tya99

I've noticed this too, and I've also noticed it stems from their team members. https://news.ycombinator.com/item?id=22614144

Looks like the sock puppets have arrived, quoting myself from that thread:

https://github.com/privacytoolsIO/privacytools.io/issues/375...

There also seems to be a small group of devout followers who travel from the Palemoon forums to other parts of reddit, HN and github to spruik the project and derail criticism. I've observed (without naming names) it's the same names doing it over and over again.

They always use the same phrases too "nazi" and "fake news", "false narrative" etc. They tend to refer to themselves as "power users" with a clear tone of superiority to their comments.

I guess it must be the deep state! (sarcasm).

Then there's this one from privacytools.io where they disregard criticism as "Fake News" https://github.com/privacytoolsIO/privacytools.io/issues/375... and get all upset at people for "shitting on them". (Note mattatobin is also one of their devs).

The terrible user experience of slack and discord is why I started using IRC even more. emoji, images, link previews, and the like all lead to annoying/awful spam. Instead of a conversation you get a stream on memes and image macros along with link and twitter spam.

I have experienced that to a certain extent on Matrix, but only in certain rooms that permit it. They are not usually #some_project but rather general channels like #linux

What I have found good is code sharing, (nothing a pastebin can't solve, except for the fact if it's a publicly logged channel the link may not work in the future). I only tend to hang out in technical related rooms.

I find it derails the conversation and clutters the screen. Nothing less fun than trying to have a conversation and some idiot is posting "related" image macros flooding the chat with garbage.

The bottom line is I want to talk to someone using text. IRC does exactly that.

I find the same with mailing lists vs bulletin boards. I think the barrier to a certain extent means people that have something worth adding will be bothered. A bit like this place. Imagine how HN would be if it was like 90% of Reddit these days shivers.

Can you explain a bit more on your VPN setup? Did you create it on the same machine as the router itself?

Yes.

Essentially it operates as a mult-home router.

Traffic on VLAN2 goes directly out to the ISP. This is useful for low latency needs such as online gaming. It is useful when you need your real IP address and do not want to trip security systems such as a online banking site might have.

VLAN 3 is used for everything else, downloading packages (apt, pacman etc, and all my web browsing). The router will send all traffic through the VPN ie tun0.

In addition I can be on VLAN3, and have "exceptions" such as to my mailserver even when on VLAN3 (my VPN VLAN).

I used CONNMARK, for this. In these circumstances the connections from VLAN3 are normally marked with a connection mark[0].

[0] https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...

I am at the moment finishing up the configs as Jinja templates, so that one may just input their configuration into the JSON configuration files and it will populate all the configs with envtpl https://github.com/andreasjansson/envtpl it would be trivial for one to extend this into an implementation orchestrated by something like Ansible.

I use that on combination with Yadm https://yadm.io and store it in my dotfiles.

I did a similar thing in order to implement network segregation via VLANs and VPN routing.

Personally I think Alpine Linux is one of the better distributions to use for routers because it uses musl which is ultra small. https://www.etalabs.net/compare_libcs.html

I have separate VLANs:

• VLAN 1: Management (no tag, null route)

• VLAN 2: Untrusted (routes direct to ISP via ppp0)

• VLAN 3: Trusted (routes direct to ISP via ppp0)

• VLAN 4: Trusted (routes via tun0 - VPN connection for private browsing etc)

• VLAN 5: Null route for devices that do not require internet access of any kind, desk phones printers etc.

(Doesn't have to be a Raspberry Pi, you can use anything that Alpine Linux runs on which is x86_64, x86, ppc64le, s390x, armhf, aarch64 (ARM8 like Raspberry Pi 3), armv7 (Raspberry Pi 2, and friends).[1]

[0] https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...

[1] https://alpinelinux.org/downloads/

The idea is that anything on VLAN2 is completely segregated at the switch and router level from the rest of my network.

I use a very similar list of addons. In addition I recommend:

* CanvasBlocker https://addons.mozilla.org/en-US/firefox/addon/canvasblocker....

