phone

    • chevron_right

      The XMPP Standards Foundation: The XMPP Newsletter September 2022

      news.movim.eu / PlanetJabber • 1 October, 2022 • 8 minutes

    Welcome to the XMPP Newsletter, great to have you here again! This issue covers the month of September 2022.

    Like this newsletter, many projects and their efforts in the XMPP community are a result of people’s voluntary work. If you are happy with the services and software you may be using, especially throughout the current situation, please consider saying thanks or help these projects! Interested in supporting the Newsletter team? Read more at the bottom.

    Newsletter translations

    This is a community effort, and we would like to thank translators for their contributions. Volunteers are welcome! Translations of the XMPP Newsletter will be released here (with some delay):

    XSF Announcements

    • The XSF membership application period for the fourth quarter 2022 is currently open. If you are interested in becoming a XSF member then you can apply for membership . Please submit by November 27, 2022.

    • The XSF Board and Council application period for the next year is currently open. If you are interested in running for the XSF Board or XSF Council then you can apply here . Please submit by November 6, 2022. Remind that XMPP Council members must be elected members of the XSF; however, there is no such restriction for the Board of Directors.

    • Security advisory: libexpat before 2.4.9 is vulnerable to CVE-2022-40674 , make sure to update, if you depend on it.

    Google Summer of Code 2022

    XSF and Google Summer of Code 2022

    The Google Summer of Code 2022 finished! The two new contributors Patiga and PawBud were working on open-source software projects in the XMPP environment. Read their all their blog posts, too. Thanks everyone for participation!

    XSF fiscal hosting projects

    The XSF offers fiscal hosting for XMPP projects. Please apply via Open Collective . For more information, see the announcement blog post . Current projects:

    Events

    Articles

    Congrats to the Monal developers for the new NLnet Funding that will cover privacy enhancements for the push servers, an explorative audio and video calls implementation, UI updates for MUC and Contact views, and SASL updates.

    Paul Schaub wrote a blog post focused on the technical details of how to check the validity of nested packet sequences using pushdown automata. This technique will be used in a partial rework of PGPainless to validate OpenPGP messages. Earlier this month another post on “Creating a Web-of-Trust Implementation: Accessing Certificate Stores” has been published, too.

    PGPainless to validate OpenPGP messages

    jmp.chat brought voicemail changes and opt-in Jabber ID discoverability to their service, along with an updated Android app and new custom F-Droid repos for both stable and pre-release versions. Furthermore, they wrote about “Privacy and Threat Modelling” in general.

    Arnaud wrote about updates on the chatty server and HTTPAuthentificationOverXMPP .

    Anoxinon.media published their blogpost XMPP - Teil 1 - Messaging mal anders [DE].

    Software news

    Clients and applications

    Maintenance release of Beagle IM 5.3.1 that fixes sending OMEMO encrypted files and entering password-protected MUC. Besides, Tigase launched a new, simpler website tigase.org that makes it easier to access open-source projects created by Tigase.

    New tigase.org

    Gajim 1.5.0 and 1.5.1 have been released . These releases come with a significant performance boost. Pinned chats can be ordered via drag and drop, message corrections have been improved, and many bugs have been fixed.

    An OMEMO 2 implementation has just been merged to Libervia , coming with Stanza Content Encryption ( XEP-0420 ) support, thanks to the great work of Syndace, author or python-omemo (which has been updated in the process). One of the major benefits is that other Stanza elements can now be encrypted too, not only the body. OX ( XEP-0373 / XEP-0374 ) should follow soon, exciting times!

    While Monal development is going forward, see the funding news above, and they deployed new Push servers as announced in the July 2022 XMPP Newsletter, users of old Monal versions would need to update, so if you or your contacts didn’t already the developers urge you to do it now .

    Missed in the August 2022 XMPP Newsletter was a release of UWPX, the XMPP client for UWP (Windows 10) devices. While version v.0.43.0.0 has only a fixup it’s unfortunately also the Final Update as the developer is stepping away from the project. Maintainers to follow-up are welcome to reach out!

    Kaidan, a user-friendly and modern chat app for every device, will receive a grant by NLnet for adding encrypted audio and video calls . Congratulations!

    Servers

    Jackal v0.62.0 is out bringing XEP-0313 Message Archive Management support and several enhancements.

