Search
1000 results for “xmpp_providers”
-
Cierra https://blah.im así que si tienes cuenta en esta instancia busca crear otra: https://providers.xmpp.net/
#xmpp #tuba #mastodon #profanity -
The Fulcrum 10 April, 2026Welcome to this week’s The Programmer’s Fulcrum.
It’s your weekly review of the essential news in the Open Media Network and Fediverse development communities with a focus on devastating big tech via Techno Anarchism. We aim to provide actionable content you can use to destroy Techno Feudalism each week. It has the additional benefit of weakening authoritarianism.
IMHO, the best way to do […]
https://newsletter.mobileatom.net/the-fulcrum-10-april-2026/ #ActivityPub #astro #ATProto #BackdropCMS #Bear #Bonfire #Codefloe #CSS #Decidim #DWeb #EmDash #FDroid #FediLab #fediverse #Ghost #Holos #HTML #HTMX #JavasScript #Kdenlive #LAUTI #Linux #OMN #PWAs #RSS #WebAwesome #WordPress #WriteFreely #XMPP #xWiki -
Emergence of governance in open communities
How the Fediverse is growing to meet its challenges
[German language version of this text will be published in FIfF-Kommunikation, the journal of the Forum InformatikerInnen für Frieden und gesellschaftliche Verantwortung (FIfF e.V.)]
ToC
The dead live longer
Multi-layered self-regulation
Gab: the Nazis are coming
Threads and Bluesky: Federation Washing?
Conclusio: Small is Beautiful
LiteraturThe social media landscape has been undergoing a tectonic shift since Elon Musk took over Twitter and Donald Trump took over the USA. The Fediverse emerged at a time when the previous phase of decentralised social networks – the blogosphere – was being supplanted by globally centralised platforms such as Facebook (2004), YouTube (2005) and Twitter (2006). With them came the problems: surveillance-based advertising, election manipulation by Cambridge Analytica, addictive design, enshittification of previously useful services (Cory Doctorow), techno-feudalism (Yanis Varoufakis).
In contrast, a counter-movement for the recentralisation of the Internet (Kahle 2016, Berners-Lee et al. 2016) is emerging and for sovereignty in Europe, which is becoming painfully aware of its comprehensive technological dependence on the US.
The perception of a crisis is giving rise to a new digital universe, the decentralised and federated Fediverse. For many migrants from toxic environments, it feels like a friendly neighbourhood where reason and civilised conversation prevail. Of course, this is not a genetic trait, hard-coded into Mastodon & Co. But how does an open community oriented towards the common good, a bustling field of players and technologies, organise itself? How does the governance of complex socio-technical systems unfold?
Resilient structures of self-organisation, so the theory goes, are the result of experiences of conflict. Current external or internal conflicts as well as structural problems (onboarding, money, etc.) trigger a collective reflection that challenges open communities to emerge from a lack of structure. The solutions, as I would like to show with examples, can be of technical or social protocols, usually a combination of both.
The dead live longer
Distributed and federated protocols have been around since 1999 with XMPP. According to official historiography, the Fediverse began in 2008 with the decentralised OpenMicroBlogging protocol and the platform Identi.ca, a free version of Twitter based on it, both developed by Evan Prodromou.
In January 2016, the World Wide Web Consortium (W3C) presented the ActivityPub protocol to improve the interoperability of the various decentralised platforms in the Fediverse. Prodromou is again co-author. Also since 2016, Eugen Rochko has been developing the microblog Mastodon, which is now the star among the decentralised platforms with around ten million users. In addition to Mastodon, the microblog Misskey, the photo platform Pixelfed, the link aggregator Lemmy and the video platform Peertube are also popular in the ActivityPub universe (FediDB: Software, April 2025).
As already mentioned, the development is motivated by criticism of the techno-feudalism of the mega-platforms. The current lead author of ActivityPub, Christine Lemmer-Webber, notes that no companies are involved in the team developing the protocol, which is very unusual for technical committees. In addition, the team identifies predominantly as queer, which leads to functions in the protocol and in the clients that help users and administrators to protect themselves from ‘unwanted interaction’ (Klemens 2023).
Mastodon is run by a non-profit limited company. The community excludes venture capital as well as surveillance advertising, which has made the mega-platforms the richest companies in the world. Mastodon per default does not even include a function for displaying adverts. But how is a global community that is essentially financed by collecting donations supposed to build an alternative to this overwhelming power and lure people out of the lock-in by the mega-companies?
As the Fediverse contradicts all business logic, experts predicted that it would soon come to an end (Woźniak 2025). The opposite is the case. At Berlin Fediday 2024, Prodromou (2024) reported on growth by all criteria: ActivityPub is being implemented by more and more platforms (WordPress, Ghost.org, Flipboard, Threads). The number of users is growing continuously, as are the bridges to other protocols, applications, content, publications and institutions of self-organisation: the SocialCG (Community Group) for ActivityPub at the W3C, the online conference FediForum, the moderator community IFTAS, Mastodon’s non-profit offshoot in the USA. He answers the question of his presentation title ‘Is Bigger Better?’ with a resounding yes.
A week later, Prodromou announced the creation of the Social Web Foundation (SWF), whose mission is a ‘growing, healthy, sustainable and multipolar Fediverse’. Shortly afterwards, the foundation became a member of the W3C as a community front-end for ActivityPub: ‘We collect requirements and design potential extensions to the ActivityPub protocol and guide them through standardisation’ (SWF 2025).
Multi-layered self-regulation
The Fediverse is, of course, also subject to external regulation through laws, etc. The focus here is on the area in which the Fediverse players are free to regulate themselves. The Fediverse project unites them on the basis of a normative conviction: a different, decentralised, federated Internet is possible. Civil society and the public sector can collectively create an online environment in which people treat each other in a civilised and respectful manner. Common values are initially shared tacitly. As the community grows and becomes more diverse, but especially when conflicts challenge these values, they are made explicit in rules of conduct, mission statements, etc. and operationalised with mechanisms for their implementation and enforcement.
Projects usually start with minimal ad hoc organisational structures and move on to more permanent forms as required. Regulation arises in order to solve problems, e.g. a legal form must be established in order to open a bank account and thus collect donations. Internal dynamic lead to the problem of the Benevolent Dictator For Life (BDFL). A free software project is started by a man (is there really not a single woman in the Wikipedia list of BDFLs?), becomes popular, grows into a community of co-developers and users, in which the founder remains at the top, respected for his valuable contributions. A meritocracy that, if left unchecked, becomes dysfunctional. The term was coined for Linus Torvalds and his Linux kernel. In the Fediverse, this currently affects Matt Mullenweg from WordPress, Daniel Supernault from Pixelfed and Loops and Eugen Rochko from Mastodon, for example. The latter announced in January 2025 that he would retire from management and concentrate on development. A new non-profit company is to be founded to which he will transfer the Mastodon brand and the copyrights to the code. This means that Mastodon’s independence no longer depends on a single person (Mastodon 2025).
Gab: the Nazis are coming
2016 was a breakthrough year for the Fediverse. It was also the year of Brexit and Trump’s first presidential election. And behind both, the Alt-Right movement emerged onto the research radar from image boards like 4Chan. An Internet-native movement that only half-jokingly boasts of having voted Trump into office and promotes “Fashy”, a “fashionable fascism” (Cramer 2017).
Gab was launched in August 2016 as a social network for radical free speech. Co-founder Andrew Torba cited ‘the total left-wing monopoly of Big Social’ as the motive. Especially during the 2016 election, Facebook and Twitter censored conservative voices. Gab started on its own technology as a mixture of Twitter and Reddit.
Gab was soon banned from the app stores for hate and pornography. In October 2018, a white supremacist killed eleven people in a synagogue in Pittsburgh. The perpetrator had posted his anti-Semitism on Gab for almost a year. As a result, payment services, web hosts and cloud providers also blocked Gab. To circumvent this block, the creators decided to migrate Gab to a fork of Mastodon in July 2019, making it accessible with every Mastodon app.
Mastodon founder Rochko spoke out on the same day. He explained that the licence (AGPLv3) does not allow certain uses or users to be excluded as long as it is complied with. At the same time, he expressed his disgust at Gab,
“which uses the pretense of free speech absolutism as an excuse to platform racist and otherwise dehumanizing content. Mastodon has been originally developed by a person of Jewish heritage and first-generation immigrant background, and Mastodon’s userbase includes many people from marginalized communities.
Mastodon’s decentralized approach that allows communities to self-govern according to their needs has enabled those marginalized communities to create safe spaces for themselves where previously they were reliant on big companies like Twitter to stand up for them, which these companies have often failed to do.” (Rochko 2019)
It was precisely decentralisation and federation that brought about a social protocol as a solution. On the one hand, many Mastodon admins had already decided to block Gab, including mastodon.social, which is operated by the Mastodon gGmbH itself. On the other hand, rules have been made explicit for the servers listed on joinmastodon.org, which is also operated by the gGmbH. With the Mastodon Server Covenant, server operators commit to
1. Active moderation against racism, sexism, homophobia and transphobia,
2. Daily backups,
3. At least one other person with emergency access to the server infrastructure,
4. And to give users at least 3 months of advance warning in case of shutting down. (Mastodon: Covenant)
There is no technical switch against Nazis. Although there have been discussions about inserting code into the clients to prevent them from logging into Gab servers, such changes can be easily reversed. The copyright licence also does not allow Nazis to be excluded from using one’s own software. There is a long debate about banning use for military purposes, for example (Kreutzer 2006). In practice, restrictions on use by licence violate the definition of free software and have not become established.
Nazis can set up their own Fediverse servers. However, the Federation’s code of conduct, the Covenant, ensures that these instances remain isolated, like Gab and Truth Social, and do no harm in the Federation. For newcomers, this level is less visible than the policies of the individual instances. However, it is crucial for the information space as a whole.
Regulations are only as good as their enforcement. Block lists for accounts and instances are maintained as tools for the daily work of admins and moderators (e.g. Oliphant). The moderators have joined forces in the IFTAS (Independent Federated Trust & Safety) forum.
Looking back at research on “alternative social media” (ASM), Robert W. Gehl (2025) notes that the widespread assumption that ASM are progressive had a blind spot: they can just as easily be used by the political right. The deplatforming of right-wing radicals on the mega-platforms increased the pressure to build their own places for radical freedom of speech. Now the research has turned into the opposite and reduced ASM to ‘alt-right social media’. However, Gehl sees an advantage in the fact that an aspect that was largely missing from the earlier literature has since been addressed: governance. ‘Much of the earliest scholarship focused on how technical elements such as free and open source software and decentralized architectures would shift power away from corporate social media to end users, but had less to say about how those users might govern themselves.’ (ibid.)
Threads and Bluesky: Federation Washing?
The next invasion of the Fediverse threatened to come from one of the mega-platforms that the alternative was up against. Meta wanted to capitalise on the Twitter exodus following Musk’s takeover and planned a text-based companion app to Instagram. Threads launches with fanfare on 5 July 2023. Thanks to Instagram’s more than two billion users, the new service gained 100 million users within five days, except in Europe, where a data protection clarification delayed the launch until December. Threads also began integrating the ActivityPub protocol in December 2023 (The Verge 2023).
