Glonce

Jabber/XMPP turns 25 with an essay arguing it beats Matrix on openness

infrastructureThe Glonce editorsHacker News🔥58Glonce rating58Impact45Novelty32Relevance70Surprise38Players48Credibility78

An essay published on gultsch.de to mark 25 years of Jabber and XMPP argues that communication tools should be treated as infrastructure, meaning they should run on open standards rather than on a single vendor's API, even a well-meaning one. The author's central claim is that interoperability requires a standards-developing organization (SDO) such as the IETF, the ISO, the W3C, or the Unicode Consortium, because these bodies force competing stakeholders to agree on a protocol rather than letting one company set the rules unilaterally.

XMPP started life as the open-source Jabber project before it was brought to the IETF and renamed. Its original RFC dates to October 2004 and received only minor revisions in March 2011. Because the X in XMPP stands for Extensible, the protocol adapts through XMPP Extension Protocols (XEPs), overseen by the XMPP Standards Foundation, which tracks which clients and servers implement which XEPs rather than writing the extensions itself. The essay traces two extensions to show that publishing a spec is not the same as delivering it: Stream Management (XEP-0198), which prevents message loss on mobile connections, was stabilized in 2009 but only saw widespread implementation around 2014 to 2015, well after the iPhone (2007) and the first Android phone, the HTC Dream (2008). OMEMO (XEP-0384), XMPP's end-to-end encryption specification, only gained traction from 2016 onward, three years after Edward Snowden's revelations about NSA surveillance put encrypted messaging on the public agenda.

The essay contrasts this IETF-run process with Matrix, the protocol built by Element (formerly Riot and NewVector). It argues Element published Matrix as its own API rather than bringing it into an SDO, that key leadership positions in the Matrix Foundation are predominantly held by current and former Element employees, and that getting outside contributions into the Matrix specification is notoriously difficult. It draws a second comparison to JMAP, a replacement for IMAP and SMTP that started inside Fastmail before going through the IETF: JMAP now has at least three independent server implementations and many client apps, while Matrix, despite dating to roughly the same era (around 2014), still has one predominant reference server implementation plus a second alternative that remains immature. The author says that reference implementation is resource-intensive to run, which makes self-hosting hard for smaller organizations and individuals, and that Element sells closed-source plugins to speed it up. The piece also warns that European public administrations pursuing digital sovereignty routinely procure Matrix-based platforms while mistaking an open-source codebase for an open standard.

The essay extends the same skepticism to consumer apps often held up as privacy-friendly, Signal, Wire, and Threema, arguing they are still walled gardens that do not interoperate with anything else. It singles out Signal, noting the organization pays its CEO close to a million dollars a year and runs its servers on AWS, and argues that being open source does not protect users if such a service shuts down or exits a market.

On XMPP's current state, the essay points to modern clients such as Dino on Linux and Conversations on Android as feature-competitive with proprietary alternatives, citing emoji reactions, cross-device read-state sync, and time zone indicators as recent additions. It also highlights channel binding, a mechanism against certain machine-in-the-middle attacks that the author says became relevant after a state-sponsored attack on a public XMPP provider, without naming or dating that incident in the retrieved text. Looking ahead, it says the community is working on message replies, gallery-style multi-image sharing, and OAuth support, all backed by experimental XEPs awaiting implementation experience, and is exploring an update to the original RFC that would bring XMPP back to the IETF as "XMPP 2.0." The retrieved text ends mid-sentence, partway through a closing analogy comparing Matrix to a reinvented, rubber-tyred metro system that still leaves a municipality locked into a single vendor; the essay's full conclusion was not available to verify.

Key facts

  • XMPP began as the open-source Jabber project; its original RFC dates to October 2004, revised in March 2011, and the essay puts its roots at more than 25 years back.
  • The author argues Matrix, published by Element (formerly Riot and NewVector) as its own API rather than through a standards body, has Matrix Foundation leadership predominantly drawn from current and former Element staff, and that outside contributions to the spec are notoriously hard to get accepted.
  • XEP-0198 (Stream Management) was stabilized in 2009 but only saw wide implementation around 2014 to 2015; OMEMO end-to-end encryption (XEP-0384) gained traction from 2016, three years after Edward Snowden's NSA surveillance revelations.
  • The essay criticizes Signal, Wire, and Threema as non-interoperating walled gardens despite their ethical reputation, pointing to Signal paying its CEO close to a million dollars a year and hosting on AWS.
  • XMPP's channel-binding feature, cited as unique among self-hostable messengers, is described as having become relevant after a state-sponsored attack on a public XMPP provider; the community is now working on message replies, multi-image galleries, OAuth support, and a possible RFC update called "XMPP 2.0."

Why it matters

The essay's core argument is that communication tools are infrastructure, and infrastructure should run on open standards set by a standards-developing organization rather than on any single company's API, however well-intentioned that company looks. It uses XMPP's 25-year run through the IETF and the XMPP Standards Foundation as the positive case and Matrix, controlled in practice by Element, as the cautionary one, arguing that an open-source codebase is not the same guarantee as an open standard.

Who it affects

The essay is aimed at digital-sovereignty advocates and European public administrations that procure messaging platforms, at privacy-focused users who default to Signal, Wire, or Threema, and at developers and operators choosing between XMPP and Matrix for self-hosted or federated messaging deployments.

How to use it

XMPP is not a product with a price; it is a protocol anyone can implement or connect to. The essay points to Dino (Linux) and Conversations (Android) as current clients that match proprietary competitors feature for feature, with recent additions including emoji reactions, cross-device read-state sync, and local-time-zone indicators, and notes that channel binding is available as a defense against certain machine-in-the-middle attacks.

How solid is it

This is a first-person advocacy essay by a longtime XMPP community writer, not a neutral report; its historical dates for the RFC and specific XEPs (2004, 2009, 2011, 2014 to 2015, 2016) are stated plainly and are independently checkable against XMPP Standards Foundation records. Its claims about Matrix Foundation governance and Element's practices are the author's own characterizations, and the retrieved text cuts off mid-sentence before the essay's conclusion, so its final argument could not be fully verified here.

Risks and caveats

The piece is explicitly one-sided against Matrix and against Signal-style walled gardens, so its framing of Element's control over Matrix governance and of Signal's business practices should be read as argument, not adjudicated fact. The state-sponsored attack it cites as the reason channel binding matters is not named or dated in the available text, and no user, market-share, or revenue figures are given for any of the platforms discussed.

“Standards need to be backed by multiple, preferably independent, implementations.”

— the essay on gultsch.de