Daniel Gultsch

Project lead on https://Conversations.im & https://Ltt.rs · Council Chair & Editor, #XMPP Standards Foundation · 2.9W/kg · Flat white socialist · Defying Gravity · European Republic

Public Key

npub1ypgz3qavuftxd7jduyhldlqpk2n2v4xcnc5rgtk4y0paycky5t7qfjpqu5

NIP-05 Address

daniel@gultsch-social.mostr.pub

Profile Code

nprofile1qqszq5pgswkwy4nxlfx7ztlklsqm9f4x2nvfu2p59m2j8s7jvtz29lqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dse28pgn

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1ypgz3qavuftxd7jduyhldlqpk2n2v4xcnc5rgtk4y0paycky5t7qfjpqu5

Show more details

Last Notes

2026-05-29 14:32:28 UTC

- reply

@nprofile…ehvw We put the instant into instant messaging.

2026-05-24 12:24:04 UTC

What #Conversations_im did was prove that the technology works. When #Matrix reinvented the wheel as an eventually consistent graph database with a JSON API, they didn't do it because #XMPP didn't work. They did it because their investors were seeking control over the entire stack.

2026-05-22 23:48:19 UTC

Element (@nprofile…k30q) makes a very big deal out of every single government agency that gives #Matrix a shot. However when you look at what actual people choose to deploy it's #XMPP.
https://qa.debian.org/popcon.php (via https://framapiaf.org/@debacle/116618695432651294)

2026-05-11 10:59:58 UTC

At this point, the Google Play app review process has become a security liability. I have had an app update for #Conversations_im in the review queue since April 28th. Previously, app updates have been rejected for stupid, hallucinated reasons; this time, we are just being ignored entirely. The release is not shipping any security fixes, but imagine if it did.
#XMPP

2026-05-03 06:13:46 UTC

It's Digital Independence Day again and #Conversations_im, the best Jabber/XMPP client for Android, is currently available for free on Google Play.
Enjoy true independence with independent messaging. No central server. No venture capital. No 'non profits' with centralized decision-making.
https://play.google.com/store/apps/details?id=eu.siacs.conversations
#XMPP #Jabber #IndieMessaging #DIDit

2026-03-31 09:13:47 UTC

- reply

@nprofile…zykx @nprofile…kewh Es kommt drauf an welchen Teil von ntfy.sh du denn Ersetzen möchtest. Wenn es dir um die Status Meldungen per HTTP verschicken geht habe ich hier mal etwas dazu geschrieben: https://gultsch.de/posts/xmpp-via-http/
Das ist ein wirklich sehr minimales Prosody setup mit 10 Zeilen config. Prosody ist idr über die Paketverwaltung installierbar und sollte dann kaum stress machen. Der 'reguläre' XMPP Account kann dann ja bei einem öffentlichen Provider liegen.

2026-03-31 06:59:25 UTC

Gerade mal geguckt: Offenbar war ich 2008 das erste Mal auf den Chemnitzer Linux Tage (inklusive Übernachtung in der Turnhalle) und 2009 habe ich meinen ersten Vortrag gehalten. Über Yacy und andere verteilte Suchmaschinen.
https://test.chemnitzer.linux-tage.de/2009/vortraege/detail.html.96.html
#CLT

2026-03-30 12:42:52 UTC

- reply

@nprofile…kewh Sehe ich auch kritisch aber der talk wurde wahrscheinlich geschrieben und eingereicht bevor ntfy.sh zu AI slopware geworden ist.

2026-03-30 08:46:04 UTC

Merle's Vortrag "Warum selbst Signal bei Google und Apple anklopft" ist übrigens eine schöne Ergänzung zu meinem UnifiedPush Vortrag.
https://media.ccc.de/v/clt26-143-warum-selbst-signal-bei-google-und-apple-anklopft

2026-03-23 05:41:52 UTC

Due to the recent popularity of #Conversations_im, I've already earned more than enough money this month and have decided to make the app free this week. Use this opportunity to onboard friends who might otherwise have a hard time paying for the app
https://play.google.com/store/apps/details?id=eu.siacs.conversations

2026-03-19 01:40:01 UTC

We are getting close to having half of Russia onboarded to #Quicksy and me going broke on SMS fees. привет, I guess 👋🇷🇺
#XMPP #Jabber

2026-03-10 10:20:34 UTC

Yesterday, I quickly put together a tutorial on how to replace ntfy.sh with a minimal, self-hosted XMPP server and published it as a GitHub Gist. Then I remembered I have a website and reworked it into two nice little posts:
https://gultsch.de/tags/ntfy.sh/
#ntfy #XMPP #Jabber #Prosody

