40
End-to-End Encrypted Chat that YOU Control: Hosting XMPP (Jabber) with Prosody (roguesecurity.dev)
submitted 1 week ago by starkzarn@infosec.pub to c/selfhosted@lemmy.world
23 comments fedilink hide all child comments

Take control of your data, join the tech chat. Host an XMPP server and leverage end-to-end encryption for your personal data

top 23 comments
sorted by: hot top controversial new old
[-] u_tamtam@programming.dev 2 points 3 days ago

Prosody is a great piece of software, and so is ejabberd which offers some perks. I can't speak for the other servers (mongooseim, openfire, tigase, ...) which I haven't tried in a long time,

All that's to say that it's amazing that we get so many well maintained and compatible servers (and clients) implementations in XMPP-land, and all the implications for its healthy future.

[-] starkzarn@infosec.pub 1 points 2 days ago

Agreed, prosody is great! I've been doing some experimenting with ejabberd and it seems more enterprise-ready, but I haven't found anything that is discernable as far as feature advantages.

[-] starkzarn@infosec.pub 6 points 6 days ago

UPDATE: For anyone who comes back to this, or any new readers -- I have added a MUC (chat room) on my XMPP server for discussion of any tech-related things, akin to the subject-matter of this blog. Hope to see you there!

xmpp:roguesecurity@groups.hackofalltrades.org?join

[-] litchralee@sh.itjust.works 4 points 1 week ago* (last edited 1 week ago)

When I see E2EE and XMPP mentioned, I think of this blog post by Soatok, outlining some very odd cryptographic choices in XMPP + OMEMO: https://soatok.blog/2024/08/04/against-xmppomemo/

I would very much like to see a richer playing field than just Signal for private messaging, but it's a tough nut to crack. For exactly which aspect that turns me away from XMPP for E2EE, I think this nails it down:

you only need check whether OMEMO is on by default (it isn’t), or whether OMEMO can be turned off even if your client supports it (it can).

When the competition is Signal, these sorts of details matter a lot.

[-] poVoq@slrpnk.net 3 points 1 week ago

That article is highly misleading.

A good response can be found here: https://www.moparisthebest.com/against-silos-signal/

[-] electric_nan@lemmy.ml 1 points 6 days ago

Who is the author of this response?

[-] poVoq@slrpnk.net 1 points 6 days ago

The person that runs the website it is posted on.

[-] electric_nan@lemmy.ml 1 points 6 days ago* (last edited 5 days ago)

I couldn't find any "about" info anywhere.

[-] starkzarn@infosec.pub 1 points 1 week ago

This is also a great article! Thanks for the link.

One cool point in favor of XMPP is that in a public setting (MUCs), there's community. Moparisbest is an active participant in several of the MUCs that I'm in. Very cool!

[-] starkzarn@infosec.pub 1 points 1 week ago

This is great, I have not seen this post before. Thank you for sharing.

You make an excellent point here, that the burden of security and privacy is put on the user, and that means that the other party in which you're engaged in conversation with can mess it up for the both of you. It's far from perfect, absolutely. Ideally you can educate those that are willing to chat with you on XMPP and kill two birds with one stone, good E2EE, and security and privacy training for a friend. XMPP doesn't tick the same box as Signal though, certainly. I still rely heavily on Signal, but that data resides on and transits a lot of things that I don't control. There's a time and a place for concerns with both, but I wanted to share my strategy for an internal chat server that also meets some of those privacy and security wickets.

[-] mistermodal@lemmy.ml 0 points 1 week ago

Never cared for the way this fellow tries to argue that everything is too difficult to be useful. I've gotten plenty of friends and family on XMPP and the clients that don't have encryption on by default are easy to remember. Really blowing it out of proportion.

Honestly, what do security researchers like this even know about normal people? They sit through all kinds of inconveniences to use Facebook. This is a thought experiment.

Some of these are valid criticisms, of course, a lot of XMPP stuff feels like it from the 2010s. It's still the only real option. Matrix client or server is bloated garbage, theu moved server fixes into a walled garden, its development is dependent on funding from the USA National Endowment for Democracy technology fund. Signal has similar funding issues and is very shady with its centralization, trust issues, demanding phone numbers. Sets users up to leak all kinds of stuff in notifications like Matrix.

The strange insistence that only Signal meets their requirements makes me skeptical, as does the way they have operated in Github threads. They seem like an emotional nightmare to work with.

[-] 7rokhym@lemmy.ca 3 points 1 week ago

Poor XMPP, no one will just let it die.

[-] lambalicious@lemmy.sdf.org 2 points 4 days ago

What for?

XMPP is quite robust and open, and while it's not in the level of simplicity of, say, IRC, it still beats pretty much everything else on connectivity and efficiency, and can be run on a potato. Storage is only slighly a concern.

OTOH nu-protocols like Mastodon stuff or Matrix stuff, while they are nice to have, are notoriously badly designed because kiddies these days can't bother to learn C. This results in highly energy-, memory- and storage-consuming systems. In the amount of RAM I need to kick up a Matrix server (assuming it even runs) I can run ~18 XMPP services and about ~240 ircd services.

[-] semperverus@lemmy.world 4 points 6 days ago

Its still better than any new chat protocol thats been made in the last decade. You'll have to pry my family XMPP server out of my cold dead hands.

[-] ClusterBomb 2 points 5 days ago

When you read technical stuff about this protocol, you understand it is a great one and it should not die.

[-] Wigglesworth@retrolemmy.com 10 points 1 week ago

The VC money won't let Matrix die. The community support won't let XMPP die.

I know which I respect more.

[-] starkzarn@infosec.pub 3 points 1 week ago

It has a long healthy life ahead! Come join the party, the proof is in the pudding.

[-] Im_old@lemmy.world 1 points 1 week ago

This is great as last time I looked to set up prosody there were no official container images.

I just need to figure out how to set up slidge/matrix bridge and then I can ditch my matrix server.

[-] starkzarn@infosec.pub 1 points 1 week ago

Yeah they just redid their container image pipeline and these containers are the result!

[-] lambalicious@lemmy.sdf.org 2 points 4 days ago

This is so nice to hear.

[-] starkzarn@infosec.pub 1 points 3 days ago

Agreed! Runtime environment management is so much nicer with modern containerization. You or ally can't overstate how much better it is to have app stack state be entirely divorced from OS state. I'm very pleased they're back on the bandwagon as well.

Stand up a server and come join our MUC!

[-] lambalicious@lemmy.sdf.org 2 points 3 days ago

This week I was setting up an IRC server for a group of friends, but might switch it to XMPP. I also have a v good friend who is hosting a XMPP server that sees very little use and has some good lots of legacy stuff going on, I'll try to ping them to see if it's worth to spin something completely new.

[-] starkzarn@infosec.pub 1 points 2 days ago

Sounds like a great opportunity to breath some life into it! If you really have the itch for IRC, there's a slidge bridge to connect IRC to XMPP!

this post was submitted on 13 Oct 2025
40 points (100.0% liked)

Selfhosted

52403 readers
973 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz