Ancestors

Toot

Written by Daniel Supernault on 2025-01-29 at 15:52

sup is like Facebook Messenger, but for the fediverse.

Connect all of your fediverse accounts on one app, and connect with people on other platforms or protocols, like IRC.

It's also going to be fully open source, and modular with a simple plugin system to add support for other fediverse platforms and more.

A universal, open, federated messenger.

Built by @PixelFed ✨

[#]sup

=> View attached media

=> More informations about this toot | More toots from dansup@mastodon.social

Descendants

Written by shnoorg on 2025-01-29 at 15:56

@dansup @PixelFed will it also use the signal protocol?

=> More informations about this toot | More toots from shnoorg@infosec.exchange

Written by shnoorg on 2025-01-29 at 15:57

@dansup @PixelFed federated signal servers would be sick.

=> More informations about this toot | More toots from shnoorg@infosec.exchange

Written by Rea Gui on 2025-01-29 at 16:06

@shnoorg @dansup @pixelfed Really hoping to see more E2EE in the Fediverse!

=> More informations about this toot | More toots from rea@mastodon.online

Written by 2xfo on 2025-01-29 at 16:48

@rea @shnoorg @dansup @PixelFed

Does it exist now? As far as i know, "direct" messages aren't really even private on this platform. (At least, tagging a person in a direct message to someone else will bring the tagged person into the conversation, not something most people would expect for "direct" messages)

=> More informations about this toot | More toots from RnDanger@infosec.exchange

Written by shnoorg on 2025-01-29 at 17:10

@RnDanger @rea @dansup @PixelFed "more than 0" is still more.

=> More informations about this toot | More toots from shnoorg@infosec.exchange

Written by 2xfo on 2025-01-29 at 17:12

@shnoorg @rea @dansup @PixelFed

"That's happened a number of times!"

"Oh yeah, how many times did that happen?"

"Zero is a number."

=> More informations about this toot | More toots from RnDanger@infosec.exchange

Written by Rea Gui on 2025-01-30 at 01:10

@RnDanger @shnoorg @dansup @pixelfed I counted Soatok’s proposals and the various discussion on Mastodon’s git repo. Might take some time to mature, but who knows

=> More informations about this toot | More toots from rea@mastodon.online

Written by The Gym Nerd on 2025-01-29 at 19:00

@shnoorg @dansup @PixelFed one could argue that matrix is kind of a federated signal.

I doubt that federating in that sense will be possible without signal opening up for it. The only thing I see possible would be a bridge still requiring you to setup an account on signal server... Like it's with the matrix-signal bridge.

So yes, in the end I would simply recommend to use matrix if you want a federated encrypted messenger that also can connect to signal today.

=> More informations about this toot | More toots from TheGymNerd@mastodon.social

Written by Tilde Lowengrimm on 2025-01-29 at 20:17

@TheGymNerd @shnoorg @dansup @pixelfed What's the argument that Matrix is like federated Signal?

=> More informations about this toot | More toots from tilde@infosec.town

Written by The Gym Nerd on 2025-01-30 at 17:34

@tilde @dansup @PixelFed @shnoorg because it is centered around private communication, has (as far as I can tell) secure E2EE and is federated...

So from a function perspective it does all for me that signal does + it's running on federation.

=> More informations about this toot | More toots from TheGymNerd@mastodon.social

Written by Tilde Lowengrimm on 2025-01-31 at 02:50

@TheGymNerd @dansup @pixelfed @shnoorg Aaah, I see what you intend. I disagree. Matrix has substantially different cryptography from Signal, and a design which relies more heavily on the good behavior of severs. It also has what I'd call bad "security smells": issues indicative of larger underlying problems in design & implementation, like this one. I don't think it's reasonable to characterize Matrix's security as equivalent to Signal's.

=> More informations about this toot | More toots from tilde@infosec.town

Written by The Gym Nerd on 2025-01-31 at 06:16

@tilde @dansup @PixelFed @shnoorg

Ok IDK what the problem with the servers should be but if you don't trust a server you can setup your own so you only need to trust yourself.

