XSF Discussion - 2017-03-24

nyco?

we should make a nice graph of at which time of day people make their renewal commits :)

jonasw: yeah, it might be leaking private information.

jonasw: did you account for people setting the renewal date in the future? :)

Guus, not in the linting, but good idea

hi guys, once again we are working on a new XEP that will replace Bookmarks in the futur, https://lite5.framapad.org/p/OlHwr5GBlY

Ge0rG, *shrug*, so does making a commit in your library

Guus: https://github.com/xsf/xmpp.org/pull/300

also https://github.com/xsf/xeps/pull/458 :)

edhelas: I weild no power in that repo. You'll need SamWhited or friends for that, I think.

Guus, no problem ;) it was just to drop the link here

Guus, yes?

nyco: l wanted to discuss with you if I should do something that I now already have done :)

(see github)

we should get your blogpost published!

it would be great if the website showed the commit used to build it somewhere, even if only somewhere hidden in the source.

jonasw: make it so.

that’d save us the "has it rebuilt yet or did something obscure fail?" guesswork

Guus, I agree, but we've just published one... this afternoon maybe ?

Guus, category Events, fixed

nyco - there will be a unknown delay between the merge being done, and the change being visible on the website.

like minutes?

unsure. I think there is a process that checks a couple of times per day if the website needs to be updated.

so, possibly, hours.

I think so, too

jonasw, I think you're the resident expert: is there value in upgrading pelican from 3.3 to whatever is the latest version?

I don’t know, actually

I have started using pelican only a few weeks ago, either ;-)

(but then spent a few intense days to port two websites to it)

ok, then let's push when we think it's good, and it's updated when it's updated... ;-)

Guus: in case of doubt, don’t change a running system

which makes you the expert. :)

I don’t even know which version is recent…

jonasw: agreed. I was actually running locally with 3.7 (which was wat I got with a default install), which gave me errors.

3.7 according to my debian…

huh

it builds the website fine here

(3.7.1)

nyco: it looks good to me now. Do you want another screenshot?

yes please, if it takes less than 30 seconds

jonasw: for me, the menu was kaput. Also, 3.7 was more forgiving when I neglected to specify the number of items in a menu correctly.

Guus: you need to run make devserver or something though instead of simply running pelican for reasons unknown to me

oh right

menu

that explains why I had a hard time finding the software lists when testing :D

well, that’s one good reason to wait with upgrading

or at least plan it properly

nyco: 32. I counted. Nost of that was trying to resize the browser window.

toooooo long!!!

jonasw: agreed - but it does suggest that there are important changes, which made me wonder.

Guus: ctrl+shift+m on firefox (re resizing)

jonasw: https://github.com/xsf/xmpp.org/issues/247

yes, cool, I see no glitch... thx Guus! ;-)

also, on our blog, we should insert visuals

can I do that, or it's too late?

go for it

I upload a picture to the repo? or use an online pic?

lol, I added the screenshot to the wrong PR :P

nyco: put it in content/images/, maybe in a new blog subdirectroy

nyco: I have no clue.

then the only question is how to reference it properly, this varies with pelican versions unfortunately

ok, we'll try on another blog post

what *should* work is this: |filename|/images/blog/thenameofyourimage.foo

sorry no time for today

ok

(filename is literally filename, see here: http://docs.getpelican.com/en/stable/content.html#deprecated-internal-link-syntax )

nyco, are or are you not going to change anything?

Guus, not this time

Then I"ll merge now.

done.

any concerns about https://github.com/xsf/xmpp.org/pull/294 ?

yes

jonasw: what concerns?

making a review right now, at least I found a typo

nyco: can we remove https://wiki.xmpp.org/web/Meetups and use the website instead?

duplicate accounting will only result in problems

Guus: review done

good catch!

