Yep. You can use Signal Protocol over XMPP by using an OMEMO-compatible client [1]. You can pretty "easily" host your own XMPP server using Prosody [2] on a Raspberry Pi.

1. https://en.wikipedia.org/wiki/OMEMO 2. https://prosody.im

Signal the app uses OWS's servers, but Signal the protocol can run on anything. WhatsApp etc definitely aren't using OWS servers.

From what I can see, they're doing everything that they can to eliminate sending anything to servers. They recently launched private contact discovery which is really interesting.

https://signal.org/blog/private-contact-discovery/

Moxie has said repeatedly that they're working to do better on this front, but it's not without its technological challenges. He's written repeatedly about this and has also called for anyone willing to try to make it happen and offered to help them. Just one example springs to mind:

https://news.ycombinator.com/item?id=12883410

And federation is possible over XMPP with Signal:

https://signal.org/blog/the-ecosystem-is-moving/

>And federation is possible over XMPP with Signal: https://signal.org/blog/the-ecosystem-is-moving/

That article does not say this. In fact, it more or less has the opposite meaning.

Yes, but decentralization is a difficult problem. I think eventually it will become like email, where everyone just uses GMail.

NAT, Firewall, etc all make it very difficult to do true P2P as well.

You might use GMail, but I can communicate with you perfectly fine even if I don't use GMail.

If by "perfectly fine" you mean highly likely to get into your recipient's spam folder - you're probably right. Having tried to self host my own mail server I can tell you it's never an easy task to actually get your message across.

That doesn't match my experience of running a mail sever for decades.

How long since you set up mail for a newly registered (possibly with previous owner) domain hosted on a VPN or rented dedicated server in an ip block that might have had previous owners?

Not sure if this is recent enough, but I moved my self-hosted email to a new address a little over 4 years ago.

The only systems that have had even tiny problems with were Gmail and Microsoft. With Gmail it took a while to build reputation as a non-offender. With Microsoft the first time I sent mail to their way, I got an automated bounce with instructions to forward to a certain address for human verification. That check round took maybe 12 hours and I haven't had any problems since.

I find that pretty reasonable.

Sounds like Microsoft (outlook.com and friends?) have improved since I sat things up - I never got a bounce. It'd be nice if Gmail was so considerate.

But how do you know that when you send mail to a new Gmail contact it won't be silently flagged as spam? And how many times will the recipient have to "un-flag" before the behaviour changeges?

> The only systems that have had even tiny problems with were Gmail and Microsoft

The "only" big provider missing from that list is apple (in the West anyway).

I've never meant to claim that smaller providers that know what they're doing aren't capable of sending proper bounces, setting proper smtp error codes on reception or of handling email to postmaster@.

It's just that with Gmail and outlook not being God net citizens - it becomes unreasonably hard to send legitimate email to a large percentage of Internet users. One possible "fix" is to send mail to Gmail users via a Gmail account and Gmail authenticated smtp servers - and so on for outlook.com - but as the number of "silos" one needs to send data to grows, that solution becomes cumbersome. Not to mention if you publish an mx record for your domain, you should be accepting email... That's the whole point...

Two years ago? Still no issues.

This comes up a lot but the reality is that its really only nerds and spammers that self-host. It's hard to fault spam filters of being suspicious of random domains. This doesn't mean there aren't many alternatives -- just about any personal email provider will make sure they're off the blacklists.

With Gmail it appears to be a question of getting on a (secret, opaque) white list.

I mean that's the nature of these kinds of lists. We don't tell anyone about how we set up our firewall, do spam filtering, or flag accounts for suspicious activity because then it would be easier to circumvent.

There are plenty efficient rbl lists that are transparent. There's grey listing.

It's not like "today, you feel white-ish enough to not be silently dropped at gw, black-ish enough to go in the spam folder without warning" is the only valid policy to fight spam.

Even simply rejecting with an error (spam suspected) would be better than the silent treatment.

And I don't see anything wrong with telling people how you set up a firewall. We even write books about that.

And that’s why end-to-end encrypted e-mail is so very hard

I actually wrote a prototype to manage that:

http://lettergram.github.io/AnyCrypt/

The problem is we need to stop worrying about end-to-end encrypted <insert name here>. We need something that blocks javascript, and encrypts our messages before they even enter the pipeline (there will still be meta data though).

The extension I built was a POC just showing how it could be done easily with Keybase.

You have a "Portfolio" link in the sidebar that doesn't seem to be for anything, and a broken #contact anchor.

>I think eventually it will become like email, where everyone just uses GMail.

Or Outlook(Office365), Ymail, Zoho, GMX, iCloud, Yandex, Proton.

Or Posteo, Mailbox.org, Tutanota, Riseup.net, etc.

Or self-hosted.

A lot of people are listing plenty of alternatives for email, but the majority of people aren't going to be this broad in email usage.

Let's be real here, the vast majority of people use Gmail or Outlook. And importantly, businesses. iCloud breaks into the consumer market though, but these are by far the leaders.