For me it looks like the article is mostly complaining about an issue in a library that some clients use and that is deprecated and no longer used by matrix.org.

All I can say is there was a professional security audit founded by German government in that no issues were detected. https://element.io/blog/bsi-funds-security-analysis-of-matrix/amp/

=> More informations about this toot | More toots from TheGymNerd@mastodon.social

Written by The Gym Nerd on 2025-01-31 at 06:25

@tilde @dansup @PixelFed @shnoorg but perhaps matrix has the edge if we go on a very theoretical level.

So Matrix could perhaps work on getting more security audits while signal could perhaps work on getting federated (I don't think they have any intentions of doing this, leading to a new vendor log-in)

From my POV it appears that matrix is save enough to be used in everyday business. If state level authority wants to spy you, they will probably hack the phone first and read before encryption.

=> More informations about this toot | More toots from TheGymNerd@mastodon.social

Written by Tilde Lowengrimm on 2025-01-31 at 16:00

@TheGymNerd @dansup @pixelfed @shnoorg If you are using Matrix, a sophisticated adversary doesn't need to hack your device. They can attack your server(s) and manipulate group membership and transcripts directly.

Matrix is federated. Its security and privacy properties are not equivalent to Signal's. That doesn't mean "don't use it"; it means that Matrix is not "federated Signal".

=> More informations about this toot | More toots from tilde@infosec.town

Written by The Gym Nerd on 2025-02-01 at 06:54

@tilde @dansup @PixelFed @shnoorg so your point is that federation is always less secure by Desi, because there are more stations that can be maintained badly and attacked?

Because you would also have to trust that the devices of others or the one signal Server are not compromised.

But obviously Matrix is not federated signal, because nothing is federated signal.

=> More informations about this toot | More toots from TheGymNerd@mastodon.social

Written by Tilde Lowengrimm on 2025-02-01 at 17:38

@TheGymNerd @dansup @pixelfed @shnoorg No, my point has nothing to do with federation in general. It is about the design of Matrix's cryptosystem in particular: a design which gives servers a great deal more latitude to add unauthorized participants to private conversations (among other things) than I think is reasonable in a notionally E2EE system.

The whole point of calling something E2EE in my opinion is that nobody but your intended recipients (or their devices) can influence message confidentiality and authenticity; intermediaries at most can impact availability (by not working slash not delivering messages in general). Matrix forces you to rely on servers also behaving well and not attempting to compromise your communications secrecy. In Signal, you very explicitly do not have to rely on the good behavior their infrastructure to guarantee confidentiality. This is not about federation; these are the designs of two different cryptosystems, which offer different guarantees!

It would in principle be possible to build something which takes Signal's actual cryptosystem, adds a key transparency system like the one that @soatok is designing for fedi, and build federation on top of that. Something like that could reasonably be called "federated Signal". Matrix is not that. It's it's own thing with different (weaker) security promises to Signal.

=> More informations about this toot | More toots from tilde@infosec.town

Written by Tilde Lowengrimm on 2025-01-31 at 15:57

@TheGymNerd @dansup @pixelfed @shnoorg "You can just run your own server." should be all the illustration needed for why these two things are not equivalent. But alas, that does not actually solve the issue. Even if you're using your own server, any channels hosted on other servers are vulnerable to those servers' manipulation. You need to rely on every server you have channels on. And if you don't have conversations on other servers, well, now it's just worse than Signal and you have to host it yourself, still no federation.

That issue I pointed out is not only so much worse than you characterize, but fundamentally indicative of poor development practices which produce many more problems which the developers are not well-suited to detect. Read the whole article. Which is why I'm not pointing at that issue as an active unfixed vulnerability, but as a "code smell" indicative of deeper and more pervasive issues.

=> More informations about this toot | More toots from tilde@infosec.town

Written by Sarah A on 2025-01-29 at 15:57

@dansup if this exists, I would like to try and test this for accessibility. I have mastodon for now, is this what you had in mind, assuming of corse you are the developer. Hehaha. happy wednesday in either case.

