TL;DR - use Signal.

Re: self-hosting – go for it! The DIY route is an excellent learning experience, so this is the way to go if you want your own privacy-friendly chat service. There’s quite a lot to achieving “privacy” and “security” though (heck, even defining these is challenging)… have you self-hosted before? How important are service quality / speed / reliability, backups, mobile + desktop? Will the folks you want to chat with use/like it too?

Re: Signal – definitely check out this app as well. They (the Signal Foundation) take privacy very seriously. Messages are only stored on devices running Signal, and they are ephemeral by default. Actually, that’s a good thing to consider: How important are durable / offline archives of your chats, useful with other tools (like grep?). Signal makes offline archiving difficult by design (for the sake of security/privacy).

Note that Signal is technically self-hostable, but I gather this is very difficult.

I self-host Nextcloud and I use Talk. I don’t love it, but I do find it useful for some things. Flipping on Nextcloud is pretty easy, but it is challenging to make it secure, reliable, fast, etc. And you still have to convince others to use it.

Hi! Author here. I added a http → https redirect to my book website, thanks all. I do intend to always serve public content via https to (as other smart folks have thoughtfully mentioned) guard against stuff getting messed with between my server and your browser (however unlikely that may be). In this case I thought my server was redirecting to https, but turns out my Firefox was forcing https (again, same as other smart folks said).

re: “expert”, ugh, I’m embarrassed to even use that word, but someone else graciously called me that (so I intended to remove “self-proclaimed”), and it supposedly helps for sales. All I know is I’m growing and learning just like you, the more I know the less I know I know, and I make mistakes all the time. I always appreciate kind corrections/feedback/comments/patches/suggestions/etc.

That includes feedback on https://github.com/meonkeys/shb/blob/main/pelican/website/content/extra/.htaccess … I feel clever fixing two things in a single redirect (getting rid of www. and forcing https), but I’m not sure if I’m doing something silly or dangerous here. I’m definitely not an expert at Apache mod_rewrite, I just cobbled that together from official docs and stackoverflow posts.