Note by @fastfinge

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

So because I have gone temporarily off my rocker, I'm working on an #xmpp client using #dotnet 10 and WPF, with artalk-xmpp for XMPP, libsignal for #OMEMO, and prism for screen reader output where needed. I'm only an evening into it, and I can already tell that OMEMO is going to be the source of complicated, inexplicable, and unreproducible bug reports for decades to come. It's still not as overcomplicated as #matrix, though.

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

OMG what am I even doing This is a huge project it's going to need Jingle and that needs WebRTC and then file transfers and voice messages and oh also localization and sounds and hotkeys and settings and multi-account support and Oh God. even with AI this will take fifteen years why did I get out of bed today and choose this for myself

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@fastfinge there's always Delta Chat which solved almost all of these problems already :)

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld I dropped Jami and signal from my life for the same reason. “Just use the official clients” is not an open protocol. Not even if the client and server are open source.

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@fastfinge you're completely wrong we have third party clients and more coming all the time

github.com/trufae/parla

lambadalambda.github.io/estuary/

Unreleased tui client by @jae

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @jae Nope. These are just running deltachat-core or libdeltachat, from what I can tell. If I want a library in C#, there is none. If I want to write my own library in C#, without depending on deltachat-core, I can't. There's no list of RFCs I can look at, nothing like xeps or IRCV3 caps, etc. It's just "use our library".

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@fastfinge @jae there is no "library" to write. It's PGP emails and SMTP/IMAP. Go ahead and do it yourself, there's nothing proprietary being implemented. It's just emails.

Name a feature that you think is some secret proprietary thing

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @jae It's not, though. Deltachat does weird shit with email headers to anonymize everything. I couldn't just read a message from deltachat in my regular email client. And I have no idea how they're doing federation and key exchange and things. But it's all based on weird links that require deltachat's domains and servers to exist and be running. I can't just type an email in the chat client and send a deltachat message.

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@fastfinge @jae

key exchange

It's Autocrypt, there's an RFC for it

Mime headers being encrypted? There's an RFC for it

The subject header being changed to [...] is a client / chatmail server implementation detail unnecessary

The Date header being smeared +- a few days is a client implementation detail too

None of that is required

All you needed to do to read the message in your email client is decrypt it. There are users reading messages in Thunderbird/Mutt/Proton Mail

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @jae Interesting that everyone uses libdeltachat or deltaachat-core, then. There is no ecosystem of standards compliant implimentations. And seemingly no clear idea what that would even mean to deltachat.

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@fastfinge @jae because deltachat-core is a nice implementation of the core protocols in a simple Rust package and presents a clean JSON-RPC API for you to build anything you want on top of it. And none of that has anything to do with accessibility anyway, that's all in the UI. So as long as you have a UI you can control, you're fine

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @jae That's what we thought with Twitter and Reddit. Then they discontinued the API's. Those are just two recent examples of something that has happened dozens of times in the last 25 years. Slack discontinuing IRC is another. If I depend on an API that could be taken away at any moment, I have nothing. If there are no competing and interoperable implementations of the standard, you're just at the whims of the owner of the one true version.

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @jae If I don't like the c# library I'm using to build XMPP, I can rip it out and pick another one. There are like 6 to choose from. If they disable an API I needed, I can build it myself, or use a different library. Those are not options with deltachat.

ArcaneChat @arcanechat@fosstodon.org

@fastfinge

If I don't like the c# library I'm using to build XMPP, I can rip it out and pick another one

which already implies they each have different features or lack thereof, which is exactly the exact same situation you have in XMPP with a lot of fragmentation,

in fact, it is better if people don't create their own chatmail core implementation

if Delta Chat becomes evil, the core is open and you can just fork it and keep using it, no one can take anything away from you

@feld @jae

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@arcanechat @feld @jae If deltachat doesn’t want people indipendantly authoring libraries that use its protocol it is not an open standard. End of story.

ArcaneChat @arcanechat@fosstodon.org

@fastfinge if you don't want to have a shared-effort security-audited implementation that everyone uses, but instead waste resources with several people re-implementing the wheel and causing incompatibility between clients, assuming people want to have to deal with "ah Paul your client don't support this and that"

then in fact, you will only make more damage than help the chatmail ecosystem, please, keep ruining xmpp 🙏

@feld @jae

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@arcanechat @feld @jae Deltachat is just as much of a poison to openness as Bluesky and threads. All marketing and vibes to capture users.

