Daniel Gultsch

Project lead on https://Conversations.im & https://Ltt.rs · Council Chair & Editor, #XMPP Standards Foundation · 2.9W/kg · Flat white socialist · Defying Gravity · European Republic

Public Key

npub1ypgz3qavuftxd7jduyhldlqpk2n2v4xcnc5rgtk4y0paycky5t7qfjpqu5

NIP-05 Address

daniel@gultsch-social.mostr.pub

Profile Code

nprofile1qqszq5pgswkwy4nxlfx7ztlklsqm9f4x2nvfu2p59m2j8s7jvtz29lqpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43qhwhrky

Publishing to

relay.ditto.pub

Author Public Key

npub1ypgz3qavuftxd7jduyhldlqpk2n2v4xcnc5rgtk4y0paycky5t7qfjpqu5

Show more details

Last Notes

2026-05-03 06:13:46 UTC

It's Digital Independence Day again and #Conversations_im, the best Jabber/XMPP client for Android, is currently available for free on Google Play.
Enjoy true independence with independent messaging. No central server. No venture capital. No 'non profits' with centralized decision-making.
https://play.google.com/store/apps/details?id=eu.siacs.conversations
#XMPP #Jabber #IndieMessaging #DIDit

2026-03-31 09:13:47 UTC

- reply

@nprofile…zykx @nprofile…kewh Es kommt drauf an welchen Teil von ntfy.sh du denn Ersetzen möchtest. Wenn es dir um die Status Meldungen per HTTP verschicken geht habe ich hier mal etwas dazu geschrieben: https://gultsch.de/posts/xmpp-via-http/
Das ist ein wirklich sehr minimales Prosody setup mit 10 Zeilen config. Prosody ist idr über die Paketverwaltung installierbar und sollte dann kaum stress machen. Der 'reguläre' XMPP Account kann dann ja bei einem öffentlichen Provider liegen.

2026-03-31 06:59:25 UTC

Gerade mal geguckt: Offenbar war ich 2008 das erste Mal auf den Chemnitzer Linux Tage (inklusive Übernachtung in der Turnhalle) und 2009 habe ich meinen ersten Vortrag gehalten. Über Yacy und andere verteilte Suchmaschinen.
https://test.chemnitzer.linux-tage.de/2009/vortraege/detail.html.96.html
#CLT

2026-03-30 12:42:52 UTC

- reply

@nprofile…kewh Sehe ich auch kritisch aber der talk wurde wahrscheinlich geschrieben und eingereicht bevor ntfy.sh zu AI slopware geworden ist.

2026-03-30 08:46:04 UTC

Merle's Vortrag "Warum selbst Signal bei Google und Apple anklopft" ist übrigens eine schöne Ergänzung zu meinem UnifiedPush Vortrag.
https://media.ccc.de/v/clt26-143-warum-selbst-signal-bei-google-und-apple-anklopft

2026-03-23 05:41:52 UTC

Due to the recent popularity of #Conversations_im, I've already earned more than enough money this month and have decided to make the app free this week. Use this opportunity to onboard friends who might otherwise have a hard time paying for the app
https://play.google.com/store/apps/details?id=eu.siacs.conversations

2026-03-19 01:40:01 UTC

We are getting close to having half of Russia onboarded to #Quicksy and me going broke on SMS fees. привет, I guess 👋🇷🇺
#XMPP #Jabber

2026-03-10 10:20:34 UTC

Yesterday, I quickly put together a tutorial on how to replace ntfy.sh with a minimal, self-hosted XMPP server and published it as a GitHub Gist. Then I remembered I have a website and reworked it into two nice little posts:
https://gultsch.de/tags/ntfy.sh/
#ntfy #XMPP #Jabber #Prosody

2026-03-09 15:40:45 UTC

Actually, even if you don’t care about #UnifiedPush, having this minimal Prosody server that just accepts messages via a simple REST API and sends them out via #XMPP is great alternative to the various sendxmpp scripts out there.
https://gist.github.com/iNPUTmice/4f58f15d9a8d2d09cfc586074184decb#sending-messages-from-command-line-via-curl

2026-02-24 10:11:09 UTC

Conversations 2.19.11 fixes four security issues that have been reported to me by @nprofile…s8xx. The release has been tagged and is currently under Play Store review.
Here are the commits. I've tried to include as much detail in the commit message as possible so you can make your own impact assessment.
1) https://codeberg.org/iNPUTmice/Conversations/commit/86375d567b1120ee10acdd3d09f568ccabdc9c83
2) https://codeberg.org/iNPUTmice/Conversations/commit/c18d469be3f54361e58f7c70d3567cb1958a9f99
3) https://codeberg.org/iNPUTmice/Conversations/commit/f59806bca2b9e113c2d38a2379e461e2cb6d795f
4) https://codeberg.org/iNPUTmice/Conversations/commit/6fdd6761e7edbaddb08d91f36d8feff75b601a10
Thank you @nprofile…s8xx!

