CallMeAl (like Alan)

Doesn’t mean it’s immune.

That is what it means.

Any project with a GPL or similar license is effectively immune from takeover.

As long as there is someone with the skills and interest with access to the source (and there are legions), they can use it. If someone wants to keep it the way it was or change it in some big way, they can fork it.

Every time there has been a corp buyout or ideological divide, the people exercise their rights and projects fork, preserving the independence and community values.

Kindly point me to three generalist, widely known XMPP servers.

The lack of generalist widely known XMPP servers has nothing to do with the fact that today anyone who wants to deploy a modern up to date XMPP server can do so, and has choices. There are also modern actively maintained clients. That’s my point. There are also many general free servers to join, even if not well known.

If you base the value of something on its popularity rather than its utility, then we aren’t concerned about the same things. As long as I can use the software I want to use in the way I want to use it, then I’m a happy user. I can’t control what other people use.

It’s the old “embrace, extend, extinguish” strategy in a new form.

Do I need to point out that this has never worked against linux/open source?

Probably but I’d have to look into it and see for myself about the details. I’m not going to let some asshole burn down perfectly good open source just by giving money to it.

Or I can ignore Omarchy. I can continue to use and support the open source projects I like. I’ve been a happy linux and open source user for 25+ years. So far no asshole with money has been able to mess it up yet and I don’t see that changing. Many have tried.

When you add /24 you are exporting to the entire subnet. A single host export looks like this
/srv/nfsv4 192.168.0.10(ro,sync,secure,root_squash,subtree_check,fsid=0)

Just leave off the subnet mask.

Is a professional audit the only thing that counts, or does open-sourcing the code so people can poke at it move the needle at all on its own?

To me, open sourcing the code is a move in the right direction but it doesn’t make up for a professional review of your encryption system.

The thing about encryption is that there are many subtle ways to get something wrong, even when just implementing it with a well known and trusted library. I took a deep dive course on Designing Secure Encryption for Practical Use and while I learned a ton from it, the main take away for me was that I shouldn’t do it if its intended for serious use. At least not without expert reviewers.

Regarding XMPP, it’s architecture is like email. Anyone can stand up their own server and your User ID looks like an email address: user@chatserver.org. Like email, you can send messages to anyone on any server if you know their ID. Phone numbers are simply never involved.

Honestly, I wouldn’t even consider using it unless it were reviewed by a professional cryptographer. There are already battletested options that don’t require a phone number or sharing info with a company. For that, I like XMPP with a client that uses OMEMO for encryption.