A lot of people recommend that, but you don't need it if you're using ghacks-user.js. The reason is because of privacy.resistFingerprinting.

* Cookie AutoDelete https://addons.mozilla.org/en-US/firefox/addon/cookie-autode....

and I block cookies by default using uMatrix.

I use CookieAutodelete on my mobile because unfortunately the container API isn't available on the Android version of Firefox.

The reason I don't use it on my desktop is because there are certain types of things that cannot be cleared.

APIs do not exist to allow clearing IndexedDB, Service Workers cache, appCache, or cache by host. Clearing cookies & localStorage on their own, and leaving orphaned persistent data is a false sense of privacy.

* https://github.com/Cookie-AutoDelete/Cookie-AutoDelete/wiki/...

* https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.1-Exte...

Edit: I also recently switched to NoHTTP instead of HTTPS-Everywhere. This way I have to explicitly allow any non-HTTPS connections.

I might have to check that out.

Im actually glad that the author pointed out that once you log in somewhere that will track you, that connection is associated with you.

Exactly, and it's usually a cookie or some sort of persistent storage. I use a VPN, but I use it at the router level. https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...

I know my ISP logs my metadata (by law), whereas I trust that my VPN provider does not.

Essentially VLAN2 all traffic is routed direct to my ISP, and VLAN3 all traffic is routed to VPN. My machine normally sits in VLAN3. I make sure not to log into anything social media related or tied to my real identity.

If I need to do banking, Facebook or something like that I'll use a device in VLAN2 (a separate computer).

All phones and devices like that are broadcasting information anyway so those are in VLAN2 as well, unless they are devices with LineageOS and no Google Apps.

A vpn is not a cure-all. It is only as private as you're willing to make it. If you want to pirate movies and chat on facebook at the same time, you're probably gonna have a bad time. What you do is absolutely a part of your advertising/tracking profile.

See in this scenario I would have a system in VLAN3 that I use for my downloading, and another computer in VLAN2 that is used for the facebooking. I use a hardened browser with https://github.com/ghacksuserjs/ghacks-user.js that hardens the browser and helps against fingerprinting.

I also use a number of addons, for various purposes

That requires hardening. Currently I use

* CleanURLs https://addons.mozilla.org/addon/clearurls/ (remove UTM and parameter tracking)

* CSS Exfil Protection https://addons.mozilla.org/addon/css-exfil-protection/

* Decentraleyes https://addons.mozilla.org/addon/decentraleyes/ (prevent tracking via CDN)

* Firefox Multi-Account Containers https://addons.mozilla.org/addon/multi-account-containers/ (used for sites to keep me logged in)

* HTTPS Everywhere https://addons.mozilla.org/addon/https-everywhere/

* Redirect AMP to HTML https://addons.mozilla.org/addon/amp2html/ (no to AMP)

* Temporary Containers https://addons.mozilla.org/addon/temporary-containers/ (Prevents tracking via ETags and other things like IndexDB)

* uBlock Origin https://addons.mozilla.org/addon/ublock-origin/ (block adverts)

* uMatrix https://addons.mozilla.org/firefox/addon/umatrix/ (block 1st party JavaScript)

lol, my reply to you was too long. http://dpaste.com/3H8SRNZ

No problems. Simply split your post over multiple replies. There is a 2000 character limit per reply.

I'm sorry for your bad experiences with the Palemoon guys. You are obviously not who this software is meant for.

Who is it meant for if it's not meant for users? Are they intentionally trying to turn away certain people?

I don't need or want sandboxing for my extensions

I think you'll find with all security, it's best to have the "principal of least privilege" https://en.wikipedia.org/wiki/Principle_of_least_privilege at all levels of software. The reason for this is because if something happens to exploit one area of your setup, the hope is that it will be stopped somewhere else.

I can take care of my own sandboxing external to the browser profile instance.

As do I. I use multiple VLANs (network segregation), Virtual Machines, and other things in addition to browser profiles. Most people however do not. Software should be designed for "most people".

