People are making steady headway in our endeavors, guided by empathy and care for our needs, lives and rights. The artisans of code, open data, ICT standards, and open knowledge are moving forward one quiet step at a time. To showcase one concrete experience, here is a new profile in our Building a Free Internet of the Future.
This is the series in which we publish a monthly interview highlighting the experiences and perspectives of individuals and communities supported by NGI Zero (NGI0) grants, as well as members and stakeholders of the NGI0 consortium. Funded by the European Commission, NGI0 supports projects related to free software, open data, open hardware and open standards. It provides financial and practical support in a variety of forms, including mentoring, testing, security testing, accessibility, dissemination and much more.
This month, we are talking with Goffi about the Libervia project, which enables instant messaging, (micro)blogging, file sharing, photo albums, events, forums and tasks among others. It received an NGI0 grant to address the challenges behind communication protocols, data and metadata.
This interview has been edited for clarity and length.
What is Libervia?
Libervia is an all-in-one communication platform. It aims to bring all your private and public communication needs to a single, easy-to-use location.
Libervia’s capabilities include:
- Messaging with one person or in groups
- Blogging
- Making audio/video calls and use in conferences
- Advanced file sharing
- Shared lists (to-do, shopping list, issue tracker, etc.)
- Personal agenda/calendar
- Organising events with RSVP handling
- End-to-end encryption
- Communicating with other protocols such as ActivityPub (the protocol used by software such as Mastodon, Peertube, Mobilizon, Pleroma, etc.)
- Integrating email via its email gateway
- Communicating over Tor to reduce metadata. Plus many other things.
It is designed to be universal: multi-platform (GNU/Linux, Mac OS, Windows, Android, iOS, GNU/Linux phones, BSD, etc.), and "multi-frontends", meaning that there is a web version, but also a desktop version, command line for automations, etc.
What is XMPP?
XMPP is a language to make software communicate together. It helps applications understand each other when they want to send messages, make audio/video calls, send files, blog, etc.
We say it's open standard, because the specifications (the documents explaining how it works, called RFCs and XEPs in technical terms) are available for free and publicly, and anybody can use them to understand how it works and communicate with other software. This is a great thing; with commercial standards, you may have to pay a lot just to see the documents. There are many programs that communicate with each other (where different servers 'talk' to one another) and with XMPP. This makes it highly adaptable to any use case, which is why it is still relevant and modern today, more than 25 years after its initial publication.
Everything that is added or modified in the specifications is discussed publicly, until a consensus is found for the hopefully best solution. So, long story short: it's a way to make various applications communicate and work together.
How are Libervia and XMPP related?
XMPP is the protocol on which Libervia is based.
Libervia is special in that it is one of the few XMPP software to not focus only on XMPP messaging and calls; it goes far beyond that and embraces all of XMPP’s capabilities. It's also experimenting a lot; for instance, there is a remote desktop control feature in Libervia with some specifications in the works.
For every new feature, I also write the corresponding specifications so others can understand how they work and build compatible software.
Everything is open and public: people can discuss how we do things, help shape its evolution, and freely re-implement it in other software. There is no vendor-locking at all.
There is a strong focus on privacy and ethics with Libervia: it has been built around a Social Contract, a declaration of our ethical values. It was the first client to implement OMEMO:2 (the new version of the main end-to-end encryption algorithm of XMPP), and the only one to my knowledge to support pub/sub end-to-end encryption (in less technical terms, which allows encrypting blog posts, forums, shared lists, etc.). There is also work on improving the ways to expose security data in an easy way to end-user with Data Policy.
So in short: all communication needs at hand, everywhere, easy to use, private when needed, fully Libre/Open Source and standard. That’s a lot of features in a complex communications technology stack that you maintain with end-to-end encryption. But what about metadata, characteristics of the data itself, which are not encrypted?
Well, indeed, most metadata is not yet end-to-end encrypted. That's actually one of the two things I'm working on with my current NLnet/NGI0 grant, along with serverless support (Serverless and Metadata Reduction for XMPP).
It's important to note that communications are always encrypted between clients and servers, and between servers. It may be desirable to have communications accessible by the server (e.g. an organisation which needs to do group chat archiving), but in many cases, we want to be sure that only the recipient can read the content of the message. That's why we use end-to-end encryption (with solutions such as OMEMO, or OX, which is an OpenPGP integration in XMPP).
That's for the message content, but we also have non-message information (e.g. read receipts, reactions, chat states, etc.). This is not end-to-end encrypted with the legacy OMEMO implementation, but is with the new version (OMEMO:2) and with OX. Unfortunately, those two protocols (which are both implemented in Libervia) are not yet widely available, and most clients still use the old version, but things are moving in the right direction, notably thanks to NLnet support.
