Hacker News Reader

Comment by edhelas | Hacker News Reader

Like... XMPP ?

IETF standard, massivelly used (video-games https://xmpp.org/uses/gaming/, IM https://xmpp.org/uses/instant-messaging/, social...), modern features, managed by a fundation with a good ecosystem and plenty of alive projects: https://xmpp.org/software/ .

Yes its not perfect, yes there's still things to improve, but the clients are there, working, on many platforms. The server-S (yes several of them!) as well, they can scale, they can adapt to many use cases.

Matrix did a few things better than XMPP (the Spaces/Servers things, that XMPP is still figuring out), but for most of the rest... well.

Oh and there's also many bridges on XMPP, maintained by different projects, and they don't need 100K$ to stay alive :)

View on HN

XMPP in its current state is a mess. The bare protocol is minimal, the things which actually make the thing usable are just a bunch of extensions, barely glued onto the thing, which means that there are clients that implement different features, and you never know if whatever you send will be supported by the receiver (including encryption).

There are a gazillion clients for Android, mostly forks of Conversations implementing slightly different extensions, but like the upstream they fail at being enjoyable to use. I have not found a decent desktop client as of my last attempt.

I seriously think that XMPP is one of the best examples of why the "write protocols, not apps" approach has failed. Without an actual, complete and cohesive reference implementation, that others follow with theirs, there will always be a fragmentation like this, which will always ruin any attempt at mainstream adoption.

Matrix isn't particularly better though; its main spec does "have" a bunch of things, sure, but they're still very bodged together (threads are replies but with a tag of "no, this is actually a thread"; and for backwards-compatibility clients are "supposed to" understand a non-marked-as-thread reply as being in the thread, but the spec doesn't facilitate any way to consistently reason about such replies (i.e. they're not included when paging through the threads messages); all formatting-ful messages contain both a HTML and plain-text version of the message; edit events contain both "* "-prepended versions of the body for clients who don't support edits, and a "proper" copy for those that do, so that's 4 copies of the body in an edit event).

And there's plenty of inconsistencies across matrix clients too: some don't support displaying spoilers and so get spoiled (incl. Element X android); most (incl. Element) don't have a way to send spoilers outside of whole-message spoilers or manually writing out the HTML. Thread support is flakey. Some clients insert a newline every 70-or-whatever chars, which is supposed to be ignored by proper HTML parsing, but some things don't. Off the top of my head.

Threads are an anti-feature to me. The only time I found them remotely useful is when I was doing an AI bot integration into the Matrix channel and it was just me and the bot.

I don't imagine using them much either even if they were feasible to use (I have the extra trouble of being primarily in a community that's bridged to discord, but the bridge doesn't bridge threads), but I've seen them used meaningfully in other discords for tangential/off-topic discussions.

XMPP had its run and is dead, replaced by Matrix. Every single contact I've had on XMPP has migrated away from it.

Anyone telling me "actually nvm, I'm switching from Matrix to XMPP again" won't get me to replace the chat app that I keep just for this one person plus 2-3 others with another experimental, broken, soon to be replaced chat app, they'll get a link to Signal and an invite to send me a letter if they don't want to use that.

Matrix seems reasonably usable for 1:1 channels at least, and I've also successfully used it for groups, including ones bridged to discord and IRC.

XMPP isn't dead, but think what you like. More and more people have been adopting it. "experimental, broken", that's not really how I describe software that's been in use since 2004 ( https://en.wikipedia.org/wiki/Gajim / https://en.wikipedia.org/wiki/Pidgin_(software) ), 2014 ( https://en.wikipedia.org/wiki/Conversations_(software) ) etc. If you want to describe something as experimental or broken just take a look at Element, which has never once been what I would describe as "polished".

As I said - every single of my chat-app-militant contacts has migrated from XMPP (which they pushed early and aggressively) to Matrix, which includes groups like hacker spaces etc. (at least the ones that didn't just give up and migrate to closed solutions).

I literally have no single person to talk to on XMPP. The software names you mention all trigger flashbacks of horrible experiences, with my last experience even worse than my recent experience with Element, and unless they have been rewritten from scratch, I wouldn't be willing to install them again. At least I can run Element in a browser tab where it can't pwn my system...

There seem to be three incompatible standards for e2ee on XMPP, the latest being https://xmpp.org/extensions/xep-0384.html which is marked "experimental". I've never seen OpenPGP used, OTR was a compatibility nightmare, and I think by the time OMEMO started to be a thing XMPP started to stop being a thing.

OMEMO is the only E2EE standard to use now (I mean, barring occasional outliers, but OMEMO is the norm). That's cool, I'm talking to people on XMPP every day with people who have zero intention of moving unless something better (by their definition) comes along. XMPP seems to be gaining popularity as one of the last possible options for a genuinely decentralized encrypted chat protocol that isn't beholden to a singular closed org/corp. I just personally onboarded like five people and they're all like "this is awesome" and.... wait, did you just say "at least I can run this in a browser tab where it can't pwn my system"? Please search "browser exploit rce" on your favorite search engine. Here's one from two weeks ago: https://windowsforum.com/threads/cve-2025-21279-remote-code-...

I used to have a couple 1:1 Matrix chats with friends where I was trying to bridge the whole "different OS" issue for E2EE chat. Neither of them use Matrix anymore, and we were all having issues with Signal (my account is still b0rked). It was just too much hassle. So I mean, the anecdotes go both ways here.

I'm a fan and active user of XMPP. However, it unfortunately is true that encryption is a can of worms. OMEMO should be the standard, yet there is fragmentation in terms of the specific OMEMO spec version that clients use. Not even the most prominent clients keep up with the latest spec, as can be seen here [1]. One of the issues is, that everything prior to 0.4.0 uses AES-128-GCM, instead of the standard that is used by other platforms (eg Signal), that is AES-256-CBC with HMAC-SHA-256. In plain English this means that most mainstream XMPP clients do not offer encryption at a level that can and should be expected these days.

[1]: https://xmpp.org/extensions/#xep-0384-implementations

Browser sandbox escape to userspace exploits are still much harder to make though, compared to... uh.. a userspace to userspace exploit, given that the latter takes literally (actually literally) zero effort, and as such you don't have one every couple weeks, but rather an ∞ of new exploits per second.

(that said, a web-based client has the aspect that an exploit could be inserted at any point with only a page restart necessary, whereas a native client would need updating; but hopefully you update your client, lest you start missing out on new protocol features!)

Hey man, GNU Social still exists toooooo

Reply on news.ycombinator.com