have different history settings and does it not handle encrypted messages fully?

pkthunder 13d ago

I think the article brushes over something that adds (IMO) a ton of friction to Jabber/XMPP: self-hosting your own server. About 6 months ago, I tried to go down the awesome selfhosted XMPP servers list and it was just so painful I ended up finding an alternative stack.

verdverm 13d ago
What stack did you land on?
- pkthunder 13d ago
  Just a self-hosted Zulip instance for family members, exposed externally via Tailscale. I wanted to try Mongoose and Snikket (possibly Prosody as well, but can't recall), but I guess my infrastructure didn't want to line up directly with what they want for a quick start. shrug
seszett 13d ago
On the contrary I found hosting an xmpp server extremely easy and very light in maintenance with prosody. I've been doing it for years and it's the part of my infrastructure that I spend the least time on certainly.
ezst 13d ago
I'm just a hobbyist sysadmin, but I did get a ton of exposure over the decades deploying some pretty random stuff, often taking the long and painful way as a learning experience (rarely using containers, often compiling from source, …). I vividly remember deploying ejabberd for the first time in disbelief: for all it was doing, it was just a fire and forget/good defaults/good logging/self-healing experience. Highly recommend.
regularfry 13d ago
Snikket claims to solve this but assumes it's got a routable IP address. If you've got it on a VM somewhere cloudy you're probably fine but I had to really jump through hoops to get it working behind NAT on my own hardware.

neilalexander 13d ago

My attempts to use XMPP mostly start and end very quickly with the fact that there isn't a single good native XMPP client for Mac or iOS. None of Monal, Siskin or Beagle are a good experience, ChatSecure appears to be abandonware and Prose is Yet Another Web App.

theshrike79 13d ago

There’s no official way to “tag” people on Jabber. Clients do it but the protocol doesn’t. This is (to me) a big issue when using bots, for example. I need a non-ambiguous trigger for them.

jprjr_ 13d ago
There is a XEP for it but as per usual, it's experimental and not widely implemented: https://xmpp.org/extensions/xep-0513.html https://xmpp.org/extensions/xep-0513.html https://xmpp.org/software/?category=clients&xeps=0513 https://xmpp.org/software/?category=clients&xeps=0513
- theshrike79 12d ago
  Yep :( I wanted to self-host a chat service where I can control my bots and AIs, but with no native tagging functionality makes it really janky to work with. Discord and Telegram Just Work, but I'd much rather have the whole thing in my control. Buzz[0] seems nice, but for one person an 5 bots having a full-ass postgres+redis+s3 setup seems completely bonkers. [0] https://github.com/block/buzz https://github.com/block/buzz

harvie 13d ago

Jabber/XMPP started to suck at the moment we've started using smartphones that keep reconnecting between wifi and mobile networks as i move around. relying on that single persistent TCP connection does not make sense anymore. This is huge pain with IRC as well... And no, i will not run server-side proxy irc client that is supposed to keep me reachable while im reconnecting. Also sending media (or even rich text) never really worked as each client implemented it differently. While whatsapp just works...

jszymborski 13d ago
So, my understanding is that while XMPP has historically sucked on mobile, it's gotten better? Does anyone know about the current experience? I don't know if it's due to new XEPs or if it's just better client implementation...
- jkxyz 13d ago
  If you're talking about the push notifications experience, then XEP-0357 solves this, but app developers have to host the infrastructure which the XMPP server calls back to and dispatches the notifications to Apple or Google. Last time I used Monal on iOS this was solved and worked well. On Android I think most apps still prefer to keep their own background connection open. https://xmpp.org/extensions/xep-0357.html https://xmpp.org/extensions/xep-0357.html
  - Leonard_of_Q 13d ago
    > On Android I think most apps still prefer to keep their own background connection open Many Android apps give the option of using either FCM (Firebase Cloud Messaging, Google's push service), UnifiedPush or polling.
    - ezst 13d ago
      Of note, Conversations and some other XMPP clients can act as UnifiedPush Distributors (i.e. they use their own reliable persistent connection to proxy notifications for other apps). Some mastodon (tusky, fedilab, …), matrix (fluffy chat, element x, …) clients use it¹ ¹: https://unifiedpush.org/users/apps/ https://unifiedpush.org/users/apps/

mococa 13d ago

I think the main problem was the fragmentation & extensions

est 13d ago

I hope more people realize, protocol is not the problem, user experience is. The Telegram client leads in every aspect by far. It's just easy to use.