=> More informations about this toot | More toots from ke7zum@glitchsoc.bg-presents.us

Written by Gentleman of Leisure 🍉🌈🏴Ⓐ☭☘ on 2025-01-29 at 16:02

@dansup @PixelFed This sounds really exciting.

=> More informations about this toot | More toots from fiend_unpleasant@mastodon.social

Written by Den Datafag Trollmann :flag: on 2025-01-29 at 16:04

@dansup @pixelfed

.mp4

=> View attached media

=> More informations about this toot | More toots from hj@shigusegubu.club

Written by Fritz Adalis on 2025-01-29 at 16:09

@dansup @PixelFed @tinker

Why wait to make it open source?

=> More informations about this toot | More toots from FritzAdalis@infosec.exchange

Written by Viktor Glukozavr Kurochkin on 2025-01-29 at 16:12

@dansup @PixelFed Is that a teaser? I guess there so nothing to check out yet?

=> More informations about this toot | More toots from glukozavr@mastodon.gamedev.place

Written by Thomas The Dank Engine 🇵🇸 on 2025-01-29 at 16:15

@dansup https://pixelfed.social/pixelfed So this is a beeper alternative?

=> More informations about this toot | More toots from ibc_tarii@mastodon.social

Written by x51 on 2025-01-29 at 16:17

@dansup @pixelfed Why not just use XMPP w/ OMEMO or Matrix?

=> More informations about this toot | More toots from x51@social.lol

Written by Daniel Supernault on 2025-01-29 at 16:18

@x51 that will be supported, but this is just a client

=> More informations about this toot | More toots from dansup@mastodon.social

Written by Guillaume Rossolini on 2025-01-29 at 16:18

@dansup 😂 the name is such a good play on words

=> More informations about this toot | More toots from GuillaumeRossolini@infosec.exchange

Written by Artem Anufrij on 2025-01-29 at 16:24

@dansup

Dan, when is the release planned?

@pixelfed

=> More informations about this toot | More toots from artem@social.anufrij.de

Written by Stevie Inghram, MS, YT, AWC on 2025-01-29 at 16:40

@dansup @PixelFed So cool, can't wait!

=> More informations about this toot | More toots from futuredrstevie@mastodon.social

Written by EloPup on 2025-01-29 at 16:41

@dansup @PixelFed

Noice 👍🏻

=> More informations about this toot | More toots from EloPup@mastodon.social

Written by lps on 2025-01-29 at 16:45

@dansup @PixelFed I can't wait, this will be amazing! Are there still plans for encrypted messages? If you're looking for a solution, please consider integrating #xmpp or the ability to connect to an external account maybe?

=> More informations about this toot | More toots from lps@mograph.social

Written by Debacle on 2025-01-29 at 17:15

@lps @dansup @PixelFed

Note, that there is already an #XMPP-#ActivityPub gateway as part of #Libervia by @Goffi. I tried it for direct messages and it worked. Unencrypted, of course, atm.

[#]Jabber

=> More informations about this toot | More toots from debacle@framapiaf.org

Written by Evan Light on 2025-01-29 at 16:50

@dansup @PixelFed @tinker So you're saying it's not "Yo"? 😂 Because the logo and name reminds me of "Yo".

"Yo" was hilarious for me for a couple of days. 😉

But, seriously, this sounds pretty cool.

=> More informations about this toot | More toots from elight@tenforward.social

Written by Frances Larina on 2025-01-29 at 17:50

@elight @dansup @pixelfed @tinker

Yo should be the encryption layer.

That way, if you use both...

=> More informations about this toot | More toots from Frances_Larina@sfba.social

Written by Catherine Schmidt on 2025-01-29 at 17:00

@dansup @PixelFed elder here….so sup would be like fb messenger while not being owned by a corporation or intrusive , censorship and advertising as well as being in the fediverse. You could say , link a Bluesky account with your mastodon?