The bridge from Instagram to the Fediverse has triggered even more heated debates than Gab, including reciprocal death threats. Above all, there were fears about the well-known strategy of embrace, extend, extinguish. From this camp, the tried and tested instrument used against Gab was brought up: a campaign for the collective exclusion of threads from the federation, which was followed by many instances.
Conversely, Fediverse stakeholders welcomed threads because they see interoperability between platforms as a major step forward. ‘We’ve been advocating for this for years,’ wrote Rochko (2023) on the day of the threads launch. In his blog post, he addresses accusations (data tracking, advertising, being overwhelmed by huge servers, embrace-extend-extinguish, moderation). However, he describes the lock-in of the social graph as the biggest problem, which prevents users from switching platforms if they do not want to lose all their contacts.
“The fact that large platforms are adopting ActivityPub is not only validation of the movement towards decentralized social media, but a path forward for people locked into these platforms to switch to better providers. Which in turn, puts pressure on such platforms to provide better, less exploitative services. This is a clear victory for our cause, hopefully one of many to come.” (ibid.)
Prodromou also welcomed the mega-platform’s access so that the Fediverse can quickly grow and become a powerful alternative. If there are problems, every site and all users are free not to connect to the newcomers. ‘Choice is part of the strength of the Fediverse.’ (Prodromou 2024)
Another invasion came from Twitter, specifically from its co-founder and former CEO Jack Dorsey. In 2019, he launched an initiative that gave rise to the AT Protocol and Bluesky Social. The platform with the look and feel of the original Twitter was launched in 2023. In January 2025, Bluesky claimed to have 30 million users (BNO News 2025).
Technically, the AT protocol allows decentralisation. In fact, the system is currently neither decentralised nor federated, as Lemmer-Webber (2024) discusses in detail. Furthermore, venture capital financing, not least from blockchain circles, raises doubts about sustainable freedom.
Conclusio: Small is Beautiful
The mega-platforms must continue to be rendered less hazardous through legal regulation. Buying oneself free is not an option. Rather, building alternatives is crucial. Decentralisation from above leads to a Fedi-Washing that only looks like it. The inherently decentralised network of protocol-connected nodes that has grown over the years and organises itself from below is sustainable. Last but not least, the Fediverse offers an opportunity for Europe. Many of the developers and more than twice as many Fediverse servers are in the EU (8,818) than in the USA (4,275) (Fediverse Observer, April 2025).
The non-profit nature and small size of the communities are clearly positive features of the Fediverse. Kissane & Kazemi (2024) have investigated how governance is organised on individual servers and between servers. Their conclusion: ‘Fediverse governance as we encountered it in our research conversations is emergent, unevenly distributed, and often reactive.’ The majority of Fediverse servers are operated by individuals or small groups. Medium-sized servers offer uniquely favourable conditions for community self-governance according to local norms and allow for very direct, context-dependent moderation that is superior to that of centralised platforms. ‘The Fediverse’s combined emphasis on the sovereignty of local norms and a federated form of network diplomacy can offer a real and optimistic challenge to the dead end of centralized content moderation at scale’ (ibid.).
To summarise: local, manageable communities form the basis, create diplomatic networks and grow organically into a fediverse that is more than the sum of its parts. Small is Beautiful as a prerequisite for Bigger is Better.
Literatur
Berners-Lee, Tim et al. (2016). Solid: A Platform for Decentralized Social Applications Based on Linked Data, 2016, http://emansour.com/research/meccano/solid_protocols.pdf.
BNO News (2015). Twitter alternative Bluesky hits 30 million users, 28.01.2025, https://bnonews.com/index.php/2025/01/twitter-alternative-bluesky-hits-30-million-users/.
Cramer, Florian (2017). Meme Wars: Internet culture and the ‘alt right’, at FACT Liverpool, 07.03.2017, https://www.youtube.com/watch?v=OiNYuhLKzi8.
FediDB: Software (o.J.). https://fedidb.org/software.
Fediverse Observer (o.J.). Server nach Land, https://fediverse.observer/stats.
Gehl, Robert W. (2025). A Brief History of Alternative Social Media Scholarship, 07.02.2025, https://www.socialmediaalternatives.org/2025/02/07/asm-scholarship-history.html.
Kahle, Brewster (2016). Locking the Web Open: A Call for a Decentralized Web, Juni 2016, https://archive.org/details/LockingTheWebOpen_2016.
Kissane, Erin & Darius Kazemi (2024). Findings Report: Governance on Fediverse Microblogging Servers, https://fediverse-governance.github.io/.
Klemens, Ben (2023). Mastodon – and the pros and cons of moving beyond Big Tech gatekeepers, Ars Technica, 02.01.2023, https://arstechnica.com/gadgets/2023/01/mastodon-highlights-pros-and-cons-of-moving-beyond-big-tech-gatekeepers/.
Kreutzer, Till (2006). Open-Source-Software zwischen Moral und Freiheit, iRights, 15.08.2006, https://irights.info/artikel/open-source-software-zwischen-moral-und-freiheit/6219.
Lemmer-Webber, Christine (2024). How decentralized is Bluesky really?, 22.11.2024, https://dustycloud.org/blog/how-decentralized-is-bluesky/.
Lemmer-Webber, Christine (2025). Toot, 19.01.2025, https://social.coop/@cwebber/113856458328842294.
Mastdon: Covenant (n.d.), https://joinmastodon.org/covenant.
Mastodon (2025). The people should own the town square, 13.01.2025, https://blog.joinmastodon.org/2025/01/the-people-should-own-the-town-square/.
Prodromou, Evan (2024). A Bigger Better Fediverse, presentation at Berlin Fediday 2024, 14.10.2024, https://berlinfedi.day/2024/.
Rochko, Eugen (2019). Gab switches to Mastodon’s code. Our statement, 04.07.2019, https://blog.joinmastodon.org/2019/07/statement-on-gabs-fork-of-mastodon/.
Rochko, Eugen (2023). What to know about Threads, 05.07.2023, https://blog.joinmastodon.org/2023/07/what-to-know-about-threads/.
SWF (2025). The Social Web Foundation announces its membership in the World Wide Web Consortium, 11.2.2025, https://socialwebfoundation.org/2025/02/11/the-social-web-foundation-announces-its-membership-in-the-world-wide-web-consortium/.
The Verge (2023). Threads is officially starting to test ActivityPub integration, 13.12.2023, https://www.theverge.com/2023/12/13/24000120/threads-meta-activitypub-test-mastodon.
Woźniak, Michał “rysiek” (2025). Eight years on, Mastodon stubbornly survives, personal blog, 05.04.2025, https://rys.io/en/177.html.
#Fediverse #FreeCulture #Internet #mediaScience #publicSphere
-
Find Your XMPP Chat Provider!
Come by to the XMPP/Jabber #Realtime Lounge at #FOSDEM! ULB, AW building, Level 1
#chat #messaging #xmpp #jabber #standards #interoperability
#decentralization #operators #service #EU #europa #opensource #EuropeanUnion #europe #FOSDEM
#Brussels -
Find Your European Union XMPP Chat Provider!
You can now easily find an XMPP provider based in the European Union:
https://providers.xmpp.net/blog/2026-01-18-eu-providers/See you at FOSDEM! AW building, Level 1
#chat #messaging #xmpp #jabber #standards #interoperability #decentralization #operators #service #EU #europa #opensource #EuropeanUnion #europe #FOSDEM #Brussels
-
#XMPP has proven to last in the toughest environments!
#chat #messaging #jabber #standards #opensource
#interoperability #decentralization #operators #service -
New table functions in Overview
On the #XMPP #Providers Overview page the table received new functions. Here you can see all available information across the #operators in a tabular view.
Search now each column for specific information. If you are actively looking for custom properties, easily start breaking down the table to your needs.
#chat #messaging #jabber #standards
#interoperability #decentralization #operators #service -
WHY do you have to convince somebody to change?
As user, I expect, when using some kind of communication, I can communicate to everybody, using same kind communication.
Let's say I send a letter - it goes around the world! Transported by many different providers.
Let's say I use landline provider "A" - why shouldn't I be able to call a frind using provider "B" or "H"??
So WHY change to Signal?
Basically it's the same as Whatsapp but
- blue instead of green.
- it's a walled garden, too (only signal can talk to signal)
- it's not free software in means of you can use/modify AND paritcipate
- you need to have phone number & a smart phone, at least to register
- it's driven by servers you mybe don't trust or would ever use? oil driven? nuclear energy driven?
- it's very easy to loose chat history, when changing deivces - we'll - a new chat history will be available soon
- [...]I like to use, what I WANT to and am still be able to communicate with everybody.
That's why I prefer using an open system. I can choose from several clients and lots of providers (or be my own one). I prefer Matrix - it's that open, that by using bridges I only have one single client for signal, rarely used whatsapp (a shared account), some email and, offcourse, matrix.
-
You have probably seen this #viral #infographic on #eu #digitalsovereignty by #reddit user u/lukakopajtic. It was viral but not very accurate 😅 recommending #bluesky and #firefox as "EU alternatives"? How? Anyway, he just updated the infographic, and it's much, much better! Most issues have been corrected. I think there is still a couple of issues I disagree with: 1) recommending #matrix instead of #jabber #xmpp 2) recommending #lineageos instead of #grapheneos (but OK, I can understand this if the focus is on self-sovereignty only), 3) recommending #droidify instead of #accrescent (but, even here, I can understand if the goal is to replace #playstore ), and 4) recommending #thunderbird as a comparison to #gmail (nothing wrong with Thunderbird, but that's an email client, not a Gmail-like suite provider, I would have rather recommended #mailfence or #mailbox ). Kudos for the initiative though, the intentions are good!
-
takahē - A new Fediverse paradigm
Fresh out of the oven is #Takahē, introducing a very interesting basic functional motive for development and delivering a beautiful #UX. It also derives inspiration in the form of its #mascott from a species once thought extinct for about a century.
That is, until a single man obsessed with the saga of this large, flightness bird since his early childhood, endlessly sought out and eventually rediscovered it was actually extant 75 years ago through his tireless efforts.
In recent years, and not without some particularly problematic attempts in the management of this #endangered species, the population of these magnificent birds has more or less stabilized at around 100 members living in the wild, thanks to the committed efforts of a government sponsored #refoliation, hatching, and rearing program; in conjunction with a comprehensive scientific tagging, tracking, and monitoring effort of those members released into the wild alongside the wild-born members of the #population.
The software project itself has struck me as rather special too, and not just for its two functionally unique characteristics amongst other #Fediverse platforms - first, and similar to name based #SSL hosting on #HTTP servers with #SNI, Takahē provides multi-domain virtual hosting capabilities to #ActivityPub - **this is huge**, and opens the door for for even the casusl home self-hoster to provide #turnkey #SaaS offerings to their friends and family members in the form of small and #single user "virtual Fediverse server instances", in consumer based home #LAN environments - let alone the potential for commercial hosting endeavors.
To my knowledge, ***this is the very first time* this novel approach to Fediverse networking over ActivityPub has been broached**.
jointakahe.org/
***If you hurry***, you might still be able to secure for yourself an account in their limited beta program.
Go ahead, you can do that now, I'll still be here when you get back 😎
And as if that alone were not enough to revolutionize the paradigm and dynamic of the Fediverse, **Takahē also introduces multiple account (alt) identities for each user user account on the server**. This can only be described as freaking groundbreaking!
