XSF Discussion - 2013-12-04


  1. Lance has joined
  2. tato has left
  3. tato has joined
  4. Lance has joined
  5. bear has left
  6. Lance has left
  7. SouL has left
  8. Alex has joined
  9. Alex has left
  10. Alex has joined
  11. Alex has left
  12. jabberjocke has joined
  13. SouL has joined
  14. Simon has joined
  15. jabberjocke has left
  16. Simon has left
  17. Simon has joined
  18. Simon has left
  19. Simon has joined
  20. dwd has joined
  21. jabberjocke has joined
  22. Simon has joined
  23. stpeter has joined
  24. stpeter has left
  25. Simon has left
  26. Simon has joined
  27. Zash has joined
  28. Ashley Ward has joined
  29. Zash has left
  30. Simon has joined
  31. Zash has joined
  32. Simon has left
  33. Simon has joined
  34. Simon has joined
  35. SouL has left
  36. SouL has joined
  37. SouL has left
  38. SouL has joined
  39. SouL has left
  40. tato has left
  41. jabberjocke has left
  42. Alex has joined
  43. Simon has left
  44. Simon has joined
  45. Simon has joined
  46. stpeter has joined
  47. stpeter has left
  48. SouL has joined
  49. intosi has left
  50. intosi has joined
  51. Zash has left
  52. stpeter has joined
  53. stpeter has left
  54. stpeter has joined
  55. Laura has joined
  56. Zash has joined
  57. bear has joined
  58. fippo http://webrtchacks.com/trickle-ice/
  59. fippo "Things get complicated for SIP because it has neither of the above: it has neither the reliable discovery mechanisms of XMPP, nor the mandatory support for trickling that WebRTC comes with."
  60. fippo poor old sip
  61. MattJ :'(
  62. stpeter heh
  63. stpeter speaking of which, would it be helpful to finish off the Server IP Check XEP?
  64. Zash Oh, hadn't seen that there was a new version of that
  65. stpeter newish, anyway
  66. stpeter all it really does is give you a hint that your IP address might not be what you think it is, thus the acronym "sic" ;-)
  67. MattJ Clever :)
  68. stpeter I love clever acronyms -- maybe I should've gone into marketing or advertising ;-)
  69. intosi has left
  70. intosi has joined
  71. Alex has left
  72. bear Board meeting in 5 minutes, I suspect it may be a fast one
  73. stpeter why do you suspect so? ;-)
  74. bear i'm just being an optimist
  75. dwd We can soon correct that one, though.
  76. stpeter http://webrtchacks.com/trickle-ice/ mentions Jingle Relay Nodes -- another spec we need to update
  77. dwd grabs thinking-pencil
  78. dwd What with SRTP-DTLS and stuff, a relay is unable to snoop on the conversation, I suppose?
  79. bear you can buy those!?!
  80. dwd bear, Don't know, but you should be able to. Then again, I also want a hex bit pencil and pen set, and I can't find those anywhere.
  81. bear checks for quorum
  82. bear ralphm, simon, dwd, laura?
  83. dwd waves appendages.
  84. Simon is here
  85. ralphm hi
  86. Laura Here
  87. bear sweet! everyone ready to start?
  88. ralphm go
  89. stpeter wow, cool, text from Laura appeared before she joined the chatrom
  90. stpeter +o
  91. dwd stpeter, Then your client had a MUC sync failure.
  92. bear yea, I just noticed she was not in the admin affiliates list
  93. bear so made the change just as she was responding
  94. dwd stpeter, You saw the role change as a entry.
  95. stpeter anyway
  96. stpeter topics for today?
  97. Simon Bear: I'd like to add a discussion about the XSF involvement with the securing of XMPP to the agenda.
  98. bear on the agenda:
  99. dwd Simon, Good call.
  100. bear GSoC update
  101. bear FOSDEM quick update
  102. bear Google outreach response/update
  103. dwd needs to largely vanish at 1700UTC (ie, 30 mins) to go cook the children's food.
  104. bear and XSF being active with the XMPP ubiquitous security thingy
  105. bear ok, first item - GSoC
  106. bear let's make this a Kev inspired meeting then - 30 minutes and done
  107. bear i'll do minutes later tonight
  108. bear the mailing list had quite a response
  109. Simon +1 for a fast meeting.
  110. bear so I want to make sure tonight the gsoc wiki page has items
  111. bear and then poke the responders to start updating it
  112. ralphm yeah, looks good
  113. bear i'll do that tonight
  114. Simon then we should mail out to the list(s) too?
  115. dwd It'd be nice to get some concrete support and suggestions.
