Matrix vs. XMPP, Security, Privacy, Apps, Efficiency ?
Matrix vs. XMPP, Security, Privacy, Apps, Efficiency ?
I recently saw Alex's video about XMPP and I got curious.
I am using Element and Schildichat a bit, trying Element X and curious about the new Development here. It seems vibrant, they rewrite stuff in rust, the Apps are fancy and all.
But I tried Conversations and it seems based too, has transparent encryption, it is damn fast, usable, supports groups and files and all. Probably doesnt use the latest fancy Android SDKs but it seems solid.
I was surprised about how fast it was, as Matrix drastically varies per server. But also I found many dead communities, and in general I dont see XMPP at all, while many Projects (if not using Discord, bruh...) have a Matrix room.
How secure is OMEMO in todays standards? Or OpenPGP, compared to Matrix or Signal Encryption? I heard it also has rotating keys and all.
There are other things, like permission systems, chosen federation, privacy, bridge support and more, that are interesting. Are there advanced modern WebUIs for XMPP you like?
I saw that it uses up waaay less resources, why is that? Really, is "simply encrypted mail" somehow worse in an important way?
Similar to IRC, where I never found nice usable apps for my taste, I thought XMPP was deprecated, but that doesnt seem so?
What can you tell me about XMPP, is it modern, secure, privacy friendly?
XMPP is much more popular for private messaging, so you don't have many large public group chats like on Discord (and lesser extend Matrix). It can do it, but clients are not really optimized for that to be honest.
You can btw learn more on https://joinjabber.org
As for the specific questions on e2ee: OMEMO as it is currently implemented in most clients is very similar to Signal in security, but like Signal it does not encrypt metadata. There is an updated OMEMO standard that does encrypt metadata as well, but it hasn't been adopted by any popular XMPP clients yet. However both versions are significantly more secure than Matrix's MegOLM, which has chosen to sacrifice a lot of security for user convenience IMHO.
XMPP is actively developed, but it doesn't have much funding for the open-source efforts, so it lacks PR and some things don't develop as quickly as what you might be used from VC funded for-profit companies like Element/matrix.
I like the Movim webclient, but most current users seem to prefer the native clients for XMPP.
XMPP uses way less resources because it was designed to scale to billions of users for chat, instead of being some over-engineered failed experiment to use a DACS for chat, which really isn't a good idea and never was.
This is good reading on XMPP
https://privacy.awiki.org/im.html#XMPP
And one about matrix
https://hackea.org/notas/matrix.html
I think that XMPP is obviously the superior choice here. Matrix is funded by venture capitalists that need to make money some way and they are actually recollecting users' data for that.
Do you have a source for the claim that collecting userdata is ultimately what funds Matrix?
have you read the article I linked?
I didn't say it was ultimately what funds matrix, they sell servers too, but they recollect data that's for sure.
Quoting the article here:
matrix.org and vector.im receive a lot of private, personal and identifiable data on a regular basis, or metadata that can be used to precisely identify and/or track users/server, their social graph, usage pattern and potential location. This is possible both by the default configuration values in synapse/Riot that do not promote privacy, and by specific choices made by their developers to not disclose, inform users or resolve in a timely manner several known behaviors of the software.
Data sent on a potential regular basis based on a common web/desktop+smartphone usage even with a self-hosted client and Homeserver:
The Matrix ID of users, usually including their username. Email addresses, phone numbers of the user and their contacts. Associations of Email, phone numbers with Matrix IDs. Usage patterns of the user. IP address of the user, which can give more or less precise geographical location information. The user’s devices and system information. The other servers that users talks to. Room IDs, potentially identifying the Direct chat ones and the other user/server.With default settings, they allow unrestricted, non-obfuscated public access to the following potentially personal data/info:
Matrix IDs mapped to Email addresses/phone numbers added to a user’s settings. Every file, image, video, audio that is uploaded to the Homeserver. Profile name and avatar of users.
I am hosting a two-person XMPP server now, and it's pretty light on resources. Matrix, however, I am not even sure my VPS would even handle: I've seen multiple people talk about how their servers would explode when someone tries to join a large room. And also there's an issue of every participating server storing chat history/media: my disk is small, I need it for the media on my site!
I am also concerned about how overly prevalent the central matrix.org server is.
all your first points are generally correct, as far as the last one however, that is the entire point in running your own instance. too many uses on matrix.org. all fedi platforms have this issue as well.
That was the point - it's not supposed to happen yet it is there at least for the moment.