A single user account for a person might be the base for say, both @[email protected] *AND* @userone@SLD02 .TLD02 *AND* @usertwo@SLD02 .TLD02 - that, at least to me, can only be described as, **"The Bees Knees"**.
I'm sure that many will cite, and of course it is not only possible but quite likely, that this will lower the bar for abusive actors to engage in shenanigans. However true as that may be, such potential (and existing practice) exists already within the Fediverse so the ease with which bad actors will avail themselves of such toolings only is only trivially simplified, not introduced; besides, complaining about such a thing is irrelevant - *the cat is already out of the bag*.
Indeed, there are already other Fediverse server platforms (such as the Hubzilla (ZOT) and Misskey families of forks and variants that already support the creation and management of multiple identities under a single account anyway - but Bringing the SNI shared hosting experience into production with a single Fediverse server instance is truly unprecedented in Fediverse space.
There's a lot more. **Did I mention the beautiful, and exceedingly intuitive UI?** Of course I did!
There's another corollary that I alluded to. Did you miss it? It was right there, *before your eyes*.
Yes, there's a metaphor, craftily scripted between the lines of everything you just read (that is, if you didn't tl;dr).
The impetus for much of #decentralization (DeSoc) and the #Genesis of the Fediverse is arguably the notion of what was indeed a #decentralized #World Wide Web over the fully decentralized #Internet, having falling victim to capture by special interests - the #deprecated, #proprietary, #privacy disrespecting and #legacy #monolithic silos - owned, spawned, and managed by mega surveillance-capitalism #data mining corporations.... IOW, the so-called, **Sunnyvale Syndrome**.
This effectively killed of much of the notion that there even still existed an independant, #distributed network of services and sites truly belonging to the #individual participants, i.e., average #schmoes like you and me.
For sometime now, many have even claimed and argued that the kinder, friendlier #web of days gone by, where small #communities of #people and #websites belonging to #individuals and small businesses were actually #extinct in reality - with only those well heeled analytically correct, SEO optimized, #subjugated websites and #chattel in the form of people that had sworn #fealty to their lords and masters remaining. #Apple, #Amazon, the #Google and #Faceplant having long since taken #possession of their souls and #identities.
It's dark, so *incredibly dark*. And you have awakened to find yourself at the bottom of a well that you *apparently* have fallen into. There's plenty of water, you're knee deep in it, and a voice from above booms aloud that food will be delivered so long as, ***"It puts the lotion on its skin!"***
And in a manner of speaking, following an *"Internet century"* (think, 'dog years') of a #dystopian #feudal Institution where _Homo sapien_ drones existing in #Lords and Vassals lockstep, told what to think, how to believe, where to shit, and when to wake up and punch the time clock, had completely replaced the actually extinct human race... Well?...
***Fast forwarding to the scene where...***
Some awkward little child in a dimly candlelit bedroom, many children, truth be told, consumed with the dreams of, and empowered with an obsessive belief that, a world where real, unique and independently diverse human beings actually existed, grew up and many years later *rediscovered that they really did still walk the earth*.
Kinda like the true story of the **Takahē**. And we too, *are beautiful*.
I'm leaving the rest for you to discover for yourselves, and look forward to many discussions on this invigorating topic. In the meantime, you can follow:
@takahe
I can be reached on Matrix at:
`@tallship:matrix.org`
via XMPP at:
`[email protected]`
and in the Fediverse at:
`@[email protected]`
I hope that helps! Enjoy!
#tallship #FOSS #virtual hosting #multiple identity #DeSoc #Sunnyvale Syndrome #AOL Effect
⛵
. -
Security Issues in Matrix’s Olm Library
I don’t consider myself exceptional in any regard, but I stumbled upon a few cryptography vulnerabilities in Matrix’s Olm library with so little effort that it was nearly accidental.
It should not be this easy to find these kind of issues in any product people purportedly rely on for private messaging, which many people evangelize incorrectly as a Signal alternative.
Later, I thought I identified an additional vulnerability that would have been much worse, but I was wrong about that one. For the sake of transparency and humility, I’ll also describe that in detail.
This post is organized as follows:
- Disclosure Timeline
- Vulnerabilities in Olm (Technical Details)
- Recommendations
- Background Information
- An Interesting Non-Issue That Looked Critical
I’ve opted to front-load the timeline and vulnerability details to respect the time of busy security professionals.
Please keep in mind that this website is a furry blog, first and foremost, that sometimes happens to cover security and cryptography topics.
Many people have, over the years, assumed the opposite and commented accordingly. The ensuing message board threads are usually is a waste of time and energy for everyone involved. So please adjust your expectations.
Art by HarubakiIf you’re curious, you can learn more here.
Disclosure Timeline
- 2024-05-15: I took a quick look at the Matrix source code. I identified two issues and emailed them to their
security@email address.In my email, I specify that I plan to disclose my findings publicly in 90 days (i.e. on August 14), in adherence with industry best practices for coordinated disclosure, unless they request an extension in writing.
- 2024-05-16: I checked something else on a whim and find a third issue, which I also email to their
security@email address. - 2024-05-17: Matrix security team confirms receipt of my reports.
- 2024-05-17: I follow up with a suspected fourth finding–the most critical of them all. They point out that it is not actually an issue, because I overlooked an important detail in how the code is architected. Mea culpa!
- 2024-05-18: A friend discloses a separate finding with Matrix: Media can be decrypted to multiple valid plaintexts using different keys and Malicious homeservers can trick Element/Schildichat into revealing links in E2EE rooms.
They instructed the Matrix developers to consult with me if they needed cryptography guidance. I never heard from them on this externally reported issue.
- 2024-07-12: I shared this blog post draft with the Matrix security team while reminding them of the public disclosure date.
- 2024-07-31: Matrix pushes a commit that announces that libolm is deprecated.
- 2024-07-31: I email the Matrix security team asking if they plan to fix the reported issues (and if not, if there’s any other reason I should withhold publication).
- 2024-07-31: Matrix confirms they will not fix these issues (due to its now deprecated status), but ask that I withhold publication until the 14th as originally discussed.
- 2024-08-14: This blog post is publicly disclosed to the Internet.
- 2024-08-14: The lead Matrix dev claims they already knew about these issues, and, in fact, knowingly shipped cryptography code that was vulnerable to side-channel attacks for years. See Addendum.
- 2024-08-23: MITRE has assigned CVE IDs to these three findings.
Vulnerabilities in Olm
I identified the following issues with Olm through a quick skim of their source code on Gitlab:
- AES implementation is vulnerable to cache-timing attacks
- Ed25519 signatures are malleable
- Timing leakage in base64 decoding of private key material
This is sorted by the order in which they were discovered, rather than severity.
AES implementation is vulnerable to cache-timing attacks
a.k.a. CVE-2024-45191
Olm ships a pure-software implementation of AES, rather than leveraging hardware acceleration.
// Substitutes a word using the AES S-Box.WORD SubWord(WORD word){unsigned int result;result = (int)aes_sbox[(word >> 4) & 0x0000000F][word & 0x0000000F];result += (int)aes_sbox[(word >> 12) & 0x0000000F][(word >> 8) & 0x0000000F] << 8;result += (int)aes_sbox[(word >> 20) & 0x0000000F][(word >> 16) & 0x0000000F] << 16;result += (int)aes_sbox[(word >> 28) & 0x0000000F][(word >> 24) & 0x0000000F] << 24;return(result);}The code in question is called from this code, which is in turn used to actually encrypt messages.
Software implementations of AES that use a look-up table for the SubWord step of the algorithm are famously susceptible to cache-timing attacks.
This kind of vulnerability in software AES was previously used to extract a secret key from OpenSSL and dm-crypt in about 65 milliseconds. Both papers were published in 2005.
A general rule in cryptography is, “attacks only get better; they never get worse“.
As of 2009, you could remotely detect a timing difference of about 15 microseconds over the Internet with under 50,000 samples. Side-channel exploits are generally statistical in nature, so such a sample size is generally not a significant mitigation.
How is this code actually vulnerable?
In the above code snippet, the vulnerability occurs in
aes_sbox[/* ... */][/* ... */].Due to the details of how the AES block cipher works, the input variable (
word) is a sensitive value.Software written this way allows attackers to detect whether or not a specific value was present in one of the processor’s caches.
To state the obvious: Cache hits are faster than cache misses. This creates an observable timing difference.
Such a timing leak allows the attacker to learn the value that was actually stored in said cache. You can directly learn this from other processes on the same hardware, but it’s also observable over the Internet (with some jitter) through the normal operation of vulnerable software.
See also: cryptocoding’s description for table look-ups indexed by secret data.
How to mitigate this cryptographic side-channel
The correct way to solve this problem is to use hardware accelerated AES, which uses distinct processor features to implement the AES round function and side-steps any cache-timing shenanigans with the S-box.
Not only is this more secure, but it’s faster and uses less energy too!
If you’re also targeting devices that don’t have hardware acceleration available, you should first use hardware acceleration where possible, but then fallback to a bitsliced implementation such as the one in Thomas Pornin’s BearSSL.
See also: the BearSSL documentation for constant-time AES.
Art by AJEd25519 signatures are malleable
a.k.a. CVE-2024-45193
Ed25519 libraries come in various levels of quality regarding signature validation criteria; much to the chagrin of cryptography engineers everywhere. One of those validation criteria involves signature malleability.
Signature malleability usually isn’t a big deal for most protocols, until suddenly you discover a use case where it is. If it matters, that usually that means you’re doing something with cryptocurrency.
Briefly, if your signatures are malleable, that means you can take an existing valid signature for a given message and public key, and generate a second valid signature for the same message. The utility of this flexibility is limited, and the impact depends a lot on how you’re using signatures and what properties you hope to get out of them.
For ECDSA, this means that for a given signature , a second signature is also possible (where is the order of the elliptic curve group you’re working with).
Matrix uses Ed25519, whose malleability is demonstrated between and .
This is trivially possible because S is implicitly reduced modulo the order of the curve, , which is a 253-bit number (
0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed) and S is encoded as a 256-bit number.The Ed25519 library used within Olm does not ensure that , thus signatures are malleable. You can verify this yourself by looking at the Ed25519 verification code.
int ed25519_verify(const unsigned char *signature, const unsigned char *message, size_t message_len, const unsigned char *public_key) { unsigned char h[64]; unsigned char checker[32]; sha512_context hash; ge_p3 A; ge_p2 R; if (signature[63] & 224) { return 0; } if (ge_frombytes_negate_vartime(&A, public_key) != 0) { return 0; } sha512_init(&hash); sha512_update(&hash, signature, 32); sha512_update(&hash, public_key, 32); sha512_update(&hash, message, message_len); sha512_final(&hash, h); sc_reduce(h); ge_double_scalarmult_vartime(&R, h, &A, signature + 32); ge_tobytes(checker, &R); if (!consttime_equal(checker, signature)) { return 0; } return 1;}This is almost certainly a no-impact finding (or low-impact at worst), but still an annoying one to see in 2024.
If you’d like to learn more, this page is a fun demo of Ed25519 malleability.
To mitigate this, I recommend implementing these checks from libsodium.