And I don't want it either, because it makes them less flexible and powerful. XUL based extensions turn my browser into a power tool,

There's plenty of frameworks out there. Perhaps what you're trying to do shouldn't be a browser extension.

Chrome is a toy.

Okay if you mean high performance web browser with a lot of market share that Mozilla must compete against in order to stay relevant?

I don't know why you are upset, because the vast majority of the Internet agrees with you.

They do because I am right. I rarely say this as I do often like a good debate, however in this situation I will.

Most people are happy to have Google control their web browsing experience. Why do you engage with them if they make you so upset? Why are you threatened by a small group of users who want a browser their own way?

I didn't engage with them. They came to our bug tracker and started to push their software on us. I contribute to the privacytools.io website. I was explaining why that particular piece of software did not belong there.

As for the HSTS thing, I'm sorry nobody explained that, I'd be happy to elaborate a bit more for you. My computer belongs to me, and I get to decide what runs on it. I can choose to use Palemoon how I want to. Not implementing HSTS according to the RFC is harming nobody except potentially myself. The way HSTS is written is self serving for the powers that be. It reenforces the SSL certificate infrastructure, and takes away user choice in the name of "security". For practical reasons, being able to disable HSTS is important for development. And even without Palemoon, there are still plenty of ways to bypass HSTS. All Palemoon is doing is saving users time.

For software that is distributed to the public certain 'sane' defaults are expected for the software to be labeled as secure. These are usually according to spec as I pointed out in https://github.com/privacytoolsIO/privacytools.io/issues/375... there are a number of reasons why software developers should make certain choices for users.

There are a couple of reasons for this:

1. Users could be socially engineered into bypassing the warning

2. The warning gets "ignored" because lazy users just want to "visit that website", without thinking of or understanding the consequences.

3. Advanced users (web developers etc) can simply fix the error server side, do something like this, https://blog.filippo.io/mkcert-valid-https-certificates-for-... or at worst compile their own browser.

4. Website owners will fix errors as it will mean their customers, visitors will not be granted access.

The fact is, if Mozilla designed software for "a small group of users who think they know everything" nobody would use their software as the majority would have a poor user experience.

What I mean by that is allowing users to override certain security (they may not understand and may put them at risk) is not a solution to lazy site owners who have TLS errors. It is very good that those site owners must now fix their problems, or the sites simply won't work.

Besides, Google, Apple, Facebook and Microsoft happily trample on the RFCs when it's convenient for them. Chrome itself was infamous for this when it first came out. I remember seeing Chrome users clobbering webservers and violating protocol to get slightly more speed. Of course, Chrome now sets the standards.

Maybe so, and those are separate issues. Those issues should be constructively criticized when they come.

I have to disagree with your characterization of Palemoon users as fascists.

I didn't say their users were. I said that certain developers certainly give off that vibe. I also said that they do engage in censorship, on their forums and on Twitter https://news.ycombinator.com/item?id=13395682. I've read about that here on HN and Reddit, ie 'forums' that they do not control. I witnessed it in that thread when one of them attempted to brigade the GitHub issue I was conversing in.

If you don't like Palemoon, then you are more than welcome to not use it and leave the community alone.

[Insert Leave Britney Alone meme] The point is I only made an argument as to why it would not be added to privacytools.io the "defenders of Palemoon" came there and accused me of spreading "fake news", and spreading "false narrative". They didn't however refute what I said in a technical sense, which is what is expected in technical communities.

If you want to say someone is wrong, then provide proof/examples, or you'll be laughed at.

The Palemoon community represents a dying breed.

Progress will do that.

Soon enough, most hardware will be forced to use their browser, and will only be permitted to go to websites that they approve of.

I don't believe that for a minute. The big tech companies have been very active in standards forums like the IETF.

And mandatory DRM.

That only happens when you want to use content like Netflix, and then it's a part of the user license agreement that Netflix MUST agree to in order to satisfy content creators/rights owners etc.

Mozilla never says that a site must use DRM, but does provide the option should they need to.