ArcaneChat @arcanechat@fosstodon.org

@fastfinge not at all, but you are free to have your own wrong opinions, have a nice day

@feld @jae

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@arcanechat @fastfinge @jae if XMPP's design by committee process was in any way conducive to producing good results we'd have multiple high quality cross-platform XMPP clients right now that would make nobody care about Telegram or Signal or Whatsapp because literally all the same functionality is implemented (the XEPs are there, it should be possible!) and it would have the largest network effect because zero lock-in, so there would be no excuse to not be using XMPP

But there's zero high quality cross-platform XMPP clients because this process doesn't work

and then Delta Chat makes the right decisions:

- build a quality core everyone can use which guarantees compatibility and an even playing field of security (not even Signal can claim this -- e.g., each app has a completely different networking implementation)

- build an app for each major platform and make them as identical as possible -- originally built off a good design that users are comfortable with: the actual Telegram client

- publish them all under the same name/logo because modern users think of "platforms" not "protocols"

- do the groundwork to be prepared if the app ever gets blocked/banned or Merlinux sued/shutdown so the same Delta Chat app can be published under a different name by someone else

- work hard to produce RFCs that are useful for everyone, not just Delta Chat (e.g., AutoCrypt v2 is meant to be used for ANY protocol, not just Delta Chat / email -- which is also co-published by someone from IETF/ACLU, an active OpenPGP member, and a Delta Chat member)

- provide a ton of documentation and user support resources

- provide a realtime feedback channels to all interested parties who are running their own Chatmail Relays

- bend over backwards to provide extensive backwards compatibility

- be actively involved with helping real groups of disadvantaged people around the world who suffer under oppressive governments, actually fly to remote places and provide information and training

- provide more details of the project's funding methodology than probably any other open source project that has existed

- actually go to court to fight for users' rights (e.g., Delta Chat in Russia last summer)

but this is just not enough for some people and either the project is considered too opaque/proprietary, or gets complaints that they shouldn't be using email this way

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @arcanechat @jae Those all sound like intentionally promoting lock in to me. The long and short of it is: tomorrow deltachat could wake up and decide it doesn’t care about screen readers anymore. When they do, I’m locked out. That makes deltachat a danger to me and my community, and is just not possible to lock us out of xmpp in the same way, even if people wanted to. Until that changes, I have to treat deltachat the same way I treat any other hostile closed protocols: don’t depend on, promote, or trust it.

ᴏᴏᴍ-ᴋɪʟʟᴇʀ: 333[𝟱𝟬𝗽𝘀𝗶 𝘁𝗼𝗶𝗹𝗲𝘁]™ @jae@bsd.cafe

@fastfinge @feld @arcanechat i have macular degeneration. im moving to screen reader mode more frequently and eventually totally as its rapid. this affects me also now that ive had time to digest this very short thread

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@jae @feld @arcanechat I should clarify that deltachat is currently really really good about accessibility. But so was Twitter, once. Organizations change. And if you have a disability, you always have to have a plan for that, for every tool you use. When accessibility breaks, you need to be certain you have a way out. Preferably one that doesn’t involve forcing all of your friends to change apps, yet again. I don’t care how much they love you: you can probably get them to change once. But not twice.

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@fastfinge @arcanechat @jae which XMPP client are you using that has good accessibility, is open source, and you don't have to worry about rotting in the app store and eventually just getting removed?

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @arcanechat @jae Monal on iOS and Mac. Miranda-ng on windows. But in both cases I have at least one other option if they break.

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @arcanechat @jae And in the case of Miranda ng I think I can do better. But even if I can’t, Miranda is fine.

ᴏᴏᴍ-ᴋɪʟʟᴇʀ: 333[𝟱𝟬𝗽𝘀𝗶 𝘁𝗼𝗶𝗹𝗲𝘁]™ @jae@bsd.cafe

@fastfinge @feld @arcanechat i've tried monal and it's really nice.

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@jae @feld @arcanechat Yup, Monal is excellent. And actively developed; builds supporting new features are in testflight.

ᴏᴏᴍ-ᴋɪʟʟᴇʀ: 333[𝟱𝟬𝗽𝘀𝗶 𝘁𝗼𝗶𝗹𝗲𝘁]™ @jae@bsd.cafe

@fastfinge @feld @arcanechat i'm only recently re-entering the apple ecosystem (mostly bsd+linux) so looking forward to trying the newer builds. thanks for the tip, sir.

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@jae @feld @arcanechat No worries! I'm assuming what's prompting your exit is your need to use screen readers more? I really do like the ideas behind BSD and wish I could actually use it. I think my fanatical dedication to openness in this thread makes it clear I would be on BSD or Linux if it was actually viable for me.

