Email or username:

Password:

Forgot your password?
18 posts total
Daniel Gultsch

11 years into the development of #Conversations_im, I’m still working to enhance its security. Most recently, I’ve added support for XEP-0474: SASL SCRAM Downgrade Protection.

To take advantage of our continued commitment to security, make sure to:

· Use Conversations rather than a (soon-to-be-abandoned) fork

· Install Conversations through a source that provides automatic updates (F-Droid for Android 12+ or Google Play)

#XMPP

Mazhe

@daniel Thanks! That's really impressive the stuff that went into #XMPP to improve usage and security, both by the spec people and those writing servers and cliens! Is this xep depending on using SASL2?

Daniel Gultsch

⚠️ 🚨 It’s time to stop using Blabber.im 🚨⚠️

The abandoned fork of #Conversations_im has a critical security issue: attackers can bypass STARTTLS negotiation, resulting in an unencrypted connection to a fake server. This vulnerability is similar to the STARTLS attack discovered in various email clients¹

✅ Fixed in Conversations 2.13.1 (Feb 2024)

📢 Please migrate to Conversations immediately! It's free on Google Play until the end of the year and always free on #fdroid

¹: archive.fosdem.org/2024/schedu

⚠️ 🚨 It’s time to stop using Blabber.im 🚨⚠️

The abandoned fork of #Conversations_im has a critical security issue: attackers can bypass STARTTLS negotiation, resulting in an unencrypted connection to a fake server. This vulnerability is similar to the STARTLS attack discovered in various email clients¹

Daniel Gultsch

Continuing a decade-long tradition #Conversations_im is currently available for free on Google Play.

play.google.com/store/apps/det

Merry Christmas 🎄 Happy Holidays ☃️ and have fun at #38C3

Daniel Gultsch

I installed #Signal and #Conversations_im on a clean install of #GrapheneOS on my Pixel 4a and measured the battery impact. The results are shocking!

Both messengers had only one contact: my regular phone.

I used my regular phone to send messages to the Pixel 4a (which was not used for anything else over the course of the experiment).

I always sent the same message via Signal and #XMPP (mixing up which app went first). In total I sent ~32 messages in intervals of 10mins to a few hours.

Battery usage stats from an Android phone. The battery is down to 10% after 20 hours since last full charge.

Signal has consumed 95% in that period and Conversations 5%
Show previous comments
Marcus

@daniel I wonder if it would be any better if you used the play store version and microG. That's what I'm using on CalyxOS and while my notifications from Signal are less reliable than Conversations, battery usage isn't too bad, though it is worse. Here's my top contenders right now. I'm using the F-Droid version of Conversations.

A screenshot listing my battery usage.

- Wireguard
- Signal
- Conversations
pixelschubsi

@daniel Signal needs to keep active and send regular pings to keep the WebSocket connection open. This is not a technical requirement of WebSockets, but stems from Signal using the latest advanced cloud technology on their servers which cuts the connection if it doesn't see active payload traffic.

Iak

@daniel interessant. Ich kämpfe auf meinem #grapheneos auch seit einer Weile mit dem Akkuverbrauch von #signal. Schade, dass in #younohost seit dem Update auf #debian 12 nicht mehr automatisch ein #XMPP Server integriert ist. Das war schon ein sehr bequemer Weg für Laien wie mich, unfallfrei, unkompliziert und günstig einen solchen zu klicken und pflegen.

Daniel Gultsch

Should #Conversations_im add stun.conversations.im as a fallback for #XMPP servers missing XEP-0215: External Service Discovery?

I’ve hesitated to add anything resembling "calling home" (no update checker, no metrics).

However, the main goal here wouldn’t be improving A/V call success (though it helps) but making P2P file transfers more reliable. Many servers still lack HTTP Upload, and the refactored Jingle File Transfer would benefit greatly from a fallback STUN server.

