Jami: GNU end-to-end encrypted alternative to Zoom and Jitsi | Hacker News Reader

Jami: GNU end-to-end encrypted alternative to Zoom and Jitsi

git.jami.net

286 pointssurround75 comments

In comparison to Zoom and Jitsi:

Jami’s major advantages are that it’s end-to-end encrypted and completely peer-to-peer, requiring no server in-between.

The major disadvantage is that it doesn’t support calls from the browser.

Not running in the browser is a major downside. I've used Jitsi this past week with technologically illiterate family members, and being able to just have them enter a URL while talking on the phone is really great.

Also, being able to just use any OS with a modern browser you please.

Personally I don’t want to have my web browser run applications, I’d rather have native MacOS or Linux apps, but I do see how having at least a version of it available in a browse is handy for potability.

Don't get me wrong: I want both to be possible, but being able to just get up and go is really helpful.

For a tool like this though I'm not sure what a native app would add. Most of what it does builds on the functionality of a modern web browser.

Modern Web browser don't allow true peer-to-peer, you always need a server.

Jami uses a fully distributed network (DHT) to initiate connections.

Webtorrent is a thing though. Is it not true peer-to-peer?

webtorrent builds on webrtc, which requires stun and ice servers. so you still send metadata to defined servers for connection handeling and most sadly you can't p2p in an offline LAN.

> so you still send metadata to defined servers for connection handeling

This is also true for typical p2p protocols though, isn't it? Normal torrent clients for example have hardcoded servers to start their dht search from.

Not necessarily. It does follow that if you submit to a tracker, but there's the DHT option which is advertised locally [0]. The way it seems to do it is the magnet uri includes the contents of a few IPs that might have, at minimum, a more up-to-date DHT with more IPs. At best it also includes some chunks of whatever you're trying to download.

[0]: https://stackoverflow.com/questions/1332107/how-does-dht-in-...

https://superuser.com/questions/592238/ does not seem to agree with that statement.

Something interesting is that Jami seems to be the only video conferencing app available on Android TV, very useful.

> doesn’t support calls from the browser

This is a feature, not a bug.

Still not an "alternative" for some people when browser-based might be the main feature. It's complicated.

Looks like GNU Ring changed its name to Jami.

Also, I already have an GNU Ring account saved in my password manager but can't seem to login (or even find a place to). However, if I try to create a new account using my old username it (correctly) states it is taken.

I'm having the same issue. Previously created an account, and I'm completely puzzled how to now log in to it! Seem to have options to create a new account or import a backup..

Interesting, I haven't tried Jami. If I am understanding it correctly it seems to provide calling features, which Zoom and other typical video conferencing type applications don't.

I'll also through Jitsi out there as a very capable FLOSS alternative to Zoom. If you tried it a few years ago it's changed dramatically in the last while. It's now WebRTC based and runs in browser without any download. It's not quite end to end encryption because the stream needs to be decoded on the server before being re-encoded for the other clients, but since you can easily self host it on a cheap VM I find this acceptable.

Jitsi does not re-encode video streams on the server, it's a SFU (selective forwarding unit) and just forwards (some) video streams to the other participators. When Simulcast is enabled, multiple resolutions of your video are streamed to the Jitsi server and it only sends those streams to clients which they asked for (participants can choose the quality of video they receive, in the UI)

Can’t WebRTC support peer-to-peer video calls without running the stream through a server? I have vague recollection that it can but am not particularly familiar with the protocol.

To answer my own question: Yes, WebRTC supports peer-to-peer video calls but does require a “signaling server” to help establish and close the peer-to-peer connection. [1]

[1]: https://www.html5rocks.com/tutorials/webrtc/basics/ "Getting Started With WebRTC"

The signaling server is only useful for the connection initialization though, and it never has access to the video stream, only to metadata (like your IP address, the supported encodings of each party, etc.). And it doesn't even really need to access them: it just needs to forward them from one peer to another, so it could be end to end encrypted.

It also needs one or several STUN servers as part of the hole punching scheme, but this one doesn't even exchange anything with anyone, so there aren't many issues here (and you don't need to roll your own: you can use Google's one)

It does, but when the number of users is >2, typically you will go through a TURN server.

TURN doesn't have anything to do with number of participants; it's there for when NAT hole-punching completely fails and you need a relay. TURN is application-protocol agnostic and just forwards packets; it does not need to decrypt whatever it's relaying. Now, one could run a malicious TURN server that MitMs connections, but I'm not sure how obvious that would be to the end-parties.

