arcanicanis / arcanicanis is on Nostr

Just someone that dorks around with federated platforms.

Last Notes

2026-10-21 06:04:57 GMT

Guess I invariably have to just shut down all the webservers I manage, per the latest PHP vulnerability announced (with patch scheduled for coordinated release at Wednesday UTC 14:00), since there's allegedly already a proof-of-concept deduced by people outside the embargo, based on the leaked summary details, as far as I understand.

2026-10-01 05:59:59 GMT

Critical announcement:
https://www.newgrounds.com/portal/view/719366

2026-04-08 00:29:56 GMT

- reply

I still don't even understand how it became a thing to defer animated emotes to a separate service entirely, and also expect it to last that way forever.

2026-04-02 21:30:00 GMT

- reply

And the exclusivity to WebSockets makes it a little annoying, because I can't make a basic relay implementation with any CGI/FastCGI-style execution (e.g. some PHP that you can throw on a craphost).
However I think I could make a simple Blossom server implementation, but a little more complicated by trying it trying to be RESTful

2026-03-22 00:05:51 GMT

Random thought: saw the mention of Isso, for a commenting system that can be used on static websites. Had the idea of something similar with ActivityPub instead, but then thought further of something where you could have something essentially proxy and transform content from a static website (given some URL pattern of which pages should be included/exempt, and where to extract content from).
Ergo, you could have some blog or other personal website, that could even be static, while having some secondary service that can transform it to ActivityPub, Nostr, or other representations, and serve an embedded (and moderated) comments section, without needing the content to originally be inside of some natively ActivityPub-based (or extended) platform.
Hell, even stepping even further: maybe could do it for an art gallery system too, that could do automatic cross-posting.

2026-03-08 23:13:59 GMT

- reply

Oh derp, and I almost forgot:
> XMPP over Nostr
There is the "Serverless" XEP originally meant for having local messaging on a LAN: https://xmpp.org/extensions/xep-0174.html
I'm sure horrors could be conjured of it in different/'wrong' contexts. Though of course people are free to make up and propose their own ideas.

2026-03-08 23:10:46 GMT

- reply

This might be the second prominent time I've seen SimpleX recommended. I think my main concern was that it sounded like it was another thing acting as another 'decentralized' overlay network just for a messaging protocol (as like with Tox), where said infrastructure is questionably free by some benefactor (unless I'm mixing it up with something else).
While comparatively, in XMPP there's accountability of who pays the bills with a server, and in Nostr, of who hosts the relays (and who they're willing to platform), versus the 'decentralized mesh [charity] network' that could flop when investors/benefactors lose interest.
If it's actually federated, and not just 'decentralized mesh [charity] net', then I could take another look. Although I don't know if 'you can run your own server' is like the bait-and-switch in Bluesky touting that you can host your own PDS, when actually you have no chance at running your own AppView server, since there is no directed delivery in ATProto, as you _have to_ filter EVERYTHING of the WHOLE NETWORK from a firehose, for receiving updates, as part of it's design.
Also to follow-up on the question I forgot to address, here's the list of XEPs at the bottom of the page: https://xmpp.org/extensions/
Meanwhile there's apparently a revised directory for implementations, which also goes into further detail of each individual XEP and when implemented/removed (per each software page), as listed on: https://xmpp.org/software/?category=clients

2026-03-08 22:44:42 GMT

- reply

> XML was - to me - always the "corporate JSON"
That's also the thing that gave people disinterest in XMPP was also the corporate use of XMPP, of some of the worst unreliable corporate software, of vendors that intentionally didn't want to bother interoperating well, support the absolute minimum possible, etc; just like how SIP telephony has been sabotaged plenty by the corporate world and vendors. Cisco wanted to hijack the attention on the trend of federated messaging, that they bought out the 'Jabber' trademark (as was the original branding to XMPP), to force people into brand association of it. Nonetheless, people having to support in the corporate side (presumably more of the European market) usually retch at it, when they think the totality of it all _is only_ the crap they deal with at work, having never touched the non-corporate side.
And yes, corporate-style XML, it was rife of all the 'consultancy traps', of vendors trying to grossly overengineer something as a 'solution' that's only meant to invent new problems for them to 'solve' by further consultancy and integration services. Thus you also have a whole suite of other things to pile on top of XML, to alter behavior, and make it even more complex than it needed to be. Thankfully XMPP foregoes all of that.
I don't really have any generalized recommendations for XML parsers. Especially when in a web browser, I'm just directly using what I have, versus piling another layer on top just for comfort.
I don't think MLS has any involvement by Matrix (just that they may implement it), I believe it originally started as a broader effort under MIMI, of creating an intermediate neutral protocol for centralized protocols to be able to interoperate in some generalized vocabulary (opportunistically acting that XMPP doesn't exist). Whereas MLS was to be something that could scale to much larger audiences, and be pushed/transformed across different transports (a la MIMI).
There could be test suites for the lower-level crypto stuff, but I don't think there's much on the high-level protocol implementation, such as intentionally dropping some messages, sending things out-of-order, censorship of a specific device, putting something back in time, and so on.
OMEMO is XMPP's implementation of Double Ratchet; 1:1 and 1:n.
COLIBRI is Jitsi Meet's XEP for SFU-facilitated conferences (and pretty explicitly in a formal presenter-led conference): https://xmpp.org/extensions/xep-0340.html
You can send stickers as PNG links, just like as if it were a result of an HTTP File Upload; it's just that such thing would lack the UX of 'sticker packs'. It's just that the leading example of an XMPP client with sticker support does it the worst way possible, and other people need to step in and make something better.