ᴏᴏᴍ-ᴋɪʟʟᴇʀ: 333[𝟱𝟬𝗽𝘀𝗶 𝘁𝗼𝗶𝗹𝗲𝘁]™ @jae@bsd.cafe

@fastfinge @feld @arcanechat accessibility plays a big part, but also having something "just working" that i dont have to think much about while i code or work on infra. i won't abandon bsd or linux anytime soon, but likely will be shifting it all to machine/server side vs daily driving a *nix box near-term.

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @arcanechat @jae And if worst came to worst, there’s always bitlbee. There’s no world where I could find myself unable to chat on xmpp.

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@fastfinge @arcanechat @jae I've been fortunate enough to convince them to change many times, so I guess they really really love me

IRC to GTalk to XMPP (bc gtalk shutdown) to Whatsapp (because XMPP was miserable) to Telegram to DeltaChat

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @arcanechat @jae Or you have techy friends. But even if they’d agree, I’m not teaching my elderly relatives deltachat just to have to teach them something else when, not if it breaks accessibility.

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@fastfinge @arcanechat @jae kinda ironic tbh as elderly users are one of the biggest success stories of Delta Chat especially as they never have to think about the concept of a username or password

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @arcanechat @jae Yes, like I say, DeltaChat has some good ideas. They've just chosen to implement them in a closed way. Same with BlueSky; I like a lot of what they do. But I will never promote using a protocol where the same organization controls both the standard and its single implementation. Because that's not open.

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @arcanechat @jae You can do passwordless XMPP. Nobody does, but you can. And there's a standard for it. So when one or more people eventually do, it'll work in both apps that decide to do it, in the same way.

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@fastfinge @arcanechat @jae "Nobody does, but you can." should be the tagline of XMPP honestly

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @arcanechat @jae And "Just use our client and our library and our invite links, because that's what openness means," can be the tagline of deltachat.

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@fastfinge @arcanechat @jae the invite links situation is well under its way to being solved precisely because of censorship and single point of failure sorts of things

but anyway -- if someone already has Delta Chat app installed, they never actually access i.delta.chat as the app intercepts the URL

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @arcanechat @jae That's good. Now once there's a viable implementation not using deltachat's libraries or controlled by deltachat, and a way for the two clients to negotiate capabilities so they aren't forced to just be identical, I can happily use and promote it. Deltachat has good ideas. It's just not safe for me, or anyone else with a disability, to risk becoming dependant on. Because "small open-source underfunded organization stops caring about accessibility" is a far more likely threat to my use-case than "government blocks my instant messenger". It's also a threat that has happened repeatedly, and will continue to happen.

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@fastfinge @arcanechat @jae

and a way for the two clients to negotiate capabilities so they aren't forced to just be identical

Why is everyone SO obsessed with trying to build a messenger ecosystem with asymmetric features/capabilities?! What a total shit show that is for everyone -- developers and users

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @arcanechat @jae Because in the real world, everyone has different needs. My friends E-ink display can't show moving videos. My ESP32 controller doesn't run JavaScript, so can't participate in Deltachat Apps. My headless Linux box has no audio or video support, so can't do voice or video calls. I can't see images at all, so would prefer that servers not waste my mobile data by sending me avatars and pictures. The only way this can work if the protocol can communicate everyone's different needs and abilities, so devices don't get things they can't handle, users don't get things they don't want, and people don't get confused about what works and what doesn't.

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@fastfinge @arcanechat @jae

My ESP32 controller doesn't run JavaScript, so can't participate in Deltachat Apps.

then all it has to do is ignore the messages related to it, they won't harm it

"be liberal in what you accept..."

I have custom bots/bot accounts. They ignore all the WebXDC messages without issue. I can even try to call them. They'll never answer, but it is completely harmless.

I literally don't get the issue here.

Let's say you have the same account accessible over Bitlbee, your phone, and some ESP32. Do you want it to expose the capabilities of the currently active device even though it's the same account? So what, someone might not have the phone button appear if you're not active on the right client?

That is a HUGE metadata leak. You absolutely should not expose that information. (Signal does right now, you can spy on people and see when they're using their phone vs their desktop)

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @arcanechat @jae What I want is for my grandmother not to think she did something wrong when she sends me an app, and the connection never establishes. Or spend five hours troubleshooting her internet when she tries to call me and it doesn't work. Or for my app not to waste all of my mobile data because my cousin sent 54 photos to the family group. Without protocol negotiation, you can never be user friendly in these ways.

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@fastfinge @arcanechat @jae

Grandma will just be calling when she gets "There was an error decrypting an OMEMO message addressed to this device." errors instead I guess?