  116. Simon +1
  117. Simon ok -happy to start adding concrete when the page is ready.
  118. jabberjocke has joined
  119. bear yes, if you all want, email me what lists I should target and I'll do them (or volunteer to help cover them)
  120. bear yea, that is better, update the wiki wth the lists and then we can coordinate
  121. bear anything else on GSoC ?
  122. stpeter (as to agenda items, I'd like to chat briefly about the various liaison relationships that might be forming)
  123. bear adds to agenda
  124. Simon Bear: happy with that for GSOC / nothing else
  125. ralphm isn't that like g outreach?
  126. bear ok, next item - google outreach results
  127. bear my take is that we are hitting a possible political stonewall ?
  128. dwd Well, no.
  129. Simon Update: Email doesn't reach google people/ G+ does. Ade pinged a couple of people inside google and "they are aware of what is happening" was the most I could get out.
  130. dwd The wheels of Google grind slowly, etc.
  131. Simon I'd tried to email quite a few people including their head of open souce Chris DiBona. Nothing back.
  132. dwd It's not so much a political stonewall, it's just the momentum of the juggernaut is hard to change.
  133. fippo i'd note https://twitter.com/juberti/status/401971677321367552 as well
  134. stpeter I did reach out to Justin Uberti and he said he would find out if it's possible / feasible for them to support s2s encryption
  135. Simon What about we take a different approach - of asking that they enable TLS without cert checking. But at this point I'm somewhat inclinded to say fuckit.
  136. bear ok, so my question would be this then: do we continue with another round of polite-behind-the-scenes contacts or do we start getting noisier on the G+ scene?
  137. dwd Simon, I don't think we've got anywhere close to that yet.
  138. stpeter Simon: that is what I suggested to Justin as a good place to start
  139. dwd bear, I'm nervous about becoming confrontational in public.
  140. fippo stpeter: they have it implemented. It worked a couple of years ago
  141. stpeter but, to Dave's point, we don't even know if they have anyone working on Talk any longer
  142. stpeter fippo: ah, I had forgotten about that
  143. dwd bear, I think the counter-reaction would be bad, basically.
  144. SouL has left
  145. stpeter I see no reason for a confrontation
  146. dwd What might be interesting is to try to get Google participation from the Chris DiBona/Ade types at the SUmmit.
  147. bear I wasn't suggesting bashing
  148. stpeter ideally we can bring along Google, although IMHO it might not happen as quickly as we'd like
  149. SouL has joined
  150. bear I was suggesting just taking some of the questions to G+ and starting a dialog
  151. dwd I know it'll be too late for the 4th Jan test day, but getting to chat face to face might prove much more effective.
  152. stpeter and BTW it's not just Google -- other providers like GMX and Dreamhost are relevant here, too
  153. fippo stpeter: i'll poke some people about GMX again.
  154. dwd bear, I think it'd end up a disaster, TBH. We just cannot control how other people pitch into a public conversation.
  155. Simon I can go an know on GMX's door here in Munich.
  156. stpeter Simon: :-)
  157. Simon is serious.
  158. ralphm dwd: agreed
  159. bear ok, so the push back i'm hearing is that we keep it direct until the first test day is over?
  160. bear and then regroup?
  161. stpeter that seems reasonable
  162. dwd Right, but I'd reiterate that if we can ply some Googlers with beer in Brussels I think it'd lubricate more than throats.
  163. jabberjocke has left
  164. stpeter :)
  165. fippo dwd: and london :-)
  166. ralphm the point is that we are effectively not having a conversation, not even no-comment
  167. Simon Sounds good. A nice report from the first test day explaining how we've tried to reach out to some of the larger providers wouldn't go amiss too.
  168. dwd ralphm, Well, we've had a to, and a fro. It's not great, but it's a start.
  169. ralphm those googlers we are talking to are not involved
  170. stpeter ralphm: methinks I'll post on +
  171. stpeter dwd: agreed
  172. Simon My post on G+ got an instant reaction.
  173. stpeter Simon: yes
  174. ralphm dwd: I chat with Ade all the time, that's easy
  175. bear ok, so the status is "still poking" with more pokes to happen and to keep it on a one-to-one level for now and let the sleeping giant that is our awesome membership quiet for the moment?
  176. Simon posting and linking to http://xmpp.net/result.php?domain=gmail.com&type=server (when it's finished testing).
  177. stpeter heh
  178. fippo simon: use google.com instead
  179. dwd Hmmm. xmpp.net isn't over https. No irony there.
  180. stpeter it doesn't force https
  181. ralphm heh
  182. stpeter we can fix that
  183. ralphm let's
  184. dwd But I digress...
