Yet another Hacker News

68 points inputmice 1 hour ago 48 comments

eimrine 1 hour ago | parent

I love XMPP, but its OTR plugin is kind of glitchy.

andix 59 minutes ago | parent

E2E encryption should be part of the main protocol spec and mandatory. It's 2026 now. Nobody needs a messenger that isn't encrypted.

verdverm 47 minutes ago | parent

> Nobody needs a messenger that isn't encrypted.

Businesses want to analyze internal company messages. Chat protocols / platforms need to make inroads with one of the core audiences for online chat. Those are largely taken right now, (slack/teams business, discord gaming/oss). If it is personal/small group messaging, several E2EE options already exist, though I understand Jabber/XMPP is trying to be in the chatroom genre

iamnothere 36 minutes ago | parent

Not every messenger needs to support every use case

verdverm 31 minutes ago | parent

you'll need one major group if traction is the goal, which seems to be what the posted link is really after

chat is network effect, so a chat app needs to answer "which network of people" if the creators about traction?

foobiekr 2 minutes ago | parent

There is literally nothing about enterprise inspecting proxies that requires the client operate without default and always on crypto. That makes no sense at all.

The way businesses handle this is by installing a certificate they manage and deploy to their proxies.

gatlin 52 minutes ago | parent

OMEMO has superseded xmpp for a while now.

ValdikSS 3 minutes ago | parent

Everybody has switched to OMEMO. It's the same encryption standard which Signal uses. It supports multiple devices and encrypted group chats as well.

ruined 1 hour ago | parent

traction? the xmpp moment was 20 years ago. it's over now

SoftTalker 27 minutes ago | parent

Yep. He's dead, Jim.

If reviving XMPP is the battle you want to fight, best of luck but I'd encourage you to take a step back, face reality, and spend your energy on something with a better chance of success. And I say that as someone who used Jabber all day long 20 years ago.

jprjr_ 1 hour ago | parent

Make a single cross-platform client that implements every non-humorous XEP. If you tell people "on Android you should use this app, on iOS use that app" - you lose regular people fast. If you have a feature that only exists in one app on one platform, you also really lose people.

People don't really sign up for protocols, they download apps. Like I often refer to the fediverse as "Mastodon" even though I know that's not entirely correct, because it's the fastest, easiest way to communicate what I'm talking about - microblogging. So you really need a single, good app you can just tell people to download.

dd8601fn 34 minutes ago | parent

It doesn’t appear to be honestly asking.

It’s mostly whining that the world is too unfair because capitalism and people are dumb for choosing Signal, etc.

cyberrock 28 minutes ago | parent

Also a self-hosted server with opinionated defaults. The year is 2026, and most users expect persistent history without having to add mod_mam themselves. Discord won from zero because it's IRC with history. I cannot believe that chat history, mentions, etc. is still not settled.

pona-a 24 minutes ago | parent

This is effectively settled. Every client worth using has standardized on certain extensions, and there are server capability testers for it [0].

There are still a LOT of things very much up in the air, such as message deletion, which work inconsistently from client to client, but message history is not it.

[0] https://compliance.conversations.im/

spystath 17 minutes ago | parent

I think Snikket [0] is supposed to do that? They even offer a turnkey hosted version.

[0] https://snikket.org/start/

pona-a 28 minutes ago | parent

Mastodon too has several client (web)apps. The Fediverse is itself a more neutral protocol with more heterogeneous platforms based on it (e.g. Lemmy, Pixelfed, etc), so Mastodon refers more to the platform (schema, UX, wider community) than the individual UI you use to access it, which just happens to usually be whatever your instance admin serves by default.

As for apps, people simply prefer instant messengers purposefully designed for their platform. There is genuinely a lot of platform-specific quirks around things like push notifications, which a non-iPhone developer not have the motivation to figure out. Besides that, a lot of these predate contemporary cross-platform technologies like Flutter.

jprjr_ 2 minutes ago | parent

Re: fediverse my point is - regular people just do not care about any of the fediverse-y parts of it. If I share a post I saw, I don't say "here's a thing I saw on the fediverse" - I just say "here's a thing I saw on Mastodon."

