This will be the last release I make of HexChat. The project has largely been unmaintained for years now and nobody else stepped up to do that work.

I want to say thank you to all of the contributors, users, and chatters I’ve interacted with over the years. HexChat was a very important and formative project for me; I started contributing to it as a teenager, learned so much, met many great people, and it led to greater things in my life. It is hard to let go but the time has come for me to move on.

I am going to move all data that I can to be hosted on Github, so all documentation, installers, and dependencies will be there until the end of Microsoft.

Forks of the project are welcomed. Nobody can stop the code from living on.

Links

• Downloads
• Changelog
• Git log

This release also comes with some bad news; The HexChat project has been undermaintained for quite a while now. I’ve been involved with this project since I was a high school student but that is long past and I simply don’t have the time to dedicate to it any longer. The Windows builds in particular are very draining and in a poor state which has kept smaller releases from happening more frequently. If anybody out there doesn’t mind building things on Windows or wants to help with maintainance contact @TingPing on Libera.Chat.

Links

• Downloads
• Changelog
• Git log

Soon after the split #hexchat was registered there with no immediate plans of closing #hexchat on freenode, rather I hoped to set up a relay bot eventually. It actually wasn’t reasonable for us to close it because its the default recommended network on existing HexChat installations. However I did set the topic to say the channel is on Libera.Chat.

Today freenode decided to mass take ownership of every channel with Libera.Chat in their topic and clear all set modes and flags removing all moderators entirely. This move shows how little respect they have for projects and that the network is no longer a safe home for any FOSS project.

The only action that can possibly be taken is to move to a different network. You can find #hexchat here: ircs://irc.libera.chat/hexchat.

If you use Flatpak or the Windows installer simply update and you will have the fix. The Microsoft Store version is in review and will be released soon. If you use any version on Linux and experience the crash please report this to your vendor with these details: https://nvd.nist.gov/vuln/detail/CVE-2018-15120

Links

• Downloads
• Changelog
• Git log

Packages

This is the first ever release where HexChat has 4 upstream installation methods where in the past it only had Windows installers.

Microsoft Store

As you may have noticed there is now a HexChat package on the Microsoft Store. Microsoft now has a SKU of Windows (10 S) that cannot install any applications outside of the store by default. This was brought to my attention by a user requesting a store version so I tried it out and everything largely went smoothly so I released it.

You may also notice it has a purchase option there; I took this opportunity to expose an easy way for users to “donate” to the project but sadly Microsoft has no actual donation option and it must be a purchase. Do not worry though as you can install it without paying indefinitely with all features they just refer to it as a trial.

It is worth noting this version is not exactly identical to the normal release in that it doesn’t ship Perl or Python support which I would like to investigate adding in the future. It also (sometimes?) uses a more obscure configuration directory so it is a bit more inconvenient to to fiddle with config files but that is more of a design fault of HexChat that it ever requires the user interacting with that directory directly.

Flathub

In recent times there have also been a lot of buzz about solutions to making portable binaries for Linux including Flatpak. These are built and hosted on the Flathub store. This is my recommended method for installing on Linux as I can directly support it, reproduce issues with it easily, and update it in minutes.

Snapcraft

The other big solution in this space is Snap. While I did make a HexChat Snap I do not recommend it for most users as it has some bugs unique to it, is less portable than and uses more space than Flatpak, and it is the more complex and difficult format for me to support. It does have a single advantage keeping it around which is that Ubuntu users can see this in the store out of the box so it is the only real method to get up to date versions to these users who may not know any better.

Build system

This release also converted the project from Autotools to Meson. This decision will likely be controversial to some as the old method would run without Python 3 but that isn’t a particularly crazy dependency IMO. The actual change here that will impact older distros is that we now require a very recent gettext but outside of that the transition seems to have gone very smoothly and is a pleasure to work with compared to autotools and it can eventually replace hand maintained Visual Studio projects on Windows.

Links

• Downloads
• Changelog
• Git log

Our release process

HexChat tries to take security of releases seriously and I would like to think does a better job at it than most small open source projects.

Firstly our main website is hosted on Github Pages over HTTPS only, it is only a landing page and does not host any files. Our downloads are hosted by me (@tingping) personally on a DigitialOcean VPS. This website is only accessible over HTTPS using modern security practices at dl.hexchat.net. Our Windows installer downloads files at runtime all over HTTPS only.

So at that point you should have gotten everything securely but we can go a step further to verify this. The source downloads and the Flatpak repo for Linux are signed by my GPG key. All Windows installers are built, signed, and uploaded by @tomek. We two are the only people you should trust any official HexChat download from.

The source to HexChat is of course open but also our build script and all of the source to build our Gtk stack on Windows is open source and can be built yourself. If anybody finds anything about this that could be improved or might be an issue feel free to contact us on IRC.