  185. bear ok, moving on
  186. stpeter ok, done with that topic?
  187. stpeter (I will try to resurrect some DreamHost contacts)
  188. bear ralphm - can you give a quick FOSDEM update?
  189. ralphm no change
  190. Simon I'd like us to talk about the security effort though as part of the XSF. This security stuff is important to get right. At the moment we spoke about it at the summit, in the board meetings and in the mailing lists. If it's purely Peter's manifesto and the XSF isn't endorsing that, then we look indecicive. And this stuff is important and we should be endorsing it.
  191. bear nicely quick - thanks ralph
  192. bear passes the mic to simon
  193. Kev Simon: FWIW, I don't think the manifesto as it stands is 'right'.
  194. Simon I can't think of a more important cause that we should be focusing on and championing.
  195. bear kev - what part of the manifesto do you not agree with?
  196. dwd Simon, I'd be concerned that too many of the operators are not committed to it - in part because of the Google (and GMX, and ... ) issues.
  197. bear the non-technical bits?
  198. Simon Or put another way, is there anything more important than focusing on security right now?
  199. Kev I've sent an Isode position to Peter a few weeks back to give him a chance to comment before making such a thing publicly.
  200. dwd Simon, Think of the children.
  201. stpeter personally I'm not really a fan of manifesto as communication method, but it's been good as a way to start the conversation and set some goals
  202. Kev But my personal position, which may or may not be similar to Isode's, is that it states the requirements too firmly without nuance.
  203. bear i.e., can we endorse the testing and interoperability of the Security Test Day without waving the manifesto as our flag?
  204. dwd bear, Not really. Or at least, we can, but nobody will understand that.
  205. Kev There are significant (non-Internet) deployments that do not need, or should not have, TLS, and the manifesto simply says they need to use TLS. If the XSF endorses that, it's saying it doesn't recognise any of these deployments as valid, and that was Not Be Good.
  206. stpeter Kev: likely something is lost in my inbox and I need to reply, sorry about that
  207. Simon a) write a manifesto b) decide that security is an important selling point for XMPP c) XSF announces secure connections on the network test days. d) XMPP is secure.
  208. Laura What about seeing the manifesto as a work-in-progress?
  209. ralphm Maybe we can change the effort to an informational XEP and then have XSF announce test days
  210. Laura Look for engagement through involevemt?
  211. stpeter Laura: I definitely see it that way, but it perhaps hasn't been presented properly
  212. Kev stpeter: I think you replied saying "Will look at this", and then lost it, then :)
  213. dwd I personally see the manifesto as a kind of bargaining position. It's a statement of our ideal for internet services.
  214. dwd The trouble is, the way it's worded leaves little compromise.
  215. Laura Does it say that clearly? "This is a statement of our ideal…" etc?
  216. Kev dwd: But because it places requirements on software, not just deployment, that is not clear.
  217. stpeter Kev: as to non-Internet deployments, the manifesto doesn't talk about those since it's about the public XMPP network
  218. bear I can get behind the XSF creating a best-practices XEP and then starts to support interop testing to implement it
  219. Simon Kev: The manifesto calls for securing public servers that interconnect - don't think it mentions "behind the firewall" installs.
  220. Kev stpeter: No, it's about software too.
  221. dwd And I think that lack of compromise is seen as worrying by a considerable portion of the deployed servers out there.
  222. stpeter Kev: yes, we need the software to support the features and configuration options that make it possible for public XMPP services to encrypt traffic
  223. Kev stpeter: Yes, but some of the software points are not 'support', they're 'do'.
  224. Simon I see it more as "if you want to talk to my users, you jolly well ought to take their privacy seriously and use TLS"
  225. dwd Simon, Right, but that's not what it says.
  226. Kev I am not opposed to the ideas in the manifesto, but the wording is Not Quite Right to my eye.
  227. Kev stpeter: You have some comments on this in your inbox :)
  228. Laura Please tell me it actually uses the phrase "you jolly well ought to"
  229. Simon :)
  230. stpeter Kev: I'm sure
  231. stpeter anyway
  232. dwd Laura, No, it says "you must and I will not compromise".
  233. dwd THough I paraphrase.