Mozilla also loves DRM.

You mean they implement it so their browser can use things like Netflix? Sure, because if they didn't everyone would just use Chrome.

Anyway, if you have any more questions I'd be happy to answer.

This is the point, though isn't it. The "Palemoon defenders" never refute what I say with actual evidence.

Somewhere I remember reading that the Tor Project refers to it now just as "Tor Browser" (the bundle part got dropped).

If you look at their website https://www.torproject.org they refer to it as "Tor Browser".

Honestly I wouldn't go anywhere near Palemoon. Not unless you feel like using an antiquated browser such as Firefox 28 which is where it forked.

I expect their shills will be deployed to this thread shortly.

It's certainly not more secure when you've got all your extensions running at highest level privileged (not WebExtensions), the sandboxing code "removed" because mattatobin a Palemoon developer says that it "doesn't work", without giving any specific use case and their non-compliance with the HSTS spec RFC6797 [0]. There's probably countless other things wrong with it, but that's what I spotted after a cursory look.

Their developers are also toxic https://github.com/privacytoolsIO/privacytools.io/issues/375 that's all the proof you ever needed.

Many of your sentiments there are demonstrated in that very thread. One of the developers (mattatobin) repeatedly avoids answering my questions and just says "fake news" and goes all trumpian on me.

Don't bother trying to ask on their forums about this they will just delete your posts and go on about "the untrue narrative" without addressing your questions.

If you contact them on twitter they will block you. It seemed like their while mode of operation was very "alt-right" if that makes sense. They live in a small "social bubble" it would seem.

I also found it rather lol that a so called "privacy browser" has to resort to using google advertising on their main page.

  15:05:34 www.palemoon.org -- script https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js 3p
  15:05:34 www.palemoon.org -- script https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js 3p
  15:05:34 www.palemoon.org -- script https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js 3p

Then, a second "access" segment. Ports in this segment are setup to not be able to talk to one another through the switching fabric at all - the only thing they can talk to is the router. Ports on the same switch are prohibited from talking by the switch's config, and different switches are given different associated VLANs. This is good for visitors, Android, Internet of Trash, etc.

Yes essentially that's what VLAN 3 and 4 are (trusted). They are able to talk to each other but VLAN 2 (untrusted) cannot. VLAN 2 cannot access my server on the LAN or any other network resources, except in certain situations where I open a single HTTP port to a specific directory that is read/only. This is where guests would be. I use this to copy 'certain' files to my untrusted hosts. The exploitation surface area is extremely low. Switch configuration can only occur when on VLAN 1 (management). I also can control which VLAN people access via WiFi via my Unifi Controller. One SSID is a trusted network, the other is untrusted. I only use EAP so I can control exactly what users have access to what VLANs via FreeRadius. All of this is documented [0][1]

For routing, the horizon seen by each device is controlled directly by its own macaddr on the router itself.

Remember MAC Addresses can be spoofed which means you can get things like VLAN hopping if you're not careful. My Windows machine where my gaming happens is "untrusted" and is in port 2 on the switch, my trusted machines are in port 3 and 4. My other family members also have certain devices they consider 'trusted' and those are in VLAN 3/4 while they have devices that are 'untrusted' in VLAN 2. It took some time to educate everyone, but I drew pictures, and explained it nicely. Unfortunately this is the world we currently live in.

I was concerned that a APT (advanced persistent threat) might have the time to monitor the system for idleness and then attempt such an activity. At least that is what I would do.

But I believe "sandboxing" in the original comment was talking about the machine itself, not network access.

Well they are sort of the same thing in this situation because it's physical sandboxing.

So PC gaming means being disciplined about getting another machine, or at least a second GPU for PCIE passthrough in a VM.

In general I think we're in a time of decommodification. The easiest way to sandbox between security boundaries is separate machines, of which there is an inexpensive surplus of.

Exactly.

No need to have banking and games on the same tablet, when a second hand nexus7 (flo) is $40 on fleabay.

