A tool for running self-hosted bridges with the Beeper Matrix server. - beeper/bridge-manager
Is anybody self hosting Beeper bridges?
I’m still wary of privacy concerns, as they basically just have you log into every other service through their app (which as I understand is always going on in the closed source part of Beeper’s product).
The linked GitHub README also states that the benefit of hosting their bridge setup is basically “hosting Matrix hard” which I don’t necessarily believe.
I’ve been interested in doing this, but I can’t tell why I need to login to Beeper in order to self host. I noticed their previous self-host solution did not require that.
Because of that login step, I decided to look into this other repo which uses Ansible to deploy a Matrix homeserver and the same bridges that Beeper uses. I haven’t finished it yet since there’s a lot of config and choices to make, but it seems like it’ll serve the same end goal.
Edit: lol, maybe if I read the intro, I’ll get my answer.
You can connect any† standard Matrix application service to your Beeper account without having to self-host a whole Matrix homeserver.
Still might go with the second option so that I don’t rely on their cloud services.
Been trying to read through to understand and see how all this is supposed to work, I guess it’s so you can use beeper app and infra and APIs to talk to your matrix server and the encryption/decryption/handshake happens here between matrix and beeper and then send to their servers for delivery and all that portion.
Ooo definitely going to give this a shot thanks for linking it. Their docs and guides say all of these bridges are encrypted and though things go through their app/services they cannot see or save anything, will be good to verify with my own bridge/instance however.
Yes I’m very interested in how they claim to have a zero knowledge model but also admit that their bridges decrypt and re-encrypt messages as they pass through. It might only be an ephemeral thing but surely it’s a massive, gaping target for bad actors to wire tap.
Hm, so it’s encrypted from your beeper client to the bridge, decrypted, then re-encrypted with the outgoing platform’s protocol. Seems like a good reason to host your own bridge, and a good call on it being a glaring attack surface.
Seems like the secret sauce is in how they deal with messaging platform integrations? Maybe the goal is to avoid another iMessage lawsuit. With Beeper as a proof of concept it would be cool to start adding integrations in a fully open source way (legality permitting)
For what I understood the decryption/encryption process happens on the bridge.
The bridge is the selfhosted component so the transformation would happen in your server and they would have no visibility over the unencrypted message.
Yeah I’m not disagreeing that it’s audible but having read the instructions it leaves a lot of unanswered questions like the above. Presumably people with more knowledge and time than me will figure it all out and write step-by-step guides at some point.
Agreed! I’m pretty psyched about their transparency and the overall model. Especially in the universe where this Apple lawsuit results in Beeper being allowed to connect to iMessage again.
Would love to hear any results you find with hosting! I’ll give it a try too and maybe do a follow on post with what I learn.
I started using their Signal and WhatsApp bridges today, probably one of the easiest setups I ever did. You just run a Docker container for every bridge, and login to your Signal/WhatsApp account by chatting in the app with the Matrix bot it creates.
Literally takes like 5 minutes if you’ve used Docker before, and you don’t need a domain or forwarded ports or anything.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
I’ve been interested in doing this, but I can’t tell why I need to login to Beeper in order to self host. I noticed their previous self-host solution did not require that.
Because of that login step, I decided to look into this other repo which uses Ansible to deploy a Matrix homeserver and the same bridges that Beeper uses. I haven’t finished it yet since there’s a lot of config and choices to make, but it seems like it’ll serve the same end goal.
Edit: lol, maybe if I read the intro, I’ll get my answer.
Still might go with the second option so that I don’t rely on their cloud services.
Been trying to read through to understand and see how all this is supposed to work, I guess it’s so you can use beeper app and infra and APIs to talk to your matrix server and the encryption/decryption/handshake happens here between matrix and beeper and then send to their servers for delivery and all that portion.
That’s a cool solution! I’d be interested in making a nix flake to do something similar to that Ansible project. Thanks for linking!!
Ooo definitely going to give this a shot thanks for linking it. Their docs and guides say all of these bridges are encrypted and though things go through their app/services they cannot see or save anything, will be good to verify with my own bridge/instance however.
Yes I’m very interested in how they claim to have a zero knowledge model but also admit that their bridges decrypt and re-encrypt messages as they pass through. It might only be an ephemeral thing but surely it’s a massive, gaping target for bad actors to wire tap.
Hm, so it’s encrypted from your beeper client to the bridge, decrypted, then re-encrypted with the outgoing platform’s protocol. Seems like a good reason to host your own bridge, and a good call on it being a glaring attack surface.
Seems like the secret sauce is in how they deal with messaging platform integrations? Maybe the goal is to avoid another iMessage lawsuit. With Beeper as a proof of concept it would be cool to start adding integrations in a fully open source way (legality permitting)
For what I understood the decryption/encryption process happens on the bridge. The bridge is the selfhosted component so the transformation would happen in your server and they would have no visibility over the unencrypted message.
In a selfhosted scenario, but what about their cloud service?
Yes, exactly. And how do you even tell the app that you want to self host? I see no option for pointing it to a different core server/bridge.
… Unless you have to do it at the point of sign-up? I remember seeing an ‘advanced’ option on the login screen.
It’s explained in the FAQ: https://www.beeper.com/faq#how-can-i-self-host-beeper I’ve not used the app so I don’t know how practical/easy it is but they’re at least offering the option, which is laudable.
Yeah I’m not disagreeing that it’s audible but having read the instructions it leaves a lot of unanswered questions like the above. Presumably people with more knowledge and time than me will figure it all out and write step-by-step guides at some point.
Agreed! I’m pretty psyched about their transparency and the overall model. Especially in the universe where this Apple lawsuit results in Beeper being allowed to connect to iMessage again.
Would love to hear any results you find with hosting! I’ll give it a try too and maybe do a follow on post with what I learn.
Please make a lemmy post about it with your findings, and link it from your comment.
I started using their Signal and WhatsApp bridges today, probably one of the easiest setups I ever did. You just run a Docker container for every bridge, and login to your Signal/WhatsApp account by chatting in the app with the Matrix bot it creates.
Literally takes like 5 minutes if you’ve used Docker before, and you don’t need a domain or forwarded ports or anything.