Our Android XMPP client yaxim was created in 2009. A decade later, we celebrated its round birthday. To make the user experience more straightforward, we launched the yax.im public XMPP service in November 2013, to become the default server in yaxim. Now, ten years later, it’s time to recap and to upgrade the hosting infrastructure.

Downtime announcement

We will migrate the server from the old infrastructure to the new one, on Thursday, November 30th, between 8:00 and 11:00 UTC. Please expect a few hours of downtime until everything is settled!

The migration will also include an upgrade to prosody 0.12 and the deactivation of TLS v1.0 and v1.1 in favor of TLS v1.3.

Update:

• The migration has been completed at 9:00 UTC.
• We have re-enabled TLS v1 and v1.1, as those are still in active use.
• We have removed offline messages archives for accounts with no activity in the last year.

/Update

Many thanks go to boerde.de for being our home for the last decade, and for enduring a few DDoS attacks on our behalf. Additional thanks go to AS250 for offering us a new home.

Ten years review

We started the service on Debian Squeeze with the freshly released Prosody 0.9 on it. Since then, there were quite a few upgrades of both the OS and of prosody. However, for technical reasons, the server is currently running on a prosody development snapshot that predates the current 0.12 major update.

In that time we’ve grown significantly, and are currently processing on average 100 thousand messages and 6.3 million presence stanzas every day.

Back in 2013, we were quite avantgarde to support not only TLSv1.0, but also v1.1 and v1.2. The support was only added into Android with the 4.1 release in 2012 and wasn’t enabled by default until 2014 with Android 5. Now we are lagging behind, given that TLS v1.3 came with Android 10 four years ago.

IRC transports

Since 2017, we are operating a beta (internal only) biboumi IRC transport on irc.yax.im and two dedicated transports for IRCnet on ircnet.yax.im and for euIRC on euirc.yax.im.

These were never officially announced and have just a few users. They will be migrated to the new host as well, but with a lower priority.

Spam fighting efforts

The XMPP spam problem has been a significant annoyance to most users. We have the opinion that XMPP spam can be best fought at the server level, where aggregate views and statistics are available, and spam can be blocked centrally for all users with mod_firewall.

In 2017, we have implemented spam detection and prevention both for yax.im users and against spam bots registered on our server. In 2020, we extended that to auto-quarantine suspicious account creations.

In the last two weeks, our spam fighting efforts have blocked 21.000 spam messages from 7.600 accounts on 72 servers, including 480 auto-flagged bot accounts on yax.im. We were not explicitly keepig note, but the number of auto-flagged accounts since the measure was introduced in 2020 is around 30.000.

As part of the JabberSPAM initiative, we have helped report abuse and bring down unmaintained spam relays.

Future

With the new hosting platform and our committed team of three administrators, we are ready to take on the challenges of the future and to sustain the growth of our user base.

A few days ago, VaxBot, a new XMPP-based vaccination appointment notification service was launched in the USA. The service is recommending Monal and yaxim as client applications, and both apps by default register accounts on yax.im.

This has brought us hundreds of new users (per day) and a significant amount of new traffic from the notifications, sometimes up to 200 messages per second. The additional traffic load caused some short service interruptions in the last days, and we are working together with the VaxBot team on implementing mitigations.

Some days ago, we have rolled out a new anti-spam measure on our public XMPP server. Accounts registered from a malware infected computer or through an open proxy (unfortunately this also includes Tor exit nodes) are flagged by default and need a manual approval from the server admins to become fully usable.

The day after the upgrade to prosody-trunk, there was an interruption in the database connection to the server’s message archive. Due to this, no messages were stored in the users’ XEP-0313: MAM storage. For users who have more than one client, this will lead to incomplete synchronization: some messages will not arrive on all devices, and it will not be possible to synchronize the history for the past four days to newly installed devices. We are very sorry for the inconvenience.

The software on yax.im has been upgraded from version 0.11 to prosody-trunk. While the new version is still considered as experimental, it provides many under-the-hood improvements that make the trade-off worthwhile. If you notice any issues, please report in the yaxim room (webchat).

We are proud to present to you yaxim version 0.9.9 “FOSDEM 2020 Edition”. Many things have changed under the hood (reliable messaging with MAM and Push, new UI with runtime permissions), and some exciting new features like even easier onboarding, service browsing and Matrix support. Taken together, yaxim now fulfills the Core IM and the Advanced Mobile profiles of the XMPP Compliance Suite 2020.

A decade ago, today, the first yaxim commit was created, making it now officially half as old as XMPP. Since then, much has happened both in the XMPP ecosystem and on the Android side of things.

The yax.im service was unavailable to ~11% of our users since March 28th. This was a result of a bug in a community module that was triggered by our upgrade to prosody 0.11.

Starting today, yaxim is switching its protocol foundation from the deprecated exchange of clumsy and inefficient XML streams to the modern and elegant combination of HTTP and JSON/REST, the Matrix protocol.

As users of a service, you have a right to know which data the service is storing about you and how it is using that data. Starting tomorrow, this right will become law in the European Union as the General Data Protection Regulation (GDPR).

In the last months, we have worked out how this affects the Jabber ecosystem. This work has resulted in the creation of new service policies for the yax.im service, which become effective today.