Anonymous poll

Poll

Yes
0
0%
No
0
0%
0 people voted.
Voting ended 22 Nov 2024 at 15:43.
Daniel Gultsch

Good news and bad news.
#Conversations_im 2.17.0 has support for emoji reactions 🎉
Since @Codeberg appears to be under constant DDoS attacks they have added pretty strict rate limits that the @fdroidorg build server keeps running into. 😞
Another build cycle just failed and it's unclear when 2.17.0 will be available on F-Droid.
Maybe Codeberg and F-Droid can back channel an allow list or something? 🙏

A chat bubble in the Conversations app with the message 'hi all. I'm trying to take a screenshot for Mastodon. Can I get some reactions on this message?!' and a bunch of reactions to said message.
Show previous comments
Hippo 🍉

@daniel @Codeberg @fdroidorg that's great news (about the reactions)! Will push everyone to upgrade once F-droid gets sorted out 😉️

DELETED

@daniel
👏 hopefully you'll resolve these issues soon and we'll have a fresh new release available 🙂
@Codeberg @fdroidorg

Codeberg.org

@daniel Sorry for the inconvenience! We did mention here that we haven't changed any of our rate limits in response to the recent outages yet, so we find this kind of weird: social.anoxinon.de/@Codeberg/1

(Regardless: @fdroidorg, feel free to get in touch with us so that we can work things out!) ~n

Daniel Gultsch

We are finally going to upgrade our #ejabberd running on conversations.im, tomorrow, Saturday May 25th.

Unfortunately we won’t be able to do this without some down times throughout the day.

You can visit status.conversations.im/ for a simple up/down check or follow this thread for the occasional status update / progress report.

Show previous comments
melessa

@daniel Could we get an eta, or at least a progress report? I'm currently cut off from everyone. To only have notice on mastodon a day before is pretty shit tbh. I'm already having a hell of a time keeping people on xmpp, this is not helping.

Pawlicker
@daniel darn it now I can't share absol paws :(
Andrzej Czerniak 🇵🇱:linux:

@daniel in the future please send a message a few days before to all users about planned downtime 😉

Thx.

Daniel Gultsch

#Conversations_im has just surpassed 250,000 installs on Google Play. 🥳

The official, publicly visible, install badges are handed out for 100k and 500k. Growth has been very linear over the last ten years so stay tuned for the next big milestone in 2034! 😜

A screenshot from the Google Play Developer Console showing a chart labeled 'Total installs'.

The x axis is time from Nov 1, 2019 until May 7 2024.

The y axis goes from 100K to 300K.

A line starts at ~125k and goes up to exactly 250k.
Daniel Gultsch

Seems like #Cheogram went the route of just pretending they upload the contact list to satisfy Google Play requirements.¹

I get why they are doing this. I've contemplated doing this myself but I’m absolutely not convinced that pretending your app is worse than it is is the right strategy here. Especially because the overwhelming majority of our users are not following us on social media and thus don’t have the context for why we would do this.

¹: blog.jmp.chat/b/march-newslett

jannic

@daniel perhaps you can get away with wording like "the contact list gets uploaded only if you press the upload contact list button", and have such a button, permanently disabled?

Daniel Gultsch

I hastily threw together a version of #Conversations_im that has no address book integration and doesn’t ask for Contacts permission.
This seems to have made it through Google Play review just now meaning the app is now available on Google Play again.

No indication from Google that they were in the wrong and hallucinated the whole "uploads contact list" thing. Instead I had to walk the path of least resistance and remove the useful and entirely harmless feature of address book integration.

Eduard Toloza

@daniel I have some contacts at Google, I will try to reach them and see if they can help.

Benjamin

@daniel sucks it has to be this way, but at least you have found a solution!

