> Signal does not know numbers or how these contatcs interact.
> It is described here [2]. Number is only needed for creating the unique hash. Server knows only the recipient, not the sender.
Signal does know everyone's numbers as everybody is logged into a Signal account on the server end (this is how your client fetches messages for your number). That same account and IP are also used when you send a message.
> Yes, and security has a large performance impact.
Not necessarily. The linked blog talks about SPARK which is about running your code through theorem provers to mathematically formally verify that your code does the correct thing _in all instances_.
Once you have passed this level of verification - you can disable assertions and checks in the release version of the application (whilst of course - having the option of keeping them enabled in development releases).
> SPARK itself can handle and prove some ownership properties but to the best of my knowledge isn't at the level of rust in memory safety on dynamically allocated memory.
And using https://www.adacore.com/sparkpro as a reference (ignore the 'Pro' bit as it's also available in the GPL edition) - anything certified to SPARK Silver level is far safer than any Rust code out there.
Funny how before Alire was a thing, people complained that there was no easy way to take other people's Ada code and add it to one's own software projects.
Now Alire exists and people complain that it's easy to add people's code into their own projects.
You don't even have to use Alire in the first place - every modern Linux distro ships with an Ada compiler - on Fedora just install gcc-gnat and off you go.
> What are people using VPNs for mostly, if they're living in a country without internet censorship?
I find it's a convenient way to prevent services beyond my ISP from knowing where am I based on IP address.
All of those apps you have on your devices presumably have permanent connections back to their servers and they can very easily tell if you're at home, out on mobile data, in an office, or in a cafe/public library or even in a different country.
With a VPN, they currently think I'm in Dallas; which I'm nowhere near right now.
> Most of what they complain about have tooling, documentation and solutions. They're just not using them.
OP's problem is that they do not want to learn. In general - if you see a person complaining about SELinux - it's because they have no interest in learning.
> Conversations, draugr.de, can't really say much on steps to reproduce - it worked reliably and then it didn't just yesterday
So it worked fine for some time, glitched one day, you presumably have done zero debugging as you have no logs or error messages to show us and somehow that means that clients "just lose messages".
> then try to find your contacts again (which may be cached by your client or not)
You can save XMPP account IDs in any mobile address book.
> Finally, you have to convince "someone" that this is just you with another account on another server. There is also no verified E2EE anymore.
I'd pretty much just do a video call at that point.
> How is this different from "when Signal goes down one uses a completely different instant messaging system", apart from using another client?
You don't have to use another client software.
> Which means: If one of these hosting companies blocks XMPP traffic (e.g., if a rogue state starts censoring) or one of these XMPP servers goes down, a huge part of XMPP users is affected.
Equally applies to most messaging apps out there. Some XMPP apps have the benefit of also supporting using Tor and hidden services - Signal/WhatsApp/etc, don't.
Don't want to use the Internet at all and your friends live close by? You can even go wild and do something like:
I realize this is something most people would not do, but XMPP's _flexibility_ allows this to be an option if it was something people wanted. Can't do Signal over LoRa.
Deceive implies bad intent, which you are not doing in this case. What you are actually doing is educating whereas Signal is the one technically doing the deceiving.
> Once again, "I, as a tech-savvy person, can operate my highly-customized XMPP setup everywhere", while ignoring that most people do not run their own servers.
I said "my server", but the exact same code could be pointed at a different server by simply changing the username/password. Compare this to having to port a codebase from Signal to WhatsApp/Slack/whatever.
I'm also just using a standard ejabberd-based deployment, nothing highly-customized about it. Have you tried a Signal server deployment? I have, and THAT is the definition of highly-customized.
> This was discussed numerous times various platforms and proven wrong.
Alternative clients exist, but they are heavily frowned upon by the community - as a lot of the functionality they add (disappearing messages, view once media) depend on people using the official clients and not custom ones that could simply ignore this functionality.
> As discussed before on this page, most XMPP users don't run their own XMPP server but use a public XMPP server on the internet. Nobody can check whether this public XMPP server tracks its users without accessing the server itself.
That's fine, same thing applies to Matrix/Signal/WhatsApp/pretty much any messaging service out there.
> So, do you assume the Signal network infrastructure consists of a single server?
Functionally - although it is clustered - it is a single server, run by a single team - and it has gone down multiple times in the past few years.
And when it does go down: good luck using that Signal client to talk to anyone over it (SMS doesn't count as it has zero security on Signal and isn't even available on the iOS client). At least with XMPP, I can point the same client to some other server and potentially continue a conversation with someone somewhere else, with the exact same OMEMO/PGP encryption.
That is why decentralized/federated is better than "all your eggs in one basket" centralized. Centralization provides one with convenience, right up until it stops working and then it becomes a massive inconvenience.
> At least Quicksy (from the Conversations developer who bragged in a public video about copying WhatsApp/Signal) and Kontalk require a phone number.
The whole point of Quicksy is to allow people to try XMPP and find contacts easily with their number before they then move on to using actual JID-based accounts.
And he's more than free to brag about what he does - he's the one that spent the time; writing code and extensions and then released the thing to the public as free and open-source code.
> Signal does. You wrote, you use Signal. Did you ever join a Signal group? There is a dialog when entering a group the first time.
This is your Signal PROFILE name, not a username. You can quite clearly see this described in Settings -> tap the top bit with your number and read the text at the bottom.
People can still see your phone number by simply clicking on your user in the group member list. Signal, at the current time[0], has zero username functionality.
I use OMEMO everywhere. However, I do know of people out there who simply do not see the point of OMEMO as, when they are the server admin, OMEMO adds no value over TLS. OMEMO also doesn't make sense in large public groups, cause you're not going to go and verify 100+ people's encryption keys one by one.
OMEMO and end-to-end encryption are also incompatible with keeping a reliable server-side archive of your messages - which will be accessible to all future XMPP clients that you add to your account - which apparently some people want. You can see this at the table at https://conversations.im/omemo/
Meanwhile, you occasionally find people on the Signal subreddit bemoaning that they lost their entire message history with a loved one because some backup file got corrupted and failed to restore or; they lost some device. Here's an example: https://www.reddit.com/r/signal/comments/rbtdtb/