undu

I understand that in a system with clients and servers having encrypted communications between the server and the clients is not enough to have end-to-end encryption.

Even then I find it strange to cobsider TLS not end-to-end, the whole gist of TLS is enabling confidential communications between 2 network nodes without any of the intermediate nodes participating in the communication being able to decrypt the data.

Of the ones I’ve tried that are fully open-source, zulip is the best one regarding UX functionality.

I’ve found Matrix is a UX nightmare, with many different clients implementing different features, or having issues if a non-default login mode is used, ending in people getting locked out after the browser logged them out because they forgot to copy a key when they were logged in.

Others like rocketchat are opencore like matter most, which means they can do the switcheroo.

The things I would care the most when checking this kind of service are:

• UX: how easy it is to use for nontechnical users
• how well-backed is the project, socially and financially, to ensure it lasts a long time
• how easy it is to get the (public) conversations out, as an exit strategy, if the one above isn’t looking so good.

I’ve used Wayland exclusively for years, but here’s an example: https://michael.stapelberg.ch/posts/2026-01-04-wayland-sway-in-2026/

tl;Dr the Wayland ecosystem has still not caught up in all edge cases, the weirder setup you have the more likely you’re affected

Vates demoed on kubecon an ARM workstation running XCP-ng, a xen-based virtualization platform.

https://xcp-ng.org/blog/2025/11/13/xcp-ng-on-arm-with-ampere/

It’s still early days, but I’m hoping it can reach homelabs, the big question being hardware enablement, which is difficult on ARM baseboards due to lack of standardization.

Disclaimer: I work with Vates, and prepared some component to compile under ARM to prepare the demo.

I know, yes. But I’m talking about virtualization, not containerizarion

Personally, I want to properly isolate the services with virtualization. The main reason is I expose some of the services online, and I don’t t want to only rely on keeping all software up-to-date at all times. This allows me to limit the damage if one of the services is compromised.

I wouldn’t use MacOS as the virtualization platform, and instead use something else, like BSD, Linux, or xen-based for my servers

Xcp-ng might have the edge against bare metal because Windows uses virtualization by default uses Virtualization-Based Security (VBS). Under xcp-ng it can’t use that since nested virtualization can’t be enabled.

Disclaimer: I’m a maintainer of the control plane used by xcp-ng