Or for my app not to waste all of my mobile data because my cousin sent 54 photos to the family group.

Already possible to disable automatic attachment downloads in the Delta Chat app

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @arcanechat @jae I mean sure. That's an actual problem that I can solve for her. Though these days it never really happens. The only protocol with that problem still is Matrix.

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@fastfinge @arcanechat @jae I haven't used XMPP in probably 5 or 6 years, but I did just have a friend mention the OMEMO error yesterday

ᴏᴏᴍ-ᴋɪʟʟᴇʀ: 333[𝟱𝟬𝗽𝘀𝗶 𝘁𝗼𝗶𝗹𝗲𝘁]™ @jae@bsd.cafe

@fastfinge @feld @arcanechat i've experienced this moving people off of signal -> deltachat. now that i'm looking at other possibilities, the feedback so far is not great.

wafflesies @wafflesies@infosec.exchange

@feld @fastfinge @arcanechat @jae isn't whatsapp just xmpp in the backend? Could be mistaken but maybe the solution is throw billions of dollars at something and it'll come out popular and polished

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@wafflesies @feld @arcanechat @jae I think it’s signal not xmpp.

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@wafflesies @fastfinge @arcanechat @jae correct, WhatsApp is just XMPP in a trenchcoat

Same with iMessage. And all push notification stuff on iOS/MacOS (APNS) is also just XMPP messages.

There's a bunch of IoT stuff out there using XMPP as well (and in some rare cases Matrix, but why would you do that, it's a blockchain essentially, what a huge misuse)

Tons of XMPP out there in the world, but mostly for specialized use cases or proprietary messenger implementations because clearly trying to work with the standards body means you won't get to deliver anything to users until next decade instead of today

edit: Yes Whatsapp is XMPP, it was ejabberd running on FreeBSD servers

Johnny Peligro @mischievoustomato@tsundere.love

@feld @fastfinge @arcanechat @wafflesies @jae xmpp shines when its anything but decentralized
cc @anemone

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@mischievoustomato @anemone @feld @wafflesies @arcanechat @jae This is not at all correct. WhatsApp uses the Signal Protocol. No relation to XMPP. en.wikipedia.org/wiki/Signal_Protocol

Johnny Peligro @mischievoustomato@tsundere.love

@fastfinge @anemone @feld @wafflesies @arcanechat @jae thanks for pointing it out
but otherwise people cite xmpp's usage by proprietary implementations as a "win" yet its all centralized

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@mischievoustomato @anemone @feld @wafflesies @arcanechat @jae I dunno, even APNS seems to have moved away from being based on XMPP. It was around 2012, back when apple had iChat and supported XMPP services in it. But once they moved to iMessage, APNS started using port 443, and I see no modern evidence whatever they're doing is XMPP.

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@anemone @feld @mischievoustomato @wafflesies @arcanechat @jae The only people I'm pretty sure are still using a proprietary version of XMPP are Nintendo, of all people. And that only because they posted jobs once or twice looking for folks with Jabber experience. But I'm not a gamer so I have no idea what they're doing with it.

wafflesies @wafflesies@infosec.exchange

@fastfinge @anemone @feld @mischievoustomato@tsundere.love @arcanechat @jae oh yeah just use that then easy

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@wafflesies @anemone @feld @arcanechat @jae The trouble with The Signal Protocol is it doesn't federate. So you can never exchange messages with people who don't use your particular app and server infrastructures. The Signal Protocol is mostly useful from the perspective of library developers.

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@fastfinge @anemone @mischievoustomato @wafflesies @arcanechat @jae Signal/Noise protocol is for E2EE, not what's inside. What's inside is a custom binary implementation of XMPP essentially

Here's a repo of someone reverse engineering this protocol:

github.com/raphaelvserafim/whatsapp-binary/

There's XMPP in there still, but they ripped out all the parts they didn't want or didn't scale

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @anemone @mischievoustomato @wafflesies @arcanechat @jae Interesting. Maybe the EU gateway provider thing will force them to federate again. Though I doubt it.

Only 3 Easy Payments of $19.95 @feld@friedcheese.us

@fastfinge @anemone @mischievoustomato @wafflesies @arcanechat @jae they'll do what everyone else is doing: spin up a company with a couple employees, build a proof of concept messenger that "federates" but restrict who can actually use it, then tell the EU gov that you satisfied their requirements because another company can interoperate with their network

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

@feld @anemone @mischievoustomato @wafflesies @arcanechat @jae Yes, probably. That's why I said I doubt it. And even if they did, we'd all block them just like the entire fediverse decided blocking threads was worth shooting ourselves directly in the face.