    Metronome IM 4.0 has been released . This version introduces Lua 5.3 support, a revamped shared API for group chats stanza archiving, MIX Core/PAM experimental support, Message Moderation support and support for containerization.

    Profanity 0.13.0 has been released.

    Libraries & Tools

    python-nbxmpp 3.2.2 and 3.2.3 have been released , adding a stringprep implementation and improvements for detecting broken TCP connections.

    The first beta of Slidge (XMPP bridges) is out!: Slidge, supporting Signal, Telegram, Discord, Steam, Mattermost, Facebook and Skype. Currently only direct messages are supported, but development is going further. Find the article in English and French .

    Work on XMPP ⇔ ActivityPub gateway (supported by a NLnel funding) has been achieved. The gateway supports features such as following/followers, favourite/like (or “noticed” in XMPP terms , reactions (compatible with Pleroma ), mentions, sharing/reboost and lastly events (compatible with Mobilizon ). It has been tested with Mastodon , Pleroma and Mobilizon. It’s still considered alpha quality, a blog post should follow soon to explain in more details .

    Ignite Realtime Community:

    Extensions and specifications

    Developers and other standards experts from around the world collaborate on these extensions, developing new specifications for emerging practices, and refining existing ways of doing things. Proposed by anybody, the particularly successful ones end up as Final or Active - depending on their type - while others are carefully archived as Deferred. This life cycle is described in XEP-0001 , which contains the formal and canonical definitions for the types, states, and processes. Read more about the standards process . Communication around Standards and Extensions happens in the Standards Mailing List ( online archive ).

    xmpp.org features a page about XMPP RFCs as well.

    Proposed

    The XEP development process starts by writing up an idea and submitting it to the XMPP Editor. Within two weeks, the Council decides whether to accept this proposal as an Experimental XEP.

    • Events
      • This specification describes how to handle calendar events with XMPP

    New

    • No new XEP this month.

    Deferred

    If an experimental XEP is not updated for more than twelve months, it will be moved off Experimental to Deferred. If there is another update, it will put the XEP back onto Experimental.

    • No XEPs deferred this month.

    Updated

    • Version 0.4.0 of XEP-0440 (SASL Channel-Binding Type Capability)
      • Make sasl-channel-binding element a top level stream feature (dg)

    Last Call

    Last calls are issued once everyone seems satisfied with the current XEP status. After the Council decides whether the XEP seems ready, the XMPP Editor issues a Last Call for comments. The feedback gathered during the Last Call can help improve the XEP before returning it to the Council for advancement to Stable.

    • No Last Call this month.

    Stable

    • No XEP moved to stable this month.

    Deprecated

    • No XEP deprecated this month.

    Call for Experience

    A Call For Experience - like a Last Call, is an explicit call for comments, but in this case it’s mostly directed at people who’ve implemented, and ideally deployed, the specification. The Council then votes to move it to Final.

    • No Call for Experience this month.

    Spread the news!

    Please share the news on other networks:

    Subscribe to the monthly XMPP newsletter
    Subscribe

    Also check out our RSS Feed !

    Looking for job offers or want to hire a professional consultant for your XMPP project? Visit our XMPP job board .

    Help us to build the newsletter

    This XMPP Newsletter is produced collaboratively by the XMPP community. Therefore, we would like to thank Adrien Bourmault (neox), alkino, anubis, Benoît Sibaud, emus, goffi, Jeybe, Licaon_Kter, martin, MattJ, MSavoritias (fae,ve), nicfab, Ppjet6, vanitasvitae, wurstsalat, Zash for their support and help in creation, review, translation and deployment. Many thanks to all contributors and their continuous support!

    Each month’s newsletter issue is drafted in this simple pad . At the end of each month, the pad’s content is merged into the XSF Github repository . We are always happy to welcome contributors. Do not hesitate to join the discussion in our Comm-Team group chat (MUC) and thereby help us sustain this as a community effort. You have a project and want to spread the news? Please consider sharing your news or events here, and promote it to a large audience.

    Tasks we do on a regular basis:

    • gathering news in the XMPP universe
    • short summaries of news and events
    • summary of the monthly communication on extensions (XEPs)
    • review of the newsletter draft
    • preparation of media images
    • translations

    License

    This newsletter is published under CC BY-SA license .