2026-03-08 21:56:46 GMT

- reply

Allegedly MSN was originally an IRC-like protocol. I can't speak to the others. Meanwhile Google Talk and Facebook Chat were originally pure XMPP (except Facebook Chat was unfederated). I think the overlap of using email addresses for login were more for a different matter, as XMPP only came around as a standard by 2004. Just generally that JIDs were maintaining the notion of being a 'user' [located] AT a 'server' (user@server), as part of identity; whereas email was the most prominent use of that form of representing identity (supposedly as far back to 1971).
Correct, the protocol is essentially XML over a TCP connection, where the vocabulary (and it's rules) establishes the notion of a protocol, without needing to lean on any other protocol (like HTTP) unlike nearly everything else in recent years. It can be accessed over other transports as well, such as plain HTTP(S) and WebSockets, to be accessible for webclients.
Yes, it feels like Matrix has kind of hastily painted themself into a corner a couple times. Especially seeing one of the diagrams for 'Sliding Sync', which just seemed unhinged (as I complained about at https://were.social/notice/Aa6Cy89IEgkINeko6K ).
Meanwhile, comparatively, 20+ years later of XMPP and I can still write the basics of a working chat client in a weekend, from scratch. And that's the off-putting thing about the Matrix ecosystem: of folks trying to usher people away from taking a look at the spec or even implementing it, to just use their first-party libraries instead. While in contrast the XMPP world is very multi-vendor, as a sign of a healthy protocol.
My original curiosity to Matrix (back when it was vector.im) was the pitch of having relatively decentralized identity, that you could still directly join in on rooms of another server even if your homeserver was temporarily down, or have multi-server federated chatrooms, meanwhile I don't think they've realized any of those things, and just invented yet another web-based chat with E2EE, but federated. Meanwhile Nostr is probably far better positioned to accomplish any of those, on such astronomically less complexity.

2026-03-02 08:36:03 GMT

[It's Not Fun Anymore]
I generally don't care for posts about 'fandom meta', but I'm breaking the rule anyway.
I just want some environment for appreciating and exchanging creative works. I enjoy a wide variety of content, but I don't have much patience left for the people involved in the communities.
I wish it could be a Demilitarized Zone, where people have a chance to escape the stresses of reality and politics. Where folks can share commonality in the things they like, rather than try to seek out incompatibilities of beliefs.
It is my repeated mistake to dig through social media, sometimes coming across identities that I've met elsewhere, and having regret of finding some charged post by someone I had assumed was a casual person. Doubly so if it's "the other side wants you dead" bait, triply so if it's advocacy for politically-motivated violence.
I try to make an active effort to not engage or talk about partisan matters publicly, or at least on social media. I very much have opinions on things, but my commentary is not going to serve anything, nor does a majority of others. There's such a low amount of originality, that the plurality and droning of the same opinions doesn't accomplish anything. People on social media are not seeking out to change their beliefs, or get down to the absolute truths---instead they're usually seeking out WWE-tier theatrics.
Some of the stuff people post online is not what you'd even say in a typical public setting, but this is apparently the norm now since probably 10-15 years ago (not referring to profanity). I'm mostly a 'free speech absolutist', I support and believe anyone should be able to legally speak whatever crazy unhinged sh't they believe. It's more the point of it being the norm of people lacking tact, or understanding what venues are appropriate for polarized topics. I am fully in support of activism (where appropriate), and people standing for what they believe in, but it shouldn't be 24/7 and should not be to the demoralization of their own political allies.
I wish Moderates didn't effectively become an 'endangered species'.
Appropriate levels of criticism or concern should not be inferred as someone being "anti-" about something.
According to the stuff that goes viral on social media, due to simply disagreeing with a stance or holding a different belief, I apparently: don't believe in human decency, want people dead, am racist/sexist/homophobic/whatever, want people to suffer, believe people should be trapped under tyranny, probably want babies to be fed to Cthulhu, and whatever else; all of this despite never holding nor uttering any of those beliefs to begin with, and said matter usually involving no correlation to those beliefs.
Supposedly because of any selection of my beliefs, I'm apparently "not allowed to" find interest in particular creative works or themes, because apparently it "just isn't" compatible, and only particular demographics are permitted to find interest in said things. I'm supposed to be an all-around bad guy and supposed to naturally foam at the mouth, regardless if I hold any common ground (_even if all_).
For some reason if I don't voice an opinion, people seem to assume I hold all of their same beliefs exactly by default. Although I think that trend happens disproportionately with a particular partisan camp. I've even had a creepy "we're so alike" comment from someone in-person, that I've _never_ uttered any words to (or even near), and where they weren't referring to any sort of online persona stuff or anything.
It's usually in the _very hidden_ off-ramps from fandom stuff, that I find some of the rare decent folks, that usually have also led to some of the same conclusions (avoids conventions, avoids events, avoids sharing their works, etc).
For context, I do not have any social media applications on my phone, nor do I ever check social media on my phone at all. I am not a perpetual doomscroller, I'll maybe check in once in a while, every few days (while fedi I might check daily, but averagely only up to ~30 minutes).
I've grown very habituated to knowing how to navigate certain fandoms due to it involving a sizable portion of my life, that I don't know how to navigate other possible social venues.
I've been enabled by said fandoms to be socially awkward or aloof, which has inhibited proper social development, that it makes it difficult to be socially compatible with people outside it. I can maintain [relatively] professional communication in work life, but I probably struggle on social life outside of it.
It gets demoralizing listening to some of the folks virtueing about being jobless, on welfare (and/or claiming 'disadvantaged adult' status), Terminally Online, "having kids is overrated", dodging out of any level of civics, of folks that could at least---at minimum---have creative pursuits or intellectual curiosities. That instead their life is defined solely by consumption, complacency, and periodic e-begging to fill any financial gaps.
I just want to be able to have some fun and normalcy again, as it was in the earlier years of the internet, or even with discourse in general.
(Cross post from https://arcanican.is/blog/2026/no-fun.php )

