I didn't downvote but your comment doesn't help me because it's what I call "generic & enthusiastic evangelism" that does not actually engage any of the concrete arguments in the blog post. An example of another comment that does try to address the author's issues is the one from arathorn[1] and I hope that one gets upvoted to more visibility.
As an example of a concrete point you didn't engage with, he worries about the reliability scenario of sending a critical message such as "my car broke down".
You cite a link of XMPP servers. But here's another list of servers where many are colored pink (they're no longer online): https://www.jabberes.org/servers/
How does the average person curate your list and avoid choosing a server that will be offline pink in the future? Non-techie people don't want to keep switching servers because somebody quits their hobby of running a XMPP server.
That's an example of why directing friends & family towards Signal is less of a cognitive burden.
The author also mentions ease of voice & video calls on Signal. The cheerleading "XMPP is alive and kicking" doesn't address that either.
I'm sorry my post has come across that way. I simply wanted to point out that framing the argument as "Matrix vs $PROPRIETARY_SERVICE" is unhelpful at best.
As an actual user of XMPP who has managed to get (some) of my contacts to join me in this brave old world of federation, I get frustrated when the conversation turns to "Matrix vs $CENTRALIZED_SERVICE_OF_THE_DAY" -- it's a false dichotomy that ignores that fact that 20 years later XMPP is still here and still hasn't died. IRC and SMTP are the only other standards for messaging that can claim that kind of longevity.
Of course XMPP is not perfect. But it's what we have to work with, and throwing our hands up in defeat and crawling back to the centralized platforms that keep letting us down is not the way forward.
One can use email and have an address at Google and one at work, and know these data points for a friend. One can use a phone and have multiple service providers (in some countries multiple sims for costs, in others legacy landlines.) One can use WhatsApp, Signal or Slack and then you need to synchronize on an entirely different backup service. None of them have the POTS guarantee and for the most part we (at least in my age demographic) don't even trust the POTS service with non-redundant numbers.
This happened to gmail recently, too, and my realtor couldn't send me contracts during a bidding war. In the case of gmail, it was an accidental reduction of provisioning to an internal service (perhaps easy to predict if you ignore the enormous complexity of the googleverse). In the case of Signal, it was a result of a scaling suddenly and faster than they could be expected to predict (perhaps easy to predict, but not a certainty; a risk in any case for a small operation like Signal).
> server implementation
In the Jabber ecosystem, there's a bunch of servers. Prosody and ejabberd are the most popular ones with easy configuration and extensibility, high reliability, support of all modern features (XMPP Compliance Suite 202X), and packaging for all distros. There's a lot more servers, but they may not be as reliable/complete.
> use matrix.org (...) or (...) will it be up (...) ?
There is no equivalent in the Jabber ecosystem, on purpose. Nobody wants to centralize all accounts, or wants to advertise services which may disappear some day. Jabber services, like web hosting and emails, is meant to be provided by hosting providers which will still be here decades from now. As with any protocol, you should never trust a provider of a single service (who doesn't deal with other protocols), unless they're the person developing this service and you want to support them. More often than not, these single services hosts are run by inexperienced volunteers who cannot guarantee they'll still have time and motivation to maintain the services years from now.
Some non-profits have been serving Jabber accounts for their members for more than a decade, like JabberFR here in France since at least 2005. And these "small" servers (JabberFR has ~700 parallel users and 2-3K servers federated with) take very limited resources and have much better uptime than most commercial messengers.
> Voice and video
This has been a long problem in the Jabber ecosystem because little people were working on it. Nowadays, 1-on-1 audio/video works perfectly across Conversations (mobile) and Gajim (desktop) and group AV works perfectly with Jitsi.
> Matrix is so hard to set up on a server
Jabber is really easy to setup on any server.
> Encryption isn’t mandatory in Matrix
Encryption isn't mandatory across the Jabber ecosystem, though some clients strongly encourage and facilitate it. This is the only criticism of matrix in this blogpost that equally applies to Jabber.
> How does the average person curate your list and avoid choosing a server that will be offline pink in the future?
That's a fair question. Registering with a hosting cooperative (not private corporation) which has a good track record is a good start. This is one of the reason we started the joinjabber.org project. Though we don't have a lot of servers recommended there just yet, we intend to curate services according to public criteria in the future.