2026-03-09 15:40:45 UTC

Actually, even if you don’t care about #UnifiedPush, having this minimal Prosody server that just accepts messages via a simple REST API and sends them out via #XMPP is great alternative to the various sendxmpp scripts out there.
https://gist.github.com/iNPUTmice/4f58f15d9a8d2d09cfc586074184decb#sending-messages-from-command-line-via-curl

2026-03-09 15:24:51 UTC

If you are concerned about ntfy.sh recently turning into AI-slopware, you can replace both the #UnifiedPush Distributor and the curl-based status messaging with XMPP. You can keep your existing XMPP account and simply replace ntfy's functionality with a self-hosted Prosody instance.
https://gist.github.com/iNPUTmice/4f58f15d9a8d2d09cfc586074184decb

2026-02-24 10:11:09 UTC

Conversations 2.19.11 fixes four security issues that have been reported to me by @nprofile…s8xx. The release has been tagged and is currently under Play Store review.
Here are the commits. I've tried to include as much detail in the commit message as possible so you can make your own impact assessment.
1) https://codeberg.org/iNPUTmice/Conversations/commit/86375d567b1120ee10acdd3d09f568ccabdc9c83
2) https://codeberg.org/iNPUTmice/Conversations/commit/c18d469be3f54361e58f7c70d3567cb1958a9f99
3) https://codeberg.org/iNPUTmice/Conversations/commit/f59806bca2b9e113c2d38a2379e461e2cb6d795f
4) https://codeberg.org/iNPUTmice/Conversations/commit/6fdd6761e7edbaddb08d91f36d8feff75b601a10
Thank you @nprofile…s8xx!

2026-02-19 12:06:46 UTC

Conversations (via #UnifiedPush) is the backbone that gives #Matrix its reliable and timely notifications. An eventually consistent graph database is a nice concept, but it takes #XMPP to put the real-time into real-time communications.
#ThatsXMPP

2026-02-05 14:16:00 UTC

Now that #Conversations_im is interfacing with Google Play Services via open-source code to retrieve a push token, we could potentially add Firebase Cloud Messaging as a last-resort fallback to the F-Droid build flavor as well.
I’m not sure if people want that. To some, the F-Droid version is a guarantee that Play Services won’t be used, even when installed on the device.

2026-02-05 08:56:05 UTC

The firebase-messaging library is supposed to provide developers with push notification capabilities. However, it includes many dependencies that add unwanted features like analytics and other "calling home" behaviors.
The recent vulnerability in Signal¹ reminded me to finally do something I've been planning for a while: removing that library and interfacing with Play Services directly.
https://codeberg.org/iNPUTmice/Conversations/commit/1abb22b542343642aacb4f7bd82f0bb2bc380ea4
1: https://github.com/signalapp/Signal-Android/issues/14556

2026-02-05 08:50:29 UTC

The problem isn't Signal itself; it's that including the firebase-messaging dependency is akin to including malware, even if Play Services aren't installed on the user’s phone.
That’s why having alternatives such as #UnifiedPush is so important.

2026-02-02 09:45:30 UTC

I think the talk Simon (@nprofile…r9cm) and I gave on #UnifiedPush at #FOSDEM turned out very well. If you have 30 minutes and want to learn how push notifications in general and UnifiedPush in particular work, check out the recording.
https://gultsch.video/w/gRGZqKKvNBvvMesyWNQzoK

2026-01-26 08:57:20 UTC

- reply

@nprofile…qd7t indeed. Thanks to @nprofile…57js for reminding me to look into this again.
https://fosstodon.org/@link2xt/115843494460805213

2026-01-18 07:26:37 UTC

#Signal isn’t just AWS. It also has a hard dependency on Google’s push notification system (FCM) if you don’t want your battery to catch fire.
Signal’s attitude towards #UnifiedPush and #FDroid speaks volumes.

2026-01-13 17:53:31 UTC

- reply

@nprofile…r9cm The other way round (making XMPP apps wake up upon receiving WebPush notifications) is currently not standardized. We are talking about a Push Notifications 2.0 XEP and I have been advocating for using WebPush but I have also met some resistance because XMPP server devs aren't super keen on a hard dependency to HTTP.
And personally I find the other direction, making the XMPP client a distributor, much more interesting.

2026-01-13 17:50:59 UTC

- reply

@nprofile…r9cm I have been talking to @nprofile…gsj5 about making Dino a UnifiedPush distributor. Similar to Conversations, Dino would be an ideal candidate to facilitate push notifications for other apps on Linux on mobile.
In that case we would like standardized a variant of the protocol that is outlined here https://codeberg.org/iNPUTmice/up/src/branch/master/README.md (which already has multiple independent implementations) and I would write the code.