2026-03-01 22:39:02 GMT

- reply

I don't see XMPP in the list, which mentionably has very stable server implementations. Just about every necessary feature has been formulated in some form of XEP. There's the Compliance Suites for guidance of which XEPs are baseline for specific use-cases (to shoot down the typical "there's too many, there's no way to implement all of them!" which misses the intent of XEPs wholly).
There's the WebSockets transport for those that want it 'hidden' amidst HTTPS traffic, or to use it directly from a web-based client, and for those that want to do DOM-style XML parsing instead of 'needing' SAX parsers (as the conventional transport generally should use a SAX parser). Arguments about 'bloat' of XML are so disproportionate when you put it alongside Matrix, with all the HTTP headers for request/response for each submitted message, as the envelope (is there also still long-polling involved?) as people seem to conveniently forget.
XMPP has a solid foundation, the subject matter has been thoroughly beaten to death for over 25 years now, all the legacy cruft expelled, all the tools are there, it's just that there's no commercial motive for building well-funded general-purpose open source clients that aren't locked to a service. Most of the money is in using it infrastructurally in closed contexts (go down the list of it being used in the backend for Nintendo Switch, LoL, Fortnite, and whatever else).
Most client projects typically read as a one-man show, and then a sweep of people sliding in making their own rebranded soft forks, over what the parent project won't merge. The threshold to building a client, even entirely from scratch (including SCRAM auth, not just PLAIN), is so low, that I had even built a basic Telegram-like webclient in about a weekend capable of at least basic direct messaging.
Last year I even built a basic XMPP client entirely in VR, using an in-world node-based visual scripting language, just off of a node for handling WebSocket messages, and very primitive string manipulation functions (slice, concat, charAt, etc) to build enough of an XML parser from scratch for it (and first time I've made a real parser). Because effectively, it uses XML in it's simplest form, it does not need---and even forbids---a lot of the footguns that otherwise 'corporate-world' XML would entail. Hell, ProcessOne (folks behind ejabberd) built a Discord-style XMPP client in barely a month very recently (process-one.net/fluux), but of course still needs to cook yet.
All the XMPP ecosystem needs is a little love in the fields of:
* Building some form of test suites for implementing OMEMO (or whichever successive standard; I don't know if MLS will ever be realized, or if something like Autocrypt v2 will slip in, if it holds merit) if none already exist.
* Tools to make it easier for server admins to test if their STUN/TURN stack is setup correctly (I've been wanting to write a simple web utility to test that, just provided a login for an account on their server) to make direct A/V calling more painless.
* Either some rework, or make a more generalized form of 'COLIBRI', for SFU-facilitated A/V conferences (it's argued as being too specific to just documenting how Jitsi Meet works)
* Making existing clients more informative, to present any backend errors with a Jingle/Muji call. e.g. actually telling the user if it's unable to build some P2P channel to a peer, versus infinitely ringing on one side, while having it act like the call has been accepted successfully on the other side but with total silence (Gajim, or at least some years ago). Or warning the user if there's no TURN service available before starting a call.
* Actually put forth sane implementations for sticker support (XEP-0449 is probably the closest chance, but has a lot of absurdities), and _NOT_ abominations like Bits-of-Binary (as Movim does), which is an abhorrence of an old idea meant for like MSN Messenger era of messaging, when you had like 24x24 emoticons, not 512x512 alpha-channeled stickers.
These are all relatively small tasks and objectives even a single person could fulfill, as I very much want to do myself, but it's hard to dedicate time to it, especially in competition to other projects I have that would help my income situation (like tools for deploying mailservers faster, a webhosting panel, and other things).
Virtually every time that someone wants to improve the nature of open source messengers, they go off into the whole sweep of trying to tackle: building their own new protocol, building their own new server, building their own new client. There's always big ambitions, but always gets lost in trying to tweak and figure out all the small minutia of choices to make (because there are probably at least 100s of design choices to make, and so much time is going to be wasted sometimes trying to prototype something, and then having a paradigm shift to shatter it, and having to walk back again on an idea).
I can write MOUNTAINS of text trying to convince people that the solutions likely already exist, that they are trying to grossly overcomplicate their solution, when all we f'ing need is: an instant messenger, that doesn't look like sh't, that makes sense to the average user, that you can have a contacts list (and perhaps their online status), directed messaging, group messaging, file transfer, and preferably some competent audio/video calling/screenshare capabilities. It is such a simple, utterly low threshold to meet, and even achievable as a webapp.
But it's always the highly-capable folks that instead fixate on: effectively reinventing some entirely anonymous mesh networking system just for a messenger, trying to accomplish the most paranoid keying scheme out-of-the-box as the minimum (something basic like just PGP or alike, is never an option, just to get started), using the Favorite Framework of the Week that will be forgotten in a year, and always end up producing NOTHING. EVERY. TIME. Or if someone _could_ actually realize something, they usually get poached by Google, Microsoft, or some other company, and the project goes dead (it happened with one of the first clients that tried introducing stickers, they got poached by Microsoft to become an MS Teams dev).
Just help fix existing clients, or build a better more-competent XMPP client. Or maybe steal ideas from XMPP-land for Nostr-land. It provides so much more predictable of a path to results, but people keep going off and doing their own thing, trying to fill a long list of non-essential checkboxes, every time. (Also, Tor, I2P, and other overlay networks exist as a transport; a person doesn't have to build a new anon net every time, just to have a semi-anon messenger)