Art: CMYKatTiming leakage in base64 decoding of private key material
a.k.a. CVE-2024-45192
If you weren’t already tired of cache-timing attacks based on table look-ups from AES, the Matrix base64 code is also susceptible to the same implementation flaw.
while (pos != end) { unsigned value = DECODE_BASE64[pos[0] & 0x7F]; value <<= 6; value |= DECODE_BASE64[pos[1] & 0x7F]; value <<= 6; value |= DECODE_BASE64[pos[2] & 0x7F]; value <<= 6; value |= DECODE_BASE64[pos[3] & 0x7F]; pos += 4; output[2] = value; value >>= 8; output[1] = value; value >>= 8; output[0] = value; output += 3;}The base64 decoding function in question is used to load the group session key, which means the attack published in this paper almost certainly applies.
How would you mitigate this leakage?
Steve Thomas (one of the judges of the Password Hashing Competition, among other noteworthy contributions) wrote some open source code a while back that implements base64 encoding routines in constant-time.
The real interesting part is how it avoids a table look-up by using arithmetic (from this file):
// Base64 character set:// [A-Z] [a-z] [0-9] + /// 0x41-0x5a, 0x61-0x7a, 0x30-0x39, 0x2b, 0x2finline int base64Decode6Bits(char src){int ch = (unsigned char) src;int ret = -1;// if (ch > 0x40 && ch < 0x5b) ret += ch - 0x41 + 1; // -64ret += (((0x40 - ch) & (ch - 0x5b)) >> 8) & (ch - 64);// if (ch > 0x60 && ch < 0x7b) ret += ch - 0x61 + 26 + 1; // -70ret += (((0x60 - ch) & (ch - 0x7b)) >> 8) & (ch - 70);// if (ch > 0x2f && ch < 0x3a) ret += ch - 0x30 + 52 + 1; // 5ret += (((0x2f - ch) & (ch - 0x3a)) >> 8) & (ch + 5);// if (ch == 0x2b) ret += 62 + 1;ret += (((0x2a - ch) & (ch - 0x2c)) >> 8) & 63;// if (ch == 0x2f) ret += 63 + 1;ret += (((0x2e - ch) & (ch - 0x30)) >> 8) & 64;return ret;}Any C library that handles base64 codecs for private key material should use a similar implementation. It’s fine to have a faster base64 implementation for non-secret data.
Worth noting: Libsodium also provides a reasonable Base64 codec.
Recommendations
These issues are not fixed in libolm.
Instead of fixing libolm, the Matrix team recommends all Matrix clients adopt vodozemac.
I can’t speak to the security of vodozemac.
Art: CMYKatBut I can speak against the security of libolm, so moving to vodozemac is probably a good idea. It was audited by Least Authority at one point, so it’s probably fine.
Most Matrix clients that still depended on libolm should treat this blog as public 0day, unless the Matrix security team already notified you about these issues.
Background Information
If you’re curious about the backstory and context of these findings, read on.
Otherwise, feel free to skip this section. It’s not pertinent to most audiences. The people that need to read it already know who they are.
End-to-end encryption is one of the topics within cryptography that I find myself often writing about.
In 2020, I wrote a blog post covering end-to-end encryption for application developers. This was published several months after another blog I wrote covering gripes with AES-GCM, which included a shallow analysis of how Signal uses the algorithm for local storage.
In 2021, I published weaknesses in another so-called private messaging app called Threema.
In 2022, after Elon Musk took over Twitter, I joined the Fediverse and sought to build end-to-end encryption support for direct messages into ActivityPub, starting with a specification. Work on this effort was stalled while trying to solve Public Key distribution in a federated environment (which I hope to pick up soon, but I digress).
Earlier this year, the Telegram CEO started fearmongering about Signal with assistance from Elon Musk, so I wrote a blog post urging the furry fandom to move away from Telegram and start using Signal more. As I had demonstrated years prior, I was familiar with Signal’s code and felt it was a good recommendation for security purposes (even if its user experience needs significant work).
I thought that would be a nice, self-contained blog post. Some might listen, most would ignore it, but I could move on with my life.
I was mistaken about that last point.
Art by AJAn overwhelming number of people took it upon themselves to recommend or inquire about Matrix, which prompted me to hastily scribble down my opinion on Matrix so that I might copy/paste a link around and save myself a lot of headache.
Just when I thought the firehose was manageable and I could move onto other topics, one of the Matrix developers responded to my opinion post.
Thus, I decided to briefly look at their source code and see if any major or obvious cryptography issues would fall out of a shallow visual scan.
Since you’re reading this post, you already know how that ended.
Credit: CMYKatSince the first draft of this blog post was penned, I also outlined what I mean when I say an encrypted messaging app is a Signal competitor or not, and published my opinion on XMPP+OMEMO (which people also recommend for private messaging).
Why mention all this?
Because it’s important to know that I have not audited the Olm or Megolm codebases, nor even glanced at their new Rust codebase.
The fact is, I never intended to study Matrix. I was annoyed into looking at it in the first place.
My opinion of their project was already calcified by the previously discovered practically-exploitable cryptographic vulnerabilities in Matrix in 2022.
The bugs described above are the sort of thing I mentally scan for when I first look at a project just to get a feel for the maturity of the codebase. I do this with the expectation (hope, really) of not finding anything at all.
(If you want two specific projects that I’ve subjected to a similar treatment, and failed to discover anything interesting in: Signal and WireGuard. These two set the bar for cryptographic designs.)
It’s absolutely bonkers that an AES cache timing vulnerability was present in their code in 2024.
It’s even worse when you remember that I was inundated with Matrix evangelism in response to recommending furries use Signal.
I’m a little outraged because of how irresponsible this is, in context.
It’s so bad that I didn’t even need to clone their git repository, let alone run basic static analysis tools locally.
So if you take nothing else away from this blog post, let it be this:
There is roughly a 0% chance that I got extremely lucky in my mental
grepand found the only cryptography implementation flaws in their source code. I barely tried at all and found these issues.I would bet money on there being more bugs or design flaws that I didn’t find, because this discovery was the result of an extremely half-assed effort to blow off steam.
Wasn’t libolm deprecated in May 2022?
The Matrix developers like to insist that their new Rust hotness “vodozemac” is what people should be using today.
I haven’t looked at vodozemac at all, but let’s pretend, for the sake of argument, that its cryptography is actually secure.
(This is very likely if they turn out to be using RustCrypto for their primitives, but I don’t have the time or energy for that nerd snipe, so I’m not going to look. Least Authority did audit their Rust library, for what it’s worth, and Least Authority isn’t clownshoes.)
It’s been more than 2 years since they released vodozemac. What does the ecosystem penetration for this new library look like, in practice?
A quick survey of the various Matrix clients on GitHub says that libolm is still the most widely used cryptography implementation in the Matrix ecosystem (as of this writing):
Matrix ClientCryptography Backendhttps://github.com/tulir/gomukslibolm (1, 2)https://github.com/niochat/niolibolm (1, 2)https://github.com/ulyssa/iambvodozemac (1, 2)https://github.com/mirukana/miragelibolm (1)https://github.com/Pony-House/Clientlibolm (1)https://github.com/MTRNord/cetirizinevodozemac (1)https://github.com/nadams/go-matrixclinonehttps://github.com/mustang-im/mustanglibolm (1)https://github.com/marekvospel/libretrixlibolm (1)https://github.com/yusdacra/icy_matrixnonehttps://github.com/ierho/elementlibolm (through the python SDK)https://github.com/mtorials/cordlessnonehttps://github.com/hwipl/nuqql-matrixdlibolm (through the python SDK)https://github.com/maxkratz/element-webvodozemac (1, 2, 3, 4)https://github.com/asozialesnetzwerk/riotlibolm (wasm file)https://github.com/NotAlexNoyle/Versilibolm (1, 2)3 of the 16 clients surveyed use the new vodozemac library. 10 still use libolm, and 3 don’t appear to implement end-to-end encryption at all.
If we only focus on clients that support E2EE, vodozemac has successfully been adopted by 19% of the open source Matrix clients on GitHub.
I deliberately excluded any repositories that were archived or clearly marked as “old” or “legacy” software, because including those would artificially inflate the representation of libolm. It would make for a more compelling narrative to do so, but I’m not trying to be persuasive here.
Deprecation policies are a beautiful lie. The impact of a vulnerability in Olm or Megolm is still far-reaching, and should be taken seriously by the Matrix community.
Worth calling out: this quick survey, which is based on a GitHub Topic, certainly misses other implementations. Both FluffyChat and Cinny, which were not tagged with this GitHub Topic, depend a language-specific Olm binding.
These bindings in turn wrap libolm rather than the Rust replacement, vodozemac.
But the official clients…
I thought the whole point of choosing Matrix over something like Signal is to be federated, and run your own third-party clients?
If we’re going to insist that everyone should be using Element if they want to be secure, that defeats the entire marketing point about third-party clients that Matrix evangelists cite when they decry Signal’s centralization.
So I really don’t want to hear it.
CMYKatAn Interesting Non-Issue That Looked Critical
As I mentioned in the timeline at the top, I thought I found a fourth issue with Matrix’s codebase. Had I been correct, this would have been a critical severity finding that the entire Matrix ecosystem would need to melt down to remediate.
Fortunately for everyone, I made a mistake, and there is no fourth vulnerability after all.
However, I thought it would be interesting to write about what I thought I found, the impact it would have had if it were real, and why I believed it to be an issue.
Let’s start with the code in question:
void ed25519_sign(unsigned char *signature, const unsigned char *message, size_t message_len, const unsigned char *public_key, const unsigned char *private_key) { sha512_context hash; unsigned char hram[64]; unsigned char r[64]; ge_p3 R; sha512_init(&hash); sha512_update(&hash, private_key + 32, 32); sha512_update(&hash, message, message_len); sha512_final(&hash, r); sc_reduce(r); ge_scalarmult_base(&R, r); ge_p3_tobytes(signature, &R); sha512_init(&hash); sha512_update(&hash, signature, 32); sha512_update(&hash, public_key, 32); sha512_update(&hash, message, message_len); sha512_final(&hash, hram); sc_reduce(hram); sc_muladd(signature + 32, hram, private_key, r);}The highlighted segment is doing pointer arithmetic. This means it’s reading 32 bytes, starting from the 32nd byte in
private_key.What’s actually happening here is:
private_keyis the SHA512 hash of a 256-bit seed. If you look at the function prototype, you’ll notice thatpublic_keyis a separate input.Virtually every other Ed25519 implementation I’ve ever looked at before expected users to provide a 32 byte seed followed by the public key as a single input.
This led me to believe that this
private_key + 32pointer arithmetic was actually using the public key for calculatingr.The variable
r(not to be confused with big R) generated via the first SHA512 is the nonce for a given signature, it must remain secret for Ed25519 to remain secure.If
ris known to an attacker, you can do some arithmetic to recover the secret key from a single signature.Because I had mistakenly believed that
Credit: CMYKatrwas calculated from the SHA512 of only public inputs (the public key and message), which I must emphasize isn’t correct, I had falsely concluded that any previously intercepted signature could be used to steal user’s private keys.But because
private_keywas actually the full SHA512 hash of the seed, rather than the seed concatenated with the public key, this pointer arithmetic did NOT use the public key for the calculation ofr, so this vulnerability does not exist.If the code did what I thought it did, however, this would have been a complete fucking disaster for the Matrix ecosystem. Any previously intercepted message would have allowed an attacker to recover a user’s secret key and impersonate them. It wouldn’t be enough to fix the code; every key in the ecosystem would need to be revoked and rotated.
