Yeah is closing, there are a lot for example jabber.at jabber.no jabber.cz chatme.im evil.im and so on (openmailbox accounts also are capable to use xmpp chat as I knew before)

it was never a good server.
the owner of trashserver.net from germany really loves his server and takes much care, maybe consider this one.

also maybe think about using something modern instead, a cool thing is also https://matrix.org/

What do you think about movim.eu for a server?

I can recommend creep.im. It is fully compatible with #omemo encryption and the modern standards used by #conversations xmpp client. https://creep.im/

https://account.conversations.im/ - it's not free as in beer, costs a few euros after a trial period, but very well maintained, and run by the creator of Conversations (the best Android client).

https://www.calyxinstitute.org/projects/public_jabber_xmpp_server is another good one.

Oh, and I run my own at hactrn.ch

yax.im

Openmailbox.org gives you e-mail without ads, OwnClowd and XMPP. They just ask for donations.

Check out this:
https://gultsch.de/compliance.html

@Tedel nice!! I didn't know about it :)

mailbox.org gives offers a privacy focused email service. jabber address on the mailbox.org jabber server is included. email address=jabber address. costs: 1 Euro per month for email and jabber service together.
mailbox.org is said to be the most secure email service in Germany (along with posteo.de)

btw: Why not using your diaspora address as jabber address, too. As far As I know most pods offer this possibility. At sechat.org my diaspora id is my jabber address, too. Jabber server is just sechat.org (same as the diaspora pod)

Riseup email includes XMPP. https://www.riseup.net/en/chat And Riseup changed their policy for getting a riseup account recently. You only need one invite from someone, not two invites.

That's great to know! I want to keep my email address separate from the XMPP, which is why I never used their XMPP service. The invitation thing is great, though!

Yes, indeed, good point. I also didn't like to use Riseup email and XMPP at the same time, so I did choose for a jabber account here : https://www.systemli.org/en/index.html You need to sign up via web (XMPP client sign up not possible). I also have an account at https://otr.im/ but very few friends use XMPP, so I'm lately focusing on Matrix, diaspora, Signal and email for communication. Perhaps this list of independent servers could give you some more ideas as well, though YMMV : https://riseup.net/en/security/resources/radical-servers

again my question: why you are not simply using your diaspora id for jabber as jabber / xmpp is integrated at most of the diaspora pods now?

wk3 seems not to have XMPP.

I'm used to separate diaspora from XMPP because wk3 didn't use to have XMPP since I first logged in, and because my password changed. Also, I like to keep some services separated.

ah, ok.

#Disroot ofcourse and you should think of upgrading to #matrix

What's so much better about matrix?

Matrix and Mastodon are the current hype in the last half year or so. The cool thing about Matrix is that it is like a spider web which can connect to IRC, XMPP, Telegram and more in the future (like e.g. Skype). Note that Matrix is still in heavy development, just like Mastodon is. But both Matrix and Mastodon attract a lot of users. (For private chat with some friends I still prefer Tox and XMPP and crypto email). Matrix offers text chat, voice chat, video chat, and can do room encryption. End to end encryption works but is in beta. See http://matrix.org and http://riot.im

I would doubt that matrix is so much better. Yes, it is open source. But in the background it is financed by big multinational corporations like Amdocs. I would not trust them or leave my pirvate communication in their hands. Instead I prefer true free and open solutions like xmpp with #conversations and #omemo

I see. People often recommend me Matrix because there's a big community there, I bet.
Like, movim almost look like it's abandoned.

I tried Movim, as user, and also installed it on a server (A few friends asked me for easy and secure chat options). Movim looks like a cool project, really nice website design, but I was not very enthusiastic about using it. The web user interface was not that intuitive, a bit confusing, and I did not manage to make my friends use it easily, so I stopped using Movim :( A bit of a pity, as I like the concept of chat + blog, and the XMPP option.

@hyperion That is also one thing I worry about with Matrix, the Amdocs connection. And I like XMPP in general. And OMEMO is really nice (OTR is so cumbersome) but there's still few people using it.

have you tried the #conversations client already? It works wonderfull with omemo.

Yes, I really like Conversations. Great app, and nice server options, and active development. A bit of a pity that user status is off by default, but found out how to enable it.

:)

I've also tested Gajim and Conversations, that worked fine. Nice website to see OMEMO dev for apps : https://omemo.top/ Unfortunately I cannot get my friends to use XMPP a lot. It turns out that it is easier to talk with them via Tox and Signal and crypto mail, including the non-geek ones ! I bet it would be easier if more XMPP applications would support OMEMO well.

yes, I use both, conversations and gajim with omemo. I convinced some good friends and family members at least. Only think I miss with gajim at the moment is that file transfer is not working between gajim and conversations.

I don't really know OMEMO. How is OTR cumbersome, compared to OMEMO?