Plus the reality of the fediverse is if you want to use multiple platforms, you wind up needing multiple accounts anyway. Like if I want to upload to Peertube, I need to make a Peertube account, so we're back to where we started of having multiple places to follow people since I can't use my Mastodon account to upload to Peertube. I'm able to have some cross-platform interaction, like commenting on videos from mastodon - but there's issues there like, Pixelfed only showing people posts with images.

When talking to most people I just call the whole thing Mastodon and treat it like its a single app/service, because that's what people are used to. If I start trying to tout how the fediverse is a decentralized platform of multiple applications and you can kinda/sorta interact across platforms - people's eyes glaze right over. They just do not care.

For apps - I've never met a person that picks a messenger because its tweaked for their platform. They just prefer whatever their friends are on. iMessage is something of a odd case since Apple just rolls you into it automatically and presents it via the default app.

BorisMelnik 20 minutes ago | parent

^^ this guy gets it!

ValdikSS 9 minutes ago | parent

>If you tell people "on Android you should use this app, on iOS use that app" - you lose regular people fast.

People don't use single browser and single email client, why IM should be different? It's a deficiency when you're forced to use a single "official client".

orbital-decay 7 minutes ago | parent

Most people don't even know what a browser is. There's a pretty big difference between a reference/fallback/default client and an official one, IMO.

aboardRat4 4 minutes ago | parent

Most people don't use browsers, the few web pages they visit are opened inside wechat or telegram with an embedded webengine.

cxr 9 minutes ago | parent

[delayed]

cjameskeller 8 minutes ago | parent

Something like https://en.wikipedia.org/wiki/Pidgin_(software) ?

aboardRat4 5 minutes ago | parent

You must be joking

pkthunder 1 hour ago | parent

I think the article brushes over something that adds (IMO) a ton of friction to Jabber/XMPP: self-hosting your own server. About 6 months ago, I tried to go down the awesome selfhosted XMPP servers list and it was just so painful I ended up finding an alternative stack.

verdverm 52 minutes ago | parent

What stack did you land on?

seszett 37 minutes ago | parent

On the contrary I found hosting an xmpp server extremely easy and very light in maintenance with prosody. I've been doing it for years and it's the part of my infrastructure that I spend the least time on certainly.

neilalexander 54 minutes ago | parent

My attempts to use XMPP mostly start and end very quickly with the fact that there isn't a single good native XMPP client for Mac or iOS. None of Monal, Siskin or Beagle are a good experience, ChatSecure appears to be abandonware and Prose is Yet Another Web App.

theshrike79 52 minutes ago | parent

There’s no official way to “tag” people on Jabber. Clients do it but the protocol doesn’t.

This is (to me) a big issue when using bots, for example. I need a non-ambiguous trigger for them.

jprjr_ 37 minutes ago | parent

There is a XEP for it but as per usual, it's experimental and not widely implemented: https://xmpp.org/extensions/xep-0513.html

https://xmpp.org/software/?category=clients&xeps=0513

harvie 48 minutes ago | parent

Jabber/XMPP started to suck at the moment we've started using smartphones that keep reconnecting between wifi and mobile networks as i move around. relying on that single persistent TCP connection does not make sense anymore. This is huge pain with IRC as well... And no, i will not run server-side proxy irc client that is supposed to keep me reachable while im reconnecting.

Also sending media (or even rich text) never really worked as each client implemented it differently. While whatsapp just works...

jszymborski 28 minutes ago | parent

So, my understanding is that while XMPP has historically sucked on mobile, it's gotten better? Does anyone know about the current experience? I don't know if it's due to new XEPs or if it's just better client implementation...

jkxyz 14 minutes ago | parent

If you're talking about the push notifications experience, then XEP-0357 solves this, but app developers have to host the infrastructure which the XMPP server calls back to and dispatches the notifications to Apple or Google. Last time I used Monal on iOS this was solved and worked well. On Android I think most apps still prefer to keep their own background connection open.

https://xmpp.org/extensions/xep-0357.html

toast0 27 minutes ago | parent

This should be solvable, although maybe a little meh. Client developers on platforms without unrestricted background connections need to run a server for push notifications. And server developers need to accept and use a push url from the clients.