For more than two users, you mainly have three options:

* MCU (Multipoint Control Unit), which IIRC does need to decrypt your video, as it will post-process it and possibly re-encode it to send a single stream to the other participants.

* SFU (Selective Forwarding Unit), which in theory doesn't need to decrypt your video, but does need some metadata about it in order to make smart decisions as to what streams to forward to whom (for example, forwarding only the stream of the person who is talking). In practice, I believe some (many?) SFUs will do decryption, thought it's not a strict requirement.

* Dumb peer-to-peer-to-peer-to-... multi-forwarding. You can of course theoretically stream your video to each other participant, and they can all do the same, but that quickly fails to scale. It might be ok for three, maybe four participants, but even then there will likely be problems.

This used to be called GNU Ring. Wikipedia has some info on features: https://en.wikipedia.org/wiki/Jami_(software)

I'd be really curious if this is a viable option for videoconferencing for say >10 people.

I'd really be interested in this as well! As Jitsi for example isn't really able to handle many participants apparently: https://community.jitsi.org/t/maximum-number-of-participants...

I've used this while trying to find open source video conferencing solutions and chat applications in the past. It spends significant amounts of time not finding my friends before timing out.

As an aside, I don't believe in the virtues of P2P anymore. It's clear to me that centralised systems scale further and faster, and what we need are benign organisations to run them. Legal forms like cooperatives and community benefit societies (nonprofits in the US I guess) are the way forward. I'd choose a community instance of Jitsi as being the best approximation of this for now.

I share your interest in cooperatives, but not all cooperatives are equal. If we expect cooperatives to provide public interest services that might otherwise be P2P or nonprofit, I think we need a special kind of cooperative.

I belong to cooperatives that are politically partisan, that engage in sharp practice, and that aren't as democratic as I'd like. I'd prefer cooperatives to concentrate on treating stakeholders fairly, representing members equally and effectively, and prudent stewardship of their assets.

Cooperatives might lose their focus on their main purposes and discourage some non-progressives from becoming members/customers by pursuing too wide a range of progressive causes.

In the UK we have a legal form called a community interest company. This, owned by a co-op, would probably be the right form.

Everything has a cost. On the long term, who will pay and maintain the Jitsi server ? How will random people find a trustworthy server ? Jami doesn't need a server.

Honestly, people will pay. They pay for Wikipedia, it is odd that you think they wouldn't pay for something as useful as this.

The marketing website itself seems to be a better resource for information: https://jami.net

> end-to-end encrypted

O RLY?

https://git.jami.net/savoirfairelinux/ring-client-android/is...

https://security.stackexchange.com/a/171461/43688

I looked through their code to see where data is being encrypted/decrypted, and was unable to locate it.

Since their issue indicated they use 4096-bit RSA, I really wanted to see if they were vulnerable to Bleichenbacher's 1998 padding oracle attack.

https://git.jami.net/savoirfairelinux/ring-project/wikis/tec...

> The SHA-1 fingerprint (160-bits) of this public certificate is the JamiId.

this-is-fine.mp4

> > The SHA-1 fingerprint (160-bits) of this public certificate is the JamiId.

I do not see any issue with this.

Probably related to this https://shattered.io/

The code you were looking for is in the OpenDHT project, which simply calls GnuTLS's gnutls_pubkey_encrypt_data(), which is PKCS1v15. OpenDHT doesn't do anything special with errors from decryption. You'd have to actually set up a test environment to say it was vulnerable with any confidence, though.

Thanks Thomas!

Maybe it got better, but for the past 6 months a friend and I tried to get this app to work with little success. The messages just DONT FREAKING SEND in a timely manner even when in the same room.

Right now we use Briar and are pretty happy with it. There's also signal as a better option.

Either way, IMO, Jami sucks.

I haven't tried it myself, but I saw https://wire.com/ linked as an open-source E2E-encrypted alternative during a few of the Zoom articles that have been posted these past few days. I'd love to see if anyone here has any experience self-hosting it, and whether it matches up performance/usability-wise.

Note that Wire only supports video conferences for up to 4 parties.

https://support.wire.com/hc/en-us/articles/360001019225-Star...

Just realised this is Ring . Wonder why they changed their name

Possibly to avoid confusion with the company that makes doorbells.

Not to be confused with Amazon Ring maybe?

C/C++ implemented custom protocols, no webrtc... What explains these security and compatibility compromises?

I'd guess that it predates webrtc.

The first commit was in late 2004, which was well before WebRTC was a thing.

Aside from the anachronism, didn't WebRTC itself have security issues?

Jami uses standard protocols like TLS, x509, SIP, SRTP..

It's actually much more standard-compliant than most alternatives.