Whew!
I’m happy to be wrong about this one, because that outcome is a headache nobody wants.
So no action is needed, right?
Well, maybe.
Matrix’s library was not vulnerable, but I honestly wouldn’t put it past software developers at large to somehow, somewhere, use the public key (rather than a secret value) to calculate the EdDSA signature nonces as described in the previous section.
To that end, I would like to propose a test vector be added to the Wycheproof test suite to catch any EdDSA implementation that misuses the public key in this way.
Then, if someone else screws up their Ed25519 implementation in the exact way I thought Matrix was, the Wycheproof tests will catch it.
For example, here’s a vulnerable test input for Ed25519:
{ "should-fail": true, "secret-key": "d1d0ef849f9ec88b4713878442aeebca5c7a43e18883265f7f864a8eaaa56c1ef3dbb3b71132206b81f0f3782c8df417524463d2daa8a7c458775c9af725b3fd", "public-key": "f3dbb3b71132206b81f0f3782c8df417524463d2daa8a7c458775c9af725b3fd", "message": "Test message", "signature": "ffc39da0ce356efb49eb0c08ed0d48a1cadddf17e34f921a8d2732a33b980f4ae32d6f5937a5ed25e03a998e4c4f5910c931b31416e143965e6ce85b0ea93c09"}A similar test vector would also be worth creating for Ed448, but the only real users of Ed448 were the authors of the xz backdoor, so I didn’t bother with that.
(None of the Project Wycheproof maintainers knew this suggestion is coming, by the way, because I was respecting the terms of the coordinated disclosure.)
Closing Thoughts
Despite finding cryptography implementation flaws in Matric’s Olm library, my personal opinion on Matrix remains largely unchanged from 2022. I had already assumed it would not meet my bar for security.
Cryptography engineering is difficult because the vulnerabilities you’re usually dealing with are extremely subtle. (Here’s an unrelated example if you’re not convinced of this general observation.) As SwiftOnSecurity once wrote:
https://twitter.com/SwiftOnSecurity/status/832058185049579524
The people that developed Olm and Megolm has not proven themselves ready to build a Signal competitor. In balance, most teams are not qualified to do so.
I really wish the Matrix evangelists would accept this and stop trying to cram Matrix down other people’s throats when they’re talking about problems with other platforms entirely.
More important for the communities of messaging apps:
You don’t need to be a Signal competitor. Having E2EE is a good thing on its own merits, and really should be table stakes for any social application in 2024.
It’s only when people try to advertise their apps as a Signal alternative (or try to recommend it instead of Signal), and offer less security, that I take offense.
Just be your own thing.
My work-in-progress proposal to bring end-to-end encryption to the Fediverse doesn’t aim to compete with Signal. It’s just meant to improve privacy, which is a good thing to do on its own merits.
If I never hear Matrix evangelism again after today, it would be far too soon.
If anyone feels like I’m picking on Matrix, don’t worry: I have far worse things to say about Telegram, Threema, XMPP+OMEMO, Tox, and a myriad other projects that are hungry for Signal’s market share but don’t measure up from a cryptographic security perspective.
If Signal fucked up as bad as these projects, my criticism of Signal would be equally harsh. (And remember, I have looked at Signal before.)
Addendum (2024-08-14)
One of the lead Matrix devs posted a comment on Hacker News after this blog post went live that I will duplicate here:
the author literally picked random projects from github tagged as matrix, without considering their prevalence or whether they are actually maintained etc.
if you actually look at % of impacted clients, it’s tiny.
meanwhile, it is very unclear that any sidechannel attack on a libolm based client is practical over the network (which is why we didn’t fix this years ago). After all, the limited primitives are commented on in the readme and https://github.com/matrix-org/olm/issues/3 since day 1.
So the Matrix developers already knew about these vulnerabilities, but deliberately didn’t fix them, for years.
Congratulations, you’ve changed my stance. It used to be “I don’t consider Matrix a Signal alternative and they’ve had some embarrassing and impactful crypto bugs but otherwise I don’t care”. Now it’s a stronger stance:
Don’t use Matrix.
I had incorrectly assumed ignorance, when it was in fact negligence.
There’s no reasonable world in which anyone should trust the developers of cryptographic software (i.e., libolm) that deliberately ships with side-channels for years, knowing they’re present, and never bother to fix them.
This is fucking clownshoes.
If you’re curious about the cryptography used by other messaging apps, please refer to this page that collects my blogs about this topic.
#crypto #cryptography #endToEndEncryption #Matrix #sideChannels #vuln
-
This weekend project (yes, another one instead of finishing the 100 others) is a #fastcgi handler to implement xep-0070, alnowing to use an #xmpp account to log in to a website. Writing it in #rust as a learning exercise.
I hope to replace "login with google" and the other things I had to add to my website ovwr the years in order to not store people's passwords. This should allow to do it in a decentralized way without forcing any specific provider.
-
@kkarhan @monocles @Stuxhost @delta Thank you for your valuable input! It's always enlightening to hear different perspectives on communication tools.
#Linphone Firstly, I appreciate the mention of Linphone. It is indeed a great tool, and I should have included it in my list. Linphone stands out for its versatility and strong support for various communication protocols, making it a robust option for both personal and professional use.#DeltaChat is new to me, and I am eager to give it a try. However, I am curious: is it just another XMPP client, or does it offer unique features that set it apart? Generally, I prefer les feature-rich clients because I often use just simple text and voice communication. For my personal use case, XMPP is fine when it is compatible with TTS (Text-to-Speech). You're right that IRC and XMPP have their strengths, but I am always on the lookout for tools that I can offer to regular users.
#Signal and Session are both backed by single entities but prioritize user privacy. Personally, I don't have enough experience to delve deeply into the pros and cons of Signal and Session. A significant limitation of Signal is that I can't build the app from source code, and as far as I know, there is no real way to run it on a server OS—it's only available on iOS, Android, and via Waydroid on Linux, with wayland GUI. At least Session is working on x86 architectures. In general, I think both are useful for mainstream users due to their familiar interfaces and ease of use. While Signal and Session do a good job with privacy, they may not be the most secure options, and they certainly don't rank high on the Free Software scale. Would you agree with my evaluation, or could you elaborate on your criticism?
#Matrix is designed to be decentralized and open, allowing users to host their own servers. This decentralization provides greater control over data and enhances privacy. Comparing Matrix to XMPP+OMEMO might oversimplify its capabilities, as Matrix offers advanced features like cross-platform interoperability and robust end-to-end encryption. It's open-source, and I haven't seen any obvious problems with it. Could you elaborate on your thoughts about Matrix?
-
Users Are Too Dependent on Centralized Techno-Fascist Corporate Structure to Ever Leave Discord
I’m watching people scatter into countless real-time chat alternatives to Discord after Discord started pulling the age-verification and age-gating card.
It’s very frustrating because people are entirely missing the point of a community and how social networks work. Real-time platforms and social media networks only work well when a large number of people share the same space at the same time. If everyone creates separate servers or competing apps, the result is fragmentation that makes it unviable.
One reason why Bluesky became so successful is the invitation and starter-pack move. It essentially allowed people to move collectively as cliques. Bluesky used invitations and starter packs to move groups of friends together. This kept communities intact. Moving as cliques preserves network structure, whereas random scattering does not. People aren’t do not seem to intend to move as cliques or subgraphs of networks off of Discord. And the whole reason people were on Discord was to host their communities, so an alternative becomes pointless if your community doesn’t remain intact.
Instead of an active, strongly connected, possibly distributed network, you get dozens of small pockets. I am referring to a potential distributed network rather than a single centralized platform, because Matrix is an example of a decentralized chat protocol. Not all alternatives have to be centralized like Discord. Technically, many older chat protocols, such as XMPP and IRC, are examples of federated real-time synchronous messaging. They allowed communication between users on different, independently operated servers. Federation means that multiple servers can interconnect so that users from separate networks can exchange messages with one another seamlessly.
Decentralized alternatives would not be a problem if people moved to the same distributed network as cohesive groups. However, what I am seeing is that people move in disconnected and stochastic ways to entirely separate distributed networks, so communities are not kept intact. For example, when people move to XMPP servers or Matrix servers, it bifurcates and disconnects social networks. Notice I said XMPP or Matrix, which logically means people are on Matrix but not XMPP, or they are on XMPP but not Matrix. That implies a person would need to be on both Matrix and XMPP to speak to their original community from Discord if it split down the middle. To synchronize conversations in chats, there would need to be a bridge. It’s a pretty complicated solution.
The likely outcome is that people will remain on the dominant platform because of its scale and structure. The deeper irony is that while people may want independence from corporate platforms, they often struggle to organize effectively without the centralized structure those platforms provide. They’ve become so dependent on corporate structures to support their communities that they have no clue how to organize their own social networks in a sustainable way.
I’ve always been an internet nerd, but most of my social life has been offline. I view my interactions with the social app layer of the internet as a game, so losing that domain of the Internet is not devastating to me.
I’ll give you an example. This is a WordPress site. You hear this insincere nostalgia from Millennials and Gen X for a simulacrum that never was, especially concerning forums. Check this out: when you go into the plugin installation section of WordPress, this is on the second row you see:
That means any WordPress site has the capability to host a forum. They’re nostalgic for a setup where you can use a simple install script on any hosting service to install WordPress. After that, you can then just add a plugin to turn it into a forum. Hell, they can do this on WordPress.com if they don’t want to self-host.
You can make a forum, but no one will use it because they’d rather use a centralized platform like Reddit. Users have become so dependent on corporations to structure and organize communities that they can’t do it themselves. It’s sort of like the cognitive debt that accrues when people outsource their thinking to AI.
The issue is not that forums are hard to host or create; rather, the issue is that people have become so dependent on centralized corporate structures that they can’t maintain or organize their own communities, which is why everyone ends up on Reddit or Discord. A reason I keep hearing for why people don’t want to leave Discord is that it’s hard to recreate the community structure that Discord’s features provide. They claim that they want independence from corporate platforms, but rely on the centralized structure those platforms provide to function socially.
People say they want decentralized freedom, but in practice they depend on centralized platforms to maintain social cohesion. Stochastically scattering to the digital winds of the noosphere destroys the very communities they’re trying to preserve.
-
Users Are Too Dependent on Centralized Techno-Fascist Corporate Structure to Ever Leave Discord
I’m watching people scatter into countless real-time chat alternatives to Discord after Discord started pulling the age-verification and age-gating card.
It’s very frustrating because people are entirely missing the point of a community and how social networks work. Real-time platforms and social media networks only work well when a large number of people share the same space at the same time. If everyone creates separate servers or competing apps, the result is fragmentation that makes it unviable.
One reason why Bluesky became so successful is the invitation and starter-pack move. It essentially allowed people to move collectively as cliques. Bluesky used invitations and starter packs to move groups of friends together. This kept communities intact. Moving as cliques preserves network structure, whereas random scattering does not. People aren’t do not seem to intend to move as cliques or subgraphs of networks off of Discord. And the whole reason people were on Discord was to host their communities, so an alternative becomes pointless if your community doesn’t remain intact.