@hyperion Nice that you got them convinced :) I don't use file transfer with XMPP but good to know it is not working yet.

What’s so much better about matrix?

Matrix is like your version 2 of XMPP. XMPP is also catching up but you can have your own matrix server in 5 minutes federate with other Matrix servers.

Some points are

• Video and voice calls via WebRTC
• Nice group chat interface with markdown and emoji
• Ability to remember history and point to "seen" notice.

If you are into groups you will like it a lot. All the issues with MUC multi user chat are solved with matrix.

Here is an android client #Riot https://f-droid.org/repository/browse/?fdfilter=riot&fdid=im.vector.alpha and before someone calls it centralised. Please change the server address and you dont need to use matrix dot org.

But in the background it is financed by big multinational corporations like Amdocs.

I have met the Matrix guys at #FOSDEM personally and the whole intention there is to be as open as possible and decentralise as much as possible. The whole intention was the roadmap to decentralisation. If you have heard the tone you can trust the guys. I hang out in the dev channels at matrix and report bugs. Its a very transparent open source software with complete openness in the development. I dont see any amdocs involvement.

@ yellofrog: with file transfer the only problem is gajim. File /image transfer between two or more people using #conversations works very good and without any problems.

@Bebel Bebel I've tested chat options with a few friends. For XMPP we've tested Conversations, Chatsecure, Xabber on the phone, and Jitsi, Pidgin, Gajim on desktops. Each time one of use would switch devices we would have to do the OTR ritual again. That is fine if we meet in real life, but when friends are far away, then we would have to exchange OTR questions/answers over crypto email for example each time. The idea of OMEMO is to make it much easier/faster compared to OTR to start encrypted chat with XMPP. The author of OMEMO is the Conversations.im core developer. See also : https://conversations.im/omemo/ and https://en.wikipedia.org/wiki/OMEMO

@ Bebel Bebel: you asked about the difference between otr and omemo: Most important difference is that omemo works with offline messages, means you can write a person even when she or he is not online. With otr ennvryption this was not possible. But have a look here for a comparison: https://conversations.im/omemo/

Instead I prefer true free and open solutions like xmpp with #conversations and #omemo

Matrix is the open source one here and its truely free and open. Try it once. Run the android client. Its quite good. Look at the bonus you grt out of Matrix.

• Bridges

@Pavi Nice to hear about that real life experience. I will probably feel more safe with Matrix if things like this will be there in the future : 1) Matrix finally gets a privacy policy (At least riot.im has one now) 2) gets the non-profit org. in the UK up and running 3) Moves matrix.org and other servers away from Amdocs and that other company servers 4) Matrix code allows self-hosted identity servers to be used. 5) open source JS code is used unlike now with vector.im

Guess what the FOSDEM talk started with?

We need to get rid of vector dot im identity server dependency

^^ Thats the lead dev attitude and its not needed if you dont use email or phone number as far as I know.

Veeeeeeeeeeeeeeery interesting!! :D

Veeeeeeeeeeeeeeery interesting!! :D

It is the most happening thing for communication in the free software world. We already have moved our Free software community of India from xmpp to matrix. Also other communities and organisations are planning. Bridging with IRC makes it very convenient.

• Adding to the bridge with IRC you can either make your room a bi directional bridge if you have ops to IRC
• Or you can just use Matrix as your IRC bouncer to maintain your presence in an IRC room.

I have uninstalled quassel daemon which was my bouncer for IRC.

@pavi That attitude is nice, but I rather see code and implementation done/visible. And I do appreciate it that matrix.org mentioned having no privacy policy in the FAQ, but why ... does it take them so long to arrange that. A little bit weird. Anyway, I do find Matrix exciting to use so far (Just like Mastodon and Nextcloud).

So... should XMPP be deprecated to Matrix?

@Bebel Bebel In my opinion no. XMPP+OMEMO is cool and XMPP has years of existence and many client software is available. I suggest to just try Matrix to see if you like it (and do realize Matrix is still in heavy development). I learned a lot about computers and phones in Matrix chat rooms in the last few weeks (nice!), but I still prefer private chatting with Tox, Signal, XMPP, self-hosted chat, and email with friends and colleagues.

And I do appreciate it that matrix.org mentioned having no privacy policy in the FAQ, but why

Why are you so concerned about a website? YOu have the source on github run it at your place. Same answer for Riot. If they are hosting it its up to them.

Look at it like the Fedora situation. Its being hosted by RH. If you expect it to be like Debian hosted by SPI or GNU/FSF its another fight totally.

I stopped using XMPP after coming to matrix. Maybe I will use it, I prefer email with PGP for detailed and secure mail.