2026-02-05 14:16:00 UTC

Now that #Conversations_im is interfacing with Google Play Services via open-source code to retrieve a push token, we could potentially add Firebase Cloud Messaging as a last-resort fallback to the F-Droid build flavor as well.
I’m not sure if people want that. To some, the F-Droid version is a guarantee that Play Services won’t be used, even when installed on the device.

2026-02-05 08:50:29 UTC

The problem isn't Signal itself; it's that including the firebase-messaging dependency is akin to including malware, even if Play Services aren't installed on the user’s phone.
That’s why having alternatives such as #UnifiedPush is so important.

2026-02-02 09:45:30 UTC

I think the talk Simon (@nprofile…r9cm) and I gave on #UnifiedPush at #FOSDEM turned out very well. If you have 30 minutes and want to learn how push notifications in general and UnifiedPush in particular work, check out the recording.
https://gultsch.video/w/gRGZqKKvNBvvMesyWNQzoK

2026-01-26 08:57:20 UTC

- reply

@nprofile…qd7t indeed. Thanks to @nprofile…57js for reminding me to look into this again.
https://fosstodon.org/@link2xt/115843494460805213

2026-01-18 07:26:37 UTC

#Signal isn’t just AWS. It also has a hard dependency on Google’s push notification system (FCM) if you don’t want your battery to catch fire.
Signal’s attitude towards #UnifiedPush and #FDroid speaks volumes.

2026-01-13 17:53:31 UTC

- reply

@nprofile…r9cm The other way round (making XMPP apps wake up upon receiving WebPush notifications) is currently not standardized. We are talking about a Push Notifications 2.0 XEP and I have been advocating for using WebPush but I have also met some resistance because XMPP server devs aren't super keen on a hard dependency to HTTP.
And personally I find the other direction, making the XMPP client a distributor, much more interesting.

2026-01-13 17:50:59 UTC

- reply

@nprofile…r9cm I have been talking to @nprofile…gsj5 about making Dino a UnifiedPush distributor. Similar to Conversations, Dino would be an ideal candidate to facilitate push notifications for other apps on Linux on mobile.
In that case we would like standardized a variant of the protocol that is outlined here https://codeberg.org/iNPUTmice/up/src/branch/master/README.md (which already has multiple independent implementations) and I would write the code.

2026-01-08 23:13:57 UTC

- reply

@nprofile…qgdv I understand the shortcomings of individual responsibility but maybe it's time to delete your Twitter account?

2026-01-04 10:28:41 UTC

- reply

@nprofile…x2l4 non-profit / social benefit status (Gemeinnützigkeit) are only granted to specific kinds of businesses (for example religious, sports, arts & culture and a few more). Open Source / free software development isn’t one of them.
That’s why Mastodon for example moved to the US.
https://blog.joinmastodon.org/2024/04/mastodon-forms-new-u.s.-non-profit/

2026-01-03 15:51:57 UTC

Ich bin auch immer noch total hyped für Gnu Taler. Bargeld ist einfach total unpraktisch, aber die US Zahlungsdienstleister Visa, Mastercard bzw Google und Apple Pay sind aus offensichtlichen Gründen sehr kritisch zu betrachten.
Gnu Taler ist einfach die perfekte Alternative zu beidem. Können wir das bitte in Zukunft auf jedem Chaos Event haben?
#GnuTaler #CCC #39C3

2025-12-23 10:14:35 UTC

- reply

@nprofile…3m83 two things: I already said in my follow up post that if someone wants to build their own clients on top of XMPP and prefers MLS over OMEMO, the XMPP community is very open to that. A protocol is much more than just the encryption. They would still benefit from all the other things XMPP has solved.
A lot of what's in that blog post is ill-informed and bordering on disinformation and fear mongering.

2025-12-22 10:58:14 UTC

The people who dislike The Algorithm™ are either consumers who basically just want an RSS feed reader (nothing wrong with that) or people who brought audiences over from other platforms.
If you’re trying to create something and find an audience for it on the #Fediverse, you need some sort of recommendation algorithm. Otherwise, you’re just posting into the void.
#ActivityPub #Mastodon

2025-12-20 11:00:55 UTC

- reply

@nprofile…n62t @nprofile…0ux3 A good engineer can make everything work and end users don’t care either way.
However if we were to start from scratch and ignore the "everyone has an email address argument" which doesn’t really hold true anymore in times when 'Chat Relays" are the recommended transport and have a level headed debate about IMAP vs XMPP for instant messaging there is no way IMAP comes out on top.

2025-12-20 09:15:03 UTC

- reply

I consider this a failure on our part but I don’t really know what to do about it. Most arguments against #XMPP don’t hold if you’re building from scratch anyway:
• #Conversations_im looks very outdated: OK, but you are developing your own clients anyway.
• XMPP doesn’t have an SDK: Neither does your #ActivityPub or email stack
• OMEMO is insecure and I would prefer #MLS: Yes, let’s work on that together and you’ll still benefit from XMPP’s 100+ solved IM problems.