2026-02-10 09:17:35 GMT

It's just so thoroughly, resoundingly demoralizing how normies keep taking the bait of centralized VC-funded platforms. Once one ship starts to sink, they crowd to the next one that appears on the horizon, like rats, just ever-continuing this cycle, and never learn.
In the time that I've been on the internet, just to keep up with "where everyone's at", I've been on: ICQ, AIM, Yahoo Messenger, MSN/Live Messenger, Google Talk/Hangouts, Skype, Facebook Messenger, Telegram, Wire, Signal, Discord, Guilded, and many several others, and the cycle just keeps repeating, just to re-skin much of the same concepts over and over again, with relatively minor variations.
I am so damn tired and have gradually dumped virtually all the above at this point (recently deleted Discord in November, deleted Telegram ~2 years before that, deleted Facebook ~10 years ago, etc).
This may come as a shock to viewers, but when I've dumped prior platforms, some friends have followed over to the alternatives (of those that weren't already there), such as XMPP.
Mentionably, also, nearly everyone has Steam in common, and Steam has actually made the voice calling system reasonably usable, and has a decent 'group' system, that's also filled the gap. For my more neckbeard-y friends, Mumble has continued to work too.
Nonetheless, in all of this, I guess there's another opportunistically new centralized VC-funded platform, that people are trying to crowd-wrangle people to next. I don't even know if some of this crap is some sort of set-up, if these influencers get kickbacks, or if people are just this retarded to keep repeating this cycle.
When I registered on Discord, about a decade ago, I already regretted it. Despite being yet another WebRTC application, that could be used in a browser, they still arbitrary forced people to install an Electron-wrapped version anyway by artificially walling off features you could do in a browser anyway (e.g. screenshare and others).
There was plenty of phobia about it watching all your running processes, but it still got adopted anyway. There's the warehousing of all your data, all your connection history since inception of your account, all your device metrics at every single individual interaction and thing you clicked on, perpetually tagged and catalogued, and much of that ran through neural nets to profile and categorize you, but still people cling to it anyway.
Now the cycle repeats again.

2026-01-01 01:27:20 GMT

I 'Awoo', Therefore I Am?