Unified Push support

[BigmenPixel0]

What about this? https://unifiedpush.org

[Mannshoch]

I already use it for a matrix client. It works !

[erinarbleizez]

As a LineageOS user in order to de-google my phone because that's the best thing to do in this dark time (and without Micro-G possibility because my phone is not supported yet) I would really like having my notification pushed through unifiedpush (which is the best simple alternative to firebase cloud messaging).

It would also be more in accordance with F-Droid philosophy of not depends on Google.

I know nothing in android dev and wouldn't be any help but if there is anything server side code related that can be made to make it happen, just tell me I'm more than willing to help.

[rudism]

Supporting unified push would have several benefits:

• Push notifications would become available on devices without Google Services.
• Client builds from 3rd parties (such as F-Droid) would gain push notification capabilities.
• Team Edition self-hosters could also self-host push servers without needing to compile their own client apps.
• Opening up to other 3rd party unified push providers would reduce the burden/dependency on the official Mattermost TPNS.
• Unified push is already used and battle-tested by many other FOSS projects (clients for Matrix, Mastodon, NextCloud, and so on).

[toastal]

I self-host my own UnifiedPush server via XMPP to disconnect as much data as possible from Google and other untrustworthy parties—both Prosody and ejabberd make it trivial to enable for the server side, & all Conversations-derived (such as Cheogram) Android clients support the client side. I’ve been using it with other apps from F-Droid just fine (Element, Tusky) & Mattermost would help with work-related chat.

[TheJonny]

It seems mattermost is using https://github.com/wix/react-native-notifications/ for push notifications - so unifiedpush should be integrated there

[TheJonny]

Hi :)

Version 9 of the server supports a plugin hook for push notifications, so i did a bit of botching:

• the server plugin https://git.sr.ht/~thejonny/mattermost-plugin-unifiedpush creates a slash command /register_unifiedpush [url]
• the android side is a separate app, https://git.sr.ht/~thejonny/matterpush , as I am not confident in react. It displays the /register_unifiedpush-command needed, and displays notifications. if you tap the notification, it opens the mattermost:// link to open the correct chat in the mattermost app. It would be really awesome if somebody would help me integrating this. I'm available as @thejonny:bruckbu.de on matrix.

essential missing features are:

• [x] encryption of the push messages
• [ ] rate limiting on the server to prevent abusing it for denial of service amplification: with n messages pushed to m sessions, the server plugin fires n*m GET requests to arbitrary URLs.
  • [ ] cleaning up stale/failed endpoints
  • [ ] app side: notify the user, if the endpoint changes, so they can reregister
  • [ ] clean up logged out sessions. Currently they still get notifications

[toastal]

Excellent work @TheJonny I appreciate that you’re hosting the code on a libre code forge too with a decentralized chat option listed.

[tgly307]

@TheJonny Thank you very much for your contribution. Could you provide the packed file, please? This will be a great help.

[TheJonny]

@tgly307 please do not expect stability yet :) For Android, it's in this F-Droid repo: https://platon.bruckbu.de/~jonny/x/fdroid/repo/ the server part should be go get; make. I don't want to provide a package right now, it should only be used in controlled environments or for testing, as the security can still be substantially improved:

• you cannot logout (after logging out from the Mattermost App, you still receive Notifications via UnifiedPush
• by registering n sessions and sending m messages, the server makes n*m HTTP-requests to user controlled URLs, so it could be used for DOS amplification. both is easy to fix, but I did not find the time yet, but maybe next week

[toastal]

In the light of the headline “Apple and Google confirm governments spy on users through push notifications” (https://www.androidauthority.com/apple-google-push-notification-surveillance-3392252/) can we consider this of higher priority finally?

@TheJonny Do you not have a mailing list set up for your repository or an issue tracker? I’m trying to get it working with Nix & spotting some things that could help out.

[TheJonny]

@toastal now I have - I am looking forward for your issues :)

why wouldn't they spy - as it would be a no-brainer for apple or google to end-to-end-encrypt the push messages in the librariy (just provide a key along the device identification token), I consider it intentional.