encom 13d ago
As long as the Signal desktop app is a 420 MB[1] pile of Electron, I refuse to install it. I may be a dinosaur, but a good desktop app is a requirement. I hate typing on a touch screen. [1] $ curl -s https://updates.signal.org/desktop/apt/dists/xenial/main/binary-amd64/Packages | awk '/^Package: signal-desktop$/{p=1} p{print} /^$/{if(p) exit}'
- mrweasel 13d ago
  Same, it might conflicts a little with the desire to have a single application, but I want a native application for each platform which uses native UI and libraries. There's no reason a messaging app should be more than e.g. 40MB.
- codedokode 13d ago
  I am ok with Electron if it is needed for Matrix. Also, Telegram has a C++ desktop client. Also, I would not advise to add proprietary repositories as you grant them root access to your system which is against security practices such as the principle of minimum privileges and defence-in-depth.
- pixelschubsi0 13d ago
  As a dinosaur, maybe dino.im is something for you ;)
- Markoff 12d ago
  I would rather prefer browser app like Whatsapp/Telegram, I am not going to install extra app and switching windows to see chat when I spend most of the day in browser on desktop
Aldipower 13d ago
This is true. Telegram is fast, stable and has some leading and meaningful features. On mobile AND desktop.

zajio1am 13d ago

I use XMPP (with OMEMO) extensively and my main problem with it is absence of some basic key trust chains and bad handling of group chats 1) With OMEMO, each client/device of a user has its own key, but there is no trust relationship between them or some common master key. I can verify and trust counterparty key, but then counterparty adds another client/device and i have to do manual verification again. 2) Group chats do not have group key, but one encrypt messages for each group member (pairwise), which means that everybody has to do key exchange with everybody. This does not scale, especially with 1), which means that even if membership is stable, new keys may appear. Some clients (Conversations) do not allow to send message to a group when they do not know some keys of some group members/devices, which is fail situation that happen pretty often.

mahboi 13d ago
I've tried designing an E2EE group chat system before and ran into all of these. They're not impossible to solve but are very hard. Telegram's official docs shrug off multi-device E2EE too, calling it a "mess."
ezst 13d ago
1) I think that's by design: you've got two ways to use OMEMO, the "friendly (default)-way" (with BTBV, Blind Trust Before Verification), and the "paranoid-way" (where you verify each and every device). In the latter, you don't want your messages to be encrypted for a new, unverified device (as it could potentially be that of an attacker): you can either verify the new device yourself, or your contact can verify theirs and you verify them again. Like I said, that's not for everyone. And if you are not that paranoid, then verification is an afterthought anyway and you don't lose or gain much with verification anyway. 2) That's where MLS¹ kicks in, essentially a new encryption scheme that's suitable for large group chats. There are projects² for its adoption in XMPP. I have no strong opinion about MLS, but I tend to think that it's more for the gimmick and having XMPP score well in random protocol benchmarks: if you've got such a large groupchat that OMEMO doesn't scale anymore, you have a groupchat with so many participants that it is only private in name and more or less encryption doesn't matter. ¹: https://en.wikipedia.org/wiki/Messaging_Layer_Security https://en.wikipedia.org/wiki/Messaging_Layer_Security ²: https://nlnet.nl/project/XMPP-MLS/ https://nlnet.nl/project/XMPP-MLS/

armchairhacker 13d ago

Is it worth it to overcome network effect? Maybe just make something so useful that it is even if only people who listen to you use it, which XMPP is, and recommend it to people who are willing to try (not only because of vague curiosity, which fades very quickly, but because it's useful to them).

