Daniel Gultsch

Ok so a few problems, on every network I've tried.

DuckDuckGo: Adding people doesn't seem to work via QR code, at all. And the client gets weird when trying to delete the account.

evil.im: Adder never gets notified that they have been "accepted", so can't view the conversation except via notification.

null.pm: Adding works fine, but OMEMO just stays at yellow exclamation marks.

dismail.de (supposedly has a fully green bar): No QR code adding, no notification of accepted contact request, OMEMO is fucked.

talker.to Basically the same as dismail.de.

So is there an actual server that is reliable and supports the requisite features set to make this a usable experience?

Are these client bugs?

Because otherwise this is going nowhere. I'm sitting next to my mate and cannot actually find a server that allows us to communicate normally.

I'm trying to set up a Jabber prosody server and I think it's working. I have no idea how to test if it is really. I got A/A on the server test thing.

How do they compile a list like this?

https://gultsch.de/compliance_ranked.html

Do they have a suite that I can run against my own server?

> some reasonable (against forks using their servers) (...) justifications

How is that reasonable in a centralized client-server model? That's precisely what we find unreasonable with Twitter and others shutting down or making life hard for 3rd party clients. Why would it be more acceptable from a free-software service?

The network effect says a centralized protocol like Signal has "zero" value without reusing the same servers. All this because Signal maintainers have an ideological argument against decentralization, which received many great responses including this one from a Jabber/XMPP client developer: https://gultsch.de/objection.html

In all cases, Signal servers control who has an account, what permissions and what can be posted. You can't just extend the protocol to enrich your client by abusing Signal's servers, but you can make your client compatible with Signal protocol (interoperability). Preventing that is rather user-hostile.

Conversations is great, but there's nothing comparable on iOS except Chatsecure which isn't yet beta quality. Then you need to pair it with a server that actually has all the recent XEP's installed (for push is XEP357, usually missing), see: https://gultsch.de/compliance_ranked.html

My current 'solution' is to use ZNC connected to Bitlbee (supporting OTR). On Bitlbee I use the jabber.fr service. ZNC has a push script for Mutter (great iOS IRC client) that I modified to redact my notification content from Apple's push service. I connect to the ZNC with TLS, so in theory everything should be ok.

NOT USER FRIENDLY but allows me to keep all my chats in one client and not tied to some shitty walled garden. Everyone less savvy I just tell them to use Signal.

Moxie's argument can be found in its essay "the ecosystem is moving"[1], which is highly fallacious. Moxie's Signal is about control and building for himself the same kind of monopoly as others currently enjoy. You can find evidence of that through the libresignal issue tracker on GitHub where he rationalizes barring access to 3rd party clients or servers[2].

He sees federation as the technically superior approach (and as beneficial for privacy and security), but also as a threat to himself, which makes the point that he doesn't have your best interests at heart.

[1]: https://gultsch.de/objection.html

[2]: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165

The claim that XMPP on mobile can only result in lots of bandwith and battery usage is false, according to Daniel Gultsch, developer of the Android XMPP client conversations: https://gultsch.de/xmpp_2016.html

Money quote: “XMPP is not suited for mobile devices. That’s a myth that has been around for ages. It is mostly spread by people who want to sell you their own proprietary instant messaging solution.”

From my own experience, high battery usage is the fault of the XMPP client. Regarding bandwith, I have been chatting over throttled 3G and regular 2G connections. The initial connection takes noticeably longer, otherwise everything except file transfers seems fine.

Moxie Marlinspike, of Open Whisper Systems, had some pretty pessimistic things to say about how stagnant federated protocols become, and why they avoided that approach with Signal. https://signal.org/blog/the-ecosystem-is-moving/

End result: Signal is a real, usable tool, the recommendation of which is fully actionable security and privacy advice you can share with anyone who is capable of using WhatsApp.

Here's some HN discussion on the post, and a piece with counter arguments. The latter, I feel, misses the entire point of how urgent the need for usable privacy and security tools is.

https://news.ycombinator.com/item?id=11668912
https://gultsch.de/objection.html