2026-01-13 08:41:18 UTC

- reply

@nprofile…lw2w Vorweg. Ich fand immer toll was Threema in Bezug auf Open Source gemacht hat. Das Fdroid repository. Den libwebrtc build den #Conversations_im auch benutzt.
Mit einem soliden Geschäftsmodel hätte man eventuell auch einfach so weiter machen können und auf natürliche Weise wachsen können.
Alternative IPO oder via SPAC an die Börse.
Persönlich wünsche ich dir aber natürlich viel Glück und hoffe, dass die allgemeinen Befürchtungen nicht wahr werden.

2026-01-08 23:13:57 UTC

- reply

@nprofile…qgdv I understand the shortcomings of individual responsibility but maybe it's time to delete your Twitter account?

2026-01-04 10:28:41 UTC

- reply

@nprofile…x2l4 non-profit / social benefit status (Gemeinnützigkeit) are only granted to specific kinds of businesses (for example religious, sports, arts & culture and a few more). Open Source / free software development isn’t one of them.
That’s why Mastodon for example moved to the US.
https://blog.joinmastodon.org/2024/04/mastodon-forms-new-u.s.-non-profit/

2026-01-03 15:51:57 UTC

Ich bin auch immer noch total hyped für Gnu Taler. Bargeld ist einfach total unpraktisch, aber die US Zahlungsdienstleister Visa, Mastercard bzw Google und Apple Pay sind aus offensichtlichen Gründen sehr kritisch zu betrachten.
Gnu Taler ist einfach die perfekte Alternative zu beidem. Können wir das bitte in Zukunft auf jedem Chaos Event haben?
#GnuTaler #CCC #39C3

2025-12-31 11:49:17 UTC

I still find it a bit odd that Udbhav Tiwari and Meredith Whittaker (@nprofile…7xkg) stormed off the stage at #39C3 with ~20 minutes left in their slot without answering any questions. I always think of Chaos events as being among equals, and a Q&A after your presentation is just part of that. But I guess if you are earning close to $1 million a year, you are a bit more equal than others.
I’m wondering if this was prearranged with the organizers and/or the Herold in that session.

2025-12-23 10:14:35 UTC

- reply

@nprofile…3m83 two things: I already said in my follow up post that if someone wants to build their own clients on top of XMPP and prefers MLS over OMEMO, the XMPP community is very open to that. A protocol is much more than just the encryption. They would still benefit from all the other things XMPP has solved.
A lot of what's in that blog post is ill-informed and bordering on disinformation and fear mongering.

2025-12-22 10:58:14 UTC

The people who dislike The Algorithm™ are either consumers who basically just want an RSS feed reader (nothing wrong with that) or people who brought audiences over from other platforms.
If you’re trying to create something and find an audience for it on the #Fediverse, you need some sort of recommendation algorithm. Otherwise, you’re just posting into the void.
#ActivityPub #Mastodon

2025-12-20 11:00:55 UTC

- reply

@nprofile…n62t @nprofile…0ux3 A good engineer can make everything work and end users don’t care either way.
However if we were to start from scratch and ignore the "everyone has an email address argument" which doesn’t really hold true anymore in times when 'Chat Relays" are the recommended transport and have a level headed debate about IMAP vs XMPP for instant messaging there is no way IMAP comes out on top.

2025-12-20 09:15:03 UTC

- reply

I consider this a failure on our part but I don’t really know what to do about it. Most arguments against #XMPP don’t hold if you’re building from scratch anyway:
• #Conversations_im looks very outdated: OK, but you are developing your own clients anyway.
• XMPP doesn’t have an SDK: Neither does your #ActivityPub or email stack
• OMEMO is insecure and I would prefer #MLS: Yes, let’s work on that together and you’ll still benefit from XMPP’s 100+ solved IM problems.

2025-12-20 09:03:47 UTC

As a community, we often ask ourselves how to attract more users to #XMPP. Yet the real tragedy is that people would rather build something entirely new (loosely based on email or #ActivityPub) than consider XMPP. Need end-to-end encryption by default? If compatibility with existing XMPP clients is a secondary concern, you can implement it in your own solution while still benefiting from our two decades of experience in instant messaging.

2025-12-09 08:35:41 UTC

I use Font Awesome icons on my presentation cover slides to link to my website and email. It would be great if we could also use them for Jabber/XMPP addresses!
#XMPP is currently the second most requested icon on Font Awesome, and it’s close to reaching the top spot. You can support the request here:
https://github.com/FortAwesome/Font-Awesome/discussions/21069
https://gultsch.social/system/media_attachments/files/115/688/689/696/112/199/original/04e35664cec55c9c.png

2025-11-30 09:17:47 UTC

„The features matter a lot less than the people who are using the platform. […]
It can sometimes be a bit misleading when you get a lot of ideas and feature requests in a community, and the conversations become, ‘We definitely need feature X to grow because that’s what’s stopping people from using the platform.‘ While that’s true in some cases, the sad reality is that any flaw can be overlooked as long as the people you want to reach are there.“
This feels true for #Conversations_im as well.