    • wifi_tethering open_in_new

      This post is public

      xmpp.org /2022/10/the-xmpp-newsletter-september-2022/

    • chevron_right

      Ignite Realtime Blog: REST API Openfire plugin 1.10.0 released!

      news.movim.eu / PlanetJabber • 29 September, 2022

    We are happy to announce the immediate availability of version 1.10.0 of the REST API plugin for Openfire!

    This release will see the performance on lookups of MUC rooms based on case-insensitive room names, or non-existing rooms. This will be particularly notable in systems that hold many chat rooms.

    Another feature that is added is that basic statistics on REST endpoint usage are now exposed. These can be viewed through the Monitoring plugin. It is worth noting that for versions of the Monitoring plugin prior to 2.4.0, Openfire needs to be restarted whenever the REST API plugin is reloaded or upgraded ( more details here ).

    The updated plugin should become available for download in your Openfire admin console in the course of the next few hours. Alternatively, you can download the plugin directly, from the plugin’s archive page .

    For other release announcements and news follow us on Twitter

    1 post - 1 participant

    Read full topic

    • chevron_right

      JMP: Newsletter: Voicemail Changes, Opt-in Jabber ID Discoverability

      news.movim.eu / PlanetJabber • 28 September, 2022 • 2 minutes

    Hi everyone!

    Welcome to the latest edition of your pseudo-monthly JMP update!

    In case it’s been a while since you checked out JMP, here’s a refresher: JMP lets you send and receive text and picture messages (and calls) through a real phone number right from your computer, tablet, phone, or anything else that has a Jabber client.  Among other things, JMP has these features: Your phone number on every device; Multiple phone numbers, one app; Free as in Freedom; Share one number with multiple people.

    This month sees the release of Cheogram Android 2.10.10-2 , based on a new upstream version and with many bugfixes and small improvements, especially around the Command UI. We also now have our own F-Droid repositories for quick update of official builds from us. We have a repository for releases and for those who want to help testing new features as they are developed we also have a repository for pre-releases .

    Some JMP customers forward their calls to another voicemail service, or otherwise do not have need for the JMP voicemail.  This month we added an official option to the Configure Calls command that allows disabling voicemail completely for users who need this.

    The default voicemail outgoing message has been changed from saying “a user of JMP.chat” to specifying what JMP number has been reached.  Anyone with a name or nickname or custom voicemail greeting set is not affected by this change.

    As a small improvement for multi-account billing users, renewal transactions now specify what number is being renewed by the transaction.

    Cheogram (and thus JMP) is now allowing all users to opt-in to Jabber ID discoverability.  This is to allow users to discover the true Jabber ID behind a phone number so they can upgrade to end-to-end encryption, video calling, high quality media sharing, etc.  This is opt-in only, and most features that make use of this are not built yet, but we wanted to give people the option to express their consent now.  This is done as part of the registration process.  For existing users, if you do not want to opt in, there is nothing you need to do.  If you wish to opt in, simply run the Register command, choose JMP, and it will ask for your consent (it will show if you use the bot as Current Value true for technical reasons, but do not worry it is set to false unless you explicitly answer yes to that question.)

    This month we have also made some progress with the early test phase launch of our data-only SIM and eSIM program .  The program is slowly rolling out to the waiting list over the course of the next month, as we gather data and feedback from early users.  If you are interested, adding your Jabber ID to the waiting list is still the best way.  We have also heard the interest in having these available for people who are not otherwise JMP customers, and hope to have that ready for testing soon as well.

    To learn what’s happening with JMP between newsletters, here are some ways you can find out:

    Thanks for reading and have a wonderful rest of your week!

    • wifi_tethering open_in_new

      This post is public

      blog.jmp.chat /b/september-newsletter-2022

    • chevron_right

      Tigase Blog: Tigase XMPP Client Apps

      news.movim.eu / PlanetJabber • 28 September, 2022 • 2 minutes

    Our XMPP Chat Apps philosophy

    Web based, JavaScript, React and so on app are great… for developers.

    We do care about users and we understand that the only way to provide users with great experience is through native apps.

    Therefore we have put a lot of effort and dedication to develop native client for each platform separately. Each of our apps is tailored for the best experience and native feeling. Plus they are optimized for each platform, so they are lightweight but also powerful and take full advantage of what is offered by the environment they are running on.

