manifesto

> for me, when both Facebook and Google rejected Jabber/XMPP federation :( I agree with you in principle, but this is only half-true. You're right that Facebook's XMPP was always just a gateway into their proprietary messaging system, but Google did support XMPP federation. What Google did not support was server-to-server TLS, and thus it was “us” who killed Google XMPP federation. In late 2013 there was an XMPP community manifesto calling for mandatory TLS (even STARTTLS) for XMPP server-to-server communication by a drop-dead date in mid 2014: https://github.com/stpeter/manifesto/blob/master/manifesto.t... "The schedule we agree to is: - January 4, 2014: first test day requiring encryption - February 22, 2014: second test day - March 22, 2014: third test day - April 19, 2014: fourth test day - May 19, 2014: permanent upgrade to encrypted

> When you are establishing a standard that clients and servers will advertise that they adhere to, don't leave technical decisions to the end-user by default. On principle I agree, but ironically the exact scenario you suggest was the single biggest event that "killed" XMPP as we used to know it. In late 2013 there was an XMPP community manifesto calling for mandatory TLS (even STARTTLS) for XMPP server-to-server communication by a drop-dead date in early 2014: https://github.com/stpeter/manifesto/blob/master/manifesto.t... "The schedule we agree to is: - January 4, 2014: first test day requiring encryption - February 22, 2014: second test day - March 22, 2014: third test day - April 19, 2014: fourth test day - May 19, 2014: permanent upgrade to encrypted network, coinciding with Open Discussion Day <http://opendiscussionday.org/>" Well-

My tinfoil hat theory (that others may have had, or it may be something I read somewhere...) is that the XMPP protocol was part of what made PRISM successful, and the timing of these orgs adding XMPP is kind of aligned with when they were “online” for PRISM. I’m pretty sure the larger orgs that were targeted could tell that the only way this information leaked easily, or was justified, was because of XMPP metadata, or some other large scale flaw. The XMPP group also had a pretty visible security/encryption lockdown that I didn’t feel like was explained well, or maybe I just didn’t understand it :) https://github.com/stpeter/manifesto/blob/master/manifesto.t...

In 2013, the xmpp community decided to enforce TLS on all server-to-server links [0]. Google still doesn't support this, essentially preventing non-gmail users to communicate with them. While OTR is a possible solution, it has its own can of worms (multi-device, offline use). Besides of this, Gmail xmpp silently fails if the other party upgraded to hangouts. [0] https://github.com/stpeter/manifesto/blob/master/manifesto.t...

Most of the XMPP network switched last year to REQUIRING encryption for one server to talk to another server. Google doesn't support encryption at all for server-to-server links, and thus servers like jabber.org (of which I'm the admin) can't talk to Google anymore. See more at https://github.com/stpeter/manifesto/blob/master/manifesto.t...

GTalk has broken federation for Hangouts users, and they failed to enable s2s encryption, which is mandatory since February: https://github.com/stpeter/manifesto/blob/master/manifesto.t...

My own conspiracy theory is that these times match up where they adopt some form of widespread XMPP. Google Talk, iMessage (2012), MS Messenger, etc... and aligns with the recent talk of re-doing encryption in federated XMPP: https://github.com/stpeter/manifesto XMPP isn't just for chat, it's for video, server to server message passing, status updates, etc...