Instead of an active, strongly connected, possibly distributed network, you get dozens of small pockets. I am referring to a potential distributed network rather than a single centralized platform, because Matrix is an example of a decentralized chat protocol. Not all alternatives have to be centralized like Discord. Technically, many older chat protocols, such as XMPP and IRC, are examples of federated real-time synchronous messaging. They allowed communication between users on different, independently operated servers. Federation means that multiple servers can interconnect so that users from separate networks can exchange messages with one another seamlessly.
Decentralized alternatives would not be a problem if people moved to the same distributed network as cohesive groups. However, what I am seeing is that people move in disconnected and stochastic ways to entirely separate distributed networks, so communities are not kept intact. For example, when people move to XMPP servers or Matrix servers, it bifurcates and disconnects social networks. Notice I said XMPP or Matrix, which logically means people are on Matrix but not XMPP, or they are on XMPP but not Matrix. That implies a person would need to be on both Matrix and XMPP to speak to their original community from Discord if it split down the middle. To synchronize conversations in chats, there would need to be a bridge. It’s a pretty complicated solution.
The likely outcome is that people will remain on the dominant platform because of its scale and structure. The deeper irony is that while people may want independence from corporate platforms, they often struggle to organize effectively without the centralized structure those platforms provide. They’ve become so dependent on corporate structures to support their communities that they have no clue how to organize their own social networks in a sustainable way.
I’ve always been an internet nerd, but most of my social life has been offline. I view my interactions with the social app layer of the internet as a game, so losing that domain of the Internet is not devastating to me.
I’ll give you an example. This is a WordPress site. You hear this insincere nostalgia from Millennials and Gen X for a simulacrum that never was, especially concerning forums. Check this out: when you go into the plugin installation section of WordPress, this is on the second row you see:
That means any WordPress site has the capability to host a forum. They’re nostalgic for a setup where you can use a simple install script on any hosting service to install WordPress. After that, you can then just add a plugin to turn it into a forum. Hell, they can do this on WordPress.com if they don’t want to self-host.
You can make a forum, but no one will use it because they’d rather use a centralized platform like Reddit. Users have become so dependent on corporations to structure and organize communities that they can’t do it themselves. It’s sort of like the cognitive debt that accrues when people outsource their thinking to AI.
The issue is not that forums are hard to host or create; rather, the issue is that people have become so dependent on centralized corporate structures that they can’t maintain or organize their own communities, which is why everyone ends up on Reddit or Discord. A reason I keep hearing for why people don’t want to leave Discord is that it’s hard to recreate the community structure that Discord’s features provide. They claim that they want independence from corporate platforms, but rely on the centralized structure those platforms provide to function socially.
People say they want decentralized freedom, but in practice they depend on centralized platforms to maintain social cohesion. Stochastically scattering to the digital winds of the noosphere destroys the very communities they’re trying to preserve.
-
Users Are Too Dependent on Centralized Techno-Fascist Corporate Structure to Ever Leave Discord
I’m watching people scatter into countless real-time chat alternatives to Discord after Discord started pulling the age-verification and age-gating card.
It’s very frustrating because people are entirely missing the point of a community and how social networks work. Real-time platforms and social media networks only work well when a large number of people share the same space at the same time. If everyone creates separate servers or competing apps, the result is fragmentation that makes it unviable.
One reason why Bluesky became so successful is the invitation and starter-pack move. It essentially allowed people to move collectively as cliques. Bluesky used invitations and starter packs to move groups of friends together. This kept communities intact. Moving as cliques preserves network structure, whereas random scattering does not. People aren’t do not seem to intend to move as cliques or subgraphs of networks off of Discord. And the whole reason people were on Discord was to host their communities, so an alternative becomes pointless if your community doesn’t remain intact.
Instead of an active, strongly connected, possibly distributed network, you get dozens of small pockets. I am referring to a potential distributed network rather than a single centralized platform, because Matrix is an example of a decentralized chat protocol. Not all alternatives have to be centralized like Discord. Technically, many older chat protocols, such as XMPP and IRC, are examples of federated real-time synchronous messaging. They allowed communication between users on different, independently operated servers. Federation means that multiple servers can interconnect so that users from separate networks can exchange messages with one another seamlessly.
Decentralized alternatives would not be a problem if people moved to the same distributed network as cohesive groups. However, what I am seeing is that people move in disconnected and stochastic ways to entirely separate distributed networks, so communities are not kept intact. For example, when people move to XMPP servers or Matrix servers, it bifurcates and disconnects social networks. Notice I said XMPP or Matrix, which logically means people are on Matrix but not XMPP, or they are on XMPP but not Matrix. That implies a person would need to be on both Matrix and XMPP to speak to their original community from Discord if it split down the middle. To synchronize conversations in chats, there would need to be a bridge. It’s a pretty complicated solution.
The likely outcome is that people will remain on the dominant platform because of its scale and structure. The deeper irony is that while people may want independence from corporate platforms, they often struggle to organize effectively without the centralized structure those platforms provide. They’ve become so dependent on corporate structures to support their communities that they have no clue how to organize their own social networks in a sustainable way.
I’ve always been an internet nerd, but most of my social life has been offline. I view my interactions with the social app layer of the internet as a game, so losing that domain of the Internet is not devastating to me.
I’ll give you an example. This is a WordPress site. You hear this insincere nostalgia from Millennials and Gen X for a simulacrum that never was, especially concerning forums. Check this out: when you go into the plugin installation section of WordPress, this is on the second row you see:
That means any WordPress site has the capability to host a forum. They’re nostalgic for a setup where you can use a simple install script on any hosting service to install WordPress. After that, you can then just add a plugin to turn it into a forum. Hell, they can do this on WordPress.com if they don’t want to self-host.
You can make a forum, but no one will use it because they’d rather use a centralized platform like Reddit. Users have become so dependent on corporations to structure and organize communities that they can’t do it themselves. It’s sort of like the cognitive debt that accrues when people outsource their thinking to AI.
The issue is not that forums are hard to host or create; rather, the issue is that people have become so dependent on centralized corporate structures that they can’t maintain or organize their own communities, which is why everyone ends up on Reddit or Discord. A reason I keep hearing for why people don’t want to leave Discord is that it’s hard to recreate the community structure that Discord’s features provide. They claim that they want independence from corporate platforms, but rely on the centralized structure those platforms provide to function socially.
People say they want decentralized freedom, but in practice they depend on centralized platforms to maintain social cohesion. Stochastically scattering to the digital winds of the noosphere destroys the very communities they’re trying to preserve.
-
In the newest edition of The Newsletter Leaf Journal, I recap the week that was at The New Leaf Journal, provide links from around the web, and discuss what looks like a very interesting FOSS project called sms4you, which allows for forwarding SMS messages to XMPP or email.
https://buttondown.email/newsletterleafjournal/archive/the-newsletter-leaf-journal-lxi-billy-the-pet svdesc/
#newsletter #aroundtheweb #links #owls #birds #foss #sms #xmpp #jmp #sms4you
-
We are looking to raise funds to provide bursaries to people promoting #Prav / #xmpp in different conferences / events. Unlike Operating System or Office Suite, messaging apps is not only personal choice.
We have setup a dedicated fund for this:
https://opencollective.com/pravapp/projects/event-bursariesWe have some funds from #PravConf sponsorship, but more would help us support people going to many more events like #BiharFOSS or #LucknowFOSS where we don't have many local community members.
-
Our hosting bill for https://poddery.com this month was 3492 INR (36.8 EUR). We provide #XMPP and #Matrix services to public.
It is run by volunteers of Free Software Community of India #fsci
@bady @kannan @sahil @ravi and many more.
Its costs are met through donations. So please consider donating or volunteering today. There is also non technical tasks like fund raising. See https://fsci.in/donate
If you are outside India buying us #Hetzner credits would be better.
-
The FreeBSD-native-ish home lab and network
For many years my setup was pretty simple: A FreeBSD home server running on my old laptop. It runs everything I need to be present on the internet, an email server, a web server (like the one you’ve accessed right now to see this blog post) and a public chat server (XMPP/Jabber) so I can be in touch with friends.
For my home network, I had a basic Access Point and a basic Router.
Lately, my setup has become more… intense. I have IPv6 thanks to Hurricane Electric, the network is passed to my home network (which we’ll talk about in a bit), a home network with multiple VLANs, since friends who come home also need WiFi.
I decided to blog about the details, hoping it would help someone in the future.
I’ll start with the simplest one.
The Home Server
I’ve been running home servers for a long time. I believe that every person/family needs a home server. Forget about buying your kids iPads and Smartphones. Their first devices should be a real computer (sorry Apple, iOS devices are still just a toy) like a desktop/laptop and a home server. The home server doesn’t need to be on the public internet, but mine is, for variety of reasons. This blog being one of them.
I get a static IP address from my ISP, Ucom. After the management change that happened couple of years ago, Ucom has become a very typical ISP (think shitty), but they are the only ones that provide a static IP address, instead of setting it on your router, where you have to do port forwarding.
My home server, hostnamed pingvinashen (meaning the town of the penguins, named after the Armenian cartoon) run FreeBSD. Historically this machine has run Debian, Funtoo, Gentoo and finally FreeBSD.
Hardware wise, here’s what it is:
root@pingvinashen:~ # dmidecode -s system-product-nameLatitude E5470root@pingvinashen:~ # sysctl hw.modelhw.model: Intel(R) Core(TM) i7-6820HQ CPU @ 2.70GHzroot@pingvinashen:~ # sysctl hw.physmemhw.physmem: 17016950784root@pingvinashen:~ # zpool listNAME SIZE ALLOC FREE CKPOINT EXPANDSZ FRAG CAP DEDUP HEALTH ALTROOTzroot 420G 178G 242G - - 64% 42% 1.00x ONLINE -
While most homelabbers use hardware virtualization, I think that resources are a tight thing, and should be managed properly. Any company that markets itself as “green/eco-friendly” and uses hardware virtualization should do calculations using a pen and paper and prove if going native would save power/resources or not. (sometimes it doesn’t, usually it does)
I use containers, the old-school ones, Jails to be more specific.
I manage jails using Jailer, my own tool, that tries to stay out of your way when working with Jails.
Here are my current jails:
root@pingvinashen:~ # jailer listNAME STATE JID HOSTNAME IPv4 GWantranig Active 1 antranig.bsd.am 192.168.10.42/24 192.168.10.1antranigv Active 2 antranigv.bsd.am 192.168.10.52/24 192.168.10.1git Stoppedhuginn0 Active 4 huginn0.bsd.am 192.168.10.34/24 192.168.10.1ifconfig Active 5 ifconfig.bsd.am 192.168.10.33/24 192.168.10.1lucy Active 6 lucy.vartanian.am 192.168.10.37/24 192.168.10.1mysql Active 7 mysql.antranigv.am 192.168.10.50/24 192.168.10.1newsletter Active 8 newsletter.bsd.am 192.168.10.65/24 192.168.10.1oragir Active 9 oragir.am 192.168.10.30/24 192.168.10.1psql Active 10 psql.pingvinashen.am 192.168.10.3/24 192.168.10.1rss Active 11 rss.bsd.am 192.168.10.5/24 192.168.10.1sarian Active 12 sarian.am 192.168.10.53/24 192.168.10.1syuneci Active 13 syuneci.am 192.168.10.60/24 192.168.10.1znc Active 14 znc.bsd.am 192.168.10.152/24 192.168.10.1
You already get a basic idea of how things are. Each of my blogs (Armenian and English) has its own Jail. Since I’m using WordPress, I need a database, so I have a MySQL jail (which ironically runs MariaDB) inside of it.