    All our applications offer the same set of features, so no need to replace them over and over again below. Here is the list:

    • Simple Chat - yes, this is the good, old 1-1 chat.
    • Group Chat - like the old IRC, now it is MUC (Multi User Chat). You can create chat rooms, public or private, open or password protected with moderators and so on…
    • Push notifications - if the app is not running on the device, the user is not connected to the XMPP server but he can still receive notifications about new messages from people.
    • iOS has now call silencing from unknown. We had this before them. All new chats from unknown users go to separate tab “From unknown” and you can turn off push notifications about messages from people who are on on your contact list. Plus, of course Tigase XMPP Server has a built-in anti-spam filtering which helps too.
    • Voice and Video calls are pretty much standard nowadays and Tigase client support it as well.
    • Multi-account support - you can add as many accounts on different servers as you want on your client and communicate through all these accounts at the same time
    • Files Sharing - yes, photos, documents, anything can be send through the XMPP client to your buddies either on the simple 1-1 chat or to entire team in a group chat. Client displays photos nicely, so you can see them directly in the app.
    • OMEMO - E2E encryption is available on all our client apps.

    We, at Tigase use all our XMPP apps ourselves.

    All Open Source

    All our XMPP Chat applications are open source with code available in public repositories on GitHub.

    Stork IM - Tigase Android XMPP Client

    Our first mobile client we created. Native Android app designed and written from ground up, again and again…

    We experimented, made mistakes and learned. So here it is. Android Java, native app. Lightweight, fast and powerful.

    Our Android client works on most Android devices. It offers a set of typical features you would expect from a chat application plus a lot more, not typical features.

    Siskin IM - Tigase iOS XMPP Client

    Our second mobile client. This one for iOS, optimized to run on phones and tablets.

    It is a native Swift app optimized for iOS for both phones and tablets.

    Simple to use but with many advanced options for more demanding users.

    We suggest to start using it in a simple mode and gradually explore other features and options.

    Beagle IM - Tigase MacOS XMPP Client

    Mobile devices are good when you are on the go. But we are software developers and we work on real computers all the time. Hence we also have and offer a real desktop, native chat client.

    Again, it’s a native Swift app designed from ground up and optimized for desktop MacOS.

    Feature set matches all other other apps.

    If you work on MacOS, we honestly recommend to try it out.

    • wifi_tethering open_in_new

      This post is public

      tigase.net /xmpp-clients/

    • chevron_right

      Tigase Blog: Tigase XMPP Server

      news.movim.eu / PlanetJabber • 28 September, 2022 • 5 minutes

    Tigase XMPP Server is Java based software

    Tigase XMPP Server is a standalone application written in Java. It is not a “web server” system. It runs independently from any other software. In most cases all it needs to run is Java Virtual Machine (JVM). For extended functionality it may require a few external libraries for the most part it is all in-house developed software.

    Java based but still very efficient

    Java is known and infamous for it’s high resource requirements and slowness. This unfortunate, bad reputation is a result of early impressions from the first years of Java and also from poorly written, bloated Java monster software. Poorly written and poorly maintained software results in tons of redundand code and overall slagishness.

    There are, however, many Java programs which are good examples how efficient, fast and resources friendly Java code can be. And Tigase XMPP Server is one of these good examples.

    We put a lot of effort to optimize, design it and implement efficient code. Here are some interesting facts:

    • The main binary code to run Tigase XMPP Server is less then 3MB
    • In some cases it can be run with as little as 10MB of RAM , usable, typical XMPP chat system can be deployed on 50MB of RAM
    • It was successfully tested to handle over 30 millions messages per second
    • It runs on production systems with over 10 million users
    • It runs on production systems processing over 5 millions messages per second
    • Typical message processing time is below 0.01 second if database is not involved

    Reliable

    We frequently put Tigase XMPP Server through very rigorous testing. Running hundreds of automated tests, performance tests and long-lasting reliability tests. This allows us to discover bugs, inconsistencies, bottlenecks, memory leaks and other potential problems in long-running applications.

    Every release is thoroughly tested and verified before publication.

    Tigase XMPP Server is known to run for over 3 years without restart on a production system.

    Secure

    XMPP was designed from ground up to be secure. Tigase, however, does not stop there. We took additional steps to make sure Tigase provides up to date security.

    Through extensive testing, third-party verification, we make sure it is a well written software, resistant to all common attacks, including SQL injection, DOS attacks, man-in-the-middle attacks and many others.

