Not sure, but I couldn't find Tox (https://en.m.wikipedia.org/wiki/Tox_(protocol)) anywhere?
this post was submitted on 03 Feb 2024
4 points (100.0% liked)
Privacy
31833 readers
106 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
I'll ask here since it's such a good thread: best FLOSS privacy respecting replacement for discord?
Adding to sibling… Discord is used in a couple of different ways at present for communities. If you mean voice coms for gaming or otherwise, Mumble should be in your repository. If it’s more of a of a Slack-like business chat, self-hosted Mattermost is actually pretty nice. If it’s just text chat, IRCv3 & XMPP have that covered & scale massively even on a home PC. If it’s voice calls, Jitsi or Jami can work. If you are posting updates or things that should be forum topics, you shouldn’t be using chat anyways where Mastodon, Misskey, Lemmy, & other Fediverse options or even Atom feeds can suffice. If you want integrated chat, community updates/posts, voice/video calls (unsure if conference calls are support) Movim is a good option--and if you don’t mind the rough UI edges, Libervia can do similar but also integrates a calendar for events. Bear in mind as well that a lot of these technologies can be bridged between one another to avoid some of the lock-in, but I would hesitate to force everyone’s chat to be piped & logged thru Discord’s servers. It’s also not bad to say “we use these 2 services” rather than requiring a kitchen sink communications application.
Very thorough response thanks. This shows me about how many things discord covers, which is a good and bad thing, makes migrating away much more difficult.
This is worthy of a more usable interface than this spreadsheet widget.
It took me a fair bit of scrolling to identify which attributes each of the six purple "N/A" values for SimpleX are, but now that I have I agree they're accurate (though I think there is an argument to be made for just writing a green "no" for each of them).
It is noteworthy that SimpleX is currently the only one of these (currently 34) messengers to not have a single red or yellow cell in its column. well done, @[email protected]! 😀
edit: istm that SimpleX (along with several other things) getting a "no" in the "can hand IP address to the police" row is not really accurate. SimpleX does better than many things here in that they don't have a lot of other info to give to the police along with the IP, but, if Bob has their phone seized (or remotely compromised) and then the police reading Alice and Bob's messages from Bob's phone want to know Alice's IP address... they can compel a server operator to give it to them. (And it is the same for a user who posts a SimpleX contact link publicly.)
Briar has even fewer N/As than SimpleX and all greens otherwise. Second column in the table.
Briar has even fewer N/As than SimpleX and all greens otherwise. Second column in the table.
Briar has a yellow Yes in row 12 ('requires global identity')
... presumably because (if you have one instance of the Briar installed) when you're talking to two different people they can check and confirm you're the same person, while in SimpleX you can create disposable/ephemeral identities for different chats.
I haven't reviewed this thoroughly but I can see that there are a lot of attributes that could be added to this table in regards to metadata protection against various parties, including revealing online presence to servers and contacts (which is a place where briar falls short).
And, because I'm not entirely uncynical, does the creator of the spreadsheet work for any of the companies included upon it?
I have worked for Status in the past, but that has not impacted the review of any apps. The spreadsheet has been reviewed thoroughly by others in the privacy space before I published it, and I encourage everyone to take a look and report any inaccuracies.
The criteria is objective on purpose. Everything on the spreadsheet can be verified for accuracy.
Status got a recommendation purely because it has proven itself to be resiliant to subpoenas and the cryptography is implemented well.
Nothing is sponsored, and no matter who I work for in the future, it won't impact the results. It's open source on GitHub, and I'm looking for contributors to decentralize control of the spreadsheets.
it would be more usable if the left column were locked so you don’t lose it when scrolling horizontally. Same for the top row.
“Email / Phone required for signup” ← these are on two very different levels of intrusiveness.. really needs to split into two rows. And from there, it’s interesting to know whether a phone must be a mobile phone or not. With email, it’s interesting to know if disposable addresses are blocked or not.
Also, for “decentralized network” for #Signal, you simply have “no”. I would change that to “No (Amazon)” to inform people they are feeding Amazon by using Signal.
In fact I suggest also adding a row: “feeds a tech giant” because privacy from tech giants is not the only factor -- some of us trying to live ethically do not want to even feed privacy offending tech giants, such as:
- Amazon
- Microsoft
- Cloudflare
- Apple
And as someone else pointed out, Delta Chat is missing.
Looks good, thanks for the hard work!
According to my uBlock Origin your site uses Google fonts which I have blocked. Can you make that more privacy friendly please ?