2025-11-25 15:54:13 UTC

Fun fact: I bought my own social network at around the same time Elon bought his.
#Mastodon #ActivityPub

2025-11-23 02:06:51 UTC

If we look at what #Mastodon did to #ActivityPub, we start to realize that #XMPP not having a client and server from a single vendor that is available on all platforms is indeed a strength, not a weakness.

2025-11-21 12:42:17 UTC

- reply

@nprofile…rvj7 @nprofile…dl3v Meta has a proprietary HTTP API that allows you to send and receive messages to and from WhatsApp and Facebook Messenger users. You can get access to that after signing a contract with Meta. Two (relatively unknown) IM companies are taking them up on that and EU users will soon be able to send e2e encrypted messages to those third party IM networks. A very high level overview of that API can be found on the internet but details are NDA'ed.

2025-11-21 12:06:58 UTC

- reply

@nprofile…dl3v What you are describing is #XMPP. XMPP isn't a single company. It's multiple open and closed source companies coming together to build one interoperable standard.
Wire, Element and Threema are more than welcome to join us.

2025-11-10 17:13:26 UTC

Tracking my checked luggage with Google Find Hub on my trip to Montreal worked surprisingly well.
Much better than ~2 years ago when I first got a Pebblebee tracker.
I also like that they come in different form factors. This time I got one in credit card format that slides into the existing luggage tag.
(#NotSponsored, obviously, but do get in touch if you want to send me absurd amounts of money for posting on #Mastodon.)

2025-11-07 23:06:21 UTC

- reply

@nprofile…azau How would I be able to tell that it’s no longer working? I've upgraded to 4.5 earlier today and since then have not seen any posts on the low volume hashtags I’m following. This may or may not be a coincident.

2025-11-03 13:55:20 UTC

Day 2 of the Hackathon went great. Marvin (@nprofile…smsf) helped me implement an opt-in feature in #Conversations_im which routes all P2P sessions (calls and files transfers) via the users home server (similar to the feature found in Signal).
I went on a nice walk to a viewpoint on Mount Royal afterwards.
Now looking forward to Day 1 of #IETF124.
#XMPP #IETF #Jabber
https://gultsch.social/system/media_attachments/files/115/486/093/581/927/386/original/55ae6a03d1fe2a11.png
https://gultsch.social/system/media_attachments/files/115/486/094/195/291/994/original/0ae88c92559eeb1d.jpg
https://gultsch.social/system/media_attachments/files/115/486/094/749/650/285/original/fba837194f236e8b.jpg

2025-10-17 18:30:46 UTC

- reply

@nprofile…y8w7 @nprofile…067n @nprofile…lx0t For the client that is true. (And Molly does for example talk directly to #Conversations_im). However the problem arises when the server sees a new message it needs to do 'something'. Like it needs to tell 'someone'. And that something to someone needs to be standardized.
In the animation on https://unifiedpush.org/developers/intro/ the top, purple arrow. That’s WebPush. And Signal doesn’t do that. And then MollySocket is a translation proxy for that.

2025-10-17 18:19:28 UTC

- reply

@nprofile…y8w7 @nprofile…067n @nprofile…lx0t @nprofile…exf3 It’s a bit complicated but broadly speaking both the Mastodon server and the Matrix server have support for an internet standard called 'WebPush'. That’s where the server HTTP POSTs the push notification to, and that’s how the notification chain gets started that eventually ends up on your phone. But the Signal server doesn’t support that standard.

2025-10-17 17:53:07 UTC

- reply

@nprofile…y8w7 @nprofile…067n @nprofile…lx0t What do you mean by 'directly'? Without MollySocket? Delivering push messages directly to WebPush endpoints is something the @nprofile…exf3 server's would have to support. And Signal famously hates infrastructure that's not run by tech oligarchs.

2025-10-16 15:28:40 UTC

Many exciting projects made it into the latest @nprofile…0rpy funding round.
My personal favorites are OMEMO v2 (#TWOMEMO 😜) for Converse.js (by @nprofile…eqyf) and GTK4 support for @nprofile…vcat.
https://nlnet.nl/news/2025/20251016-selection-NGI0CommonsFund.html
#XMPP #Jabber #Converse #OMEMO

2025-10-12 08:14:48 UTC

I want to move away from YouTube Music.
What open source music player are you using on Android?

2025-10-06 10:09:47 UTC

Since a speaker at #FediDay25 made the offhand comment that "advertisement is free speech" allow me to offer a quick rebuttal: No, emotionally manipulating people into buying shit they don’t need is not free speech.
Any instance distributing advertisements into the #Fediverse needs to be defederated immediately.