ezst 13d ago
I've been self-hosting XMPP for slightly more than 10 years now. I started out of necessity with 2/3 family members, so I would have reliable messaging while travelling on a tight bandwidth, and/or to places that would censor the usual alternatives. This turned into 20+ family members over time. Old friends, then colleagues, joined in about similar proportions. I'm experienced enough to never have "pitched it" or tried to "sell it" to them. I only tell them that this is what I use, and that, unlike the other commercial things they may be familiar with, it will keep working for as long as I'm alive to pay the hosting bills. That generally gets them curious-enough to try. About colleagues, some eventually start using it among themselves because it's a more "relaxed" experience than using Teams on their phone. I won't change the world that way (nor do I intend to), I just think that there is room for more than just one monopolistic and slowly-enshittifying network, and plenty for XMPP.

foobiekr 13d ago

Most of the critique in the post is about the low quality of Signal's app, which has zero to do with the protocol. And frankly almost every XMPP client was vastly worse in quality terms than Signal is and OTR regularly just produced garbage. It had a chance. Signal is not widespread because the only reason to use it is high privacy consciousness or being in the government and wanting secure chat with automatic deletion for conversations you're not supposed to be having. It's a little like asking "Carburetors: How do we gain traction?" XMPP is not a well designed protocol in many ways. There's no particular reason for anyone to care.

NietTim 13d ago

Sounds like the same issue as with Mastodon. The vast majority of people are not interested in a 'protocol' (or even know what that is), they do not care what protocol powers their _app_, they just care about their app

mtkniazi 13d ago

[flagged]

larrysalibra 13d ago

Jabber/XMPP is now over 25 years old. Its peak was back when Google Talk and Facebook Chat adopted it in the late 2000s and when Whatsapp launched using XMPP under the hood. And it largely died when those two large companies went fully proprietary around 2015. The fact that 25 years later it's still being described as two completely different names with a slash between them ("Jabber" SLASH "XMPP" ) makes me pretty confident it's not coming back. Don't get me wrong...I'd love open, interoperable chat that everyone is reachable by as much as anyone, but it's important to recognize when one approach isn't working and why it isn't. There's a lot of lessons to be learned from the death of jabber which I outlined in a post back on 2019: https://larrysalibra.com/the-death-of-jabber/ https://larrysalibra.com/the-death-of-jabber/

ezst 13d ago
It doesn't matter as much as you think. Office workers around the world are using email(/IMAP) just fine. Jabber/XMPP was used today to the satisfaction of everyone when I video-called my 90 years-old relative. All she had to do was to scan some QRCode a decade or so ago when I on-boarded her. XMPP isn't going anywhere. As I wrote in a sibling post, it survived 2 or 3 generations of commercial messengers, and only got better and more relevant in that timespan. It's far from dead. I'll probably be dead myself long before it does.

Aldipower 13d ago

I remember when I connected my XMPP client, Pidgin I think, to the Facebook XMPP server and all my Facebook "friends" appeared in Pidgin as chat contacts. That were the times. Eventually Facebook turned this possibility off... Probably the Facebook chat is still XMPP internally even today.

ezst 13d ago
And Google Talk. And WhatsApp. https://www.process-one.net/blog/whatsapp-facebook-erlang-and-realtime-messaging-it-all-started-with-ejabberd/ https://www.process-one.net/blog/whatsapp-facebook-erlang-an...
- rw_grim 13d ago
  and AIM even had an XMPP bridge for a _very_ short time.
mahboi 13d ago
At some point I had iChat with AIM, Facebook, and Google all set up, and actually talking to all my friends that way. It was sweet.

testaccount156 13d ago

[flagged]

mahboi 13d ago

"Signal doesn’t actually suck. It’s fine. It gets the job done. It lets me communicate with my friends." The beginning was complaining about Signal! What is XMPP needed for then? Also, doesn't seem like many people have friends on either of them.

