Modern XMPP project discussion - 2025-02-04

Hey all. I'm new here. With my company, we are building Parula, which should become a mail, chat and video conf app for average users, and with a nice UI. https://parula.beonex.com (BTW: Try it out for mail, and send me feedback how well it works for you) I am building the XMPP protocol implementation, for 1:1 and group chat and 1:1 video calls, preferably with OMEMO. We're using TypeScript. So far, I tried XMPP.js and Stanza libs, and now I will try the Snikket SDK https://github.com/snikket-im/snikket-sdk . If you have any other recommendations, let me know.

Hi Ben, Matthew here - nice to meet you in Brussels 🙂

Hey Matt! Thanks so much for Snikket and your tip 🙂 I'm looking forward to try it out.

> Hey all. I'm new here. With my company, we are building Parula, which should become a mail, chat and video conf app for average users, and with a nice UI. > https://parula.beonex.com (BTW: Try it out for mail, and send me feedback how well it works for you) > I am building the XMPP protocol implementation, for 1:1 and group chat and 1:1 video calls, preferably with OMEMO. We're using TypeScript. So far, I tried XMPP.js and Stanza libs, and now I will try the Snikket SDK https://github.com/snikket-im/snikket-sdk . If you have any other recommendations, let me know. 🤔 ↺

Will Parula be open-source?

Ah I see the mustang.im github ✏

A rename I guess?

Yes, Parula is open-source. Mustang is the code-name for it.

> Yes, Parula is open-source. Mustang is the code-name for it. 👍 ↺

For video group chat you might want to look into the recent work of adding Galene as a SFU done by the libervia project under an nlnet grant.

I think the xep for that is being reviewed right now

I've been asked for a good iOS client. While I do have an iOS device lying around I could test with, I could not find a decent client so far. Any recommedations? TOFU or just blind acceptance of keys is something that should not be there, so far I couldn't find a client that does this right.

Monal

Tofu is imho a good compromise to help with e2ee adoption.

Seems to blindly trust all keys, couldn't find a setting to change that

> Tofu is imho a good compromise to help with e2ee adoption. I've got a different requirement ↺

https://docs.modernxmpp.org/client/design/ is very useful for new XMPP client implementors. Thank you. Reminds me a bit of GNKSA https://gnksa.org/gnksa.txt

Ha, thanks. The GNKSA document is new to me...

> I hope that in the future trusted computing just collapses, or exploits become more reliable and unfixable, so we can truly own our hardware again Stop financially supporting or buying from vendors that want to screw you over. Learn to accept some compromises in supporting the vendors/people that are doing the right thing. ↺

> Power9 doesn't have this 😇 https://www.ibm.com/docs/en/power9?topic=partitions-trusted-boot ↺

> Distributed Identity - its a sectionally revealabe protocol made by Microsoft identity team Squeaky Latex Folf _Decentralized_ Identifiers; where is the claim that Microsoft has any involvement with DIDs anywhere? Unless you're mixing it up with something else. ↺

> I don't know why we need MLS if we already have OMEMO. Will OMEMO be ported to MLS or is it going to be a whole new spec? I believe the intent is that: if other protocols also implement MLS, you could theoretically have E2EE secured communications bridged between different protocols ↺

> the scale problem could be fixed if we had a cryptographer. we do not. MLS does It's a matter of someone actually doing the work, and someone bothering to audit it; you don't "need" a cryptographer to implement the protocol if it's written clearly enough and the person implementing it understands the basics of cryptography engineering, just more on the auditing part. It's the issue with open source in the present years that everyone just wants free code and nobody wants to put in the effort. ↺

Initiative is probably the rarest thing to find anymore.

Everyone's free to step in and make XMPP even better, but usually the folks that are making all the armchair critiques are almost never the same people willing to do the work.

It's surprisingly easy to learn the basics of the protocol and writing a basic client from scratch