2025-10-06 09:09:20 UTC

Ah yes, @nprofile…rsu8, the Android app store focused on security, privacy, that forces me to login with a Github account?! 😂

2025-10-06 06:13:43 UTC

Twitter was the place where the news happened, not where it was reported. You want to be where Taylor Swift announces she got engaged, not where news outlets report on her engagement.
Bringing news outlets onto the Fediverse is not going to recreate the magic that Twitter had.

2025-10-06 06:07:26 UTC

- reply

@nprofile…xu2n Chat Control has exceptions for closed, private deployments. For example Slack or Microsoft Teams won't have client side scanning. (That would be stupid and open the door for corporate espionage, and if anything is more important than the children it's capitalism).
Jabber/XMPP is just a series of private deployments that occasionally happen to be interconnected.
#Conversations_im is a client that can connect to closed, private deployments so it won't get client side scanning.

2025-10-04 06:52:35 UTC

We are not going to write open letters on how we are heroically going to withdraw from Europe. We will stay here continuing to operate as usual. We are infrastructure.
#Conversations_im #XMPP

2025-10-04 06:50:14 UTC

EU Chat Control won't apply to the federated Jabber/XMPP ecosystem.
#Conversations_im is used by various militaries, police forces and intelligence agencies in Europe. They will make sure it won't get any client side scanning.
#XMPP #Jabber #ChatControl

2025-09-06 08:39:52 UTC

I'm paying Google ~100 euros a month for their services and the privilege of publishing Conversations on the Play Store.
For a week now, I have been unable to release any updates because I'm still hoping to talk to someone at Google about their false accusation that I'm collecting users' email addresses, and any publication would reset my slot in the queue.

2025-08-25 10:26:54 UTC

I’m going to be at the Datenspuren (@nprofile…uelk) conference in Dresden talking (🇩🇪) about #UnifiedPush
UnifiedPush is a topic I’m really passionate about. Every #Android user needs to know about this.
https://talks.datenspuren.de/ds25/talk/3783DB/

2025-08-23 12:30:17 UTC

Getting rid of these white outlines around shortcuts was incredibly cumbersome. I tried 3 different things over the course of weeks but I finally have something that is ready to ship with 2.19.3.
Even Signal doesn't have this fixed yet. 🙈
BTW did you know about shortcuts? You can add quick access to certain chats either by long pressing on the Conversations launcher icon and dragging one of those items to the home screen or by long press on the home screen → Widgets → Conversations.
https://gultsch.social/system/media_attachments/files/115/078/058/013/478/271/original/2db1b12e11a75ddc.jpeg
https://gultsch.social/system/media_attachments/files/115/078/058/315/448/468/original/692ec90d0769e8a7.jpeg

2025-08-21 11:45:37 UTC

- reply

@nprofile…vu4x Prosody 13 and ejabberd 24.02 just have it.

2025-08-21 11:24:24 UTC

End-to-end encryption (E2EE) is important. However, on self-hosted or otherwise trusted servers, the client-to-server transport layer presents a much larger attack surface. It’s the first hurdle an adversary must overcome before they can attack E2EE.
That’s why #Conversations_im includes advanced MITM detection called Channel Binding. Turn it on today!
It’s optional for now because not all servers support it. Talk to your admins.
Neither @nprofile…0n4t nor @nprofile…g4yp offer comparable protection.
https://gultsch.social/system/media_attachments/files/115/066/464/406/138/552/original/deb3f628366470d2.png

2025-08-21 06:06:50 UTC

- reply

@nprofile…8nud #Conversations_im setzt neuerdings Occupant IDs¹ für Message Corrections in Gruppenchats voraus. Das macht den Code einfacher und zuverlässiger und ist auch Voraussetzung für Reactions. Grundsätzlich ist unsere Anspruch durchaus das Conversations mit einer Breite an XMPP Servern gut funktioniert aber fast zwei Jahre nach dem ejabberd occupant-ids bekommen hat ist dann auch irgendwann mal Schluss.
Die Faustregel ist: Können die XMPP Server in Debian Stable das?
¹: https://xmpp.org/extensions/xep-0421.html

2025-08-16 07:04:15 UTC

The @nprofile…f4mz and #Conversations_im developers have a booth at @nprofile…e0sg. Come find us to talk about #XMPP and grab some merch.
https://gultsch.social/system/media_attachments/files/115/037/163/940/903/112/original/d981aef35d665229.jpg

2025-08-16 04:28:52 UTC

I love @nprofile…e0sg. It was the first conference I ever went to 20 years ago. But damn those start times are not hacker friendly.
I'm so tired I just tried to put whole beans in my portafilter.
Anyway see you there soon.
#XMPP #froscon #Conversations_im
https://gultsch.social/system/media_attachments/files/115/036/547/581/800/359/original/b0083a998fee8bdb.jpg

2025-08-15 07:01:01 UTC

Which eSim roaming / travel provider (Airalo, Saily, …) is the least shitty when it comes to selling my data?
I don’t care which one is the cheapest I just don’t want them to sell my location data and browsing history.
I've used Airalo in the past - at least they don’t require me to use their app. Does anyone know if Saily requires me to use their app or can I install the eSim and manage data plans via their web interface?