I also have a Git server, running gitea, which is down at the moment as I’m doing maintanence. The Git server (and many other services) requires PostgreSQL, hence the existence of a PostgreSQL jail. I run huginn for automation (RSS to Telegram, RSS to XMPP). My sister has her own blog, using WordPress, so that’s a Jail of its own. Same goes about my fiancée.
Other Jails are Newsletter using Listmonk, Sarian (the Armenian instance of lobste.rs) and a personal ZNC server.
As an avid RSS advocate, I also have a RSS Jail, which runs Miniflux. Many of my friends use this service.
Oragir is an instance of WriteFreely, as I advocate public blogging and ActivityPub. Our community uses that too.
The web server that forwards all this traffic from the public to the Jails is nginx. All it does is
proxy_passas needed. It runs on the host.Other services that run on the host are DNS (BIND9), an email service running
OpenSMTPd(which will be moved to a Jail soon), the chat service runningprosody(which will be moved to a Jail soon) and finally, WireGuard, because I love VPNs.Finally, there’s a IPv6-over-IPv4 tunnel that I use to obtain IPv6 thanks to Hurricane Electric.
Yes, I have a firewall, I use
pf(4).For the techies in the room, here’s what my
rc.conflooks like.# cat /etc/rc.conf# Defaultsclear_tmp_enable="YES"syslogd_flags="-ss"sendmail_enable="NONE"#local_unbound_enable="YES"sshd_enable="YES"moused_enable="YES"ntpd_enable="YES"# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disabledumpdev="AUTO"zfs_enable="YES"hostname="pingvinashen.am"# Networkingdefaultrouter="37.157.221.1"gateway_enable="YES"ifconfig_em0="up"vlans_em0="37 1000" # 1000 -> WAN; 37 -> Home Routerifconfig_em0_1000="inet 37.157.221.130 netmask 255.255.255.0"ifconfig_em0_37="inet 192.168.255.2 netmask 255.255.255.0"static_routes="home"route_home="-net 172.16.100.0/24 -gateway 192.168.255.1"cloned_interfaces="bridge0 bridge6 bridge10"ifconfig_bridge10="inet 192.168.10.1 netmask 255.255.255.0"## IPv6ipv6_gateway_enable="YES"gif_interfaces="gif0"gifconfig_gif0="37.157.221.130 216.66.84.46"ifconfig_gif0="inet6 2001:470:1f14:ef::2 2001:470:1f14:ef::1 prefixlen 128"ipv6_defaultrouter="2001:470:1f14:ef::1"ifconfig_em0_37_ipv6="inet6 2001:470:7914:7065::2 prefixlen 64"ipv6_static_routes="home guest"ipv6_route_home="-net 2001:470:7914:6a76::/64 -gateway 2001:470:7914:7065::1"ipv6_route_guest="-net 2001:470:7914:6969::/64 -gateway 2001:470:7914:7065::1"ifconfig_bridge6_ipv6="inet6 2001:470:1f15:e4::1 prefixlen 64"ifconfig_bridge6_aliases="inet6 2001:470:1f15:e4::25 prefixlen 64 \inet6 2001:470:1f15:e4::80 prefixlen 64 \inet6 2001:470:1f15:e4::5222 prefixlen 64 \inet6 2001:470:1f15:e4:c0fe::53 prefixlen 64 \"# VPNwireguard_enable="YES"wireguard_interfaces="wg0"# Firewallpf_enable="YES"# Jailsjail_enable="YES"jailer_dir="zfs:zroot/jails"# DNSnamed_enable="YES"# Mailsmtpd_enable="YES"smtpd_config="/usr/local/etc/smtpd.conf"# XMPPprosody_enable="YES"turnserver_enable="YES"# Webnginx_enable="YES"tor_enable="YES"
The
gif0interface is a IPv6-over-IPv4 tunnel. I have static routes to my home network, so I don’t go to my server over the ISP every time. This also gives me the ability to get IPv6 in my home network that is routed via my home server.As you have guessed from this config file, I do have VLANs setup. So let’s get into that.
The Home Network
First of all, here’s a very cheap diagram
I have the following VLANs setup on the switch.
VLAN IDPurpose1Switch Management1000pingvinashen (home server) WAN1001evn0 (home router) WAN37pingvinashen ↔ evn042Internal Management100Home LAN69Home GuestHere are the active ports
PortVLANsPurpose24untagged: 1Switch management, connects to Port 222untagged: 1000pingvinashen WAN, from ISP21untagged: 1001Home WAN, from ISP20tagged: 1000, 37To pingvinashen, portem019untagged: 1001To home router, portigb118tagged: 42, 100, 69, 99To home router, portigb217untagged: 37To home router, portigb016tagged: 42, 100, 69To Lenovo T480s15untagged: 100To Raspberri Pi 42untagged: 99From Port 24, for switch management1untagged: 42; tagged: 100, 69; PoETo UAP AC ProThe home router, hostnamed
evn0(named after the IATA code of Yerevan’s Zvartnots International Airport) runs FreeBSD as well, the hardware is the followingroot@evn0:~ # dmidecode -s system-product-nameAPU2root@evn0:~ # sysctl hw.modelhw.model: AMD GX-412TC SOC root@evn0:~ # sysctl hw.physmemhw.physmem: 4234399744root@evn0:~ # zpool listNAME SIZE ALLOC FREE CKPOINT EXPANDSZ FRAG CAP DEDUP HEALTH ALTROOTzroot 12.5G 9.47G 3.03G - - 67% 75% 1.00x ONLINE -
The home router does… well, routing. It also does DHCP, DNS, SLAAC, and can act as a syslog server.
Here’s what the
rc.conflooks likeclear_tmp_enable="YES"sendmail_enable="NONE"syslogd_flags="-a '172.16.100.0/24:*' -H"zfs_enable="YES"dumpdev="AUTO"hostname="evn0.illuriasecurity.com"pf_enable="YES"gateway_enable="YES"ipv6_gateway_enable="YES"sshd_enable="YES"# Get an IP address from the ISP's GPONifconfig_igb1="DHCP"# Internal routes with pingvinashenifconfig_igb0="inet 192.168.255.1 netmask 255.255.255.0"ifconfig_igb0_ipv6="inet6 2001:470:7914:7065::1 prefixlen 64"static_routes="pingvinashen"route_pingvinashen="-net 37.157.221.130/32 -gateway 192.168.255.2"ipv6_defaultrouter="2001:470:7914:7065::2"# Home Mgmt, Switch Mgmt, Home LAN, Home Guestifconfig_igb2="up"vlans_igb2="42 99 100 69"ifconfig_igb2_42="inet 172.31.42.1 netmask 255.255.255.0"ifconfig_igb2_99="inet 172.16.99.1 netmask 255.255.255.0"ifconfig_igb2_100="inet 172.16.100.1 netmask 255.255.255.0"ifconfig_igb2_100_ipv6="inet6 2001:470:7914:6a76::1 prefixlen 64"ifconfig_igb2_69="inet 192.168.69.1 netmask 255.255.255.0"ifconfig_igb2_69_ipv6="inet6 2001:470:7914:6969::1 prefixlen 64"# DNS and DHCPnamed_enable="YES"dhcpd_enable="YES"named_flags=""# NTPntpd_enable="YES"# Router Advertisement and LLDPrtadvd_enable="YES"lldpd_enable="YES"lldpd_flags=""
Here’s
pf.conf, because security is important.ext_if="igb1"bsd_if="igb0"int_if="igb2.100"guest_if="igb2.69"mgmt_if="igb2.42"sw_if="igb2.99"ill_net="172.16.0.0/16"nat pass on $ext_if from $int_if:network to any -> ($ext_if)nat pass on $ext_if from $mgmt_if:network to any -> ($ext_if)nat pass on $ext_if from $guest_if:network to any -> ($ext_if)set skip on { lo0 }block in allpass on $int_if from $int_if:network to anypass on $mgmt_if from $mgmt_if:network to anypass on $sw_if from $sw_if:network to anypass on $guest_if from $guest_if:network to anyblock quick on $guest_if from any to { $int_if:network, $mgmt_if:network, $ill_net, $sw_if:network }pass in on illuria0 from $ill_net to { $ill_net, $mgmt_if:network }pass inet proto icmppass inet6 proto icmp6pass out all keep stateI’m sure there are places to improve, but it gets the job done and keeps the guest network isolated.
Here’s
rtadvd.conf, for my IPv6 folksigb2.100:\ :addr="2001:470:7914:6a76::":prefixlen#64:\ :rdnss="2001:470:7914:6a76::1":\ :dnssl="evn0.loc.illuriasecurity.com,loc.illuriasecurity.com":igb2.69:\ :addr="2001:470:7914:6969::":prefixlen#64:\ :rdnss="2001:470:7914:6969::1":
For DNS, I’m running BIND, here’s the important parts
listen-on { 127.0.0.1; 172.16.100.1; 172.16.99.1; 172.31.42.1; 192.168.69.1; };listen-on-v6 { 2001:470:7914:6a76::1; 2001:470:7914:6969::1; };allow-query { 127.0.0.1; 172.16.100.0/24; 172.31.42.0/24; 192.168.69.0/24; 2001:470:7914:6a76::/64; 2001:470:7914:6969::/64;};And for DHCP, here’s what it looks like
subnet 172.16.100.0 netmask 255.255.255.0 { range 172.16.100.100 172.16.100.150; option domain-name-servers 172.16.100.1; option subnet-mask 255.255.255.0; option routers 172.16.100.1; option domain-name "evn0.loc.illuriasecurity.com"; option domain-search "loc.illuriasecurity.com evn0.loc.illuriasecurity.com";}host zvartnots { hardware ethernet d4:57:63:f1:5a:36; fixed-address 172.16.100.7;}host unifi0 { hardware ethernet 58:9c:fc:93:d1:0b; fixed-address 172.31.42.42;}
[…]subnet 172.31.42.0 netmask 255.255.255.0 { range 172.31.42.100 172.31.42.150; option domain-name-servers 172.31.42.1; option subnet-mask 255.255.255.0; option routers 172.31.42.1;}subnet 192.168.69.0 netmask 255.255.255.0 { range 192.168.69.100 192.168.69.150; option domain-name-servers 192.168.69.1; option subnet-mask 255.255.255.0; option routers 192.168.69.1;}So you’re wondering, what’s this
unifi0? Well, that brings us toT480s
This laptop has been gifted to me by [REDACTED] for my contributions to the Armenian government (which means when a server goes down and no one knows how to fix it, they called me and I showed up)
Here’s the hardware
root@t480s:~ # dmidecode -s system-versionThinkPad T480sroot@t480s:~ # sysctl hw.modelhw.model: Intel(R) Core(TM) i5-8350U CPU @ 1.70GHzroot@t480s:~ # sysctl hw.physmemhw.physmem: 25602347008root@t480s:~ # zpool listNAME SIZE ALLOC FREE CKPOINT EXPANDSZ FRAG CAP DEDUP HEALTH ALTROOTzroot 224G 109G 115G - - 44% 48% 1.00x ONLINE -
The T480s has access to VLAN 100, 42, 69, but the host itself has access only to VLAN 100 (LAN), while the jails can exist on other VLANs.