I'm on it

typo fixed

link added

I'm tempted to make futher improvements in future PRs, if needed

no objections

could you do one last sanity check?

just thought the typo needs to be fixed before, the others are merely MAY suggestions

absolutely, tx

Guus: works for me

+1

done

I'm gonna merge my own updates too

*naughty*

do it

done it

looks better that way than with three open renewal PRs pending

that may evoke bad feeling for some who waited months to have their software listed ;-)

*feelings

(or servers)

can we close website PR # 193?

https://github.com/xsf/xmpp.org/pull/193

the changes it carries are obsolte anyways

great minds

I just closed it

:)

goffi makes a good point here: <https://mail.jabber.org/pipermail/jdev/2017-March/090299.html>

do we want that? If so, on a separate page or below the servers listing?

Finding good components is not trivial to be sure

and also it highlights a core feature of XMPP, being able to interface with other protocols by embedding them

my gut feeling is to merge it with the servers list ✏

I wouldn’t merge it, because they’re different things, but putting them on the same page might work

good to me too

same page, different table

right

also we really should have that description field.

I just now realised you’re not Guus. I got tricked despite colours. (I blame it on the fact that the pidgin colours changed radically when I changed the background color by only a few bits from 99% white to 98% white or something)

yes, for components it’s definitely needed, otherwise you don’t know what it is.

*sigh*

Stop impersonating me Ge0rG!

There's something to adding server components to a public list. I don't have a preference how that's done.

Guus: I'd change my nickname, but that's impossible because of MSN restrictions.

Ge0rG: switch to AIM, and you're done.

*switch to AIM to reach your goals

but my aim isn't very good

I think this concludes my round of fixes for today

I'd be greatful if someone *eyes intosi* could help sort out some of the issues that need access to the file system of the webserver

(where did the XEP archives go? Can we add various redirects? Delete the old ical files + related infra, etc)

Guus: tickets?

Or a ticket, at least ;)

https://github.com/xsf/xmpp.org/issues/280

https://github.com/xsf/xmpp.org/issues/279

possibly https://github.com/xsf/xmpp.org/issues/242

https://github.com/xsf/xmpp.org/issues/241

https://github.com/xsf/xmpp.org/issues/224 (which is somewhat duplicated by another one)

also, I don't know what this means: https://github.com/xsf/xmpp.org/issues/152

... and that's just from a quick glance over the issue list... :)

of 152, I think most don’t apply to a static website without confidential content or interaction.

ETOOMANYTICKETS

;)

you asked for it! ;-)

I'm trying to get that fixed intosi, but there's only so much I can do myself

(which i mostly did, afaik)

what do you guys think about https://github.com/xsf/xmpp.org/issues/212 ? We should either commit to it, or close the issue.

IMO, closing 152 as WONTFIX would be OK

I fail to see what 279 tries to cover that 224 doesn't.

please comment on the ticket, which makes it less awkward for me to close it.

Guus: +1 to WONTFIXing 212

intosi: yeah, probably duplicates.

also, https://github.com/xsf/xmpp.org/issues/275 - no one but me really likes that, right?

in which case it should be closed

meh. you can't click on blog post titles on https://xmpp.org/blog.html to read the full version.

275 is not something I will fix for you ;) It's content anyway, so you can fix it, or not fix it, without help ;)

yes - apart from the annoying bit that I don't know any of those people :D

I think the issue with 275 is to find the right text for the individual persons listed

Ge0rG: right, that annoyed me too

it’s easy-ish to fix though

jonasw: please do

jonasw: +1

you two are guilty for the dirty kitchen!

I take it back. the CSS is SASS

I cannot into sass

jonasw: please note that I am here just slightly longer than you :)

but I like cooking...

jonasw: how is that a CSS issue? Isn't it rather about HTML <a>?

yes, but it changes the colour of the header then

jonasw> of 152, I think most don’t apply to a static website without confidential content or interaction. can you add that to the ticket?

did

intosi, out of curiosity: what is the update frequency of the website (how often does it check for changes in github), and why?

Guus, Ge0rG: https://github.com/xsf/xmpp.org/pull/301

screenshot?

on my way

>.>

github doesn’t like my screenshots

"That file is hidden"

"Something went really wrong"

wow.

I just use 'select file' in the comment box

yes

that’s what I do

file permission problem?

now it works

screeshot attached

perhaps put quotes around the title in the link?