2025-07-26 09:37:37 UTC

I’m on my way from #IETF123 in Madrid.
Here is a quick summary
· A seven day conference is pretty exhausting 😪
· Pretty excited about the long term future of #MLS. Not necessarily for interoperability but as a well tested building block
· Significantly less excited about MIMI
· We should specify #XMPP over WebTransports
· Bluesky seems to have some genuine interest in standardizing some of their low level/infrastructure technologies
· JMAP/Email community still doing new and exciting things

2025-07-12 07:02:37 UTC

#Matrix spent a decade turning the problem of worrying about which extensions your server supports into worrying about which room version your server supports.
Meanwhile, the #XMPP community got their act together, reached a rough consensus on which extensions are worth pursuing, and now you can install any of the four major servers without having to worry about what extensions are working behind the scenes.

2025-07-10 09:23:32 UTC

The Google Play App review team has their own accounts. The Developer Console let's me enter test credentials. Sometimes they use those sometimes they just create new accounts. Depends on the individual reviewer.
The Play version doesn't have channel search. The only reason a reviewer would join a channel is that they explicitly entered the address or used an external search engine.
The last app review got rejected because the app hosts terrorist content.
How do browsers ever pass the test?
https://gultsch.social/system/media_attachments/files/114/828/198/616/871/844/original/8b08e0c63cc19652.png

2025-06-28 07:59:12 UTC

For the next release of #Conversations_im I’m switching the default for showing all messages, including sent ones, left aligned, to 'on' for all tablets.
Combine this with disabling 'Colorful chat bubbles' and this looks pretty clean and almost like a regular desktop app.
This post is also a reminder to existing tablet users that those two settings exist. Too bad there aren’t that many of you.
#XMPP #Android
https://gultsch.social/system/media_attachments/files/114/759/894/865/846/865/original/66c7938185b14bac.png

2025-06-21 11:14:49 UTC

PSA: If you read advertisements on your podcast or YouTube video, you are not a journalist, you are a salesperson.
And no, your audience isn’t smart enough to distinguish between content and advertisements. If that were true you wouldn’t be paid significantly more for native ads.

2025-06-18 06:54:13 UTC

- reply

@nprofile…hdlj what you are daydreaming about is called #UnifiedPush and exists and is working well on #Android.
Depending on what distributor you use (multiple are available) it will literally use #XMPP. For example via #Conversations_im
https://unifiedpush.org/

2025-06-08 17:19:24 UTC

With Elon threatening to decommission Dragon and Trump threatening to cut subsidies to SpaceX, maybe Boeing can step in and build a capsule that flies astronauts to the ISS.

2025-05-26 10:17:14 UTC

I'm on my way back from the Berlin XMPP Sprint and had a fantastic time. Thank you so much @nprofile…mqk5 for organizing it, and thank you to everyone who participated. It was especially cool to see some new faces; it's pretty amazing that the #XMPP developer community is still able to attract new talent.
I made good progress on finally being able to show full-size avatars (profile pictures) in #Conversations_im. Stay tuned to learn more about that towards the end of this week.

2025-05-22 09:47:55 UTC

I want to get back to writing more long-form content. In the age of ChatGPT, that seems like a valuable skill to maintain.
However, my old website used handcrafted HTML and simply wasn’t up to the task, so I made a new one. Check it out: https://gultsch.de

2025-05-07 12:30:41 UTC

- reply

@nprofile…hz4t I think instant messaging services must associate accounts with phone numbers (and possibly somehow validate that with Russian mobile providers; presumably to associate accounts with actual identities)

2025-05-07 11:16:18 UTC

I guess it’s a good thing that the genocide in Ukraine has devalued your currency so much that 800,000 rubles isn’t actually that much money.
> By the ruling of the magistrate of judicial district No. 422 of the Tagansky district of Moscow, companies Threema GmbH and Pagebites Inc have been fined 1 million rubles each, and Gultsch & Weiss GbR has been fined 800 thousand rubles.
🇷🇺 https://www.interfax.ru/russia/1024302
🇬🇧 https://translate.kagi.com/translate/https://www.interfax.ru/russia/1024302

2025-05-06 06:44:47 UTC

Google is on a mission to sell you larger and larger screens while showing you less and less information on them.
If this screenshot were satire, it would actually be pretty hilarious.
https://www.theverge.com/news/661483/google-leak-material-3-expressive-android-design
https://gultsch.social/system/media_attachments/files/114/459/531/219/047/972/original/427e44ee02e34b46.png

2025-04-23 06:33:24 UTC

- reply

@nprofile…5q8k Note that I personally had no opinion on which URI scheme to pick (web+activitypub, web+ap, acct) I just wanted the feature to work.
I didn’t know about your fedi proposal at the time. If there is a good reason to I’m willing to implement that too. However as other people in the comments pointed out web+… has some benefits.