This is exactly my point. In regard to my mobile phone I use a Redmi Note 5, with LineageOS, without Google Apps. If I tablet gamed I would have a 7" tablet specifically for that. I would tether it to my phone via WiFi AP and the CPU/GPU would probably be more powerful than you'd get in a phone anyway.

I only install things through F-Droid. I have made a significant attempt to de-google my life and have been successful.

Right now all I have on there is

• andOTP org.shadowice.flocke.andotp

• AnySoftKeyboard com.menny.android.anysoftkeyboard

• Barcode Scanner com.google.zxing.client.android

• BusyBox ru.meefik.busybox

• Call Recorder com.github.axet.callrecorder

• DAVx⁵ at.bitfire.davdroid - Used for syncing with my private Radicale instance.

• Draw com.simplemobiletools.draw.pro

• F-Droid org.fdroid.fdroid

• Fennec F-Droid org.mozilla.fennec_fdroid

• Flym net.frju.flym - RSS yay.

• Ghost Commander com.ghostsq.commander

• K-9 Mail com.fsck.k9

• Maps com.github.axet.maps - Provides a native experience for OSM maps. If I need Google Maps I just use a web browser.

• Markor net.gsantner.markor - Awesome text editor/markdown editor

• MuPDF viewer com.artifex.mupdf.viewer.app

• oandbackup dk.jens.backup

• OpenKeychain org.sufficientlysecure.keychain - PGP mail yes.

• OpenTasks org.dmfs.tasks - Used for syncing tasks with my private Radicale instance

• OpenVPN for Android de.blinkt.openvpn

• primitive ftpd org.primftpd - I upload/download via sftp to my phone without plugging it in with ssh keys (ie /sdcard/.ssh/authorized/keys)

  sftp_phone() {lftp sftp://user:DUMMY@{{ IP_OF_PHONE }} -e 'set sftp:connect-program "ssh -a -x -o KexAlgorithms=diffie-hellman-group-exchange-sha256 -o MACs=hmac-sha2-512,hmac-sha2-256 -i ~/.ssh/id_rsa"'}

• Revolution IRC io.mrarm.irc - Yeah I still use IRC and not IRC bridges, yet with Riot because of https://github.com/vector-im/riot-web/issues/2320

• Riot.im im.vector.alpha

• Share to Clipboard com.tengu.sharetoclipboard

• Silence org.smssecure.smssecure

• VLC org.videolan.vlc

[0] http://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_...

[1] https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...

Anti-cheat software seems like a great platform to launch targeted malware in-order to achieve a beachhead on a computer network: highly targeted, and effectively undetectable.

I would expect most software developers don't sandbox their gaming machines from their work-from-home environments.

I have been worried about this for some time. In my country we have a lot of issues with metadata retention so I set something up like this[0].

I have separate VLANs:

• VLAN 1: Management (no tag, null route)

• VLAN 2: Untrusted (routes direct to ISP via ppp0)

• VLAN 3: Trusted (routes direct to ISP via ppp0)

• VLAN 4: Trusted (routes via tun0 - VPN connection for private browsing etc)

• VLAN 5: Null route for devices that do not require internet access of any kind, desk phones printers etc.

(Doesn't have to be a Raspberry Pi, you can use anything that Alpine Linux runs on which is x86_64, x86, ppc64le, s390x, armhf, aarch64 (ARM8 like Raspberry Pi 3), armv7 (Raspberry Pi 2, and friends).[1]

[0] https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...

[1] https://alpinelinux.org/downloads/

The idea is that anything on VLAN2 is completely segregated at the switch and router level from the rest of my network.

That article seems like product placement.

They vaguely have a clickbaity title, and then just say "people click links in email".... they can click links in anything so that's not specific to email.

Then they advertise a product at the end "best antivirus".

I have been doing some reviewing of myself and intend to publish on privacytools.io early next year.

https://github.com/privacytoolsIO/privacytools.io/issues/603...

I tested a number of new email and security related RFC to see how the providers complied. We plan to have a criteria (also in that issue) to rate them on a scoreboard.