> directing friends & family towards Signal is less of a cognitive burden
Not in my experience. This leads to questions like how can i talk to someone who doesn't have a phone number (you can't). Why is the service not working sometimes (smaller hosts have better uptimes). Why am i receiving phone calls from weirdos who took it from a groupchat i joined, i thought signal stood up for privacy. And hypothetically, in the future: why is Signal actively cooperating with law enforcement in my country. Why was Signal sold to a data-mining private corporation. Why is Signal going bankrupt and closing all services and where can i go...
I'd much rather take 5 minutes to explain to someone that Jabber is like email and they need to find a trustworthy, reliable provider, than spend hours and hours dealing with the mess and pain a centralized approach like Signal creates. Source: most of my friends and relatives are on Jabber; some have some moderate complaints about UX but it "just works".
It's already HARD enough to get them on Signal because they can't just click on the "Connect with Facebook" button. I got my mom on Signal and she actually converted other people to use it because it was not much harder than Whatsapp to set up.
XMPP nerver killed MSN back in the day's for the same reason...
Support for creating invitations from within the app was recently added to Conversations (sponsored by the Snikket project). I'm hoping to see more servers deploy this functionality in the coming year, and more clients implement support.
Snikket is built around the idea of invite-first for onboarding onto self-hosted servers. As the dev I may be biased, but I've onboarded many people seamlessly this way.
first it automatically trust the devices but if you want you can improve it with manual verification :
"TLDR: Automatically trust all new devices of contacts that haven’t been verified before, and prompt for manual confirmation each time a verified contact adds a new device."
I mean, surely there's a decent XMPP web client out there you could use with OAuth.
While being federated is a huge plus for me, it still needs to be a good and usable messenger on all other fronts. If I can't imagine my mother using it, you are doing something wrong.
I am not usually of the "software must be usable by a baby"-front, but for a messenger adoption is key, and unless I only talk to my nerd friends it needs to be both simple and at least up to task with Signal (videocalls, groups, easy to find contacts, ...)
And I want to be able to recommend it. I just currently can't, this was the point of my comment.
If it’s anything more than open app >> fill in phone number or create account >> see list of people to chat with, it’s already dead in the water.
https://play.google.com/store/apps/details?id=im.quicksy.cli...
When evaluating WhatsApp alternatives, this somewhat made me choose XMPP over Matrix. I recently uninstalled WhatsApp, Telegram and LINE (felt pretty good) and now use Conversations with most of my friends and family who were kind enough to try it out. Apparently Quicksy is free in the Google Play Store which is good news because nobody was willing to pay 2.50 EUR for Conversations and installing F-Droid just to install another app was quite a hurdle.
Indeed. For sure XMPP has ugly corners (disclaimer I never implemented anything, mostly read some XEPs). I believe parts which are quite clean are the pub/sub part and the message archive (MAM). Afaik the current group chat extension (MUC) isn't so great (once you try to add history multi-device) and some people are trying to refactor it on top of pubsub (MIX) but it's not very active.
The matrix team clearly had precise ideas about the right way to do federated group chat and in fact (again afaik, my matrix knowledge is dated) their "rooms" seem to be quite flexible by not being completely tied to a particular server (several servers participate in hosting a room). Imho matrix has an edge in designing this from scratch and already knowing what the hard parts are from the beginning and i hope the good ideas will come over to XMPP. Perhaps some day an XMPP server will support matrix, making more clients available to the network (well integrated clients on every plateform is the real hard part for every distributed network).
Is it? (genuinely curious) Can't one see the matrix server-server state synchronization protocol as a transport layer for MAM archives? And pubsub nodes in XMPP are very matrix-room-like. This could be an XMPP extension allowing to multi-home pubsub nodes.
Also, there are recent matrix proposals [*] for representing several things (groups and user profiles) as rooms. Given the analogy room=pubsub, the user-profile-as-room seems to be the same thing as XMPP's PEP (used to share personal data, like public keys or avatar). And the group-as-room would be the MIX proposal.
[*] https://github.com/matrix-org/matrix-doc/blob/matthew/msc177...
I ran a medium-small sized XMPP community for many years, and eventually the community abandoned it and went back to IRC because it had better client/bot support. Matrix has a really good solution for end to end encrypted group chat, so I haven't seriously looked back at XMPP since then. They were the first ones with a decent solution to the most important feature I needed in decentralized group messaging, so they won IMO.