2025-04-23 06:30:18 UTC

- reply

@nprofile…5q8k I recently started an initiative to get web+ap (aka https://fedilinks.org/ by @nprofile…7nmp) support in various apps. My plan is to get at least open and autolink (making the URIs clickable in plain text) support and if/when that has some adoption clients will have an easier time to generate and use those links too.
#Conversations_im has support for linking (including fallback). Fedilab has support for opening. There is an issue for Tusky (https://github.com/tuskyapp/Tusky/issues/5027)
Help me spread he word!

2025-04-16 19:52:40 UTC

- reply

@nprofile…k72j in Conversations you can go to Settings / Connection / ✅ Hostname & Port

2025-04-14 15:19:16 UTC

The "Open source developers don’t care about UI" trope is incredibly insulting.
It’s like telling the forth runner across the finish line at a marathon they clearly don’t care about winning.
Nobody wants their app to look bad. We can and do look at other apps and try to follow trends. Trends change rapidly and UI development is difficult and time consuming.

2025-04-10 09:10:10 UTC

- reply

@nprofile…tslx Yes of course. I don’t think the security researchers did anything wrong expect for signing such a restrictive contract with their customer. The correct move would have been to negotiate with their customer to simply publish the audit. I obviously couldn’t do that myself because I didn’t know who their customer was. Any negotiations had to go through the third party security company.

2025-04-10 08:41:54 UTC

Security firm: We found XYZ. Here are steps to reproduce. Our customer wants a detailed timeline for when you expect to have this fixed.
Me: (That’s not how this works but) here is the commit.
Security firm: Please credit our researcher in the commit.
Me: I'd be more than happy to give you credit once you've published the audit.
Security firm: We can’t publish the audit
(later)
Please credit us.
Me: I'd be more than happy to give you credit once you've published the audit.
(repeat 10x)

2025-04-10 08:31:33 UTC

Security audits are a funny thing. We lack the (financial) resources for regular, thorough penetration tests. However I’m aware that some of the higher profile users of #Conversations_im occasionally perform audits without my direct involvement and without publishing it afterwards. Those audits aren’t adversarial as indicated by them wanting me to fix what they find.
The funniest instances are when they want to be credited for finding an issue but refuse to make the audit public.

2025-04-10 08:15:31 UTC

A big thank you to Radically Open Security for performing the audit and to @nprofile…klwf for funding it.
Radically Open Security has been a long term partner of #Conversations_im ever since they did the first #OMEMO audit back in 2016!
Recent audit: https://conversations.im/2025_audit_conversations.pdf
OMEMO audit: https://conversations.im/omemo/audit.pdf

2025-04-10 08:12:28 UTC

A recent security audit of #Conversations_im¹ found that wildcard certificate handling didn’t fully comply with the spec.
Conversations was accepting *.a.example for c.b.a.example, even though wildcards are only meant to match a single label.
This issue has been fixed in version 2.18.0, now live on Google Play.
¹: https://conversations.im/2025_audit_conversations.pdf
#XMPP #Jabber

2025-04-09 15:23:36 UTC

- reply

@nprofile…czym Ich bin froh das wir mit @nprofile…f4mz und @nprofile…srwa zwei brauchbare Clients haben. Für jedes UI framework einen eigenen Client ist vielleicht auch ein bisschen zu viel verlangt. Schön wäre es natürlich…

2025-04-09 13:25:30 UTC

Looks like Dino is enabling #OMEMO by default for the next release¹. I think that was the last of the major #XMPP clients to do so. Hopefully we can now put the "But XMPP is not encrypted by default" debate to rest.
¹: https://github.com/dino/dino/commit/fc6447c56e7fdaf6f6d843a2215d870caee4aba0

2025-04-09 12:18:32 UTC

- reply

@nprofile…lslt I think this depends on what security implications you have in mind. I don't think XMPP has major security implications on the server side that go beyond let's say hosting a website or generally keeping a Linux server secure (regular updates etc). However if that's what you have in mind then conversations.im certainly takes that off your plate.

2025-04-09 11:51:01 UTC

You are encouraged to self-host #XMPP but you are not required to. We try to make self hosting as easy as possible. I think it is one step above hosting your own website but way easier than hosting your own e-mail.
If you are medium tech-savvy I recommend getting your own domain and going for an XMPP provider that let’s you bring your own domain (for example: https://account.conversations.im/domain/) this gives you the flexibility to self host or switch providers later.

