Modern XMPP project discussion - 2025-04-29

Do we have an overview of OMEMO version support in different clients somewhere? What is the current version? 0.7? None of the websites I found mention what the newest version would be.

https://xmpp.org/extensions/xep-0384.html#appendix-revs

0.3 is the latest supported version in most places (what's generally called oldmemo), the latest 0.8 is generally called twomemo. Other revisions of that document "don't really matter"

👆

Practically all clients are doing 0.3.0 except for Kaidan and... something else I forget

2018? And that's still not been broken?

Kaidan and Libervia I think, I'm not sure how much testing Libervia has had though, but it's using syndace's library

The internet is largely built on the same cryptographic primitives it has been using for decades :)

(ignoring some notable bad choices along the way)

But apart from ECC, there haven't been many fundamental new changes. Post-quantum stuff is emerging as the next big change, I think. There's no reason to assume that something from 2018 would be broken, as most of our cryptographic primitives are older than that and not expected to be broken for a long time yet.

I still encounter people who insist on using OTR, which I probably wouldn't depend on myself, nevertheless I don't think it is technically broken

> Practically all clients are doing 0.3.0 except for Kaidan and... something else I forget Moxxy ↺

Ah yes, thanks

> I still encounter people who insist on using OTR, which I probably wouldn't depend on myself, nevertheless I don't think it is technically broken there have been some significant improvements in OTRv4 because of some security concerns in OTRv3, but available clients seems to be stuck on OTRv3, so the situation is similar but worse as with OMEMO. ↺

The Modern XMPP chatroom doesn't have an avatar like all the others moderns chatrooms. Ironic 🫣

Welcome to PostModernist XMPP

Because it's not this kind of modern

Maybe we should add a HDR version of the XMPP logo ( https://sharpletters.net/2025/04/16/hdr-emoji/ )

> Welcome to PostModernist XMPP Let's out a full gray picture. Brutalist XMPP we call it 👌✨ ↺

*put

> Maybe we should add a HDR version of the XMPP logo ( https://sharpletters.net/2025/04/16/hdr-emoji/ ) What the :D

A friend found this and now thinks OMEMO 0.3 is not really okay anymore: https://soatok.blog/2024/08/04/against-xmppomemo/ This is mostly FUD, right? Nothing I should have to take too serious?

Yeah, that person is on a mission against anything that isn't Signal

There are multiple inaccuracies, and they aren't interested in feedback

erebion, https://www.moparisthebest.com/against-silos-signal/ is a response to that

it also links to a reponse by one of the OMEMO authors that soatok deleted from their comment section apparently.

>Here's the short and simple reason you should ignore it. > >The point that seems to go right over their heads is: > >It doesn't actually matter how cryptographically secure your end-to-end encryption is when 1 entity controls all ends, and can instantly update them whenever they want. Also not accurate. Signal users can verify each other, they cannot just manipulate or read without getting detected.

I'm so annoyed by all those simplistic views and simple answers... :/

Unfortunately, in reality, there are no simple answers... :)

My favourite is the endless questions about whether X is "more secure" than Y

https://share.bouah.net/HMsrxz45XrgY2S0pally_NYj/output.png

:D

> https://share.bouah.net/HMsrxz45XrgY2S0pally_NYj/output.png Fig: The XMPP logo on my tshirt after 100 washing machine ↺

> >Here's the short and simple reason you should ignore it. > > > >The point that seems to go right over their heads is: > > > >It doesn't actually matter how cryptographically secure your end-to-end encryption is when 1 entity controls all ends, and can instantly update them whenever they want. > > Also not accurate. Signal users can verify each other, they cannot just manipulate or read without getting detected. this is about the application itself. No amount of verification helps if Signal just pushes an update to the app and that gets auto-installed on your system. ↺

that is quite similar to e2ee in a browser, which also can't be really secure due to the code being delivered to the user ad-hoc

Aren't Signal server and app open source?

app yes server no?

iirc

Then what is https://github.com/signalapp/Signal-Server ?

How is this? https://softwaremill.com/what-ive-learned-from-signal-server-source-code/

sort of, they sometimes do a code dump, but for the server there is no way of knowing what they really run, and for the client you can verify the binary, but since they can just push an update through the playstore any time, this is unlikely to help much unless you are extremely paranoid and manually verify every update before installing it.

Fdroid app has signal app but says signal app depends on one proprietary server. So it looks like you'd have to do work on the app and server to make and use your own.

Kris: Your points seem similar for xmpp servers and apps.

yes if you run Molly from f-droid you can mitigate a bit against that.

> Kris: Your points seem similar for xmpp servers and apps. no, because in xmpp there is a rich exosystem of different clients developed by different people. ↺

there is not one entity that controls them all and could push changes that effect the cross app communication

I don't find molly in fdroid. Disclaimer: Technically, Signal is from Guardian repo.

>> Kris: Your points seem similar for xmpp servers and apps. > no, because in xmpp there is a rich exosystem of different clients developed by different people. but he's right, omemo mitm is possible ↺

> Unfortunately, in reality, there are no simple answers... :) Exactly. So why are those that prevalent? Anyway, now I know that OMEMO was mainly updated to encrypt some metadata such as the reactions as well and that the encryption hasn't been broken yet. Thank you all very much. ^_^ ↺

https://molly.im/get.html

you need to add an external repo to f-droid

> but he's right, omemo mitm is possible that's an entirely different threat vector then what we are talking about. ↺

and only possible with tofu

> this is about the application itself. No amount of verification helps if Signal just pushes an update to the app and that gets auto-installed on your system. Reproducible builds help detecting that. Secret services could only do targeted attacks against few individuals with the risk of detection, not everyone. That'd be noticed pretty soon. ↺

> that is quite similar to e2ee in a browser, which also can't be really secure due to the code being delivered to the user ad-hoc Except that there's no reproducible website build thing that could prevent delivering a manipulated website to people. ↺

too late, but yes as I said this does help a bit

there are afaik browser extensions that prevent replacing cached javascript

Idk, that choice becomes trust Guardian/Signal, or Molly org/Signal...