Finally, there's data needed to route and deliver the message: who it's sent to, your IP address, your contact list (called a "roster" in XMPP), who can see your presence, etc. This kind of data is necessary in many cases (e.g. your server can use your roster to check if an entity is allowed to contact you), but it's also sensitive information (from which we can know a lot of things about you).
So for the grant, I've implemented popular solutions to hide some metadata (notably Tor to hide your IP address, and/or the one of the server), and proposed and implemented solutions to optionally encrypt your contact list. It's optional because XMPP is extremely flexible, and for some use cases you may want your server to know who your contacts are, and in some other cases, you don't.
You are working to protect our fundamental human right to privacy, and a grant from NGI0 helps you do that work, but it’s only temporary. How do you manage, day to day, to make a living and work on these projects that are so incredibly important?
Well, to be honest, it's difficult.
To cut a long story short, Libervia (previously called Salut à Toi) was initially a side project started around 2008-2009. Due to favourable circumstances, I was able to work on it full-time at one point. Later, I had to take up a job, and after a while, I requested part-time hours so I could dedicate more time to the project.
Then I heard about NLnet and had a major project accepted to implement an ActivityPub/XMPP gateway and work on end-to-end encryption. Over time, I had other projects accepted and decided to go full-time on the grants.
I've been very lucky to have this support, and I am very grateful to the NLnet team for letting me work on these things, and to the NGI programme for the funding.
But as you said, grants are temporary, and they are hardly sustainable in the long run. First, we work via a memorandum of understanding (MoU), where we propose several steps and receive the agreed amount once the work has been validated. However, estimating the time needed for development is extremely difficult in such projects: you may think something will be easy, only to end up chasing bugs for weeks or encountering unexpected issues that require further development.
Once a step is finished, the NLnet team verifies the work and sends the payment. This process can take a long time, usually around three weeks, sometimes more. This is clearly explained by NLnet and expected when submitting a payment request, but it means that we need careful planning if this is our only source of revenue. Since I also have to handle side tasks (in my case, the grants have always been for adding new features and working on specifications, but I also need to stabilise existing code, administrate the website, reply to users, work on documentation, installation, etc.), I've often found myself in a difficult situation.
Additionally, a grant is not a salary. This means there is no coverage for healthcare, unemployment insurance, retirement or paid annual leave.
So, while it is great to have this support, and again I've been very lucky to have several projects granted and to have been able to work full-time on libre software, open specifications, and things that truly matter, it is not sustainable.
Now, I am looking for ways to sustain the development in the future. I am thinking about finding an ethical business model: everything would remain fully libre software (no open-core), and I would run a parallel SaaS, offer consulting, provide training, or offer customisation for schools, organizations, associations, and companies.
If this doesn't work, I will return to a regular job, part-time if possible, and continue applying for grants to support at least one or two days of work per week on XMPP and Libervia.
Based on your experience and background in so-called free libre and open-source technologies, where do your cultural influences come from?
I'm not sure if I can relate my cultural background directly to Libre software, but it definitely influences my way of thinking and working. The Libervia project was first called Salut à Toi, in reference to a song from the French punk band Bérurier Noir" (Les Bérus for short), later covered by great bands such as Les Ogres de Barback. The song is an ode to diversity and people fighting for their rights. Les Bérus have been a band of major influence in the "alternative" music scene in the ’80s, have links with the "squat" movements, and carry energy with them; we can definitely find similitude to parts of Libre and commons movements.
I've also been lucky enough to have travelled quite a bit, and I've hosted people from many parts of the world through Couchsurfing, then BeWelcome (I have left the former to join the latter). It was a fantastic way to discover various people, cultures, opinions, music, foods, etc. All this has been influencing me.
Today, I'm still influenced by people I'm talking to and things I see. There are many interesting things happening around ActivityPub and Mastodon for instance, like the use of "alt" text with media for accessibility, the comments we often see about (in)accessibility of certain software/use, comments from people with other experiences than mine, etc. We also have interesting discussions during meeting with XMPP community.
I also try to pay attention to how people use software, the problems regarding privacy, usability, etc. It's also important to understand how new generation are using communication technologies. I believe that we need to create our own way, and not clone what commercial platforms are doing.
I love events for meeting people and discussing various topics, not necessarily the computer-centred ones. Even if I love things such as FOSDEM for technical value and the fact that there we can meet many people behind the software we use, I prefer events where we can explore topics that have social and political implications. I would love, one day, to create a kind of "unplugged" event, around discussions, socialisation, maybe food and music, more than computer and technical talks.
Xavier Coadic is a consultant for the NGI0 consortium, and a free/libre open source software activist with 15 years of experience in free open source cultures and communities (software, data hardware, wetware, policy makers and political groups, research and development).