So contributions require folks create accounts with Microsoft for GitHub? That’s a bit contradictory, but here you are telling folks to raise “Issues” exposing themselves to Microsoft’s ToS & data collection machine.
You're not required to contribute. I went with GH because it doesn't require creating a new account on an obscure Git provider, which would kill the chwnces of anyone contributing.
Git provides itself, so forges aren’t even required (the d is distributed version control). Issue trackers don’t need to be attached to the code forge. Ewen if you like someone else hosting it & an sidecar of integrated bug tracking, it should not require an account with Microsoft if privacy is the end goal—and there’s a host (pun not intend) of other options.
PRISM Break, Calyx live on GitLab (not obscure, supports SSO). Many free software projects like Freedesktop, GNOME, KDE, DivestOS, Briar, Jami self-host the community edition of GitLab. Privacy Tools & Awesome Privacy mirror to Codeberg, presumably to espcape the megacorporate bubble. LibreWolf is exclusively Codeberg. Cwtch self-hosts Gitea. Prosody self-hosts its Mercurial server. Choosing not Microsoft GitHub puts you in good company.
If a mailing lists alternative isn’t your thing, Forgefed, federation protocol for software forges, would apply for anyone with a Fediverse account (so Lemmy) could submit issues with Forgejo build it in along with others soon (GitLab expressed interest).
Choosing proprietary tools and services for your free software project ultimately sends a message to downstream developers and users of your project that freedom of all users—developers included—is not a priority.
—Matt Lee, https://www.linuxjournal.com/content/opinion-github-vs-gitlab
Mailing lists are for old fat unix guys. Who uses email anymore? I can't even remember the last time I opened my inbox, maybe a month ago for a 2FA code?
I'll stick with GitHub because its what I know. If you don't want to use GitHub, then you can still view the spreadsheet, just dont click the GitHub or Datasets links in the fop left.
You’re in a privacy-related space that values keeping data away from the corporations—that’s why your response has a worse ratio. If you don’t want your messaging data with data with Meta or Google, why would you be okay with Microsoft for your code? I like that instead of acknowledging the multitude of options you would have that puts your project in better position for contributor privacy, you chose to attack the one you disliked the most, mailing lists, & dismissed everything else. It’s really not any more difficult to pick up something like Codeberg & the UI loads faster too.
If someone said “WhatsApp is what I know, why should I care about your $MESSAGING_APP?” would you not, like, send them the output of your project to explain how their digital privacy is at risk? Consider building another list comparing code forges & see that you get little extra from MS GitHub being closed, proprietary, centralized, for-profit/publicly-traded, requires accepting Microsoft ToS to create an account, search locked behind auth, slow to load, slow to fix bugs, has outages constantly, locks out all users from Yemen et al. due to US sanctions, plays ball with capitalists (such as following record label demands to take down youtube-dl), pushes ‘social’ features (massive can of worms), tries to monopolize the developer space on the network effect, etc.
I think that information for XMPP is inaccurate. I use it for private communication. E2E encryption is on by default in Conversations, messages are removed from a server if MAM is off.
Dino, Gajim turn on OMEMO by default & even the TUI Profanity prominently displays [unencrypted] in red at the top by default nudging you to pick OMEMO, OTR, or PGP for end-to-end encryption. The protocol is generic on purpose & meant to be extended with encryption which in the case of private chat applications, is now defacto. Much in the same way, TLS isn’t required since there are application that don’t require it, but defacto, all guides for setting up a XMPP server for chatting applications will suggest TLS where some servers have options like s2s TLS required or it won’t talk to the other server.
Seems weird that there’s a big, red no even when all the defaults point in the direction yes for human-to-human chat. Much in the same way some values are wrong like apps & servers being open source when there very much are proprietary XMPP servers out there like WhatsApp & Zoom. There’s also a reason Tails OS comes with Dino (or Pidgin) & every dark web guide explains how to connect to XMPP thru Tor + OMEMO/OTR, because it can be secure & anonymous enough for criminals & whistleblowers while being lightweight & decentralized.
It's always crickets when the issue of improper poor ranking of XMPP is addressed in these threads..
Everything has to be new & shiny or it’s bad. XML bad, JSON good. /s
Why Session is not recommended for private communication?
They purposefully removed perfect forward secrecy, which is an important part of preventing future compromise in the chain of messages.
They explained this, and why it doesn't weaken the stack.
This opinionated ruling about "no PFS,no secure" is questionable judgement
This is awesome! Is there a way to freeze the first column? Just so you can scroll to the right and see the categories
Working on it
Deltachat?!
view more: next ›