rickydroll 13d ago

The fundamental question is: why should I use Jabber? What's the use case that makes it better than WhatsApp, Signal, et cetera? My most-used messaging app is SMS because if you have a cell phone, you have SMS. Example this morning is I made a connection with a handyman recommended by a friend. Text message, and it just worked. So what's the compelling reason to move to Jabber? Why should my 92-year-old mother use it?

regularfry 13d ago
You don't need to ask anyone else's permission. The thing that got me over the hump was wanting secure chat with an AI agent running on my own hardware. Asking WhatsApp for an API key just rubbed me up the wrong way.

mahboi 13d ago

I'd like Jabber to establish itself as the federated, non-E2EE chat platform. OMEMO is too little too late. You want E2EE so badly, you use Signal which has figured it out better than anyone else and is still glitchy. There's a reason Telegram is more popular; most people take stability and features over security. Some use cases like business chat actually can't have E2EE, and that'd probably be Jabber's foot in the door because no other open solution has taken off in business, and businesses don't need so much network effect. This was a main Jabber use case back in the day too. Make decent official Jabber clients, called Jabber and not something else like a bird, and server that implements the right spec with default settings. Now is the time, you can AI slopcode entire native apps if you want to. If someone really want to put extensions on a server, it's called XMPP and isn't compatible with Jabber; the X stands for excommunicated.

ezst 13d ago
> Some use cases like business chat actually can't have E2EE, and that'd probably be Jabber's foot in the door because no other open solution has taken off in business So, Cisco Jabber (now Webex)? You can't really compete against Microsoft and its bundling strategy. Even Slack is dying, unfortunately.
- mahboi 13d ago
  Yes, you can't beat Microsoft at this, at best you can be a choice for those who want in-house instead of trusting Microsoft. Webex can't be run on-prem, can it? I vaguely know about the old Cisco Jabber.
- theshrike79 12d ago
  If Slack is dying, what's replacing it?
  - ezst 12d ago
    Teams. Your CFO keeps telling your head of Projects/Engineering that he's already paying for it anyway. And your helpdesk loves it because it's sharepoint all the way down and up, and they can shine their "Microsoft Certified Kung-Fu level Sharepoint Master Accreditee" certification.

cadamsdotcom 13d ago

> There are only two features people actually care about: reliable message delivery and the ability to reach their friends. Sorry to be a pain, and with full recognition that I don't probably represent the majority, but I care about emoji reactions, reply support, ability to send & receive images and video, ability to see that video later, a reasonable set of access control features for group chats; reply-privately for group chat messages, and a dozen other things. And I care about not making someone download an app I've never used that talks the protocol, because I can't support them getting started. So a single cross platform UX is needed too before you can hope for traction. Some of this is UX; some requires infra (eg. storing & forwarding media) But to produce a "complete" messaging tool is harder than it looks and the protocol layer, while important, should not be the focus of discussion. There needs to be a holistic conversation that includes UX, infrastructure capabilities, branding, and network effects.

theshrike79 12d ago
Yep, the baseline for "messaging" has changed. Without first party emoji support, preferably custom emojis too, images, reaction gifs etc the majority of non old-nerd people won't even consider the system. And it can't just be an optional feature in some clients, it needs to be something that just works everywhere.

Markoff 12d ago

implement SMS into your whatever Android app I am using Whatsapp and I MUST have some SMS app in phone, if your app will support SMS and on top of that will provide Jabber/XMPP messages over data I will be more than happy to replace my SMS app with your app. Sadly seems there is pretty much NONE apps where dev would bother to implement support for simple SMS. And if your app doesn't support SMS I am not going to install any other obscure app since I need SMS to receive 2FA codes/delivery notifications/doctor appointments, etc. Signal used to be liek this until 2022, not many people used it, but at least you could use it for SMS and if there was Signal contact you could use their network, in their wisdom they removed SMS feature, so Signal was removed from phones of my whole extended family since we need SMS and not going to have extra Signal without SMS, if anyway majority use Whatsapp.

cykros 12d ago

Bitlbee + irssi. It'll ensure the wrong people don't end up in your chats. For use on mobile, run it in a tmux or screen session and reconnect over ssh.