2025-04-09 10:51:06 UTC

The good news is you don’t have to wait for the slow, democratic process of the European Union to impose tariffs on US-based digital services. You can boycott Amazon, WhatsApp, and Signal today.

2025-04-03 15:23:53 UTC

- reply

@nprofile…jkuj @nprofile…7nmp no I wasn't aware. That's pretty cool. And hopefully soon redundant once everyone supports web+ap:// URIs 😃

2025-04-03 15:15:32 UTC

I think I’ve found a relatively nice solution for #FediLinks in #Conversations_im.
You can put web+ap URIs into a message (or room description) and ideally a click on those will open your Mastodon client. However if no installed app supports those (the only app that I’m aware of is Fedilab) Conversations will open a browser instead.
Currently no app will create web+ap links but it is fairly easy to handcraft them.
cc @nprofile…7nmp
#XMPP #ActivityPub

2025-04-03 13:29:36 UTC

I've seen (generative) AI code. I'm currently not worried about AI putting artists out of work.
Anyway here is me catching up to Internet trends from three weeks ago.
https://gultsch.social/system/media_attachments/files/114/274/268/735/771/508/original/99920f039c464a17.png
https://gultsch.social/system/media_attachments/files/114/274/268/866/286/128/original/0d8ca1e402c42c00.png

2025-03-30 08:44:26 UTC

- reply

@nprofile…dwme I assume you are testing with this exact commit? https://codeberg.org/tom79/Fedilab/commit/db17df93f0bd3851941d948a8b6dbfed28d57481
If you wanted web+activitypub: to work (without the //) you can’t have host and pathPattern in there. Only <data android:scheme="web+activitypub" /> analogous to the gist I linked earlier.
However see my comments on the Tusky issue tracker on why I believe fedilinks is better than FEP-07d7: https://github.com/tuskyapp/Tusky/issues/5027#issuecomment-2764451529
fedilinks uses :// anyway

2025-03-29 18:07:44 UTC

- reply

@nprofile…dwme @nprofile…njn8 Conversations has been able to open xmpp: URIs (without //) for years.
Just to be sure I tested this with web+activitypub: URIs quickly to make sure web+ URIs don’t get special treatment - and it’s working fine in both Firefox and Chrome on Android.
Here is the intent filter I was using: https://gist.github.com/iNPUTmice/79757b4edc5fbfc8c9aab2b965cdcb87
I have no strong opinions on whether the // should go in there. But I’m advocating for consistency. (And clarity in the FEP)

2025-03-29 16:49:34 UTC

- reply

@nprofile…njn8 @nprofile…dwme personally I belive it's fine to assume https as the transport. While ActivityPub may or may not work over telnet I don't think we'd be using a web+ scheme for that.
However - assuming that we can agree on https - my question was just: is it
a) web+activitypub:something
b) web+activitypub://something
The examples in the FEP indicate a although there isn't any normative text.
The web+soup example here https://html.spec.whatwg.org/#custom-handlers also uses variant (a)

2025-03-29 16:11:40 UTC

- reply

@nprofile…dwme That’s awesome. I think the URIs are supposed to look like this: web+activitypub:toot.fedilab.app/@apps (Notice the absence of //)
Maybe @nprofile…njn8 can chime in to clarify? Maybe also something to be more explicit about in the FEP.
I know that over a decade we had both variants in the #XMPP world and that turned out to be a mess when parsing (Correct in the XMPP world is without the //)

2025-03-28 17:29:42 UTC

@nprofile…4fxs do lenses and 'jump to first result' not work together?
I have a lens to search RFCs that I invoke with '!rfc keword'. But when I do '\!rfc keyword' I’m redirected to something other than the first search result of '!rfc keyword' (It’s a bit hard to tell but it might be the search result for when searching for literally '!rfc keyword' w/o invoking the lens)

2025-03-28 17:02:42 UTC

- reply

@nprofile…cvq7 Signal prides itself for not having group information on the server. So the information on who is in the group is in the protocol. Otherwise Signal wouldn't know where to route the message to.

2025-03-28 16:29:35 UTC

- reply

@nprofile…f9kf
> He changed his profile picture to a photo of himself so it was much easier to see which Jason Signal contact corresponded to that Jason.
This still leaves the risk of people deliberately changing their username+profile picture to match that of Jason to trick you to invite the wrong Jason to the group chat
In #Conversations_im we try to show the Jabber ID (not just the username) in relevant places (during invites, for new chats)
For #Signal that would be the phone number, I guess

2025-03-28 14:03:34 UTC

- reply

@nprofile…lj4a yes this is currently the most requested feature for #Conversations_im. However it's also incredibly hard to do. This will come but I don't have an ETA.