Verifying the installer

1. Download the HexChat installer

2. Run it and you should see this including the Publisher line:

   

3. Click on the publisher name to see more information:

   

4. And lastly you can click View Certificate to see exact details:

   

5. The exact public key to compare against:

   30 82 01 0a 02 82 01 01 00 a4 44 55 27 b5 f1 64 bf 11 09 15 38 aa 5f b2 01 72 06 a2 db 95 79 0f 17 d1 62 29 4c 08 f1 e1 e0 dd 65 da f8 b9 db 1b c5 fa 49 93 e4 9e 3b d9 56 03 cf 1e d8 a4 6a 27 3b 9b 21 50 86 a8 1a 2a c9 3b c5 77 b0 b6 53 ad 81 8a 39 e5 20 bc 5c f9 d4 00 0d e1 d2 47 a0 ca 7b 69 96 61 24 56 1d bd bd 42 37 72 81 27 8e 8c 9a f4 07 84 24 fc b5 a2 51 7f 24 6a 8b 5b 2b 0b fe 79 a8 fa 73 53 c7 f6 d3 ae 6a 08 46 10 37 37 f1 45 80 39 18 86 39 9c 0d 88 ef 57 cc 6c 50 b0 40 4a a2 b1 fb c4 e5 21 45 2b 11 33 69 62 98 5b 8a 57 0c 7d 43 a1 3a 6c e4 e7 95 b4 df 8e 1d c3 cd b4 58 75 62 f5 4a 55 0a 94 05 1f 92 54 31 18 17 08 99 10 0a 88 eb 41 02 2c 25 0b eb 2d b5 e2 86 ac 59 ae f2 d2 4c 3d 7c 43 3d e4 83 00 c0 a5 fb f9 a9 25 cc 1c a6 d8 2b b3 02 55 75 29 cf 28 89 91 91 7e 99 56 2d e1 b7 02 03 01 00 01

Now that the installer is verified does that mean it is safe? Well the truth is that this is impossible to assert. You must have impllict trust that @tomek and I are not malicous. There is also a very small chance that a third party whos software we use is actually malicious but as mentioned above you can verify all software we use.

Why is it flagged?

We don’t write your AV software so we don’t actually know. There are plenty of assumptions that can be made though; For one thing IRC has historically been used in a lot of malware and since [He]xChat is open source it is plausible some of that very code was used or they just flag the IRC protocol entirely outside of whitelisted applications.

Another common reason HexChat is flagged is because other users can write arbitrary things in chat that we log. A tactic some spammers use is to print malicious HTML in chat; This is absolutely harmless to us as we do not parse HTML or execute JavaScript at all but it will make your AV angry.

What can be done?

The only course of action is to whitelist HexChat for now and contact support for your AV. This happens every release and usually a few weeks after they will add it to the whitelist. You might suggest that we contact every provider ourselves but this is a task that does not scale up nor is it our problem. Hopefully we can make you feel a little more confident that it is probably not actually malware though.

Fishlim

The fish plugin did get some love this cycle fixing a few bugs and implementing key exchange (/keyx) which allows two clients to negotiate a more secure password. It also finally handles basic things like /me working so enjoy.

Plugin API

There were also a few fixes and additions for any addon creators:

• The channel list has a “chanmodes” entry and you can see a use for it in my buffextras.lua script.
• The hexchat_pluginpref_get_int() API returned 0 or -1 on failure inconsistent with the docs so that was fixed which also fixed the lua plugin.
• If you ate an event that causes a highlight the UI used to still change which was fixed allowing nohighlight scripts to be greatly simplified.
• There have been longstanding issues with hooking “Close Context” where you could very easily trigger a crash; These have not been fully fixed and may never be but the common cases have been handled.

Links

• Downloads
• Changelog
• Git log

Links

• Downloads
• Changelog
• Git log

Lua

Just some quick background information: the plugin supports lua[jit] 5.1-5.3, is shipped on all platforms, and the documentation can be found here.

The first thing that really stands out when switching from Python scripts to Lua ones is the resource usage. I have around 10 scripts loaded at any given time and the python plugin alone would use around 60MB of ram, when I rewrote every script in Lua that number decreased to about 4MB. On top of that luajit is an extremely fast interpreter though scripts are rarely CPU bound.

Another useful feature is that Lua is extremely portable, this means that Windows users do not need to deal with the hassle of downloading a giant Python installer that ends up broken, requires rebooting, or is incompatable with a script. The Windows installer will include all of Lua itself which is effectively a 1MB single binary and will be installed by default so scripters can be confident users have it.

Lastly and my favorite feature is the ability to use a library called lgi. GObject-Introspection is a technology that allows information about C libraries to be used externally (usually from other languages). This means that scripts can integrate with the same libraries HexChat uses itself such as GLib and Gtk. This library is small enough that we will be bundling it on Windows which means for the first time all Windows users can have scripts that can easily modify the UI or integrate with the mainloop.