If I understand correctly, Google and Apple have a way for clients to request push tokens, but in order to use the token, you have to authenticate as the app owner, so a client unaffiliated with the server can't simply send a push token to a server and have that be used ... Instead you'd need that push proxy server.

That proxy server comes with concerns about reliability and privacy and etc, but if you do pushes without cleartext content (and you should!), the footprint is minimal and you gotta do what you gotta do.

I don't follow xmpp/jabber, but I'd hope there's already an XEP for this. It's a pretty apparent need for the last I dunno 15 years and it has a clear solution.

With the right agitation, maybe you could get sharable platform push tokens and skip the intermediary app developer pusg server, but that seems unlikely.

You probably also want something in the push system to help trace push problems. For small chat servers and smallish client push proxy servers, I expect minimal operations staffing, but when messages are being delayed because of push problems, you want to be able to let affected clients know that they need to be more agressive with periodic/background connections until push works again. You may also want to let users or the administrators of the proxy push servers know as well. Pushes might be initiated late on the origin, delayed between the origin and the proxy, queued for a long time at the proxy, delayed between the proxy and platform push, or delayed within platform push (including on device delays from Doze, etc).

You've got to be able to detect that so you can make adjustments and reduce delay. Messaging delay reduces user satisfaction.

zajio1am 24 minutes ago | parent

I have no problem with that with XMPP. Conversations automatically reconnects after each switch within few seconds, so it is transparent for users. On IRC that is huge pain, true.

ValdikSS 11 minutes ago | parent

XMPP has brilliant session management, it reconnects more seamlessly than many other protocols on mobile. It literally reconnects (rejoins the same session within different TCP connection, not replaces it with a new session).

>Also sending media (or even rich text) never really worked as each client implemented it differently.

Everyone use HTTP upload nowadays, it works all the time.

mococa 43 minutes ago | parent

I think the main problem was the fragmentation & extensions

est 37 minutes ago | parent

I hope more people realize, protocol is not the problem, user experience is.

The Telegram client leads in every aspect by far. It's just easy to use.

encom 12 minutes ago | parent

As long as the Signal desktop app is a 420 MB[1] pile of Electron, I refuse to install it. I may be a dinosaur, but a good desktop app is a requirement. I hate typing on a touch screen.

  [1] $ curl -s https://updates.signal.org/desktop/apt/dists/xenial/main/binary-amd64/Packages |
    awk '/^Package: signal-desktop$/{p=1} p{print} /^$/{if(p) exit}'

mrweasel 2 minutes ago | parent

[delayed]

zajio1am 36 minutes ago | parent

I use XMPP (with OMEMO) extensively and my main problem with it is absence of some basic key trust chains and bad handling of group chats

1) With OMEMO, each client/device of a user has its own key, but there is no trust relationship between them or some common master key. I can verify and trust counterparty key, but then counterparty adds another client/device and i have to do manual verification again.

2) Group chats do not have group key, but one encrypt messages for each group member (pairwise), which means that everybody has to do key exchange with everybody. This does not scale, especially with 1), which means that even if membership is stable, new keys may appear. Some clients (Conversations) do not allow to send message to a group when they do not know some keys of some group members/devices, which is fail situation that happen pretty often.

armchairhacker 15 minutes ago | parent

Is it worth it to overcome network effect? Maybe just make something so useful that it is even if only people who listen to you use it, which XMPP is, and recommend it to people who are willing to try (not only because of vague curiosity, which fades very quickly, but because it's useful to them).

foobiekr 11 minutes ago | parent

Most of the critique in the post is about the low quality of Signal's app, which has zero to do with the protocol. And frankly almost every XMPP client was vastly worse in quality terms than Signal is and OTR regularly just produced garbage. It had a chance. Signal is not widespread because the only reason to use it is high privacy consciousness or being in the government and wanting secure chat with automatic deletion for conversations you're not supposed to be having.

It's a little like asking "Carburetors: How do we gain traction?"

XMPP is not a well designed protocol in many ways. There's no particular reason for anyone to care.

NietTim 3 minutes ago | parent

Sounds like the same issue as with Mastodon. The vast majority of people are not interested in a 'protocol' (or even know what that is), they do not care what protocol powers their _app_, they just care about their app