2025-12-20 09:03:47 UTC

As a community, we often ask ourselves how to attract more users to #XMPP. Yet the real tragedy is that people would rather build something entirely new (loosely based on email or #ActivityPub) than consider XMPP. Need end-to-end encryption by default? If compatibility with existing XMPP clients is a secondary concern, you can implement it in your own solution while still benefiting from our two decades of experience in instant messaging.

2025-12-09 08:35:41 UTC

I use Font Awesome icons on my presentation cover slides to link to my website and email. It would be great if we could also use them for Jabber/XMPP addresses!
#XMPP is currently the second most requested icon on Font Awesome, and it’s close to reaching the top spot. You can support the request here:
https://github.com/FortAwesome/Font-Awesome/discussions/21069
https://gultsch.social/system/media_attachments/files/115/688/689/696/112/199/original/04e35664cec55c9c.png

2025-11-30 09:17:47 UTC

„The features matter a lot less than the people who are using the platform. […]
It can sometimes be a bit misleading when you get a lot of ideas and feature requests in a community, and the conversations become, ‘We definitely need feature X to grow because that’s what’s stopping people from using the platform.‘ While that’s true in some cases, the sad reality is that any flaw can be overlooked as long as the people you want to reach are there.“
This feels true for #Conversations_im as well.

2025-11-23 02:06:51 UTC

If we look at what #Mastodon did to #ActivityPub, we start to realize that #XMPP not having a client and server from a single vendor that is available on all platforms is indeed a strength, not a weakness.

2025-11-10 17:13:26 UTC

Tracking my checked luggage with Google Find Hub on my trip to Montreal worked surprisingly well.
Much better than ~2 years ago when I first got a Pebblebee tracker.
I also like that they come in different form factors. This time I got one in credit card format that slides into the existing luggage tag.
(#NotSponsored, obviously, but do get in touch if you want to send me absurd amounts of money for posting on #Mastodon.)

2025-11-07 23:06:21 UTC

- reply

@nprofile…azau How would I be able to tell that it’s no longer working? I've upgraded to 4.5 earlier today and since then have not seen any posts on the low volume hashtags I’m following. This may or may not be a coincident.

2025-11-03 13:55:20 UTC

Day 2 of the Hackathon went great. Marvin (@nprofile…smsf) helped me implement an opt-in feature in #Conversations_im which routes all P2P sessions (calls and files transfers) via the users home server (similar to the feature found in Signal).
I went on a nice walk to a viewpoint on Mount Royal afterwards.
Now looking forward to Day 1 of #IETF124.
#XMPP #IETF #Jabber
https://gultsch.social/system/media_attachments/files/115/486/093/581/927/386/original/55ae6a03d1fe2a11.png
https://gultsch.social/system/media_attachments/files/115/486/094/195/291/994/original/0ae88c92559eeb1d.jpg
https://gultsch.social/system/media_attachments/files/115/486/094/749/650/285/original/fba837194f236e8b.jpg

2025-10-17 18:30:46 UTC

- reply

@nprofile…y8w7 @nprofile…067n @nprofile…lx0t For the client that is true. (And Molly does for example talk directly to #Conversations_im). However the problem arises when the server sees a new message it needs to do 'something'. Like it needs to tell 'someone'. And that something to someone needs to be standardized.
In the animation on https://unifiedpush.org/developers/intro/ the top, purple arrow. That’s WebPush. And Signal doesn’t do that. And then MollySocket is a translation proxy for that.

2025-10-17 18:19:28 UTC

- reply

@nprofile…y8w7 @nprofile…067n @nprofile…lx0t @nprofile…exf3 It’s a bit complicated but broadly speaking both the Mastodon server and the Matrix server have support for an internet standard called 'WebPush'. That’s where the server HTTP POSTs the push notification to, and that’s how the notification chain gets started that eventually ends up on your phone. But the Signal server doesn’t support that standard.

2025-10-17 17:53:07 UTC

- reply

@nprofile…y8w7 @nprofile…067n @nprofile…lx0t What do you mean by 'directly'? Without MollySocket? Delivering push messages directly to WebPush endpoints is something the @nprofile…exf3 server's would have to support. And Signal famously hates infrastructure that's not run by tech oligarchs.

2025-10-16 15:28:40 UTC

Many exciting projects made it into the latest @nprofile…0rpy funding round.
My personal favorites are OMEMO v2 (#TWOMEMO 😜) for Converse.js (by @nprofile…eqyf) and GTK4 support for @nprofile…vcat.
https://nlnet.nl/news/2025/20251016-selection-NGI0CommonsFund.html
#XMPP #Jabber #Converse #OMEMO

2025-10-12 08:14:48 UTC

I want to move away from YouTube Music.
What open source music player are you using on Android?