    We closely track changes and developments in the security protocols and make sure Tigase is up to date, uses only safe ciphers and algorithms.

    Additional, hardened mode, turns Tigase into very restrictive configuration, which may break connectivity with older apps and servers, but on the other hand, ensures that security it tightest possible for demanding customers.

    Very Scalable

    Tigase uses resources very efficiently. It can easily handle half a million users on a single server or more. But no matter how efficient the server is and how optimized the software is, there is a limit on how much a single server can handle.

    Therefore, from the very beginning we planned on making Tigase scalable. Out of the box Tigase offers near-linear scalability or exact linear for some use cases.

    It can be deployed on large number of servers over distributed data centers and cloud providers to provide a single logical system for practically unlimited number of online users sending millions of messages per second.

    Cloud independent

    Tigase XMPP Server is Java application and can be deployed on anything that can run Java programs. It does have some special integration features for Amazon AWS cloud system but it can run on any Cloud. Our customers deploy Tigase on Google Cloud, Microsoft Azure cloud and many others and also on in-house dedicated data centers.

    Tigase has a built-in load balancer to better distribute connected users and devices but it can also play nicely with external load balancers which are used on different environments.

    Extensible

    Tigase XMPP Server can be used as it is.

    Out of the box it is capable to provide sufficient functions for typical XMPP systems and in many cases for not so standard XMPP services.

    There are, however, deployments with specific requirements or third-party systems with which Tigase has to integrate. For such cases, Tigase XMPP Server offers exceptional flexibility. Well designed and rich API allows adding custom elements like blocks.

    There is no single line of code in Tigase which is fixed. Anything and everything can be replaced with custom made code and plugged-in through configuration file.

    Administrator friendly

    From our experience we know that starting a complex system is a big challenge. However, even greater challenge is maintaining such a system long-term. Therefore, we have put a lot of effort to make sys ops life easier.

    There is a huge number of tools built-into the Tigase XMPP Server which make maintaining Tigase much simpler than expected:

    • Command line tool to execute all admin tasks
    • Web UI for admin to see critical system parameters and performance metrics
    • Thousands of runtime performance metrics allow to diagnose system in real-time
    • Built-in self-monitoring system which can send notifications via email or XMPP if it detects problems
    • Detailed diagnostic log can be switched on/off
    • Detailed diagnostic log for a single user can be switched on/off
    • Audit Log
    • Self-fault recovery
    • Automatic cluster reconfiguration

    Easy to track performance

    Proper monitoring is one of key areas we focus during development, testing and maintaining services. Tigase XMPP Server offers thousands of run-time performance metrics, which allow to track the system in real-time.

    Every significant processing unit generates performance metrics, therefore if there is any slow down or a bottleneck it is very easy to diagnose the system, locate the problem and fix it.

    Easy to integrate

    There are many ways to integrate third-party systems with Tigase XMPP Server.

    It has very well thought and rich API which allows to add new components and plugins. These plugins can interact with other systems to exchange information.

    However, Tigase employs a common pattern for so called “Connection Managers” which are responsible for network communication. Each connection manager talks a different protocol and Tigase can easily learn new protocols to connect to virtually any external service to exchange information in real-time.

    Tigase also offer access through REST API which can be easily extended using various scripting languages. This is a powerful feature which allows to add new REST API calls using a programming language of your choice.

    Tigase XMPP Server can be also configured to retrieve users’ data from different databases storing data in different formats. This allows for an easy integration with other systems without writing a single line of code.

    • wifi_tethering open_in_new

      This post is public

      tigase.net /xmpp-server/

    • chevron_right

      Tigase Blog: Tigase XMPP Libraries

      news.movim.eu / PlanetJabber • 28 September, 2022

    Our software philosophy

    Actually nothing new and nothing surprising here. We want to have as much of a reusable code as possible. And this reusable code should have a simple but powerful API to be useful for quickly creating software.

    That’s it.

    And this is how we design and develop our XMPP libraries. Check them out.

    Documentation to all our projects is available online and sample codes? Take a look at our XMPP Chat apps which are open source too.

    • wifi_tethering open_in_new

      This post is public

      tigase.net /xmpp-libraries/

    • chevron_right

      Tigase Blog: Tigase Instant Communication, Presence and Messaging

      news.movim.eu / PlanetJabber • 28 September, 2022 • 8 minutes

    What is “Instant Communication”

    First things first. What is this all about?