I'm also hoping some of these providers will really consider

• https://jmap.io/

• http://arc-spec.org/

Despite what some people say, I think email will always exist in one form or another. There is a need to send a simple text message to people with minimal fuss. That means no walled gardens or bullshit to get in the way.

None of these website are legit. Magisk should ONLY be downloaded from the official places.

https://forum.xda-developers.com/apps/magisk/official-magisk...

https://github.com/topjohnwu/Magisk

None of these website are legit. Magisk should ONLY be downloaded from the official places.

https://forum.xda-developers.com/apps/magisk/official-magisk...

https://github.com/topjohnwu/Magisk

Nothing to see here.

Arjun Sud said the company urged him to use two-factor authentication, an online security procedure where customers take an additional step, like entering a temporary code, in addition to passwords when logging into the system.

Google said the recent incidents stem from customers "using compromised passwords … exposed through breaches on other websites."

Surprise! Poor opsec leads to you getting pwned.

decade(s)

It isn't like they switch off the old networks 3G, 4G etc when the next generation comes out. I also assume this cannot be fixed with a firmware update.

Also:

https://www.pcmag.com/article/360533/what-is-6g

In a paper proposing 6Genesis, director Matti Latva-aho explains "a new mobile generation appears every 10 years, and thus, 6G will emerge around 2030 to satisfy all the expectations not met with 5G, as well as new ones to be defined at a later stage."

A good place to start is https://www.privacytools.io/#browser

Spend some time using uMatrix (much better than NoScript these days). If you're running uMatrix you do not need NoScript.

Some good documentation in regard to uMatrix:

https://www.electricmonk.nl/docs/umatrix_tutorial/umatrix_tu...

https://github.com/gorhill/uMatrix/wiki/The-popup-panel

https://github.com/gorhill/uMatrix/wiki/How-to-block-1st-par...

https://github.com/gorhill/uMatrix/wiki/How-to-create-rules-...

Wouldn't using something like https://github.com/lefcha/imapfilter also be an option?

It would be awesome if some day there was a "jmapfilter". I think JMAP would be really efficient for this use case.

This is one of the reasons I recommend https://www.privacytools.io

It's fairly well thought out, and the decisions usually are agreed upon on the issue tracker https://github.com/privacytoolsIO/privacytools.io/issues/ before actually appearing on the page.

I also think it's a lot more 'user digestible' than https://prism-break.org ever was.

While we're writing a wishlist, native Wayland support wouldn't go amiss. That goes for Firefox too!

That will happen after it makes it's way into standard Firefox releases as Thunderbird is based off ESR. It is happening.

See Martin's reply:

https://mastransky.wordpress.com/2018/10/09/firefox-on-wayla...

Martin Stransky October 9, 2018 at 8:12 pm

Unfortunately Thunderbird 60 is based on Firefox 60ESR which misses lots of Wayland patches.

We can consider backport but I’d leave it on X11 for now and fine tune the patches on Firefox first.

Overall progress can be monitored here https://bugzilla.mozilla.org/show_bug.cgi?id=635134

I have been wanting to switch from i3 to Sway for some time now and not have blurry fonts in Mozilla products. (That's what happens if you use them through XWayland).

On a side note I have been curious about https://www.etesync.com but haven't tried that.

I'm using SOGo for my family's groupware and although SOGo provide plugins for Thunderbird

I used to use SOGo but found it used way too much resources. None of us really even used 'webmail' so I ditched SOGO.

I went with https://radicale.org most of my family either uses mail clients, Thunderbird, (with Lightning), Canary Mail (the mac user), DAVx⁵ (formerly Davdroid). Radicale allows for ldap authentication which was a must for us.

On a side note the SOGO Integrator plugin took AGES to be updated for Thunderbird 60. I found https://gitlab.com/CardBook/CardBook/ to be WAY better, particularly as it replaces the crufty-old Thunderbird addressbook.

Passing a law is easy, but putting it in practice is enough thing. We of course won't hear about that side of it because "secret".