I tried a couple times to build out my own clients/bots etc for XMPP, and it just seemed way overly complex. I had to bundle something like 30 megs of jar files for a simple hello world app.
Also some silly things like ejabberd refusing to hash passwords in their user database because they were "already encrypted with SSL". It was all just a frustrating mess, and a security nightmare.
Matrix, with Element, has a pretty web frontend that does encrypted messaging right. If XMPP has anything like that, please do let me know, but every time I've glanced back at it, it seems stuck in the stoneage of messaging apps, still working on getting a committee together to form the standards for even the most basic functionality that everything else had 10 years earlier.
It's basically the same encryption scheme as Jabber/XMPP uses with OMEMO. The two were developed around the same time. On Jabber existing rooms need to be set to "members only" and "non-anonymous" for encrypted groupchat to take place because Jabber multi-user chats enable using nicknames (only the MUC operators know your address) which prevents clients from querying each other's key.
> I had to bundle something like 30 megs of jar files for a simple hello world app.
That sounds horrible. There's pretty good XMPP libraries around nowadays, like slixmpp if python is your thing. There's also a WIP Rust xmpp library if you'd rather.
> Also some silly things like ejabberd refusing to hash passwords
That sounds creepy. However, prosody does that very well though. And it seems ejabberd supports SCRAM authentication since 2007?
> Matrix, with Element (...) If XMPP has anything like that
ConverseJS is a web-based Jabber/XMPP client that does encrypted groupchat. It's supported by other clients as well (such as Conversations on Android). Movim, the more popular Jabber web client (because it has social features) does not support OMEMO yet unfortunately.
ConverseJS may not be as user-friendly as Element though because they don't have (yet?) the $$$$$$ of VC/government money matrix has.
> still working on getting a committee together to form the standards
There is a bureaucratic tendency around the XMPP Standards Foundation, because standardization is very important to avoid lock-in. However client devs have pushed features before/meanwhile publishing specifications and bureaucracy does not seem to be a concern for (some?) devs in practice.
In any case, if you want a point, whenever technical people bring up the technical superiority of X protocol or tool in a discussion, I like to ask myself this question. How many people actually use the thing that someone is telling me is so much better for the world? If it's so good, why is nobody using it for practical things? Have they used it before and there's a decline, or is it a new up and comer and it just hasn't caught on?
I think just asking the question sparks a valuable train of thought.
They are not talking about "technical superiority" though, but about "alive and kicking" and "work together pretty decently" and you followed up with a question of daily volume as somehow being the indicator of the maturity of the technology itself.
There are multiple reasons for a lack in adoption, of course. Network effects, FOMO and walled gardens, financial might and power of dominating competitors to name a couple besides just the quality of the tech itself. And it doesn't help when many people off-handedly state the technology is not good, because it is not yet as broadly adopted as the centralized giants it is trying to be an alternative too :)
The 'why' you have here is a more open question and there's a lot in there. Companies trying to make money from it, users not having seen many real privacy implications on a wide scale, police presence being up and down etc. etc.
I'm not arguing in favor of these corporations. I'm a proponent of non-profit federated networks like the Jabber federation (based on XMPP protocol). Not that XMPP is better than ActivityPub/Matrix in all regards, but it has stable standards, rock-solid implementations with very good scaling stories, and there's a vibrant non-profit community working on:
- better, modern clients for chatting: Conversations, Dino.. - unified branding/UX across platforms with Snikket client/server distribution - social networking: Movim (web), salut-à-toi (multi-platform) - decentralized forging to replace github: salut-à-toi uses it for own development - onboarding people with prosody's mod_invite - federated chat over tor onion services with prosody's mod_onion
Matrix, SMTP and ActivityPub have other strong points going for them, but i could argue most of the Matrix criticism in the article does not apply to the Jabber ecosystem. Disclaimer: i'm a happy Jabber user and contributor to the https://joinjabber.org/ project (a new born in the ecosystem)
Based on some yearly port-scanning surveys [1], the developers of the Prosody XMPP server think there are over 50,000 servers running Prosody (out of a total of over 85,000 XMPP servers). There are a handful of large public servers and then what I imagine would be a very long tail of tiny private servers.
Back in 2016 I came across a computer science paper where the author had studied the decentralization vs. centralization phenomenon in various cases (not just in IT but also in real-life social networks, economic dependency graphs etc.) and concluded that every man-made decentralized system will eventually exhibit centralization to some degree as it will develop nodes that have orders of magnitude more edges than the average node. It seems to be a very natural phenomenon. I wish I remembered the author or the title…
As another commenter has pointed out, Delta.chat shows just how closely an email client can mimic the chat/IM interface.