    We say this is “Instant communication” or “Near real-time communication” and indeed, this is about communicating, talking, sending messages, sending other information, documents. Instant or real-time means, whatever you send, is sent right away, it is also delivered right away.

    Would the receiving person get it right away too? Well, it depends, if the person is online, it gets it right away and can respond right away.

    Messaging really means chatting, talking. It’s not just sending and receiving messages. You send a message, friend receives it in real-time and can respond right away. You see the full chat history, context, you just talk. And you can chat with many people at the same time, in what we call group chat rooms. It’s like sitting at the table with friends and talking to them.

    What special about this system is, that You know if your friends are online. If you send a message to online friend you can expect his response right away, if he is offline, you know about it and you know you may have to wait for a response. No guessing. This is the “Presence” part in the title. Presence is just a status of the other person: online, offline, busy, away, and so on… So you not only can send a message to your friend instantly but also can know his current status, also in real-time. As soon as somebody changes his status, you know it right away.

    Presence is also much more than just online status. Presence can optionally carry on additional information, like location, mood, what your friends are listening to and just anything your friend chooses to share with you.

    And… “last but not least”, the system is not just for people talking. It’s for devices as well. Anything that can send some information, share some data, update it’s status can effectively use our software. IoT is an ideal example where our software excels and shows it’s full power.

    How is it different from e-mail?

    Simple enough. It all looks similar to email, send and receive messages. What’s more, even a user address looks exactly like email. So what is the difference?

    There are a few significant differences:

    1. E-mail is not real-time and is not instant. It may be quite fast but it may also be quite slow (a couple of minutes) until the email is actually delivered and this is still considered a norm for email messages.

      XMPP is actually near real-time and instant. Typical delivery time is way below 1 second.

    2. E-mail is not really for chatting or talking. It’s more like sending letters, longer texts. It’s not really suitable for sending short messages or notifications.

      XMPP is just for that. Chatting, talking, sending short messages or notifications. However our software has expanded on the basic features and allows rich text formatting using Markdown language. You can send long texts and even letters nicely formatter which are pleasant to read.

    3. E-mail has no presence information. You send an email message but you do not know whether your friend is online, when he gets the message, when he can read the message and finally respond. You just send an email and wait.

      XMPP does have presence information. Plus all kinds of confirmations built-in. You know if your friend is online, when he received the message, read it and you know when to expect a response. You know whether your friend is available to talk right now or busy doing something.

    4. E-mail was designed and created very long time ago. When the high security and privacy was not such a big concern, there was no spam, and other attacks. Over time security of email improved but there are many different techniques and standards not always adopted by every email provider. Spam has been a huge problem for a long time and so far nobody knows how to solve it.

      XMPP came to be long time after e-mail. When all the email weaknesses and problems were well known. So it was designed from ground up to solve the problems. Security is embedded in the XMPP core, privacy was the main concern and preventing Spam and DOS attacks was taken into consideration from the very beginning.

    How is it different from SMS / Text Messages?

    SMS / Text messages are instant, aren’t they? They are sent and delivered in real-time, aren’t they?

    At first, it all sounds like SMS / Texting. People chat over SMS all the time. Is XMPP any different.

    There are a few significant differences:

    1. Presence - is completely missing from SMS/Texting. You have no idea whether the person is at their device to read the message and text you back. You are sure, that he gets the message, usually, right away, unless their device is turned off. But you have no way of knowing if the device is on or off, whether your friend is close by to the device, and not busy to respond.
    2. User address/ID - for SMS / Texting, this is just a phone number. Sure, nowadays it is kind of personal thing but if it changes, then friends may have problem finding out your new number, may have problem contacting you at all. So you have to take a good care of letting them know about the phone number change. But even if you have still your number and poeple can text you, the device may be far on the table when you rest on the coach with your tablet. To read a text from a friend or send somebody SMS you would have to interrupt your rest, find your phone and type the message on the screen. Don’t mention about all your chat history. When your mobile is gone, all the SMSes / Texts are gone too.

      With XMPP , this problem does not exist. You can have multiple applications connected to your one user address and can chat with friends using whatever device you have handy with you. And all your friends will always recognize you as you. And you can choose to store your chat history on the server and you can see it on any devices and app you connect with.