  234. Laura Scary
  235. Laura What about "we will help you to…"?
  236. stpeter Kev: the only "do" I see is "no more SSLv2 and SSLv3", but I think the "and SSLv3" can be removed -- it's SSLv2 that is bad
  237. Laura More encouraging?
  238. stpeter in any case, this is not the place to wordsmith
  239. stpeter and 27 minutes have gone by in this meeting :-)
  240. Kev stpeter: Are you happy for me to share the mail more widely, or would you like to read it first?
  241. stpeter action item for me is to review all feedback and propose changes to the manifesto
  242. Kev OK.
  243. Simon My original point is that the XSF needs to be seizing this moment to fix security on s2s links (I don't care what you do on your c2s links)
  244. stpeter Kev: I'm fine with public discussion -- transparency is always better IMHO
  245. dwd stpeter, Right. But I think the point is that it's not clear that the XSF can wholeheartedly support it in its current form, which is unfortunate, because the goals of it seem very well aligned.
  246. bear can we get some wordsmithing on this in the lists and take this up again next week?
  247. stpeter dwd: I'm not sure what it means for the XSF to support such a thing -- does that mean the membership needs to vote, or can the Board voice its support?
  248. stpeter bear: sure
  249. dwd Simon, "Do this or go home" has the unfortunate problem that many people seem happy enough to take the latter option, judging by the lists.
  250. stpeter the idea is very much to give us some aspirational goals, *not* to split the network!!
  251. dwd stpeter, I would argue that the Board shoudl probably judge consensus, rather than ask for a formal vote in most cases.
  252. Simon dwd: I was thinking about that. And yes, there are some vocal opponents. But I think we risk loosing the voice of the vast majority of silent suporters that would like secure connections.
  253. stpeter but the text in the manifesto about unauthenticated encryption seems to make this uncontroversial
  254. dwd stpeter, " the idea is very much to give us some aspirational goals" - right, totally behind you on this. I think it's the absolutism, as it were, that's causing the discomfort.
  255. bear looks at the time
  256. bear ok, if we can get the wordsmithing fixed
  257. stpeter dwd: OK, I will revisit the text and see if I can propose some scrubbing to remove any remaining traces of absolutism
  258. Simon I think the manifest is right - this is a network and at some point one has to force the issue - it's been many years now and the state of XMPP security has rumbled on in an insecure hodgepodge.
  259. bear then we will have a chance next week to talk about what/how we as the board can get the membership to support the effort?
  260. stpeter Simon: yes, *but* IMHO we should be able to at least get to unauthenticated encryption using even anonymous DH
  261. stpeter bear: yes
  262. dwd stpeter, +1.
  263. stpeter shuts up about security
  264. ralphm heh
  265. bear that sounds like a best-practices XEP for sure
  266. bear so people can be pointed to it as a HOW-TO once they get their F from xmpp.net
  267. fippo bear: i pestered dwd about starttls+dialback already
  268. dwd If we're done with this, does that mean we're done-done?
  269. Simon (peter: what's happening on Jabber.org's upgrade?)
  270. bear ok, that was the last agenda item
  271. Simon moves soapbox to the side.
  272. stpeter quick update about the liaison agreements
  273. bear any agenda bashing?
  274. bear moves box to peter's side
  275. stpeter I have received communication from the UPnP Forum about a liaison agreement with them
  276. stpeter I'm working on this with someone from Cisco who is involved in UPnP Forum
  277. stpeter we'll do a bit of back and forth in the next day or two
  278. stpeter then I think I can send a proposed document to the Board
  279. stpeter they have a template for such things, we just need to fill in some of the details
  280. stpeter I haven't really reviewed it yet, just received it yesterday
  281. stpeter but it's in the works
  282. stpeter and you saw my note about their UPnP Cloud initiative
  283. stpeter so that's all good, I think
  284. stpeter I need to follow up with both ISO TC 122 and IEC TC 57
  285. stpeter I apologize for taking last week off ;-)
  286. ralphm any more text on that?
  287. stpeter that = ISO and IEC?
  288. ralphm upnp+xmpp
  289. bear smacks peter with the "you should take more time off" bat
  290. ralphm apart from the news page
  291. stpeter oh, BTW, UPnP Forum is very interested in conformance / compliance testing and might be able to contribute code in this area for XMPP stuff
  292. dwd stpeter, Do we have to approve your vacation time as your management?
  293. stpeter ralphm: I have two presentations (PPT format) that I can probably share -- the rest has all been verbal chats I've had with some folks at UPnP Forum
  294. ralphm right
  295. stpeter they've had quite a few technical questions about MUC, pubsub, security, naming, etc.
  296. stpeter even Jingle stuff
  297. stpeter I think they basically want to accomplish the vision that Dirk Meyer was working on a few years ago
  298. ralphm cool
  299. stpeter yep
  300. dwd My children are hungry; but I think we just ask the Council to select some folk in readiness on the assumption Peter will sort out the legal mumbo jumbo.
