MattJ100

32 ms·

241.
by MattJ100 5y ago
Correct, it's been possible for many years. What's generally the case is that people complaining about things like this are still using/remembering software that hasn't changed much in the last decade. Common culprits ar
242.
by MattJ100 5y ago
> If there is nothing like that then there is no point to have STARTTLS. I agree that there is really no benefit to have STARTTLS with modern TLS implementations (e.g. now that we have SNI everywhere), but this was not entirely the case
243.
by MattJ100 5y ago
We're working on surfacing this information. It's hard keeping track of a diverse and evolving ecosystem - it's been attempted in the past (years ago), but manually keeping things up to date didn't work out because the i
244.
by MattJ100 5y ago
I'm not aware of any vulnerability in XMPP due to the use of starttls. If you (or anyone) can prove otherwise, I'd be happy to see that. We can do coordinated disclosure across projects via the XSF.
245.
by MattJ100 5y ago
Signal operators can also inject messages to people. So this is a strange comparison. What holds true in both systems is that if someone does this, it's detectable thanks to E2EE. Which is the entire point of E2EE.
246.
by MattJ100 5y ago
> Can we agree that >90% of non-technical XMPP users likely don't run their own XMPP server? Yes. The majority of people cannot, and will not ever, run their own server. However my ideal is that the remaining "10%" of p
247.
by MattJ100 5y ago
They have a feature called "sealed sender"[1]. Your Signal client authenticates to a Signal service that verifies you, and then signs and issues a certificate that you can use to vouch for your identity. Then, you can encrypt this
248.
by MattJ100 5y ago
Traffic correlation attacks are very difficult to mitigate. Even Tor is not immune to this (see research such as [1], and the Tor project's own statements that the design is not resistant to analysis by a global network observer). Also
249.
by MattJ100 5y ago
I already responded to your "admin in the middle" article here: https://news.ycombinator.com/item?id=29104983 I run my own XMPP server (Snikket) for my family, and I have no fear of the metadata it (I) can theoret
250.
by MattJ100 5y ago
That's slightly different. XEP-0070 is about allowing someone to verify that you own a given XMPP address. That is indeed often all you need for a "Log in with XMPP" functionality. Just how many sites allow you to log in with
251.
by MattJ100 5y ago
Movim is a social-oriented XMPP client, so yes, it needs to log in to your account. You don't have to use the mov.im instance - in an ideal world your own server can run a copy of Movim, but you can also self-host, or even run it local
252.
by MattJ100 5y ago
XMPP server software doesn't generally default to allowing account registration when first installed, but many people enable it as an easy way to on-board users. Either they don't realize the consequences of doing this on an inter
253.
by MattJ100 5y ago
Actually it does have this feature, and has done for many years. Many clients have it now, but Gmail was where I first encountered it. I don't know if it was the pioneer. Here's a blog post by someone digging into how it works: h
254.
by MattJ100 5y ago
I agree onboarding can be a hurdle (for any decentralized network). These days many XMPP clients support invitations which make the process much easier (see https://blog.prosody.im/great-invitations/ ). This easy onboa
255.
by MattJ100 5y ago
Nothing. XMPP has an active community, mature servers for every kind of deployment, and many clients under active development for a range of platforms. My personal focus within the community these days is with improving the ecosystem UX thr
256.
by MattJ100 5y ago
I've worked with XMPP for years, and while I'm not going to give XML a glowing review, I do think most alternatives would have been worse for XMPP's use-case (extensible interoperable messaging). I also think XMPP is one of a
257.
by MattJ100 5y ago
It's mitigated in several ways. But first of all consider that XMPP is hardly inefficient by today's standards, when mobile devices can stream video continuously for hours on a single charge. Still, battery is important to conside
258.
by MattJ100 5y ago
If aesthetics are the main issue, then that's validation that we've come a long way :) The iOS app hasn't yet been through a thorough visual review, though it is planned in the coming months (a number of fixes are already in
259.
by MattJ100 5y ago
Indeed, https://quicksy.im/ follows this approach, it's as trivial as it can be. My focus with Snikket is on making it as easy as possible for people to run their own server (hosted or self-hosted), and to avoid a repe
260.
by MattJ100 5y ago
1000% agree, so much so that I started such a project and wrote a blog post about this very problem[1] and launched what has become a full-time project to solve it (Snikket). These days I believe very much in identifying and serving a speci
261.
by MattJ100 5y ago
Here's what you're looking for: https://xmpp.org/about/compliance-suites/ Compliance suites are reviewed, updated and published annually with the recommended set of features across a range of different c
262.
by MattJ100 5y ago
XMPP was developed as an open protocol to bridge to proprietary communication platforms, just as Matrix is today. There are still such bridges (more commonly called "gateways" or "transports" in XMPP), such as for WhatsA
263.
by MattJ100 5y ago
This is not a problem with XMPP, but any open ecosystem. There's no way to force third-party developers to implement stuff, especially when they are open-source volunteers working in their free time. XMPP does have this feature parity
264.
by MattJ100 5y ago
Well, this is a good demonstration of the "products vs protocols" issue that I actually wrote a blog post about: https://snikket.org/blog/products-vs-protocols/ Much has been said about the staleness (or
265.
by MattJ100 5y ago
Oh, sure. Pidgin has (unintentionally) done a lot of harm to XMPP in the past decade. It was a wildly popular client "back in the day", and even today it's still often the only open-source IM app that comes to peoples' m
266.
by MattJ100 5y ago
For the record XMPP supports mobile, does not lose messages when you go offline, and has archives. I'm yet to see an open-source implementation of server-side search, but most clients can search local history. It's probable that e
267.
by MattJ100 5y ago
> Would love to be pointed to the best counterarguments, but again the focus on product was the interesting take for me. I attempted to summarize the trade-offs in this post: https://snikket.org/blog/products-vs-prot
268.
by MattJ100 5y ago
Valid question, not sure why the downvotes. You're right, the server can modify the contact list (and this is used extensively within organizations, and in Snikket to ensure family members can see each other by default). But this isn&#
269.
by MattJ100 5y ago
I believe you're slightly misunderstanding the details here (no surprise, as the article is not clear). All modern XMPP servers store the password securely hashed, and during authentication only hashes are exchanged. Your comparison to
270.
by MattJ100 5y ago
The problem with pure peer-to-peer communication is that it is unreliable due to IP address changes and NATs, requires you to always be online (or at least both be online simultaneously) and also exposes your social graph to your ISP and an

More ›