Kris has a point though, if Signal were pushing a manipulated update, there'd be a slight chance the Molly version would not contain it. Either because the upstream code is okay or because they notice it when looking at the code. But then you need to trust the Molly devs instead.

Ken Thompson has some thoughts on that: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf

> Idk, that choice becomes trust Guardian/Signal, or Molly org/Signal... or trust f-droid? I don't see a huge difference there and the main point is that you don't put all your eggs in one basket with the Signal Foundation. ↺

From the outside, the organization structure differences are form. You are probably somewhat more familiar with xmpp because _some_ or most development appears to be in open. You still trust groups of people working together...

> Kris has a point though, if Signal were pushing a manipulated update, there'd be a slight chance the Molly version would not contain it. Either because the upstream code is okay or because they notice it when looking at the code. But then you need to trust the Molly devs instead. targeted updates that are easy possible to do covertly on the Playstore are also much harder with F-droid. ↺

>> Idk, that choice becomes trust Guardian/Signal, or Molly org/Signal... > or trust f-droid? I don't see a huge difference there and the main point is that you don't put all your eggs in one basket with the Signal Foundation. In theory, if you get it from fdroid main repo, it went through some additional scrutiny, fwiw, and to the extent independent. However, at least one primary fdroid reviewers are xmpp promoters, and fans of Gultsch...

The Signal Foundation falls under the cloud act and is in direct jusidiction of the US government. For that reason alone they can't be trusted.

Should operations under the German jurisdiction be any more trusted?

currently for sure. But it is best to not trust the same group of people with all the ends like the original article already explained.

Doubt. :) Wikipedia is unreliable, but here is an easy copy/paste. > According to a document leaked by Edward Snowden, there is another working agreement among 14 nations officially known as "SIGINT Seniors Europe", or "SSEUR".[118] This "14 Eyes" group consists of the Nine Eyes members plus Belgium, Germany, Italy, Spain, and Sweden.

the political situation has changed quite a bit in the US since then. The already weak rule of law is basically non existing these days, so that argument has limited merit.

but in any case this does not invalidate the second and more important point at all.

> Yeah, that person is on a mission against anything that isn't Signal The mopar blurb is the same, except substitute xmpp.

> Unfortunately, in reality, there are no simple answers... :) Indeed.

> But it is best to not trust the same group of people with all the ends like the original article already explained. ^ Argues against signing up for jmp/snikket and using Cheogram. :(

Well, if you use Snikket servers and Cheogram app, you've already detached the ends from the middle

and for the middle, self-hosting is much easier with Snikket than with Signal

"Same group of people" is not changed by having different small company paperworks, or being physically on different continents most of the time. Self hosting does not change who originates and rolls out changes, but agreed it gives more control and responsibility.

Large corporations, small companies, you choose

How big is mythicbeasts (mostly 5 eyes), prosody benefactor? I know microsoft/github, snikket benefactor, is huge.

where did you get the idea that microsoft is a "benefactor" of Snikket?

Doesn't snikket use free like beer github?

well yes, but how is that Microsoft being a benefactor? that amouts to a few cents per month in worth at best ✏

You don't question mythicbeasts being a benefactor for prosody. Microsoft is giving a lot of the same services to snikket.

I have no idea who mythicbeasts is, but to say that Microsoft is a "benefactor" of Snikket is beyond silly.

What would you call someone who gives you stuff for "free"?

so someone using facebook is having facebook as a benefactor?

I would argue the opposite is the case. Microsoft benefits more from open-source projects being hosted on github than the reverse.

Obv microsoft also profits somehow, using the people who use github... Yes, like FB.

Snikket is a benefactor of Microsoft 🤯

Give and take... Both parties do...

> Should operations under the German jurisdiction be any more trusted? Yes, no fascism *yet* in Germany. Who knows what might happen, time will tell.... oof

> I have no idea who mythicbeasts is, but to say that Microsoft is a "benefactor" of Snikket is beyond silly. https://blog.prosody.im/new-server-new-sponsor/

Would you prefer "sponsor"?

I don't get your point. we are talking about really small sums.

If it's worth so little, why not pay someone else and get off github?

My point was, to some degree, Matt and maybe prosody choose large corporations to work with. Though possibly implying smaller are better, for security-related issues.

you are arguing for the sake of arguing and your argument doesn't make much sense.

Well, if you want to make it personal, you are saying some things you don't back up, such as the vaguely small value or cost of what microsoft gives away. Or changes in "political situation". Which also makes no sense. We can stop here.

Under what rock are you living? 😅

3rd rock from the sun, duh. 🤣

Yeah, I think we should end it here... I also don't understand the point being made, but we're somewhat off-topic by now and I don't expect continuing will be fruitful

erebion: > I'm so annoyed by all those simplistic views and simple answers... :/ Main point, agreeing with ^.

> Yeah, I think we should end it here... I also don't understand the point being made, but we're somewhat off-topic by now and I don't expect continuing will be fruitful 👍 ↺

👍