I share your concern - matrix is bloated as a protocol. I assume you tried synapse. I wonder how conduit (rust) or dendrite (go) would perform.
I didn't try it, but I read about it and talked to people who did. Two of them ran Synapse and one tried Conduit. The result - Conduit does consume much less but still noticeably more than XMPP (plus the storage concern is still there).
[This comment has been deleted by an automated system]
Yes, Matrix.org is a huge problem. Even Mastodon is way more federated.
XMPP is too fragmented with all the addons or whatever they're called (edit: XEPs). Chatting with people on different servers, or even different clients is a crapshoot whether basic features like encryption are enabled. I have a lot of hope for Matrix as they work out the bugs.
Try using Matrix with a non-synapse / non-element client setup and you will have as much if not more fragmentation issues. Heck, Synapse doesn't even follow the official Matrix standard, so things break all the time on other Matrix servers like Conduit.
XMPP had a lot more time to iron out federation issues between different implementations, and it shows.
E2e encryption works more hassle free in my experience with XMPP as well, at least for private chats and small groups.
I'm basically still 'testing' both of them out. Neither is good enough for me to lobby my friends to use. I use Cheogram for XMPP, mostly for it's integration with SIP/jmp.chat. Years ago I spent a bunch of time on Movim. I'd be very happy for XMPP to be a consistent experience.
Yeah, he did showcase XMPP in a way that normal users care about. I’m excited to try this with my friends and family using one of those open servers and later spin up a prosody server myself.
Here is an alternative Piped link(s):
https://piped.video/watch?v=GurbaZzwYvU
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source; check me out at GitHub.
XMPP lacks half the features of Matri, userbase is non existent, and there's not a single good client. That's all you need to know.
Complete BS, sorry to say. XMPP is mainly targeting a different use-case so the feature set is not 1:1 comparable to Matrix, so in some areas it has significantly more features, in others less.
I'm also still interested in the xmpp vs matrix debate. I'm using matrix ATM because it seems more actively developed and used, but I know some people still swear by xmpp. Ultimately I really just want a decentralized alternative to discord, but beyond that I feel like I'll just want to go to whichever alternative has the most users, since that's pretty useful for chatting software.
I've heard feedback that matrix doesn't seem to be very united, with different groups implementing different competing features proposals etc., which does seem to be a pretty big issue.
I'm also pretty optimistic about a lot of the new stuff being built on matrix. I recently became aware of Commune, which is about making sections of matrix servers web searchable, and that sounds incredible - one of my biggest issues with discord is how often it gets used as effectively game wikis, collecting all these guides and information that's only accessible through a proprietary discord account. No anonymous search.
Matrix is probably closer to Discord if you use that mainly for public group chats. But actually you will be surprised how nice IRC can be for that as well, including modern looking webclients.
XMPP is more of an replacement for WhatsApp, Signal and Telegram right now.
It is easy to cook up your own IM protocol, but for interoperability between providers (which is the whole point of using XMPP or Matrix in the first place!) we need to agree on a protocol. The way we agree on protocols is standardization. XMPP is the proper IETF internet standard for instant messaging while Matrix is effectively just another product by some startup with lots of venture capital funding for shiny clients and marketing.
Also, XMPP servers and clients are also a lot less bloated.
Yeah, for a Discord alternative a web searchable Matrix server might me good... but not for anything private
No XMPP windows client support VOIP, clients development for XMPP are almost dead, so there is no comparaison here with matrix. I wish I could use XMPP instead, but it is something to relegate to the past.
You can use Movim just fine in any browser and it has voice and video calls.
Dino also has it and it can be installed on Windows although that is still a bit experimental.
Modern standard voice calls for Gajim are (finally) being worked on as well.
Xmpp client development is far from dead. There are several very interesting new clients being developed and are in preview or should be released soon, like Moxxy and Prose.
So you wrote all of this to agree that there is no VOIP supporting windows client. despite them having been in development for more than a decade . I have personnaly checked with gajim developers about VOIP support on windows and they confirmed they are not planning on working on it. xmpp doesn't belong to 2020(s)
i am on the calyx jabber server
A kind of speed talk about matrix during a conference last month (SRECon23 EMEA): https://m.youtube.com/watch?v=JZsJwEjrrcM
There's a slide about XMPP at 28:40.
I am more interested in this coming law he is referring to at 36:54 but I can't find it in https://digital-markets-act.ec.europa.eu/index_en
Here is an alternative Piped link(s):
https://m.piped.video/watch?v=JZsJwEjrrcM
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source; check me out at GitHub.