Daniel Gultsch

Being able to do proper message replies (including jumping to the original message) was one of the primary reasons for starting the work on Conversations 3.0
I’m glad it’s working now.
youtube.com/shorts/lkgbQFIJEdg

Mike

@daniel Woho! This and reactions will be <3

Daniel Gultsch

I mentioned before that Conversations 3 will use Dynamic Colors (Material You). Here are two screenshots of how this will look in the chat screen.

Daniel Gultsch

I will stop maintaining and running the Conversations Compliance Tester¹.

The Compliance Tester was originally a small command line tool used to verify the configuration of your XMPP server. A GSoC project turned it into a web service that quite frankly is becoming a burden to run.

The architecture is fine considering it was written by a student; but not great.

At a time where most XMPP server have very sane default configurations it has outlived it's usefulness.

¹: compliance.conversations.im

I will stop maintaining and running the Conversations Compliance Tester¹.

The Compliance Tester was originally a small command line tool used to verify the configuration of your XMPP server. A GSoC project turned it into a web service that quite frankly is becoming a burden to run.

The architecture is fine considering it was written by a student; but not great.

pluhmen

@daniel Thanks for that tool it helped a lot to get a xmpp server running with sane extensions and config.

Daniel Gultsch

In light of recent events I've started to reconsider which companies and services I want to trust and rely upon.

Over the coming days I’m going to make some changes to the Conversations development infrastructure.

· F-Droid will become a more prominent way to download and install Conversations
· Translations are moving from Transifex to Weblate¹

In addition to that I’m going to reconsider what role Github will be playing in the future.

¹: translate.codeberg.org/project

In light of recent events I've started to reconsider which companies and services I want to trust and rely upon.

Over the coming days I’m going to make some changes to the Conversations development infrastructure.

· F-Droid will become a more prominent way to download and install Conversations
· Translations are moving from Transifex to Weblate¹

Daniel Gultsch

Just in case you are spending the next couple of days with people who are not on #XMPP yet and have some time on your hands. 😊

Conversations is currently available for free on the Google PlayStore.

play.google.com/store/apps/det

Daniel Gultsch

Any sufficiently complex JSON protocol will eventually implement features people dislike about XML. #JMAP has namespaces and XPath.

I’m told JSON schemas are a thing too.

Guus der Kinderen

@daniel JSON schemas are exactly as much fun as you expect them to be. #askMeHowIKnow

Daniel Gultsch

Conversations 2.11 will ship the largest protocol update in years. Traditionally it takes 6-7 round trips (not including TLS) to fully establish an #XMPP connection.
Thanks to the work @mattj and I have been doing over the last two months we can bring this down to just one.
This can significantly improve the reliability on flaky or throttled connections.

@prosodyim has community modules for the required server extensions (Bind 2, SASL 2, FAST)

Conversations 2.11 will ship the largest protocol update in years. Traditionally it takes 6-7 round trips (not including TLS) to fully establish an #XMPP connection.
Thanks to the work @mattj and I have been doing over the last two months we can bring this down to just one.
This can significantly improve the reliability on flaky or throttled connections.

Show previous comments
Marcus

@daniel @mattj @prosodyim It's great to hear you're so committed to improving not just your own app, but the XMPP standard as a whole.

qbi

@daniel @mattj @prosodyim do you plan to integrate Atinspam features into Conversations in the near future?

BoosterFive 🚀

@daniel @mattj @prosodyim that's great! Thanks for continuing to support the best mobile xmpp client out there on any platform!

Daniel Gultsch

If you were wondering how well #XMPP works on mobile devices: The XMPP-based MoyaApp has 6.5M users in South Afrika 🇿🇦.

businessinsider.co.za/the-moya

Show previous comments
Tuxicoman

@daniel is it open to discuss with jabber network or it is a closed network using #xmpp as backend?

0 (shadowbanned)

@daniel

> They also found that, at the time, there was a widespread view that “apps steal your money so don’t put apps on your phone.” People did not realise the apps were being updated to make them more efficient, but they just saw it as their data being stolen.

They're not half wrong, though. 🤡

Go Up