The half-time journal

Yeah! Why the heck not.

The first week of this month we saw lots of drama around discord's age verification nonsense that shall impact the planet early next month.
So since then, I've been taking serious looks around at alternatives - self-hostable services, I mean.

No commercially hosted messaging platform will be able to evade the political pressure of identifying their users in the most anonymity destroying manner. (Because that's cheap, and also great to sell more data for advertisement money making reasons)
For example Matrix.org has welcomed new discord exiles, but made it clear that they will also verify user age/ID soon. At least on the publically hosted server instances, which I assume 90% of people will use.

I have seen many furries flood onto Stoat - a discord clone, formerly called Revolut. The company that develops it sits in the UK. As a UK company, of course they will verify the identity of the users as well - they will have to. Law says so.
Stoat can be self-hosted. If you have a server, you can set it up just for yourself and your friends with no corporate oversight. But it is a huge stack of interconnected services! And I look at it with dread.

Extra-nerdy paragraph following, you can skip this ###

---

Stoat uses a huge stack. Database - Mongo of course. Redis as message broker. Another message broker. An S3 storage server (minio of all things, they have ceased maintaining their repo in december! But could be replaced.) Add to that an API server, a web server, an events service, a web app, a file server, metadata and image proxy, task daemons, push notification service... And half of this is shit that they clobbered together on their own. Audited? Heck naw.
There are so many 0-day and N-day exploits waiting to be found and used there, so many opportunities for Shit to Go Wrong™, I couldn't keep this safe and stable. It would be a 24/7 job.

None of Stoat's user data/messages are encrypted. No end to end encryption, each of those services sees the raw data. No privacy. Of course they would have to police the uploads as well to scan for peepees and kiddie porns.
For a strictly isolated service that sits behind a VPN or just in an internal network? Maybe. For anything more? Nah :D

---

### Nerdy paragraph finished!

So what else is there! Cloud offerings are out. They will all take your anonymity away and look at what you post. First in the name of the children, then in the name of preventing political statements that the people in power don't like. And eventually you'll just get jailed or shot for something you said privately 5 years ago. (Hopefully things will change before it escalates this far, but you know, it takes time for the old people who keep electing the even older people who make these laws to die out.)

So message encryption is needed. I think this is really sensible because sooner or later all of the hosting companies will also be put under pressure to snoop. Or just get gag-ordered by their respective secret services in power.
I'd rather have it that my root server has no data that is of any use to anyone take an uninvited look, IF someone comes to take a look.
I don't do anything evil other than lust over monstery dicks and tech like any respectable mad-shark xD But it is out of principle. When I feel constantly watched and I begin to not say things how I think and feel them, that is just not good.


Another very nerdy paragraph ahead! You may skip this if you don't care about a list of things I tested: ###

---

I looked at these things and set up local copies to explore their features or self-hostability:

- Matrix- the homeservers are really resource heavy and lack admin features such as message deletion, managing file attachments, garbage collection, moderation, etc. Group chats are not encrypted. Metadata is not encrypted. The chat clients are awful. Federation is clunky. The developers are busy huffing the fumes of their own greatness.
- Delta Chat - Actually very interesting. Uses modified email servers as backend to pass messages around. Encrypted messages, and the security claims have been audited. Messages aren't stored on the server forever, but just long enough so they get delivered. Problem: Email servers get pelted with spam attempts and it requires opening quite many outdated ports for old email compatibility reasons. Who would send unencrypted emails in this day and age??? If they could settle on just using one port for the email communication and get rid of the legacy garbage, I think this could be a really cool thing to self host!
- SimpleX - I think this might be the most maximally encrypted chat protocol I've seen to date. Amazing tech... sadly it only has one chat client, and that is an absolute turd. Even worse than the one for Matrix! 600-900 MB RAM usage for an anemic feature-lacking client? Fuck straight off to hell. With a better client, I think this could be great. Don't see it happening anytime soon though.
- Tinode - Looks like a self-hosted telegram. Similar chat features. Very easy to write clients for this. Overall not terrible! But: No encryption. No federation. This might grow into something good over time. Right now for my purposes: No.
- IRC Servers - Too cumbersome to maintain. Also most web hosts I have been at explicitly forbid running one of them. Few clients have features that people are expecting from modern chat clients. Not encrypted.
- XMPP Servers - Robust, clunky to set up though. Only one/two XMPP clients actually support modern end to end encryption and other fancy features, most have been severely neglected over the past decade. It is an option I'll look more into.
- Databag - Interesting! Encrypted messages, encrypted group chats. Very lightweight and uncomplicated service, most parts written in Go. Can run even on a single core server. For a small friends circle or special project, I can see myself using this, even though it lacks super advanced fancy features right now. Nice built-in web UI. Friendly developer. Encryption has not been audited though, not sure if it's any good. Might have gaping holes.
- Nerimity Adaptchat / StrafeChat - Visual discord clones. I'm tempted to say hot garbage. If any of these survive more than a few months I'd be surprised. Obviously not encrypted.
- Stoat As already rambled about in the passage up there, it is not an option.

All of these things rely on some form of external helper for audio and video calls, and in each case the users are wishing for a built-in solution. Seems to be a difficult thing to solve. None do any desktop sharing as far as I can see.
Is it really that hard? Though one could solve this problem by just self-hosting a stream using Owncast or something similar, I suppose. And for voice calls there is Mumble or Teamspeak. But again, users are lazy and don't like splitting up tasks like that.

---

### Nerd section over!

So I wish I had found a perfect thing yet and could say: AYYY I FOUND THE PERFECT THING!! But there are pros and cons to be carefully considered.
I want to find something decent and stop this demolishing of my anonymity and privacy. Jumping from one burning building to another will not stop this. It only works when one isolated company goes mad because their shareholders or new company told it to -- see Tumblr back in 2015 or so. But this time it is NOT just discord suddenly having gotten mad on their own, it is a systemic problem that will affect *all* public platforms. One by one. Until you give up, or get out.
Hosting one for your friend circle seems the only way out. :0 And that's the plan.

Are any of ye also looking into this?
Thoughts? Plans? Are you already running some chat server? I'm curious. Uwu