=> More informations about this toot | More toots from lillyfinch@mstdn.social

Written by dch :flantifa: :flan_hacker: on 2025-01-29 at 17:20

@dansup game changer! Sweet

=> More informations about this toot | More toots from dch@bsd.network

Written by Rémi du Nord on 2025-01-29 at 17:44

@dansup https://xkcd.com/927/

=> View attached media

=> More informations about this toot | More toots from remidu

Written by Solid snack on 2025-01-29 at 19:43

@remidu @dansup feels like you need to use one of the 14 standards and make it compliant with the other 13

=> More informations about this toot | More toots from Cattail@mastodon.social

Written by TheStrangelet :bc: on 2025-01-29 at 17:45

@dansup @pixelfed E2EE encryption support? No one should be using a messenger without encryption in this day and age.

=> More informations about this toot | More toots from thestrangelet@beige.party

Written by orbitalmayo on 2025-01-29 at 18:20

@dansup @PixelFed E2EE?

=> More informations about this toot | More toots from orbitalmayo@mastodon.social

Written by Security Writer :verified: :donor: on 2025-01-29 at 18:41

@dansup @PixelFed you’re doing so much good work, Dan, that I’m worried you’re going to start your villain arc soon 😂

=> More informations about this toot | More toots from SecurityWriter@infosec.exchange

Written by The Gym Nerd on 2025-01-29 at 19:10

@SecurityWriter @dansup @PixelFed you have to be rich first in order for that to happen 😅

And a 40k Donation Campagne is not nearly enough for this. Till now, I think nobody got rich from the Fediverse... Even if many would definitely deserved it.

=> More informations about this toot | More toots from TheGymNerd@mastodon.social

Written by eryk on 2025-01-29 at 18:43

@dansup @PixelFed seems awesome

=> More informations about this toot | More toots from kameleonnn@mastodon.social

Written by joene 🏴🍉 on 2025-01-29 at 18:58

@dansup @PixelFed

[#]Soon?

=> More informations about this toot | More toots from joenepraat@todon.nl

Written by ⠵⠻⠷⠕⠭ 🍥🍉⚪🌹 on 2025-01-29 at 19:08

@dansup @PixelFed These projects are look pretty cool and I know I can use a web UI for some of them, but are you considering putting the apps into FDroid, I haven't seen them there. Cheers

=> More informations about this toot | More toots from z3r0fox@mastodon.social

Written by Total Sonic Media on 2025-01-29 at 19:35

@z3r0fox @dansup @PixelFed - there are 3rd party Pixelfed clients on F-droid though, e.g. PixelDroid and Pixelix

=> More informations about this toot | More toots from TotalSonic@mastodon.social

Written by slax on 2025-01-29 at 23:20

@z3r0fox @dansup @pixelfed you should be able to get the APK from the site and github as well as alternative apps that can connect to the platform.

=> More informations about this toot | More toots from slax@hometech.social

Written by Total Sonic Media on 2025-01-29 at 19:30

@dansup @PixelFed - Matrix and XMPP support in this would be great to see as well.

=> More informations about this toot | More toots from TotalSonic@mastodon.social

Written by cos on 2025-01-29 at 19:36

@dansup @PixelFed how does it compare to Matrix? The description is almost identical. Bridging them will probably be easy.

=> More informations about this toot | More toots from cos@fosstodon.org

Written by The Many Voices of Anne Ahlert on 2025-01-29 at 19:36

@dansup @PixelFed

[#]Sup #WhatsUp #BigBangTheory #TBBT

=> View attached media

=> More informations about this toot | More toots from TheManyVoices@mastodon.social

Written by jadedctrl :programo: :korektu_min: on 2025-01-29 at 21:17

@dansup @pixelfed Having difficulty grokking this. Is sup supposed to be a multi-protocol chat program? Basically @pidgin but a web-app? :gutkato_scivola:

=> More informations about this toot | More toots from jadedctrl@jam.xwx.moe