2025-10-06 10:09:47 UTC

Since a speaker at #FediDay25 made the offhand comment that "advertisement is free speech" allow me to offer a quick rebuttal: No, emotionally manipulating people into buying shit they don’t need is not free speech.
Any instance distributing advertisements into the #Fediverse needs to be defederated immediately.

2025-10-06 09:09:20 UTC

Ah yes, @nprofile…rsu8, the Android app store focused on security, privacy, that forces me to login with a Github account?! 😂

2025-10-06 06:13:43 UTC

Twitter was the place where the news happened, not where it was reported. You want to be where Taylor Swift announces she got engaged, not where news outlets report on her engagement.
Bringing news outlets onto the Fediverse is not going to recreate the magic that Twitter had.

2025-10-06 06:07:26 UTC

- reply

@nprofile…xu2n Chat Control has exceptions for closed, private deployments. For example Slack or Microsoft Teams won't have client side scanning. (That would be stupid and open the door for corporate espionage, and if anything is more important than the children it's capitalism).
Jabber/XMPP is just a series of private deployments that occasionally happen to be interconnected.
#Conversations_im is a client that can connect to closed, private deployments so it won't get client side scanning.

2025-10-04 06:52:35 UTC

We are not going to write open letters on how we are heroically going to withdraw from Europe. We will stay here continuing to operate as usual. We are infrastructure.
#Conversations_im #XMPP

2025-10-04 06:50:14 UTC

EU Chat Control won't apply to the federated Jabber/XMPP ecosystem.
#Conversations_im is used by various militaries, police forces and intelligence agencies in Europe. They will make sure it won't get any client side scanning.
#XMPP #Jabber #ChatControl

2025-09-06 08:39:52 UTC

I'm paying Google ~100 euros a month for their services and the privilege of publishing Conversations on the Play Store.
For a week now, I have been unable to release any updates because I'm still hoping to talk to someone at Google about their false accusation that I'm collecting users' email addresses, and any publication would reset my slot in the queue.

2025-08-25 10:26:54 UTC

I’m going to be at the Datenspuren (@nprofile…uelk) conference in Dresden talking (🇩🇪) about #UnifiedPush
UnifiedPush is a topic I’m really passionate about. Every #Android user needs to know about this.
https://talks.datenspuren.de/ds25/talk/3783DB/

2025-08-23 12:30:17 UTC

Getting rid of these white outlines around shortcuts was incredibly cumbersome. I tried 3 different things over the course of weeks but I finally have something that is ready to ship with 2.19.3.
Even Signal doesn't have this fixed yet. 🙈
BTW did you know about shortcuts? You can add quick access to certain chats either by long pressing on the Conversations launcher icon and dragging one of those items to the home screen or by long press on the home screen → Widgets → Conversations.
https://gultsch.social/system/media_attachments/files/115/078/058/013/478/271/original/2db1b12e11a75ddc.jpeg
https://gultsch.social/system/media_attachments/files/115/078/058/315/448/468/original/692ec90d0769e8a7.jpeg

2025-08-21 11:45:37 UTC

- reply

@nprofile…vu4x Prosody 13 and ejabberd 24.02 just have it.

2025-08-21 11:24:24 UTC

End-to-end encryption (E2EE) is important. However, on self-hosted or otherwise trusted servers, the client-to-server transport layer presents a much larger attack surface. It’s the first hurdle an adversary must overcome before they can attack E2EE.
That’s why #Conversations_im includes advanced MITM detection called Channel Binding. Turn it on today!
It’s optional for now because not all servers support it. Talk to your admins.
Neither @nprofile…0n4t nor @nprofile…g4yp offer comparable protection.
https://gultsch.social/system/media_attachments/files/115/066/464/406/138/552/original/deb3f628366470d2.png

2025-08-16 07:04:15 UTC

The @nprofile…f4mz and #Conversations_im developers have a booth at @nprofile…e0sg. Come find us to talk about #XMPP and grab some merch.
https://gultsch.social/system/media_attachments/files/115/037/163/940/903/112/original/d981aef35d665229.jpg

2025-08-16 04:28:52 UTC

I love @nprofile…e0sg. It was the first conference I ever went to 20 years ago. But damn those start times are not hacker friendly.
I'm so tired I just tried to put whole beans in my portafilter.
Anyway see you there soon.
#XMPP #froscon #Conversations_im
https://gultsch.social/system/media_attachments/files/115/036/547/581/800/359/original/b0083a998fee8bdb.jpg

2025-08-15 07:01:01 UTC

Which eSim roaming / travel provider (Airalo, Saily, …) is the least shitty when it comes to selling my data?
I don’t care which one is the cheapest I just don’t want them to sell my location data and browsing history.
I've used Airalo in the past - at least they don’t require me to use their app. Does anyone know if Saily requires me to use their app or can I install the eSim and manage data plans via their web interface?