    3. Chat feedback . With SMS / Text you send a message and… wait. In XMPP, you send a message, you see when it was delivered, you also see when the friend read it and finally you can even see when the friend starts typing response.

    How is it different from Twitter, FB?

    Twitter and Facebook are social networking services. Although you can send a message to other people, these services are not really designed for effective, real-time communication. They are more like publications, where you can post a message, a longer article, photo or just anything for people to see, when they come over to your profile.

    In theory, the XMPP in it’s core can do all that can be done on Twitter and Facebook and also so much more. It’s just a matter of implementing apps that can make use of all the XMPP capabilities.

    The Tigase XMPP Server could serve as a social networking platform out of the box and there already are systems like this. Our focus, however, is on real-time communication, hence our apps are designed as effective messaging clients.

    How is it different from Skype, ICQ, AIM, FB Messenger, iMessage and others big names?

    Ok, so, there are chat / messaging systems available already. They are instant and near real-time. Big brands are behind them they are not going anywhere any time soon. They also offer voice and video calls and all the features and maybe even more.

    How XMPP is different and how Tigase is different and better then?

    First of all XMPP is a public and open standard. So, you know what is under the hood, how it works, you can evaluate if it is secure. You can easily create own tools, apps, servers to connect to the world wide XMPP network. Well, the XMPP by desgin is extensible, so you can easily customize and extend the basic XMPP protocol with more features and capabilities.

    None of this is true for the big name systems.

    You do not really know how your messages are sent and delivered by the big names. How your personal data is handled. Even if you assume, they are big with big pockets, so they can implement secure systems and can take care of your data. There are other important questions: It safe? Who has access to it? Would they sell your profile to third-party?

    XMPP and Tigase for that matter allows you to deploy your own instant communication system, independent from any other, you keep all your data, you control everything, you decide what is allowed, who can communicate with whom. And still while having independent system for your needs, you can communicate with other users who are on XMPP.

    And if you want some extra features, customization, there is no way to have it on the big name systems. You just have to rely on what is there and adjust yourself to what is available.

    How is it different from Slack?

    And again, it all sounds like Slack. So similar in every aspect. Is there any difference?

    Indeed there is. In principle XMPP has all the same features as Slack has. Probably even some more. The main differene is that with XMPP you can choose software vendor (Tigase is one of them but there are many others), deploy your own system, independent which is under your full control, you keep your data and you decide what happens with them.

    • wifi_tethering open_in_new

      This post is public

      tigase.net /tigase-instant-communication/

    • chevron_right

      JMP: Privacy and Threat Modelling

      news.movim.eu / PlanetJabber • 19 September, 2022 • 3 minutes

    One often hears people ask if a product or service is “good for privacy” or if some practice they intend to incorporate is “good enough” for their privacy needs.  The problem with most such questions is that they often lack the necessary context, called a threat model, in order to even begin to understand how to answer them.  Understanding your own threat model (and making any implicit model you carry more explicit to yourself) is one of the most important steps you can take to improve your privacy.

    What is a Threat Model?

    A threat model is a list of possible vulnerabilities, often with attached priorities.  In the context of personal privacy, this includes anyone who you might not want to learn private infomation about you, what private information you most want that party to remain ignorant of, and why.  For example, someone may not want their ISP to learn that they are communicating on LGTBQ+ forums, because their ISP is their school and their school might tell their parents, whom they are not yet ready to tell.  In this example they might say “I don’t want the school to learn” but because of the reasons it may actually be more important to say “I don’t want my parents to learn.”  So the ISP, the school, and the parents all represent potential vulnerabilities, with the parents as the most important.

    Why is a Threat Model Important?

    You cannot protect your privacy unless you know what your are protecting and what you are defending against .  Otherwise you may take extra steps to secure something not worth protecting, omit something you were unaware needed protected, or even protect something at the detriment of something you would have cared more about.  Privacy is not a slider from zero to infinity, you cannot be simply “more” or “less” private in some general abstract way.

    For example, someone may be a part of a group of insurgents in a small country.  They wish the contents of their communication to be kept a secret from the current government if any one of them is found out, so they choose to use an end-to-end encrypted messaging app.  They have prevented their mobile carrier and government from logging their messages!  They also secure their devices with biometrics so they cannot be stolen.  However, due to the unpopularity of this app in their country, when asked the carrier can immediately identify the current location of anyone using it.  When any of these people are brought in for questioning, the investigator forces the biometric (face or fingerprint) onto the device from the person in custody, unlocks it, gets access to all the decrypted messages, and let’s just say the insurgency is over.