Read http://matrix.org/docs/guides/faq.html#what-is-the-difference-between-matrix-and-xmpp it has proper clarity on what the difference is.

pavi: matrix.org and vector.im are the only two mentioned ID-servers according to current Matrix documentation. In general : if I fill in personal information to sign up at a website I like to see their TOS, Privacy Policy. Currently every Matrix user is dependent on those two ID-servers. Without it there's no communication possible. What happens if my friends fill in email address and phone number during sign up at e.g. matrix.org ? People have the right to know about Privacy Policy when signing up for a service.

Currently every Matrix user is dependent on those two ID-servers.

Yes I agree about the id servers and thats why I mentioned about it at FOSDEM. They should be replaced for sure. And again you also realise that without email and phone we dont need those id servers.

I really trust the #matrix devs, here is a reply to our discussion.

@pavi, nice that you asked, but why tell others to use a product which is not finished yet ? With XMPP people are really independent, and XMPP exists since many many years. It is also not very difficult to set up a self-hosted XMPP server with OMEMO enabled. I've tested it a few months ago, and that worked fine. I personally prefer to wait and see how Matrix develops before burning all ships, and bet on one horse.

before burning all ships, and bet on one horse.

Not my intention. Matrix is an upgrade. I understand for some these things you highlighted above are very very crucial. But the benefits are there and you and me obviously know them very well.

Finally to conclude I would also say Matrix is not perfect but its getting there. Have a look at it, its definitely worth the little time you take for creating the account and visiting the website/app.

Some of my friends do find privacy/security very important. When showing them Matrix I felt bad to tell them that their phone devices and browser info is stored, and that they should not sign up including email address because things are unclear when it comes to privacy policy, and that Amdoc does advanced business with metadata. Try a search for "amdocs spy".

@ yellofrog +1 for the very same reasons I prefer xmpp, too

For me, Matrix looks like another (not to underestimate it) social media to know and blend in :) Looks good to me.

"Not being complete" does not concern me... I wish I could gather money to pay devs, and hopefully they can spend more time on it.

I can't read the code so well, so I can't tell by myself if they are secure or not. Fortunately I have friends I trust (who I saw what they can do) to tell me this stuff, but many doesn't, and I question how are the rest of people to trust such things. (Better than trusting Google or Facebook, am I right?)

@pavi i guess if you talk to Telegram devs about privacy, they will be nice to you too and say something like "hey you can trust us". If your trust is based on that, it is just a naive feeling.

But the fact is riot opens a connection to matrix.org without asking and without any notification. Then it uses vector.im as a central Identity Server by default.
In consideration to the relationship of matrix and Amdocs, I am at least about riot and matrix and would wait for another Client or riot to change that behavior.

*at least worried

I do realise that I would sound too stupid when I say I trust them but it was something I felt personally and in their interactions. The code is opensource for gods sake. And even for the vector dot im thing the dev clearly is looking for someone to code those things. If a pull request is rejected then my trust would be lost and we can give a -ve karma point for Matthew and others. Sorry if I trust easily.

@hyperion

Only think I miss with gajim at the moment is that file transfer is not working between gajim and conversations.

Indeed it does in both ways. Beside the #OMEMO Plugin you need #UrlImagePreview Plugin to be able to see received images. For sending the #HttpUpload Plugin can be used with OMEMO. Just tested it again successfully.
Check the #Gajim Wiki.

@pavi
Do you know #Google #Analytics? Did you know #Riot uses Google Analytics?

import com.google.android.gms.analytics.GoogleAnalytics;
import com.google.android.gms.analytics.Tracker;

You see, even if anything is #OpenSource that doesn't guarantee #privacy. Services using Google Analytics either doesn't know about their using it or lack of privacy awareness. In my opinion they loose believability when talking about privacy or security.

I really wonder why, #F-Droid doesn't warn about that. It is not hidden at all, they should have seen it. In other cases they warn if an app is #tracking.

Did you know #Riot uses Google Analytics?

No I didn't observe that. I dont use the android app. But its ugly as hell. It must be forked.

https://github.com/vector-im/riot-web/issues/2075

• Removed Google analytics and made it opt only.

Android issue to remove it https://github.com/vector-im/riot-android/issues/61

Ah ok. you have an iPhone or you just don't use the app because of that? Good to see they removed it on the web edition.

Ok thanks, looking forward for a “clean” Riot Version. Unfortunately the issue is from March 2016 and still they didn't remove it =(

Ah ok. you have an iPhone or you just don’t use the app because of that? Good to see they removed it on the web edition.

Sorry I dont trust phones with their ability to control javascript and tracking. Iphone is a walled garden, its offtopic for me in phone world.

Unfortunately the issue is from March 2016 and still they didn’t remove it =(

https://github.com/vector-im/riot-android/commit/ce1f6974c51a5092c3f225cf0fe2f43e336f032c

^^ They added settings to disable google analytics.