2025-07-12 07:02:37 UTC

#Matrix spent a decade turning the problem of worrying about which extensions your server supports into worrying about which room version your server supports.
Meanwhile, the #XMPP community got their act together, reached a rough consensus on which extensions are worth pursuing, and now you can install any of the four major servers without having to worry about what extensions are working behind the scenes.

2025-07-10 09:23:32 UTC

The Google Play App review team has their own accounts. The Developer Console let's me enter test credentials. Sometimes they use those sometimes they just create new accounts. Depends on the individual reviewer.
The Play version doesn't have channel search. The only reason a reviewer would join a channel is that they explicitly entered the address or used an external search engine.
The last app review got rejected because the app hosts terrorist content.
How do browsers ever pass the test?
https://gultsch.social/system/media_attachments/files/114/828/198/616/871/844/original/8b08e0c63cc19652.png

2025-06-28 07:59:12 UTC

For the next release of #Conversations_im I’m switching the default for showing all messages, including sent ones, left aligned, to 'on' for all tablets.
Combine this with disabling 'Colorful chat bubbles' and this looks pretty clean and almost like a regular desktop app.
This post is also a reminder to existing tablet users that those two settings exist. Too bad there aren’t that many of you.
#XMPP #Android
https://gultsch.social/system/media_attachments/files/114/759/894/865/846/865/original/66c7938185b14bac.png

2025-06-21 11:14:49 UTC

PSA: If you read advertisements on your podcast or YouTube video, you are not a journalist, you are a salesperson.
And no, your audience isn’t smart enough to distinguish between content and advertisements. If that were true you wouldn’t be paid significantly more for native ads.

2025-06-18 06:54:13 UTC

- reply

@nprofile…hdlj what you are daydreaming about is called #UnifiedPush and exists and is working well on #Android.
Depending on what distributor you use (multiple are available) it will literally use #XMPP. For example via #Conversations_im
https://unifiedpush.org/

2025-06-08 17:19:24 UTC

With Elon threatening to decommission Dragon and Trump threatening to cut subsidies to SpaceX, maybe Boeing can step in and build a capsule that flies astronauts to the ISS.

2025-05-26 10:17:14 UTC

I'm on my way back from the Berlin XMPP Sprint and had a fantastic time. Thank you so much @nprofile…mqk5 for organizing it, and thank you to everyone who participated. It was especially cool to see some new faces; it's pretty amazing that the #XMPP developer community is still able to attract new talent.
I made good progress on finally being able to show full-size avatars (profile pictures) in #Conversations_im. Stay tuned to learn more about that towards the end of this week.

2025-05-22 09:47:55 UTC

I want to get back to writing more long-form content. In the age of ChatGPT, that seems like a valuable skill to maintain.
However, my old website used handcrafted HTML and simply wasn’t up to the task, so I made a new one. Check it out: https://gultsch.de

2025-05-07 12:30:41 UTC

- reply

@nprofile…hz4t I think instant messaging services must associate accounts with phone numbers (and possibly somehow validate that with Russian mobile providers; presumably to associate accounts with actual identities)

2025-05-07 11:16:18 UTC

I guess it’s a good thing that the genocide in Ukraine has devalued your currency so much that 800,000 rubles isn’t actually that much money.
> By the ruling of the magistrate of judicial district No. 422 of the Tagansky district of Moscow, companies Threema GmbH and Pagebites Inc have been fined 1 million rubles each, and Gultsch & Weiss GbR has been fined 800 thousand rubles.
🇷🇺 https://www.interfax.ru/russia/1024302
🇬🇧 https://translate.kagi.com/translate/https://www.interfax.ru/russia/1024302

2025-05-06 06:44:47 UTC

Google is on a mission to sell you larger and larger screens while showing you less and less information on them.
If this screenshot were satire, it would actually be pretty hilarious.
https://www.theverge.com/news/661483/google-leak-material-3-expressive-android-design
https://gultsch.social/system/media_attachments/files/114/459/531/219/047/972/original/427e44ee02e34b46.png

2025-04-23 06:33:24 UTC

- reply

@nprofile…5q8k Note that I personally had no opinion on which URI scheme to pick (web+activitypub, web+ap, acct) I just wanted the feature to work.
I didn’t know about your fedi proposal at the time. If there is a good reason to I’m willing to implement that too. However as other people in the comments pointed out web+… has some benefits.

2025-04-23 06:30:18 UTC

- reply

@nprofile…5q8k I recently started an initiative to get web+ap (aka https://fedilinks.org/ by @nprofile…7nmp) support in various apps. My plan is to get at least open and autolink (making the URIs clickable in plain text) support and if/when that has some adoption clients will have an easier time to generate and use those links too.
#Conversations_im has support for linking (including fallback). Fedilab has support for opening. There is an issue for Tusky (https://github.com/tuskyapp/Tusky/issues/5027)
Help me spread he word!

