Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XMPP vs. Matrix

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 92 posts

Re: XMPP vs. Matrix

#71

Post by Tmpod »

ementally wrote: post #52
dngray wrote: post #23

Earlier quoted context omitted.

> Routing data between servers and networks you literally control This isn't always the case, not every user is a server admin. Also for group chats other server admins will certainly know what data your requesting. TLDR is that XMPP is not a private protocol, and that was never its intention. It was actually very centralized in it's original usage and the designers clearly envisaged similar usage to email ie $compan…

https://simplex.chat/ has lesser metadata than Signal[1][2], Matrix and XMPP. SimpleX Chat is going to move to Groups V2[3] very soon to make the experience much better. [1]: https://www.ndss-symposium.org/ndss-paper/improving-signals-... [2]: https://arxiv.org/abs/2305.09799 [3]: https://github.com/simplex-chat/simplex-chat/issues/4620#iss...

SimpleX looks really interesting. Will have to read on it. Seems somewhat like "magic", is there any gotcha?

Re: XMPP vs. Matrix

#72

Post by gsoto »

Fell wrote: post #7

In order to answer this question it is important to understand the fundamental difference between XMPP and Matrix. XMPP was invented at a time, where communicating online meant sending a message from one device to another. However, the modern expectations for messaging apps are much more than that. Sending media, using multiple devices, deleting messages, editing messages, read receipts, notifications when typing, gr…

A lot of the features you mention were already there in XMPP 20 years ago. I've lost track of the standard a long time ago but I assume the rest have been added through extensions.

Re: XMPP vs. Matrix

#73

Post by Tmpod »

kfiven wrote: post #8

Haven't used XMPP much so can't comment on that but in case of Matrix, I use conduit (server) + cinny (client) and it's much lighter and better setup than the synapse and element. Conduit isn't super feature rich nor cinny but if you aim for rich text messages it works well.

Cinny's latest update seemed really good and juicy, with lots of important features finally added. Haven't tried it proper yet tho.

My issue with anything not Synapse (for now), is migration and atability. Conduit is still somewhat a young project in comparison, and I'm not entirely confident in the upgrade paths yet. They also use RocksDB (or sled), which furthers this "fear", perhaps irrationally so. I'd love to host my conduit server with confidence though, but I'd also need Matrix to properly support account migration. IMO it's one of the key features still missing and it's damaging its "decentralized" image.

Re: XMPP vs. Matrix

#74

Post by em-bee »

johnisgood wrote: post #35
Fell wrote: post #7

In order to answer this question it is important to understand the fundamental difference between XMPP and Matrix. XMPP was invented at a time, where communicating online meant sending a message from one device to another. However, the modern expectations for messaging apps are much more than that. Sending media, using multiple devices, deleting messages, editing messages, read receipts, notifications when typing, gr…

> Running a Matrix Synapse server is quite a commitment Commitment in what way? I found it fairly easily to set it up with a domain of my own.

the matrix server where i have my account, run by a small tech community with one admin recently had to switch from a blacklist to a whitelist approach in order to curb the amount of fake accounts and spam they were getting. as a side effect since that change i had to bother the admin multiple times because one of the groups i was participating in was not reachable. the amount of work the admin has in order to keep the server im shape is much more than i would be willing to tolerate.

on top of that not a month goes by where something doesn't break.

a security conscious friend who joined matrix because of me (well, he was interested before, but i finally gave him a reason) just deleted his matrix clients in disgust after some messages randomly could not be decrypted.

i suspect that there is still a problem on the server i am using, therefore more potential work for its already overworked admin.

Re: XMPP vs. Matrix

#75

Post by Tmpod »

dngray wrote: post #16
the_third_wave wrote: post #9

XMPP + OMEMO (E2E encryption), no doubt. Open standards, multiple implementations, cross-platform and it mostly just works. Light on the server, "maintenance-free". Conversations on Android, Gajim or Dino-IM on desktop. I tried Matrix but found it to be more complicated without adding significant functionality.

> more complicated without adding significant functionality This simply is untrue. Having first class E2EE that covers VOIP and all features (eg Matrix, Signal etc) like that is obviously a benefit. Essentially you can't "use Matrix/Signal wrong" and realize later your communications weren't E2EE, you certainly can with XMPP.

While that's certainly the plan, Matrix is still not at the "can't use it wrong" stage Signal has gotten to. Verifying multiple devices is still inconsistent and often requires multiple tries (may be an issue with the matrix.org server, dunno) and "Unable to decrypt" errors are still somewhat a common sight.

It has gotten much better in recent times, but not quite there just yet.

Re: XMPP vs. Matrix

#76

Post by some_furry »

inputmice wrote: post #65
Kye wrote: post #62

Earlier quoted context omitted.

>> "But there is a lot of FUD if not outright lies in that blog post. " For example...