I tried Jami recently and it just doesn't work, I think it has problems with punching through NAT and routing.

I would love to see a messenger/audio call/video call app built on the zerotier SDK, I never had connection problems with zerotier.

Originally discussed here 9 months ago:

https://news.ycombinator.com/item?id=20311324

I just installed on a Debian 10 machine, then on my old Android 6.0.1 junk tablet. No problems on the PC, while the Android one always crashes when attempting to pair with the PC by pointing the camera at the QR code, and adding manually the exported account on the network hangs indefinitely on the "adding account" window.

Not a big issue since I don't carry the tablet around, just to let the developers know if they read here.

> just to let the developers know if they read here.

Or, raise the issue with them for investigation, since a comment on an unrelated site isn't a reasonable way to provide feedback

But it was most convenient for the user. Maybe it's equally fair to lecture developers on reasonable ways to collect feedback.

I didn't lecture anyone. What did you find inconvenient about the existing methods of contact?

Obligatory: has anyone used this before?

Never even heard of it.

This has been around for a while. Why isn't it in the Ubuntu repository?

That's strange. It shows up in Debian. Maybe they set up the old Ring to act as a transitional package?

It's there in 19.10

Ah. Running 18.04 LTS here.

Does anyone find these names a bit weird?

What happened to 80's glorious days where company and product names were super cool.

  - DynaMax
  - Ultron
  - Trinitron
  - Hypersystems
  - Logicore
  - Supra
  - Intertech
  - UniversalSystems
  - NationalTech
  - Automark
  - Spectra
  - Pentatype
  - PolyMatrix
  - MicroSpace
  - RotoCore

Now we have things such as Flikr, Waymo, Skype, Jitsi and this thing... Jamo or Jami. :-/ Human race is regressing.

For people to be able to find you on the Internet, you need a Googlable name that has nothing else associated with it.

That's true, otherwise it gets drowned in the noise. I guess, I was just commenting on the general trend of the way we name things today.

“Jami is inspired by a Swahili word that means “community”. The name was chosen as it reflects the vision: to be a service open to all, to be community supported, and to respect the privacy of users.” - https://jami.net/help/

Why does a product name have to have a "meaning" behind it? Kodachrome was abstract.

It doesn't have to. But it can. This is an example of that.

The shorter your name is, the easier it is to find unintended connotations or outright obscene meanings in different languages – and now because your product is global, you just can't localize its name for foreign markets like Mitsubishi had to do with Pajero in Spain.

Kodachrome wasn't abstract. It was Kodak's color film, and thus a pseudo-portmanteau of "Kodak" and "chroma" (i.e. color).

I'm sure there are meanings behind a lot of the other names you listed, too.

How about Kodak? I am sure there are many names that are abstract.

From https://petapixel.com/2011/08/03/origin-and-evolution-of-kod...

> The letter “K” had been a favorite of Eastman’s, he is quoted as saying, “it seems a strong, incisive sort of letter.” He and his mother devised the name Kodak with an anagram set. He said that there were three principal concepts he used in creating the name: it should be short, one cannot mispronounce it, and it could not resemble anything or be associated with anything but Kodak

Because nowadays you are selling a lifestyle and experience rather than a product, and being "woke" gives you bonus points for no additional costs.

Wait until you find out what Ubuntu means.

You bet their marketing guys had a background story then just like they have now.

Like many things '80s, it went way "Over the Top".

(For reference, that's Foobar2000 over there rolling its eyes...)

Ok stop with the E2EE encrypted. Literally if you're running your own hardware, you don't "Need" E2E. You need to understand your attack surface, your vulnerabilities, and your goals. E2EE is not the optimal use case for everyone and everything.

- Zoom does not support self-hosting

- Self-hosting Jitsi is not the optimal use case for everyone.

People are free to choose between Jami and Jitsi, and it’s great to be able to have different options based upon your use case.

Most importantly, these one-click-join services are easily accessible by everyone* with a web browser, so switching service providers is a breeze.

I could use clarification on this. Lets start with the assumption that I have my own machine/router/cable modem....and I want to talk with my girlfriend, who also uses one of my machines/routers/cable modems that I spec'd, procured, set up, and administrate for her.

Would I be wrong to be concerned about the potential for contractors to review private video that was captured/re transmitted by the central servers, e.g. for machine learning training purposes or other "internal" service quality checks? And potentially capturing some of that video if they find it interesting and potentially sharing it anonymously on viral social media? It seems that would be a rare occurrence, but possible.

Would end-to-end encryption be an appropriate way to eliminate that risk?

Reply on news.ycombinator.com