I also thought about prefixing it with "about"

Continue reading 'New XMPP Software Listing Rules'

it’s reaaallly hard to edit those files while the devserver thing writes over your vim terminal btw :D

I have this handy Vagrant image...

(or you just could use two terminals)

yeah, that's better

new commit+screenshot attached

agreed

ping Ge0rG

I'm not bothered by the missing green

if anything, it makes it more coherent with the rest of the site

I liked the touch of colour, and I’ll probably bring it back once I figure out how to use sass

it makes it less coherent on how the blog article looks after you followed that link

ah, right.

last time I tried to use sass I was baffled that it takes 30 seconds to process a few files

ugh

yeah, I frequenly work with people that gave Maven flak for downloading a lot of stuff and taking a lot of time. I now get to look at them funny every time they make me do npm install.

:>

The PR looks good to me. I'll leave it sit for a bit for others to be able to comment

looking forward to do apt remove npm grunt; apt autoremove after this

grave bugs of npm (→ 1.4.21+ds-2) <Outstanding> b1 - #857986 - npm: package is 3 years old (consider removal?) Summary: npm(1 bug)

I cannot into sass, now it’s not finding some included files which also aren’t in the repository.

intosi, anything I can help with?

Just triaged right now. Where I made remarks, consider them and you (or others) provide an answer, and I'll make it so when it's more convenient, and doesn't interfere with my actual job ;)

ah, right, intosi, can you give some details on how the website is built on the server? I’d like to know (a) if it is rebuild completely (i.e. with a fresh output directory) every time and (b) if so, does it do that unconditionally any N hours or does it check if a "change" happened and (c) if the latter, how does it detect a "change"?

Peace, out.

ah, darn, too slow

thanks for your help! I'm off to do some work that actually pays bills too :)

(Y)

I've provided feedback where needed, I think. As far as I'm concerned: just do it. (c)(r)(tm).

things here are left in limbo way too long for my comfort

an improvement that is later improved upon further is better than having no improvement at all.

bear, can this be closed: https://github.com/xsf/xmpp.org/issues/109 ?

hmm: I can't add an "item for discussion" on the Trello board for the Board. Could someone add https://github.com/xsf/xmpp.org/issues/175 there? It's a relative simple clean-up.

dwd / ralphm / samWhited ?

jonasw: +1 to the blog changes, even with blue instead of green

OH LOOK... on Hacker News: the URL may contain news.ycombinator.com and then /newest please upvote the meetup entry quickly (before it goes away) if you want/can and then comment, still if you want

nyco: an actual url to the HN article in question might be a few orders of magnitude more efficient...

https://news.ycombinator.com/item?id=13948527 for instance, that would've helped.

Wasn't the theory that they count votes less if you go there directly?

NOOOOOO

it has the actual opposite effect!

Less is more. War is peace.

efficient for what? so that you click?

we are already identified by HN as being part of the "xmpp trolls" cluster.

Ignorance is bliss

I am shocked.

you broke the pattern

clicking on the URL in a short amount of time by a few people actually decreases the scoring thus it will be less visible, and visible for a shorter period of time

nyco: by any people or just by logged-in HN members?

so, here's a tought: perhaps we shouldn't try to affect the ranking at all, and let the actual algorithm do its thing? :)

Guus: no, we need a blackhat SEO to make XMPP more prominent.

Ge0rG, both

Guus, exactly, so say to people how they can reach it, do not push the actual URL

nyco: so by placing a ycombinator-link to, for example, slashdot, I can kill it?

that sounds like fun

yes

how broken is that?

Reddit has that as well, and so forth with Product Hunt, etc.

and that are probably the same people who complain about facebooks filtering

no, no, nooo, it is NOT broken, it is actually FIXING the click shemas!

no, I don’t get why clicking a link without interacting with the voting would have any effect

either positive or negative

that’s just broken

an enterprise asks all the employees to click "+" in a URL... that's a common practice, that must be fought

that’s a different story, I agree

but if I don’t vote, I think my click on the link should not have any influence

awesome! and you just told us to go click somewhere :D

+1 Guus

Guus, not "told", asked politely... and I have not given the direct URL, that's the point

"go click yourself!"

jonasw, -1

nyco: only to trick the system

potatoes potatoes :D

you would’ve given the URL if it wouldn’t affect our score, right?