* Conversations uses two different OpenPGP implementations. (It doesn’t) * The auth tag truncation was 'silently' introduced in the spec. It wasn’t. The author retracted that but only barely * ominously pointing out that Conversations has a SASL implementation (In fact Conversations can use that to detect some MITM attacks; which is pretty cool) * ominously pointing out that Conversations has a certificate parser (ye…

> * ominously pointing out that Conversations has a certificate parser (yes and so does almost everything that uses TLS)

It's trivial to use TLS without writing your own certificate parser. Doing this means taking on a lot of unnecessary risk, such as CVE-2023-33202.

Your encrypted messaging application shouldn't need to have a separate X.509 or ASN.1 parser built into it. If you're going to use them from TLS, you should rely on the library your OS vendor maintains for you, since they have an incentive to keep theirs secure anyway.

"Ominously pointing out" that the Conversations project has taken on an unhealthy amount of complexity and risk isn't FUD, it's a criticism of how the project is managed. Confuse the two at your own peril.

Re: XMPP vs. Matrix

#77

Post by Xen9 »

erszcz wrote: post #24
Fell wrote: post #7

In order to answer this question it is important to understand the fundamental difference between XMPP and Matrix. XMPP was invented at a time, where communicating online meant sending a message from one device to another. However, the modern expectations for messaging apps are much more than that. Sending media, using multiple devices, deleting messages, editing messages, read receipts, notifications when typing, gr…

Disclaimer: I'm an XMPP server developer and work on [MongooseIM]( https://github.com/esl/MongooseIM ). > XMPP was invented at a time, where communicating online meant sending a message from one device to another. However, the modern expectations for messaging apps are much more than that. Sending media, using multiple devices, deleting messages, editing messages, read receipts, notifications when typing, group chats…

There used to be a "security-focused" project that configured easily XMPP projects but I don't recall its name. Last time I checked it was dead.

Re: XMPP vs. Matrix

#78

Post by inputmice »

some_furry wrote: post #76
inputmice wrote: post #65

Earlier quoted context omitted.

* Conversations uses two different OpenPGP implementations. (It doesn’t) * The auth tag truncation was 'silently' introduced in the spec. It wasn’t. The author retracted that but only barely * ominously pointing out that Conversations has a SASL implementation (In fact Conversations can use that to detect some MITM attacks; which is pretty cool) * ominously pointing out that Conversations has a certificate parser (ye…

> * ominously pointing out that Conversations has a certificate parser (yes and so does almost everything that uses TLS) It's trivial to use TLS without writing your own certificate parser. Doing this means taking on a lot of unnecessary risk, such as CVE-2023-33202. Your encrypted messaging application shouldn't need to have a separate X.509 or ASN.1 parser built into it. If you're going to use them from TLS, you sh…

There are certificates that are valid for the XMPP domain example.com but not for the regular (HTTP) server on example.com. Off-the-shelf verifier don’t have support for that.

Re: XMPP vs. Matrix

#79

Post by alt187 »

I'd say you're taking the problem backwards. Your friends and family will follow you probably because you ask them, rather than because of any intrinstic feature of the protocol.

So the real question is which one do you want to use?

In terms of server software, XMPP is lighter, easier to manage and scales better.

In terms of protocol, the Matrix protocol has an immense metadata problem. While encryption is sound, the metadata carried with every message is as good as plaintext. XMPP meanwhile provides pseudonymous rooms and minimal metadata leakage.

In terms of direction, I trust the XMPP foundation more. The Vector foundation comes from a multinational and is clearly a startup. I don't think anything good can come from the tight coupling between Vector and Matrix, no matter how much Matthew tries.

Vector also relicensed Element under a CLU (Contributor License Agreement). For me, it's a sword of Damocles.

In terms of community, it's pretty personal but I don't like the people on Matrix at all. The XMPP users seem more friendly. Your mileage may vary though. It may also not matter if you only want to talk to your already existing friends.

However, the best XMPP client is beautiful like the face of a dying man, and just as easy to use. Matrix is way ahead on client design.

Re: XMPP vs. Matrix

#80

Post by johnisgood »

johnisgood wrote: post #35
Fell wrote: post #7

In order to answer this question it is important to understand the fundamental difference between XMPP and Matrix. XMPP was invented at a time, where communicating online meant sending a message from one device to another. However, the modern expectations for messaging apps are much more than that. Sending media, using multiple devices, deleting messages, editing messages, read receipts, notifications when typing, gr…

> Running a Matrix Synapse server is quite a commitment Commitment in what way? I found it fairly easily to set it up with a domain of my own.

I should have omitted the "I found it fairly easily to set it up with a domain of my own." part, because I do like the answers to the question, those are the sort of answers I was hoping for, so thank you.
Post reply on HN