They have been hoovered up, by home assistant. I made no claim, nor did the source, that clear-text credentials were shipped anywhere.

This is meant to drive awareness on a transparency and dev issue, not an overt compromise. My language was maybe a bit too inflammatory though, I suppose.

Agreed, prosody is great! I’ve been doing some experimenting with ejabberd and it seems more enterprise-ready, but I haven’t found anything that is discernable as far as feature advantages.

UPDATE: For anyone who comes back to this, or any new readers – I have added a MUC (chat room) on my XMPP server for discussion of any tech-related things, akin to the subject-matter of this blog. Hope to see you there!

xmpp:roguesecurity@groups.hackofalltrades.org?join

I have experimented with Simplex, but it feels less tuned toward hosting federated infrastructure and more tuned toward participation with the greater network in a pseudo-anonymous fashion.

Adoption is also always a hurdle with any ecosystem like this, and XMPP is certainly ahead of Simplex in that avenue.

It has a long healthy life ahead! Come join the party, the proof is in the pudding.

Yeah they just redid their container image pipeline and these containers are the result!

Super true. I think this was best exemplified by SignalGate

This is great, I have not seen this post before. Thank you for sharing.

You make an excellent point here, that the burden of security and privacy is put on the user, and that means that the other party in which you’re engaged in conversation with can mess it up for the both of you. It’s far from perfect, absolutely. Ideally you can educate those that are willing to chat with you on XMPP and kill two birds with one stone, good E2EE, and security and privacy training for a friend. XMPP doesn’t tick the same box as Signal though, certainly. I still rely heavily on Signal, but that data resides on and transits a lot of things that I don’t control. There’s a time and a place for concerns with both, but I wanted to share my strategy for an internal chat server that also meets some of those privacy and security wickets.

That’s because they just terminate TLS at their end. Your DNS record is “poisoned” by the orange cloud and their infrastructure answers for you. They happen to have a trusted root CA so they just present one of their own certificates with a SAN that matches your domain and your browser trusts it. Bingo, TLS termination at CF servers. They have it in cleartext then and just re-encrypt it with your origin server if you enforce TLS, but at that point it’s meaningless.

This is absolutely not what DNSSEC is. DNSSEC provides authenticity of the response, not privacy. You’re describing a means of encrypted name resolution, like dns-over-tls, dns-over-https, etc.