Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UnifiedPush: A decentralized, open-source push notification protocol

f-droid.org

Post reply on HN
Print view View original

141–150 of 150 posts

Re: UnifiedPush: A decentralized, open-source push notification protocol

#141

Post by Andrew_nenakhov »

MayeulC wrote: post #140
Andrew_nenakhov wrote: post #125

Earlier quoted context omitted.

You seem to not see the forest behind the trees. It doesn't do 100% of what your UnifiedPush does, sure, but it does 99%. All it needs to reach the final 1% is to send a message with an agreed payload format to a client. A day of work. As I said, we did it as far back as 2016: a watered-down XMPP client (a "distributor", as you call it) was used to deliver push notifications to a few different apps on devices that di…

> You seem to not see the forest behind the trees I almost used my sentence myself. The overlap is almost zero. > All it needs to reach the final 1% is to send a message with an agreed payload format to a client. This is the part we're interested in. We standardize this part and make it modular. The core issue is that multiple "client"s that do not interact with each other traditionally each implement their own paylo…

> Unfortunately (or maybe fortunately), not every app uses XMPP.

App doesn't need to 'use' XMPP to use push notifications. For developers, it is essentially identical to using FCM. XMPP part here simply offers a very effective way to decentralize the service, as federation server-to-server part in XMPP is wonderful, and top XMPP servers like ejabberd have great performance.

> Well, please at least try to understand the thing you're criticizing before, that's the bare minimum.

My company has created this very thing for a customer years ago, so I think I pretty much do understand what you are creating.

It wasn't open, yet, the effort to make it open would be pretty small. We could probably release it, but I don't see the real need for it, as it is a likely dead end: making apps run in the background on Android was what we did for years, and the writing is on the wall. Background running becomes more and more difficult with each new version of Android, even on pure Android phones. Biggest manufacturers, however, like Samsung, Huawei, Xiaomi simply kill off background processes without mercy. So it is more than likely we won't be able to run 'dispatcher' apps on Android, just like we can't on iOS, and we'll have to rely solely on push notification service which is built into the phone OS. If there is a fight worth fighting, it is the one to force phone OS developers to open this part of an OS to allow using custom push notifications services.

Re: UnifiedPush: A decentralized, open-source push notification protocol

#142

Post by miyuru »

MayeulC wrote: post #10
ilyt wrote: post #7

Earlier quoted context omitted.

Uh, the site doesn't load...

Looks like IPv6 is broken :/ The AAAA record was temporarily removed to try to mitigate.

Interested to know what happened here.

Shouldn't Happy eyeballs fall back to IPv4 when IPv6 is broken?

Re: UnifiedPush: A decentralized, open-source push notification protocol

#143

Post by javaunsafe2019 »

agsnu wrote: post #134
javaunsafe2019 wrote: post #123

Please don’t get me wrong but I wonder what is the use case for this. First of all this tries to solve a problem that has already been solved by the mobile device OS layer within IOS and Android and furthermore is only working for Android. Why should anyone use this?

It looks like this aims to be a replacement for people want to use an Android-based OS but don't want to rely on Google services, normally for reasons of philosophical objection to big tech's de facto surveillance capabilities. So presumably users of GrapheneOS, CalyxOS, LineageOS, etc. Also since Google is blocked in China, Firebase Cloud Messaging doesn't work there. Android has something like a 75% market share in…

Thanks for explaining and giving context - I was totally not aware of this total block of Google in the Chinese market.

Re: UnifiedPush: A decentralized, open-source push notification protocol

#144

Post by deroanth »

EGreg wrote: post #35
ajvs wrote: post #4

Earlier quoted context omitted.

Thanks for your great work creating this protocol. Hope more app developers add support for it, especially for privacy focused apps like Signal which by relying on Google servers are leaking metadata.

If you deliver notifications, you are always leaking metadata around timing. A police unit parked outside a guy’s house and confirmed it was him in the real time chatroom, by cutting his internet and seeing him drop off. If you want real anonymity on the Internet, never use push notifications. Always “pick up your mail” periodically from random endpoints on the Web.

> A police unit parked outside a guy’s house and confirmed it was him in the real time chatroom, by cutting his internet and seeing him drop off.

I guess I'm going off of too few details probably, but this doesn't seem like a very sound strategy to me. It's certainly not impossible that the real criminal lost internet around the same time as some suspect's was cut by the police. I know I've shown up as online to other people for up to several minutes after losing internet in real-time situations (e.g. games). I suppose police just need "reasonably likely" to take action though, not definite reasons.

Re: UnifiedPush: A decentralized, open-source push notification protocol

#145

Post by MayeulC »

miyuru wrote: post #142
MayeulC wrote: post #10

Earlier quoted context omitted.

Looks like IPv6 is broken :/ The AAAA record was temporarily removed to try to mitigate.

Interested to know what happened here. Shouldn't Happy eyeballs fall back to IPv4 when IPv6 is broken?