So I have a Jail named
unifi0that runs the Unifi Management thingie.Here’s what
rc.confof the host looks likeclear_tmp_enable="YES"syslogd_flags="-ss"sendmail_enable="NONE"sshd_enable="YES"ntpd_enable="YES"# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disabledumpdev="AUTO"zfs_enable="YES"hostname="t480s.evn0.loc.illuriasecurity.com"ifconfig_em0="up -rxcsum -txcsum"vlans_em0="100 42 69"ifconfig_em0_100="up"ifconfig_em0_42="up"ifconfig_em0_69="up"cloned_interfaces="bridge0 bridge100 bridge42 bridge69"create_args_bridge100="ether 8c:16:45:82:b4:10"ifconfig_bridge100="addm em0.100 SYNCDHCP"ifconfig_bridge100_ipv6="inet6 auto_linklocal"rtsold_flags="-i -F -m bridge100"rtsold_enable="YES"create_args_bridge42=" ether 8c:16:45:82:b4:42"create_args_bridge69=" ether 8c:16:45:82:b4:69"ifconfig_bridge42="addm em0.42"ifconfig_bridge69="addm em0.69"jail_enable="YES"jailer_dir="zfs:zroot/jailer"ifconfig_bridge0="inet 10.1.0.1/24 up"ngbuddy_enable="YES"ngbuddy_private_if="nghost0"dhcpd_enable="YES"lldpd_enable="YES"
I used Jailer to create the
unifi0jail, here’s what thejail.conflooks like# vim: set syntax=sh:exec.clean;allow.raw_sockets;mount.devfs;unifi0 { $id = "6"; devfs_ruleset = 10; $bridge = "bridge42"; $domain = "evn0.loc.illuriasecurity.com"; vnet; vnet.interface = "epair${id}b"; exec.prestart = "ifconfig epair${id} create up"; exec.prestart += "ifconfig epair${id}a up descr vnet-${name}"; exec.prestart += "ifconfig ${bridge} addm epair${id}a up"; exec.start = "/sbin/ifconfig lo0 127.0.0.1 up"; exec.start += "/bin/sh /etc/rc"; exec.stop = "/bin/sh /etc/rc.shutdown jail"; exec.poststop = "ifconfig ${bridge} deletem epair${id}a"; exec.poststop += "ifconfig epair${id}a destroy"; host.hostname = "${name}.${domain}"; path = "/usr/local/jailer/unifi0"; exec.consolelog = "/var/log/jail/${name}.log"; persist; mount.fdescfs; mount.procfs;}Here are the important parts inside the jail
root@t480s:~ # cat /usr/local/jailer/unifi0/etc/rc.confifconfig_epair6b="SYNCDHCP"sendmail_enable="NONE"syslogd_flags="-ss"mongod_enable="YES"unifi_enable="YES"root@t480s:~ # cat /usr/local/jailer/unifi0/etc/start_if.epair6b ifconfig epair6b ether 58:9c:fc:93:d1:0b
Don’t you love it that you can see what’s inside the jail from the host? God I love FreeBSD!
Did I miss anything? I hope not.
Oh, for the homelabbers out there, the T480s is the one that runs things like Jellyfin if needed.
Finally, the tiny
Raspberry Pi 4, Model B
I found this in a closed, so I decided to run it for TimeMachine.
I guess all you care about is
rc.confhostname="tm0.evn0.loc.illuriasecurity.com"ifconfig_DEFAULT="DHCP inet6 accept_rtadv"sshd_enable="YES"sendmail_enable="NONE"sendmail_submit_enable="NO"sendmail_outbound_enable="NO"sendmail_msp_queue_enable="NO"growfs_enable="YES"powerd_enable="YES"# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disabledumpdev="AUTO"zfs_enable="YES"rtsold_enable="YES"samba_server_enable="YES"
And the Samba Configuration
[global]# Network settingsworkgroup = WORKGROUPserver string = Samba Server %vnetbios name = RPi4# Logginglog file = /var/log/samba4/log.%mmax log size = 50log level = 0# Authenticationsecurity = userencrypt passwords = yespassdb backend = tdbsammap to guest = Bad Usermin protocol = SMB2max protocol = SMB3# Apple Time Machine settingsvfs objects = catia fruit streams_xattrfruit:metadata = streamfruit:resource = streamfruit:encoding = nativefruit:locking = nonefruit:time machine = yes# File System supportea support = yeskernel oplocks = nokernel share modes = noposix locking = nomangled names = nosmbd max xattr size = 2097152# Performance tuningread raw = yeswrite raw = yesgetwd cache = yesstrict locking = no# Miscellaneouslocal master = nopreferred master = nodomain master = nowins support = no[tm]comment = Time Machine RPi4path = /usr/local/timemachine/%Ubrowseable = yesread only = novalid users = antranigvvfs objects = catia fruit streams_xattrfruit:time machine = yesfruit:advertise_fullsync = truefruit:time machine max size = 800G # Adjust the size according to your needscreate mask = 0600directory mask = 0700
That’s pretty much it.
Conclusion
I love running homebrew servers, home networks and home labs. I love that (almost) everything is FreeBSD. The switch itself runs Linux, and the Unifi Access Point also runs Linux, both of which I’m pretty happy with.
While most homelabbers used ESXi in the past, I’m happy to see that most people are moving to open source solutions like Proxmox and Xen, but I think that FreeBSD Jails and bhyve is much better. I still don’t have a need for bhyve at the moment, but I would use it if I needed hardware virtualization.
Most homelabbers would consider the lack of Web/GUI interfaces as a con, but I think that it’s a pro. If I need to “replicate” this network, all I need to do is to copy some text files and modify some IP addresses / Interface names.
I hope this was informative and that it would be useful for anyone in the future.
That’s all folks…
Reply via email.
https://antranigv.am/posts/2024/06/freebsd-server-network-homelab/
#Containers #Dell #DellLatitudeE5470 #FreeBSD #homeServer #HowTo #Jailer #Jails #macOS #Networking #pf #Samba #Unifi #Unix #VNET
-
Please consider taking this (very) short survey to provide guidance to the Snikket team about the development priorities of existing and potential users:
https://snikket.org/community/survey/#success -
durare. org is now listed in #XMPP providers website!
https://providers.xmpp.net/provider/durare.org/
We are currently in class B since creating accounts is a manual process to prevent spam sign up.
My wishlist is adding email verification to automate sign ups.
Thanks to the entire team behind #Durare
This public service is supported by your donations and maintained by volunteers with love! Consider donating today https://durare.org/#donate
-
"🚨 *Major lawful Interception *: Russian XMPP (Jabber) Service Under Attack! 🚨"
The largest Russian XMPP (Jabber) messaging service, jabber.ru (also known as xmpp.ru), has been targeted in a sophisticated Man-in-the-Middle (MiTM) attack. The attackers intercepted encrypted TLS connections on Hetzner and Linode hosting providers in Germany. 🇩🇪🔓
Several rogue TLS certificates were issued using the Let’s Encrypt service to hijack encrypted STARTTLS connections on port 5222. The attack was unveiled due to an expired MiTM certificate. The interception might have been ongoing for up to 6 months, with 90 days confirmed.
The attack seems to be a lawful interception that Hetzner and Linode might have been compelled to set up. The implications are severe: all communications between the affected dates could be compromised. Users are urged to check their accounts for unauthorized #OMEMO and #PGP keys and to change passwords. 🔑🚫
Author: ValdikSS, 21st October 2023
Source: ValdikSS's NotesTags: #XMPP #Jabber #MiTM #Cybersecurity #Hetzner #Linode #EncryptionBreach #TLS #STARTTLS #LetsEncrypt 🌐🔐🚫
-
Iran blocks Signal messaging app after WhatsApp exodus... BUT many wonder why WhatsApp and Instagram are not blocked
This is pretty puzzling as we know Signal is reputed to be secure (apart from having to provide a phone number to register) and although Telegram's default settings allow access to metadata and even message content ultimately, both have been banned because they have been proven before not to release any user data.
But why was WhatsApp not banned in Iran, and neither in Russia previously either? This is what is really puzzling many people? It would be pure unfounded conjecture to speculate whether WhatsApp provides metadata about who contacts whom, locations, etc to authorities as we've not seen evidence of this yet as far as I know. We do not know this but all the same, the question does need to be asked.
If you are in Iran I'd recommend though that you install XMPP, or P2P apps such as ManyVerse or similar anyway as centralised apps are just too easy to monitor or disable. https://squeet.me/objects/962c3e10902855c52e7485201c0902edc69c4fe2 -
Przez wiele lat używałem Jabbera (#xmpp) jako podstawowego i jedynego komunikatora. Jednak lata lecą i chociaż XMPP dzielnie opracowuje kolejne rozszerzenia protokołu to jednak serwerów jest z roku na rok coraz mniej a nawet te wciąż istniejące i cieszące się nadal dobrą opinią mają bus factor = 1. Nawet pomimo, że każda instancja YunoHosta ma wbudowany serwer XMPP nie sprawia, że użytkowników przybywa. #smutek #jesien
-
Przez wiele lat używałem Jabbera (#xmpp) jako podstawowego i jedynego komunikatora. Jednak lata lecą i chociaż XMPP dzielnie opracowuje kolejne rozszerzenia protokołu to jednak serwerów jest z roku na rok coraz mniej a nawet te wciąż istniejące i cieszące się nadal dobrą opinią mają bus factor = 1. Nawet pomimo, że każda instancja YunoHosta ma wbudowany serwer XMPP nie sprawia, że użytkowników przybywa. #smutek #jesien
-
Przez wiele lat używałem Jabbera (#xmpp) jako podstawowego i jedynego komunikatora. Jednak lata lecą i chociaż XMPP dzielnie opracowuje kolejne rozszerzenia protokołu to jednak serwerów jest z roku na rok coraz mniej a nawet te wciąż istniejące i cieszące się nadal dobrą opinią mają bus factor = 1. Nawet pomimo, że każda instancja YunoHosta ma wbudowany serwer XMPP nie sprawia, że użytkowników przybywa. #smutek #jesien
-
Przez wiele lat używałem Jabbera (#xmpp) jako podstawowego i jedynego komunikatora. Jednak lata lecą i chociaż XMPP dzielnie opracowuje kolejne rozszerzenia protokołu to jednak serwerów jest z roku na rok coraz mniej a nawet te wciąż istniejące i cieszące się nadal dobrą opinią mają bus factor = 1. Nawet pomimo, że każda instancja YunoHosta ma wbudowany serwer XMPP nie sprawia, że użytkowników przybywa. #smutek #jesien
-
Przez wiele lat używałem Jabbera (#xmpp) jako podstawowego i jedynego komunikatora. Jednak lata lecą i chociaż XMPP dzielnie opracowuje kolejne rozszerzenia protokołu to jednak serwerów jest z roku na rok coraz mniej a nawet te wciąż istniejące i cieszące się nadal dobrą opinią mają bus factor = 1. Nawet pomimo, że każda instancja YunoHosta ma wbudowany serwer XMPP nie sprawia, że użytkowników przybywa. #smutek #jesien