    So did the insurgents make “un-private” choices?  No!  For other people with different vulnerabilities, their choices may have been ideal.  But when their identity and current location is more at risk than the content of their messages, sending messages less-encrypted over a more-popular app or protocol (which could have all contents logged for all users, but very likely does not), and deleting them regularly from the local device in case they are caught, would have been more effective.

    Privacy LARPing

    “Privacy LARPing” is what happens when someone wants to be “more private” because it is cool and not because they have any well-reasoned need for privacy.  Believe it or not, this kind of use case also has a threat model.  The model may be more built on what kinds of vulnerabilities are currently trendy to defend against, but it exists nonetheless.  Putting thought and explicit description into your threat model can be a great way to seem even more “with it” so it’s highly recommended.  You may even identify real threats of concern (there certainly are some for everyone) and move beyong the LARP and into addressing your real needs.

    How to Build a Threat Model

    This is really an introspection activity.  Ask yourself what kind of entities are most concerning to you.  Estranged friends or lovers?  The other people at the airport or coffee shop?  Local police?  Local SUV owners?  Federal agencies?  Data brokers?  The list of people who may want to know more about you than you want them to is endless, so revisit your model from time to time.  Try to add to it and refine it.  This kind of work is never “done” because the scope is so vast.  Do talk to others and educate yourself about what the set of possible threats is, but do not take each new threat you learn about with the same weight.  Try to understand whether mitigations or new techniques are able to acheieve what you need, rather than blindly applying every “defense” without regard for context.

    • wifi_tethering open_in_new

      This post is public

      blog.jmp.chat /b/2022-privacy-threat-modelling

    • chevron_right

      Gajim: Gajim 1.5.0 / 1.5.1

      news.movim.eu / PlanetJabber • 19 September, 2022 • 1 minute

    Gajim 1.5.0 and 1.5.1 come with a significant performance boost. Pinned chats can be ordered via drag and drop, message corrections have been improved, and many bugs have been fixed.

    What’s New

    For many years, Gajim’s internal handling of how a chat is loaded and displayed hasn’t changed. Each chat would create a new Control , which would hold the chat banner (name, chat state, etc.), the conversation view (messages), and a message input, including actions and menus. This approach does not scale well, since Gajim’s resource usage would increase with every new chat. With Gajim 1.4, we introduced a new conversation view, which increases the overall number of elements being displayed at the same time. Multiply this by the number of open chats, and you’ll get a lot more elements, which have to be rendered all at once. Due to some GTK theming issues (looking at you, backdrop animation), every focus/defocus of Gajim would lead to a spike in CPU usage.

    To overcome these limitations, we changed Gajim’s fundamentals. The whole chat window with all its elements is now created only once, and then shared between all chats. Gajim just switches each element’s state when switching chats. Due to a drastically reduced amount of elements being loaded, this change alone reduces Gajim’s RAM usage by 20 %. With less elements being rendered at once, the delay ‘from click to action’ is also significantly reduced. In other words: Using Gajim feels more snappy.

    Gajim 1.5

    Gajim 1.5

    More Changes

    New

    • Drag and drop for ordering pinned chats
    • Use Ctrl+Number to switch between workspaces
    • The chat list can now be toggled using a button or Ctrl+R

    Changes

    • Chat command system has been reworked
    • Message corrections are now available from the message menu
    • Windows: Overall text size has been increased
    • Ctrl+F replaces Ctrl+H for opening the search bar
    • Advanced Configuration Editor (ACE): non-default settings are highlighted
    • Syntax highlighting for the XML console’s input
    • IPython support has been removed

    Fixes

    Over 40 issues have been fixed in this release.

    Due to a bug found shortly after releasing Gajim 1.5.0, it was necessary to release Gajim 1.5.1.

    Have a look at the changelog for the complete list.

    Gajim

    As always, don’t hesitate to contact us at gajim@conference.gajim.org or open an issue on our Gitlab .

    • wifi_tethering open_in_new

      This post is public

      gajim.org /post/2022-09-19-gajim-1.5.0-released/