Here are some basic examples that should give you an idea of more advanced things you can do with this ability:

local lgi = require('lgi')
local GLib = lgi.require('GLib')
local Gio = lgi.require('Gio')

hexchat.register('FileTest', '1', 'Opens a file async')

--[[ A common problem in scripts is that they have to do blocking IO
     operations and in a graphical application like HexChat this means
     locking up the client. To avoid this GLib provides many asynchronous
     APIs that use threads and the mainloop to avoid blocking. This is just
     an example of opening a large file without blocking. ]]--

hexchat.hook_command('readfile', function (word, word_eol)
	if #word < 2 then
		print('Need a file name')
		return hexchat.EAT_ALL
	elseif not GLib.path_is_absolute(word[2]) then
		print('Need an absolute path')
		return hexchat.EAT_ALL
	end

	local file = Gio.File.new_for_path(word[2])
	local original_context = hexchat.props.context

	-- This starts another thread and calls the function when it is finished
	file:load_contents_async(nil, function (file, result)
		local contents, etag, err = file:load_contents_finish(result)

		-- We need to manually reset the context as it may have changed
		if not original_context:set() then
			hexchat.find_context():set() -- front
			print('Original context lost')
		end

		if err then
			print('Error reading file: ' .. tostring(err))
		else
			print('File contained: ' .. #contents .. ' bytes')
		end
	end)

	return hexchat.EAT_ALL
end)

local lgi = require('lgi')
local Gtk = lgi.require('Gtk', '2.0')

hexchat.register('WinTile', '1', 'Tile the window left/right')

--[[ HexChat being a graphical application many times you want scripts
     to modify the UI, this is just a simple script that takes a reference
     to the main window and modifies it in a simple way (moving and resizing).
     In practice you can do any operation you would like including spawning
     new windows and modifying widgets. ]]--

hexchat.hook_command('tile', function (word, word_eol)
	if #word < 2 then
		print('Need side, left, right, or reset')
		return hexchat.EAT_ALL
	end
	local side = word[2]:lower()
	local window = Gtk.Window(hexchat.get_info('gtkwin_ptr'))

	if side == 'reset' then
		local width, height = hexchat.prefs['gui_win_width'], hexchat.prefs['gui_win_height']
		local x, y = hexchat.prefs['gui_win_left'], hexchat.prefs['gui_win_top']

		window:resize(width, height)
		window:move(x, y)

		hexchat.command('set -quiet gui_win_save on')
	elseif side == 'left' or side == 'right' then
		local screen = window:get_screen()
		local width, height = screen:get_width(), screen:get_height()

		hexchat.command('set -quiet gui_win_save off') -- We don't want to save the temporary size

		window:resize(width / 2, height)

		if side == 'left' then
			window:move(0, 0)
		else
			window:move(width / 2, 0)
		end
	else
		print('Invalid side. Need left, right, or reset')
	end

	return hexchat.EAT_ALL
end)

Links

• Downloads
• Changelog
• Git log

Platform Integration

Firstly there has been a lot of improvement in making various features equal across platforms.

Notifications

Since Windows 8.1 there has been notification support built into Windows and as of this release we finally support them natively thanks to @leeter. The same treatment has also been done on OSX so we now support notifications on all platforms.

Spell Check

Windows 8 also added native support for spell checking without installing any external dictionaries so we can now make use of that.

Plugins

Secondly a number of plugins were completely rewritten from scratch fixing numerous problems, adding requested features, and improving cross platform support.

Sysinfo

The sysinfo plugin got a major rewrite making the plugin unified across all platforms. This added initial support for OSX, added a lot of information to the Windows plugin such as storage space and multiple gpus, and cleaned up the formatting.

Identd

The identd feature has been rewritten from scratch to be cross platform as well as fixing numerous issues and adding the abililty to customize the port. This can be configured in Settings > Preferences > Identd.

Updater

The update plugin has always been rather basic so with this release we have started using WinSparkle for updates which allow us to show a graphical update dialog showing the changelog.

IRCv3.2

A new round of specs from IRCv3 released this cycle and we have added support for a few. The most interesting of these at the moment is cap-notify. This allows for the server to dynamically add and remove new capabilities which is heavily used in an upcoming ZNC release to support various capabillities exposed by networks.

Encoding Changes

This will be a somewhat more contraversal change but this release of HexChat has made major changes to how encodings are handled. Previously if an invalid encoded message was recieved the client would always attempt to decode it as ISO-8859-1 which while possibly working would often just result in corrupted and incorrect text, now it is replaced with “�” as per the standard.

On top of that the “IRC” encoding has been entirely removed; This was a hybrid encoding that would try to support both CP1252 and UTF-8. HexChat now pushes everybody to use normal UTF-8, this might be a problem in some communities but in the long term this is a better solution that all clients can support.

Historically XChat has not used ssl very securely; The last release of it used terrible defaults such as forcing SSLv3 (which is known insecure) and does not take any effort to verify the cert is for the correct address you connected to. With this HexChat release this has finally changed; Now only TLSv1.0+ are accepted and all hostnames are verified as well as a few other more secure options. The next release will hopefully take this a step further including features such as supporting certificate pinning.

Outside of HexChat itself the project has taken measures to ensure our releases are secure. Recently I moved dl.hexchat.net, which hosts all project related downloads, entirely over to https. Since 2.10.0 all source releases have been signed by my personal gpg key and the Windows installers are all now signed by tomek.

Links

• Downloads
• Changelog
• Git log