2025-04-16 19:52:40 UTC

- reply

@nprofile…k72j in Conversations you can go to Settings / Connection / ✅ Hostname & Port

2025-04-14 15:19:16 UTC

The "Open source developers don’t care about UI" trope is incredibly insulting.
It’s like telling the forth runner across the finish line at a marathon they clearly don’t care about winning.
Nobody wants their app to look bad. We can and do look at other apps and try to follow trends. Trends change rapidly and UI development is difficult and time consuming.

2025-04-10 09:10:10 UTC

- reply

@nprofile…tslx Yes of course. I don’t think the security researchers did anything wrong expect for signing such a restrictive contract with their customer. The correct move would have been to negotiate with their customer to simply publish the audit. I obviously couldn’t do that myself because I didn’t know who their customer was. Any negotiations had to go through the third party security company.

2025-04-10 08:41:54 UTC

Security firm: We found XYZ. Here are steps to reproduce. Our customer wants a detailed timeline for when you expect to have this fixed.
Me: (That’s not how this works but) here is the commit.
Security firm: Please credit our researcher in the commit.
Me: I'd be more than happy to give you credit once you've published the audit.
Security firm: We can’t publish the audit
(later)
Please credit us.
Me: I'd be more than happy to give you credit once you've published the audit.
(repeat 10x)

2025-04-10 08:31:33 UTC

Security audits are a funny thing. We lack the (financial) resources for regular, thorough penetration tests. However I’m aware that some of the higher profile users of #Conversations_im occasionally perform audits without my direct involvement and without publishing it afterwards. Those audits aren’t adversarial as indicated by them wanting me to fix what they find.
The funniest instances are when they want to be credited for finding an issue but refuse to make the audit public.

2025-04-10 08:15:31 UTC

A big thank you to Radically Open Security for performing the audit and to @nprofile…klwf for funding it.
Radically Open Security has been a long term partner of #Conversations_im ever since they did the first #OMEMO audit back in 2016!
Recent audit: https://conversations.im/2025_audit_conversations.pdf
OMEMO audit: https://conversations.im/omemo/audit.pdf

2025-04-10 08:12:28 UTC

A recent security audit of #Conversations_im¹ found that wildcard certificate handling didn’t fully comply with the spec.
Conversations was accepting *.a.example for c.b.a.example, even though wildcards are only meant to match a single label.
This issue has been fixed in version 2.18.0, now live on Google Play.
¹: https://conversations.im/2025_audit_conversations.pdf
#XMPP #Jabber

2025-04-09 15:23:36 UTC

- reply

@nprofile…czym Ich bin froh das wir mit @nprofile…f4mz und @nprofile…srwa zwei brauchbare Clients haben. Für jedes UI framework einen eigenen Client ist vielleicht auch ein bisschen zu viel verlangt. Schön wäre es natürlich…

2025-04-09 13:25:30 UTC

Looks like Dino is enabling #OMEMO by default for the next release¹. I think that was the last of the major #XMPP clients to do so. Hopefully we can now put the "But XMPP is not encrypted by default" debate to rest.
¹: https://github.com/dino/dino/commit/fc6447c56e7fdaf6f6d843a2215d870caee4aba0

2025-04-09 12:18:32 UTC

- reply

@nprofile…lslt I think this depends on what security implications you have in mind. I don't think XMPP has major security implications on the server side that go beyond let's say hosting a website or generally keeping a Linux server secure (regular updates etc). However if that's what you have in mind then conversations.im certainly takes that off your plate.

2025-04-09 10:51:06 UTC

The good news is you don’t have to wait for the slow, democratic process of the European Union to impose tariffs on US-based digital services. You can boycott Amazon, WhatsApp, and Signal today.

2025-04-03 15:23:53 UTC

- reply

@nprofile…jkuj @nprofile…7nmp no I wasn't aware. That's pretty cool. And hopefully soon redundant once everyone supports web+ap:// URIs 😃

2025-04-03 15:15:32 UTC

I think I’ve found a relatively nice solution for #FediLinks in #Conversations_im.
You can put web+ap URIs into a message (or room description) and ideally a click on those will open your Mastodon client. However if no installed app supports those (the only app that I’m aware of is Fedilab) Conversations will open a browser instead.
Currently no app will create web+ap links but it is fairly easy to handcraft them.
cc @nprofile…7nmp
#XMPP #ActivityPub

2025-04-03 13:29:36 UTC

I've seen (generative) AI code. I'm currently not worried about AI putting artists out of work.
Anyway here is me catching up to Internet trends from three weeks ago.
https://gultsch.social/system/media_attachments/files/114/274/268/735/771/508/original/99920f039c464a17.png
https://gultsch.social/system/media_attachments/files/114/274/268/866/286/128/original/0d8ca1e402c42c00.png