They should, which is why nobody noticed it was broken.

Someone told us IPv6 was broken after we submitted here, as they use an IPv6-only network, apparently. I just posted that up there in case that was the actual issue encountered by the commenter. We're not sure why it broke yet, but we'll fix it when there's less traffic.

Re: UnifiedPush: A decentralized, open-source push notification protocol

#146

Post by MayeulC »

joelthelion wrote: post #124

Would this be vulnerable to spam?

Each application gets a unique URL, that is supposedly kept secret from any other party. They are also very easy to rotate, as the specification advises to ask for a new one (that could be the same) on every app launch.

Moreover, when something is sent to that URL, it gets forwarded to the application, which then interprets it before displaying a notification (for most apps).

By spam, I think you meant someone sending messages to random people's notification area. No, this is highly unlikely.

Re: UnifiedPush: A decentralized, open-source push notification protocol

#147

Post by MayeulC »

Andrew_nenakhov wrote: post #141
MayeulC wrote: post #140

Earlier quoted context omitted.

> You seem to not see the forest behind the trees I almost used my sentence myself. The overlap is almost zero. > All it needs to reach the final 1% is to send a message with an agreed payload format to a client. This is the part we're interested in. We standardize this part and make it modular. The core issue is that multiple "client"s that do not interact with each other traditionally each implement their own paylo…

> Unfortunately (or maybe fortunately), not every app uses XMPP. App doesn't need to 'use' XMPP to use push notifications. For developers, it is essentially identical to using FCM. XMPP part here simply offers a very effective way to decentralize the service, as federation server-to-server part in XMPP is wonderful, and top XMPP servers like ejabberd have great performance. > Well, please at least try to understand t…

I am not trying to denigrate XMPP in any way, I also use it, though I am not very familiar with the internals. Here, the decentralized aspect doesn't seem to bring a lot of added value (what would you federate? Push senders and push servers? The relationship is mostly 1:1 in every case).

> It wasn't open

Then, I'm sorry, but even if the design was miles ahead of what is being proposed here, it might as well not have existed.

> If there is a fight worth fighting, it is the one to force phone OS developers to open this part of an OS to allow using custom push notifications services.

Well, we're proposing an API for it, and we will certainly push alternative OSes such as LineageOS, /e/ and others to adopt it; we hope it gets picked up by bigger fish, but we can't exactly pressure them into doing it, besides demonstrating that it works, documenting it and raising awareness, which is what we're doing here.

Re: UnifiedPush: A decentralized, open-source push notification protocol

#148

Post by naasking »

deroanth wrote: post #144
EGreg wrote: post #35

Earlier quoted context omitted.

If you deliver notifications, you are always leaking metadata around timing. A police unit parked outside a guy’s house and confirmed it was him in the real time chatroom, by cutting his internet and seeing him drop off. If you want real anonymity on the Internet, never use push notifications. Always “pick up your mail” periodically from random endpoints on the Web.

> A police unit parked outside a guy’s house and confirmed it was him in the real time chatroom, by cutting his internet and seeing him drop off. I guess I'm going off of too few details probably, but this doesn't seem like a very sound strategy to me. It's certainly not impossible that the real criminal lost internet around the same time as some suspect's was cut by the police. I know I've shown up as online to othe…

More than that, the criminal could have been a neighbour piggybacking on his WiFi.

Re: UnifiedPush: A decentralized, open-source push notification protocol

#149

Post by 12907835202 »

MayeulC wrote: post #2

Wow, that was submitted here quicker than we could do it! UnifiedPush has been a thing for a while, see the official website: https://unifiedpush.org/ With this blog post, we† tried to clarify a few names. Feel free to point out things that are still unclear, the documentation is pretty much a WIP. UnifiedPush aims at replacing the push notifications mechanism provided by Google services with something independent, t…

The home page you've given is a little confusing to me and I'm not sure if it's confusing or just not aimed at me.

Is this just for mobile (android only?) developers, or is it for any push notifications e.g. browser.

Could I use this with PHP or JavaScript for example?

Re: UnifiedPush: A decentralized, open-source push notification protocol

#150

Post by janosdebugs »

binwiederhier wrote: post #98
janosdebugs wrote: post #63

This is a nice concept, but I owned more than one Android phone that would ignore the battery optimization settings and kill the applications anyway.

I have been working and running ntfy [1] on my phone for a year now (ntfy is a UnifiedPush distributor), and it is true that Android does kill the app every now and then. But it is instantly restarted. Usually ntfy delivers notifications much much much faster than Google's FCM, especially in doze mode. FCM seems to try and conserve battery much more. Disclaimer: I am the maintainer of ntfy. [1] https://github.com/bin…

Sadly, I had phones where I couldn't keep anything running. Not sure what the manufacturer did there. Even the normal notifications didn't arrive at times. (E.g. Signal)
Post reply on HN