Maybe but you can’t open the settings before you didn’t setup an account. So first of all you have to provide some data to be able to disable it. Can't tell about the content yet.
Also just saw that it is removed in the F-Droid Version, that is why F-Droid doesn’t give a warning. But still there is the initial transmission.

I gather Matrix need a better service provider/server, is that right?

You can find some public providers at
https://www.hello-matrix.net/public_servers.php
Via #Webkoll you can check if the provider is using Analytics, other trackers or not.
I just bother about Riot:
* using vector.im as central Identity Server since it is not good if all userdata is in control of one hand.
* using Google Analytic in the PlayStore Version which is probably not clear to most users.
* Connecting matrix.org after (first) startup without asking or notifying the user.

using vector.im as central Identity Server

Please dont give the matrix server email address or phone number that way id server will not be used.

Also just saw that it is removed in the F-Droid Version

Maybe thats why I didn't notice it. I always suggest people to use fdroid version. The google play store version also uses GCM

The google play store version also uses GCM

Well thats not the problem I think since you can’t avoid GCM if you you have GAPPS installed. Also there are some benefits by the use of GCM. If you don’t want to use GCM you have to remove Google Apps.
But it is not obvious to a normal user that Riot is tracking with Google Analytics.

If you don’t want to use GCM you have to remove Google Apps.

Ofcourse If I have an android I will use cyanogenmod and not even touch GCM. You talk a lot about privacy and GCM is no problem? I am surprised. Any http request going to google servers is enough to track you.

I personally would throw the whole android on a sandbox. Check for outgoing requests and block any thing to google via hosts file.

I think this discussion is going pretty well, and it's pretty damn interesting to see such discussion by people who know their stuff. But, please refrain from ad hominem fallacy. It's an habit of us all, no exceptions, to resort to ad hominem, and I'm sure everyone wants to keep this discussion as healthy as possible, towards knowledge and comprehension.

I am learning a lot from this discussion, and I am sure this can be refered to in the future :)

Any http request going to google servers is enough to track you.

You missunderstand me. I personally don't use Google Services at all.
What I wanted to say is that a user that has Google Services installed, possibly heard about GCM or at least has the Idea that Google is doing some stuff in the background. GCM can increase battery lifetime.

But if a user is ok with Google tracking him, that doesn't include he is ok with any app installed from PlayStore tracking him.

I personally would throw the whole android on a sandbox. Check for outgoing requests and block any thing to google via hosts file.

You can do that with #AFWall+ from F-Droid too with a custom script like this by michaelmgl.

@​Bebel oh i don't feel attacked and I don't think I attack piva personally. We're just discussing =)

@Bebel : Its normal to get personal if thats what you meant by "Ad hominem fallacy". yes the discussions can also continue very formally but there is no spice in it 😛

You can do that with #AFWall+ from F-Droid too with a custom script like this by michaelmgl.

Yes I was looking at it. Its a good thing to have. How about sending everything via #TOR ?

But if a user is ok with Google tracking him, that doesn’t include he is ok with any app installed from PlayStore tracking him.

Lesser evil vs Bigger evil. Anyways I am against both of them tracking. I also suggest people who install riot to do the extra step of install fdroid and then install riot.

I also suggest people who install riot to do the extra step of install fdroid and then install riot.

But don't forget to tell them to disable Unknown Source after installing and updating apps again except they can make F-Droid a system app or enable privileged extensions.

disable Unknown Source after installing and updating apps again except they can make F-Droid a system app

What is that? can you explain more?

I think this discussion is already going too far^^. You may start a private conversation or via #XMPP muto@despora.de

(Off-topic again, sorry! But sorry if I called something out when nothing was going on! At least in Brazil, shit gets really nasty at this point, which is why I wanted to prevent such things. It's rare to see mature people discussing, that's all q: )

Noooooo continue the discussion here! :P

/me misses those days of mailing list flame wars.

Nowadays everyone is too polite and its boring. Also if someone is too polite or formal it indicates lack of passion and it gets boring.

@Muto Making F-droid a system app does seem to only apply to really older Android OS installs. I think the two apps in F-droid to make F-droid a system app (and therefore not needing to enable "unknown sources" in the settings) did not work for me on Android 7.x and Android 6.x (I think both apps refused to be installed or smth, warning about Android version).

pavi: too polite, too formal might be your perception, but I do dislike too hostile attitudes myself :) (e.g. I used to be a fan of Linus Torvalds many years ago, he had nice and witty humor, but now he turned into an acid person). Example : I have a colleague who likes to discuss like crazy and always wants the last say ... I find that boring and tiring :)

@Bebel if your interested in these topics you can follow certain tags mentioned in this discussion. There are more people familiar with it than just the two of us.
Also I already have to scroll a lot if we continue discussing all related topics here… O_o

@yellowfrog, yes since Android 7 it is not possible anymore (yet), pls open a new conversation for that