2025-03-30 08:44:26 UTC

- reply

@nprofile…dwme I assume you are testing with this exact commit? https://codeberg.org/tom79/Fedilab/commit/db17df93f0bd3851941d948a8b6dbfed28d57481
If you wanted web+activitypub: to work (without the //) you can’t have host and pathPattern in there. Only <data android:scheme="web+activitypub" /> analogous to the gist I linked earlier.
However see my comments on the Tusky issue tracker on why I believe fedilinks is better than FEP-07d7: https://github.com/tuskyapp/Tusky/issues/5027#issuecomment-2764451529
fedilinks uses :// anyway

2025-03-29 18:07:44 UTC

- reply

@nprofile…dwme @nprofile…njn8 Conversations has been able to open xmpp: URIs (without //) for years.
Just to be sure I tested this with web+activitypub: URIs quickly to make sure web+ URIs don’t get special treatment - and it’s working fine in both Firefox and Chrome on Android.
Here is the intent filter I was using: https://gist.github.com/iNPUTmice/79757b4edc5fbfc8c9aab2b965cdcb87
I have no strong opinions on whether the // should go in there. But I’m advocating for consistency. (And clarity in the FEP)

2025-03-29 16:49:34 UTC

- reply

@nprofile…njn8 @nprofile…dwme personally I belive it's fine to assume https as the transport. While ActivityPub may or may not work over telnet I don't think we'd be using a web+ scheme for that.
However - assuming that we can agree on https - my question was just: is it
a) web+activitypub:something
b) web+activitypub://something
The examples in the FEP indicate a although there isn't any normative text.
The web+soup example here https://html.spec.whatwg.org/#custom-handlers also uses variant (a)

2025-03-29 16:11:40 UTC

- reply

@nprofile…dwme That’s awesome. I think the URIs are supposed to look like this: web+activitypub:toot.fedilab.app/@apps (Notice the absence of //)
Maybe @nprofile…njn8 can chime in to clarify? Maybe also something to be more explicit about in the FEP.
I know that over a decade we had both variants in the #XMPP world and that turned out to be a mess when parsing (Correct in the XMPP world is without the //)

2025-03-28 17:29:42 UTC

@nprofile…4fxs do lenses and 'jump to first result' not work together?
I have a lens to search RFCs that I invoke with '!rfc keword'. But when I do '\!rfc keyword' I’m redirected to something other than the first search result of '!rfc keyword' (It’s a bit hard to tell but it might be the search result for when searching for literally '!rfc keyword' w/o invoking the lens)

2025-03-28 17:02:42 UTC

- reply

@nprofile…cvq7 Signal prides itself for not having group information on the server. So the information on who is in the group is in the protocol. Otherwise Signal wouldn't know where to route the message to.

2025-03-28 16:29:35 UTC

- reply

@nprofile…f9kf
> He changed his profile picture to a photo of himself so it was much easier to see which Jason Signal contact corresponded to that Jason.
This still leaves the risk of people deliberately changing their username+profile picture to match that of Jason to trick you to invite the wrong Jason to the group chat
In #Conversations_im we try to show the Jabber ID (not just the username) in relevant places (during invites, for new chats)
For #Signal that would be the phone number, I guess

2025-03-28 14:03:34 UTC

- reply

@nprofile…lj4a yes this is currently the most requested feature for #Conversations_im. However it's also incredibly hard to do. This will come but I don't have an ETA.

2025-03-28 13:27:48 UTC

For the next #Conversations_im release I’m refactoring how URIs are linked / made clickable. I’m adding a bunch of URI schemes like tel and mailto on top of the existing xmpp, http(s) and geo but removing support for "things that look like web URLs but aren’t actually URIs" (like 'example.com') to avoid some false positives.
Once the 2.18.0-beta comes out tomorrow or so let me know if you see things that isn’t matched and should be matched or vice versa.
https://gultsch.social/system/media_attachments/files/114/240/273/790/587/458/original/857480399d8a2b8a.png

2025-03-28 11:05:47 UTC

- reply

@nprofile…qywj I understand the concern about bad fallback on the web. I just wish people would be a bit more pragmatic about it and at least add support for reading / opening such URIs. Nobody suggested replace all Follow buttons with web+activitypub: links.
Can we have support for FEP-07d7 in #Tusky and #Fedilab? (cc @nprofile…7cuz @nprofile…dwme)
It shouldn’t be that hard to implement at least one of the possible URI schemes in #Conversations_im, #Lttrs, #Tusky and #Fedilab. Maybe get @nprofile…g4yp on board too?

2025-03-27 21:06:26 UTC

Is there any #ActivityPub / #Mastodon URI scheme used in the wild that would allow me to open an ActivityPub account directly in my Android app?
I've seen 'acct' and 'web+ap' mentioned but none seem to be implemented.
The goal is that given a text of "Here is my Mastodon profile acct:daniel@gultsch.social" #Conversations_im can link that directly into #Tusky. (Just like mailto and xmpp URIs open my E-Mail or IM app respectively)
Have @nprofile…dwme or @nprofile…7cuz considered that? If not way not?