Ge0rG: click the button?

jonasw, no, that's a "if you want/can"

jonasw, that was not a "do that"

I don’t feel that makes a huge difference

but then again, I’m allergic to viral marketing

that is a little polite push, not a massive fraud

nyco: we're not discussing the manner in which the question is asked, but the fact that it's an artificial attempt to influence a score.

jonasw, it is not about what you feel, it is about the algo behind

"Die Grenzen sind fließend.", as we say in germany

jonasw, which means?

"the line is blurry", probably

fluent borders

?

ah, that makes more sense :)

wow guys... we cannot win...

I don't consider myself to be in a competition

<-- most aweful marketing person *ever*

sure, but the other guys will win

oh, I am.

Guus, that's the point

we massively lack marketing at the XSF

nyco: I agree that some marketing is important. I disagree with manipulating scores.

so don't slow it down when we attempt to fix a little the awfulll situation that we are in

I’d like to know what kind of marketing daniel did to make Conversations fly actually.

a little openness guys...

oh, waqas, you’re around. do you have a minute to take a look at XEP-0390? https://xmpp.org/extensions/xep-0390.html

Conversations does not fly, it has 10 to 50k downloads on Play Store

yeah, again - i'm not in an aweful situation. I get to do cool stuff - I could not care less if it's used by 10 or 10,000 people.

also he gets out of the building quite often: Twitter, blog posts, events/slides

nyco: that’s pretty flying

but hey, I won't stop anyone from promoting XMPP either :)

jonasw, WhatsApp and FB Messenger are above a billion, a billion

I know

but the network effect isn’t linear either

I think that Daniel primarily build a pretty good client.

at 50k you don't get any network effect

which made him stand out.

promotion won’t fix anything unless we can provide people with software which doesn’t suck though

5 years ago you could reach critical mass at 1 million, now it is rather several millions

jonasw, That. Let's do that now.

I’m on it!

I have a paid amateur radio app on Play Store that's also in the 10k-50k bin. It's the #1 app for its use case though, and people know it.

I just ditched a class to be able to do some polishing on my client before I hand it in to Prototype Fund. which will also get publicity if it’s accepted.

Ge0rG: you also have a dice app I found out. I actually have that installed :D

jonasw: did you have it installed before you knew me?

ye

*yes

yay! I'm famous!

jonasw: I only wrote that app because there was a bunch of dice apps before, and they all sucked.

that’s the best reason for writing an app

perhaps we should do that for XMPP clients.

I’m on it.

I usually need a dice app because I forgot my dice, and not because I want to shake my phone like crazy.

when I’m not busy with website PRs :-)

(obligatory xkcd reference in 3, 2, 1 ...)

Ge0rG: seriously?

Guus: this is also why I got involved with yaxim... back in 2009

jonasw: yeah.

oh-kay, so do those people also write SMS by moving their phone like a pen?

presumably, yes. If you can write them the app to do that.

I'm sure there is a market for that.

s/sure/afraid/

Afer all, ICQ got famous for using a typewriter click sound on each key press

there are terminal apps which do the same

jonasw: I'm skimming through XEP-0390, it seems sensible at first glance

thanks for taking a look!

jonasw: I'll later try to implement this in simple code, which would help think through any edge cases

that’d be awesome

"if I didn't find anything I don't think that would be enough to count as evidence that problems don't exist." <-- I think Kev was just dethroned as the king of double negatives :)

I fail to parse that

I haven't had enough coffee yet to even try

Don't see anything wrong with that sentence.

my parsing suggests to add a ", but" behind "anything" to make it readable

I don't think I would say that I don't see anything wrong with that sentence, but that doesn't mean any problems exist in it.

"I have only proved the sentence correct, I have not tested it"

Does it compile?

EMORECAFFEINE

hey, do we have stats/traffic numbers on the xmpp.org website?

I'm not seeing an obvious tracker in the source of the pages (like google analytics). Unsure if we generate statistics from the access logs.

Nothing says "Privacy-focused" like Google Analytics

Nothing says "Privacy-focused".

sorry. You did. :)

and https://xmpp.org/

I sit corrected.