I have no doubts that the big companies which this seems mostly for will be doing everything to decentralize and remove themselves from the problem citing "systemic weakness" and then doing nothing for the government.

P2P messaging apps have a hard time with group messages

Well https://tox.chat and https://ring.cx (now Jami) can do just that as well as https://briarproject.org.

So these do exist. Such a thing was also being proposed for Ricochet https://github.com/ricochet-im/ricochet/issues/54

I should also add many of those who use IRC use a bouncer like ZNC which handles things like away messages, play buffer etc.

Running a bouncer is a lot less effort than your own synapse home server for Matrix I might add.

Many people still do use paste-bins especially when they want syntax highlighting. Most of the support channels for major Linux/BSD distributions are on IRC still as with open source software.

For public communities end-to-end encryption isn't really necessary because they are public. IRC has authentication and transparent encryption.

Additionally it's very distraction-less and there are plenty of good console command line clients, eg weechat, irssi etc.

To this very day I use email and IRC daily. Thunderbird and Weechat start when I login.

Sometimes I use qTox to stay in touch with family (parents etc) as it's easy to use (particularly for non computer literate users). Decentralized and peer to peer. Many of my computer-illiterate friends have commented on it's simplicity when compared to other proprietary options.

I sometimes use Matrix if I need 'some other service ie gitter' or Matrix itself. When gaming with close friends we usually use my mumble server.

As much as I would like to use Signal do not like the fact that it is bound to a phone number and is centralized. I wrote about that more in depth here https://reddit.com/r/privacytoolsIO/comments/9re6l5/chat_sol...

Many years earlier I used XMPP with OTR particularly when GoogleTalk and Facebook had gateways. Now that Google shut down their gateway, and now Hangouts I'm certainly not going to adopt their next fly-by-night software.

I've never had any motivation to go near discord, slack, telegram or some other fly-by-night software. I also have no need to try out things like Rich Communication Services (RCS) which are also vulnerable to state "technical assistance order" style notices.

It is time more people used more end-to-end, decentralized encrypted tools. The more people that uses these tools the less eager governments will be in passing useless laws that won't really help anyway.

It's clear state governments won't stop at trying to make the centralized ones put backdoors in on command, UK Australia etc.

IRC has, for all intents and purposes, been replaced by Discord.

Yeah you can keep saying that but it doesn't make it true.

IRC has what most people need a text chat. A lot of the new features that these new programs have are unnecessary. End to End encryption being the most useful one, fortunately there's things like Matrix.

In other words, a large number of communities I frequented have re-formed in Discord, and are much more active.

A lot of communities don't have a Discord server/channel so how active are those ones?

I wouldn't correlate activity with quality either. Typically I have found I get better/more knowledgeable responses from mailing lists, those are as old as email itself.

There's still a few holdouts, but it's usually just 3 or 4 good-ol-boys who haven't left the server for 12 years.

If anything the introduction of Matrix has meant those channels are even more active with bridges especially on Freenode and OFTC where such bridges are officially supported.

It's interesting to watch contenders like gitter, slack, mattermost, riot/matrix, etc,

Gitter is accessible by Matrix, Slack I've never needed to use as with mattermost. There's just so many 'options' out there that.

For private business stuff I'd probably use Rocketchat because I can self host it and not depend on some other company. It's good for sharing code snippets.

Matrix, particularly Riot still needs to become more mature. It is not as mature and dependable as IRC yet for general chat yet.

The Matrix spec isn't even finalized and is subject to change. That said it is making good progress. Their effort in regard to bridges makes it far more appealing than any of the other dozen proprietary options. If anything has the possibility of displacing IRC it will be Matrix.

I have seen that already particularly for developer communities.

falling to the rise of Discord, which was for gaming communities but now it's like the reddit of chat servers.

Yeah but that's not developers, and yet despite these subsections using it I've never had the need. Next year it will be something else. The only reason Discord is as popular as it is is because Twitch ran a very aggressive advertising campaign.

For gaming you still can't beat a private mumble server.