At least an email to the user's @Facebook email address gets picked up in messenger.
https://play.google.com/store/apps/details?id=im.quicksy.cli...
It's as easy to use and to automatically recognize contacts as Whatsapp and Signal but it's federated to XMPP.
And people who don't use Quicksy host service can register to be easily recognize as a contact :
> We charge a small fee to enter your Jabber ID and phone number into our directory. This cross financing allows us to make Quicksy completely free for its users. If you are a paying customer of the conversations.im hosting service, you can enter your number for free.
As stated on their home page, it's a fork of the Conversations (conversations.im) client with contact discovery which they're selling.
> Quicksy is a spin-off of the popular Jabber/XMPP client Conversations with automatic contact discovery.
So it's just a conversations.im client trying to make a buck with a contacts service based on what I can see. Edit: in context in case you didn't know, Matrix (at least via app.element.io -> vector.im) has a contact discovery service, and it already works with phone numbers and email addresses using a blind one-way lookup for privacy.
Also a problem is iOS clients. Developing on iOS requires lock-in into the Apple ecosystem and most XMPP folks are free-software people so nobody will bother to buy Apple hardware/software specifically to develop for their closed ecosystem (i.e. unpaid labor for a multi-billion corporation), although i'm sure a lot of folks would be happy to do just that if that was sponsored work (donations, grants).
On Android, Conversations (or its forks Quicksy/Snikket) is the best. ChatSecure on iOS has been buggy for years (every time i tried with someone with an iPhone), but nowadays Siskin appears to be a good iOS client, though i haven't had the hardware/system to try it myself.
I'm not someone implementing XMPP but I remember reading articles about it back in the day and I recall hearing that the consensus that it's not a good protocol for mobile. Mobile being probably 95% of messaging traffic.
That means apple & google are effectively dictating how you can use TCP (i.e. not outside of HTTP and friends), and everything is now terrible.
Ok, but this is our reality. Windows has been the dominant desktop OS since 1995 or so (and MS-DOS was the one from 1985 until 1995 or so, from the same company).
Linux has been dominating the server space since about 2005 or so.
iOS and Android have dominated the mobile since about 2010.
I'm not holding my breath for any of these OSes disappearing from their niches before I die...
The article brings valid points that are not invented.
1) UE / ease of use for non-tech savvy users
2) a "killer feature" that gets people talking
While 1) is a no-brainer, 2) is a more difficult.
What does matrix offer to users other than "decentralization" (which is great for people on HN who like tinkering, but a usability drawback due to bootstrap time of joining a p2p network, and p2p in itself not offering a __security__ advantage[please ask to see the threat model when there are blanket claims that p2p is more secure]).
Signals claim to fame comes from actual subpoenae that returned no usable metadata. Matrix (so far) has never been tested in adversarial conditions[citation needed]. While matrix's e2ee is an often talked about feature, it is not part of most matrix-implementations. Only riot claims it does e2ee however the claims on voice security are vague. Not clear if p2p or multiparty voice are E2E encrypted. Also you can optionally encrypt text chat rooms (which means it's not the default and so it's either not used by non-tech savvy users and those who rely on it risk getting exposed due to the extra steps it takes).
I'm excited for decentralized technologies[3] but Riot is not in a state (yet) where I'd recommend it to exposed groups or individuals. So if neither e2ee is properly implemented, nor does it offer some radical new feature, nor is it actually more user-friendly - then why should anyone bother with it?
[1] compete = moderate attempt in getting a name for itself considering that Signal is stealing all the attention in comparison to all other "secure" messengers
[2] https://www.documentcloud.org/documents/3120046-Open-Whisper...
[3] cwtch: more bleeding edge than matrix, potentially buggy and certainly not ready for prime-time but they understand that: "your threat-model isn't my threat-model" https://docs.openprivacy.ca/cwtch-security-handbook/risk.htm...
We're never ever going to tear ourselves away from this death by centralization if we keep inventing excuses for why we don't use the federated/distributed systems that we already have!
Edit: for those who are interested in using XMPP in 2021, there is a good list of public servers available at https://list.jabber.at/ and a list of clients that support modern OMEMO end-to-end encryption at https://omemo.top/