  301. stpeter yes
  302. bear cool, sounds like a +1 to peter's plan
  303. stpeter we can discuss more next week
  304. stpeter I just wanted to provide a quick update
  305. bear next week, same time and place?
  306. dwd Someone (COuncil or us) should put out a call for volunteers to serve on these things.
  307. dwd (to members@)
  308. stpeter seems like a Council thing
  309. dwd bear, Yes.
  310. stpeter let's put that on their agenda for next week's Council meeting :-)
  311. dwd stpeter, Happy for it to be Council, they're doing the selection.
  312. stpeter WFM
  313. bear k, i'll send an email to membership@ asking council to add it to agenda
  314. bear ok, we are done then - thanks all!
  315. dwd Doesn't that effectively act as a call for volunteers?
  316. bear nope, just a public way of getting it on the council agenda
  317. stpeter :)
  318. Kev Yes, just make sure that anything going on Council agends reaches me via email please (either directly, to council@ or to members@ with a clear subject line) so I notice it.
  319. bear +1
  320. stpeter yay
  321. bear k, i'll write up the minutes after work using the new Kev method
  322. stpeter super
  323. stpeter thanks, all!
  324. stpeter good discussion
  325. bear and the i'll do the calendar additions for next week
  326. Simon thanks all
  327. bear yep, thanks everyone
  328. Laura Bye all
  329. stpeter it's great to see such passion about XMPP after all these years :-)
  330. bear +1
  331. Kev So, post meeting...Board could use more bios :)
  332. Kev I'm happy to put them in place if people send them to me, or everyone probably has access to do it themselves.
  333. Laura Tried to log in to do mine but couldn\t get in. I have my password - is the user name email address?
  334. Laura It didn't like me
  335. Kev I don't believe so - who created your account?
  336. Kev Bug them about it :)
  337. bear looks at laura's account
  338. bear laura: your username is "laura" and the email is listed as "laura.gill@surevine.com"
  339. Laura Thank you bear
  340. stpeter updates the Board calendar
  341. Laura *makes note to do my homework*
  342. stpeter Laura: hopefully these meetings aren't too crazy for you -- we have a certain style of communicating and it can be difficult to follow, I think :-)
  343. bear it does take some getting used to
  344. Kev At least we don't communicate by yelling (much) :)
  345. stpeter hmph, I have a dentist appointment next Wednesday morning, I am not sure how I schedule such a thing at that time :(
  346. bear do you want a schedule change before/after?
  347. stpeter I can provide information by email beforehand and the Board can proceed, I think
  348. bear k
  349. stpeter maybe I can join via mobile or show up early and use their wifi
  350. bear I'm up for sliding the meeting up an hour if the others are ok with it
  351. stpeter I'm going to see if (a) the dentist has wifi or (b) I can move the appointment
  352. Kev Hahahaha
  353. stpeter if we have a 30-minute meeting, we should be fine :-)
  354. Kev Sentences you never expect to see "I'm going to see if the dentist has wifi".
  355. stpeter heh yeah
  356. stpeter I'll work it out on my end
  357. stpeter Board calendar updated
  358. bear has sent email to members@ asking for council time
  359. Kev Thanks bear.
  360. bear yw
  361. bear the gsoc wiki page has been created by jabberjocke - \o/
  362. ralphm has left
  363. bear proofreads the new page for typos and spelling
  364. bear sends blurb to members@ about GSOC project ideas
  365. Simon has left
  366. Laura has left
  367. Laura has joined
  368. Simon has joined
  369. Laura has left
  370. Simon has joined
  371. Alex has joined
  372. Simon has left
  373. Zash has left
  374. Zash has joined
  375. Ashley Ward has left
  376. tato has joined
  377. tato has left
  378. tato has joined
  379. tato has left
  380. tato has joined
  381. SouL has left
  382. fippo kev: the agenda for the next meeting is going to be pretty heavy
  383. fippo three submissions from me ;-)
  384. tato has left
  385. Kev Yay.
  386. tato has joined
  387. MattJ dwd, can you expand "with strong identity being considerably more prevalent that it was"? (assuming s/that/than/)
  388. SM has joined
  389. dwd We have a big push for proper certificates that seems to be working.
  390. dwd But you know, I thought I'd make it sound exciting and technical.
  391. jabberjocke has joined
  392. Ashley Ward has joined
  393. tato has left
  394. ralphm has left
  395. bear has left
  396. Simon has joined
  397. Simon has left
  398. Ashley Ward has left
  399. MattJ So now we need to get the discussion over to the security list somehow
  400. MattJ and then jingle, and the WG list
  401. stpeter :P
  402. Zash has joined
  403. tato has joined