2025-03-05 16:51:43 UTC

After gradually moving all my code repositories from #Github to @nprofile…8x0h I have now disabled my Github Sponsors account. A very big thank you to everyone who has supported me over the years. 😍
Not just in light of recent events - after all this is a process I started over two years ago - but also in light of recent events I want to have as little dependencies as possible to platforms run by the Tech Oligarchs.

2025-03-05 13:26:07 UTC

- reply

@nprofile…hz4t Unclear. The API is documented¹ and/or not super hard to reverse engineer. I have seen at least one case where I could tell from nginx logs (failed attempts due to incorrect use, followed by correct use from the same IP) that the app was not used. I don’t know how common this 'actual abuse' is compared to 'accidental' things like users having a typo in the phone number or the SMS not being delivered.
¹: https://codeberg.org/iNPUTmice/QuicksyServer/src/branch/master/README.md

2025-03-05 12:24:32 UTC

It’s very important for me to say that existing quicksy.im account will continue to exist for a long time. The server Quicksy runs on is very cheap (10 Euro / month). Worst case we will move them over to the conversations.im server and basically run them for free. (~1000 Quicksy users is a drop in the bucket for conversations.im)
What bothers me - and makes me unsure about the future of Quicksy - is paying 100 Euro a month in SMS fees.

2025-03-05 12:14:59 UTC

We need to talk about Quicksy.im again 🤨
· Quicksy has 880 monthly active users. The median number of messages send and received per user per month is 25
· Quicksy is experiencing a high volume of unsuccessful registrations, meaning attempts that trigger an SMS but don't result in account creation. This occurs when SMS messages don't arrive or when users 'test' the service with fake or nonexistent numbers. These failed registrations drive up costs with little benefit.

2025-03-05 07:59:51 UTC

- reply

@nprofile…46qq Weil mich das auch stört habe ich gerade mal getestet 'de-De, de' in den Accept-Language header von Firefox einzutragen. Das scheint zumindest teilweise den gewünschten Effekt zu haben in sofern als das das dubbing aus ist. (Die Titel sind trotzdem auf Englisch)
Ist ein bisschen blöd zu testen weil ich nicht weiß unter welchen Bedingungen genau das dubbing anspringt.

2025-02-12 03:01:23 UTC

- reply

@nprofile…ctme I figured as much and I want Conversations to work for people who don't know what that is.

2025-02-11 14:03:23 UTC

- reply

I don’t understand how Singapore has both the best public transportation system¹ and the worst stroads in the world.
¹: I’m sure Hong Kong would like to have a word with me now.
https://gultsch.social/system/media_attachments/files/113/985/619/511/120/183/original/20fdcb60fce899d8.jpg
https://gultsch.social/system/media_attachments/files/113/985/620/100/085/035/original/3f77ecb070a3653d.jpg

2025-02-11 13:59:42 UTC

Heading back after a great week in Singapore. 🇸🇬
Fantastic food and a really good vibe all around.
Next stop: Berlin XMPP Meetup.
https://gultsch.social/system/media_attachments/files/113/985/535/313/444/337/original/be6b766bce1b445b.jpg
https://gultsch.social/system/media_attachments/files/113/985/536/155/303/688/original/8905dd3a7fe58fdd.jpg
https://gultsch.social/system/media_attachments/files/113/985/540/355/953/074/original/a9479b47050ff17e.jpg
https://gultsch.social/system/media_attachments/files/113/985/559/833/770/753/original/176893106f095a4c.jpg

2025-02-11 11:04:08 UTC

On my recent Lufthansa flight, I noticed their FlyNet Wi-Fi allows #XMPP traffic (likely via port 5223), but HTTP uploads were blocked. So, I added a new feature to #Conversations_im that lets users retry failed uploads via Jingle P2P file transfer, which will fall back to IBB if needed. Can’t wait to test it on the return flight! ✈️

2024-11-21 18:03:40 UTC

More thoughts on the STUN server fallback question:
· This is something other #XMPP Clients just do quietly without having a big debate about it¹
· I don't think users should configure this. Anyone who knows what a STUN server is will likely switch to a server offering one.
· Treat it like channel search. On first use (call, file transfer), ask once: Use our fallback STUN server? Yes/No.
¹: https://github.com/dino/dino/blob/v0.4.4/plugins/ice/src/plugin.vala#L49-L52

2024-05-26 06:38:13 UTC

- reply

Maintenance took way longer then anticipated but we were done late last night. Unfortunately something else happened early this morning. We are working on it.

2024-05-24 06:48:16 UTC

- reply

@npub1qxt…m80t quicksy.im and our UnifiedPush service (up.conversations.im) are hosted separately and will not be impacted.