Zash: what about embedding ajax.googleapis.com? :-)

Zash: is https://prosody.im/chat/ that chat.tar.gz thing?

yes

Zash: any comments on https://github.com/xsf/xmpp.org/issues/101 ?

I'm still sad that Candy isn't as maintained as it should be

I tried the Candy demo again recently, it just said "Connecting" forever so I gave up

(where "recently" == "just now")

We run Candy at www.igniterealtime.org/support/group_chat.jsp

SamWhited: Seen mod_candy?

It has quircks, but it's usable.

nicknames seem to be fixed anyways

Has the issue been fixed where if I join as both "Zash" and "zash", one gets ignored?

"username already in use"

there is an SPA version of Converse.js at https://github.com/jcbrand/inverse.js which is even-more-beta

unsure - there are many oddities. One of my biggest gripes with Candy is that it dies (without letting the user know) on any uncaught error.

which gives people the impression that no-one is responding.

My main gripe with Candy were the XHTML-IM security issues…

waqas: I disabled XHTML-IM in our instance - it introduces instability

Good

so those might still be in there

they do appear to be escaping things properly and not sticking stuff in attributes now at least; do they support XHTML-IM? Regardless of how good things are otherwise, as far as I'm concerned that is a security risk in and of itself.

they support it, but you can disable the support

and/or not enable it - I'm not sure anymore, it was a long time ago

What's the use case we are talking about? single-page anonymous access to a MUC?

Yup

then maybe prosody's chat is the way to go, with some fancy CSS around it

jonasw: buggy has a question mark behind it, mainly because it's just a tarball on a web page that hasn't been touched in years

Mainly because nothing has really changed in terms of requirements

Candy seems okay now (at least, the way I think I got it last time has been fixed), but I have gotten it to execute arbitrary JS in the past. Prosody's web chat is literally the only one that I don't think I've been able to inject or otherwise break too badly.

only one out of the ones I've tried, obviously.

SamWhited: Same. And I'd tried many, including ones without xhtml-im and desktop clients...

*nods*

I'm not sure the tarball reflects what is actually used either

It's fairly easy to style too; eg. https://muc.mellium.im/ for a project that doesn't actually exist that I will launch one day.

for the record: i think you guys are overly cautious. I'd rather go with a well maintained project than a dormant one.

but, if we can pick any one client, i'm happy to go with that.

I'd rather go with simple and low footprint for attack over anything else; but maintained would be nice too.

if the prosody devs would make it a real project, with an issue tracker etc, it would instantly lift off

I think that any client has a decent amount of complexity, and vectors of attack - perhaps not that one that we test for now, but eventually, something will be found.

as it is, one could get the impression it is an unmaintained student project that was dropped on a web page a decade ago

Ge0rG: Who would maintain it in that case?

I'm curious how much demand there is

Ge0rG: Someone did that, then added tons of broken features and then forgot all about it.

Yeah, I think the main concern would be scope creep. It was designed to be one simple thing: provide users with chatrooms anonymously. Stuff like admin-tools, etc were out of scope.

I'm okay with the feature scope, but I need to think of it like an admin: if I install it onto my machine, I need some way to update it, monitor for CVEs etc.

As it is now, it doesn't even have a name

"Chat"

Have you noticed how our issue tracker is called issue tracker?

Zash: "chat.tar.gz" rather?

"chat tarball" — good name, I like it!

jonasw> Zash: is https://prosody.im/chat/ that chat.tar.gz thing?

let's call it "that chat.tar.gz thing"

:D

TCTGZT

catchy

Chatty McChatface, please.

The Client Formerly Known as chat.tar.gz

chat tarball… chatball.. magic chatball! It's perfect!

Guus: +1

so... after a year and a half, let's pick a webchat client.

who can create a PR that introduced Chatty McChatface?

introduces*

*That Chat.tar.gz Thing

Watch out, it's that chat.tar.gz thing!

... anyone?

Ge0rG, in your post about Chatball (which I hadn't seen before) maybe mention mod_muc_ban_ip in the Prosody config part as a side note

MattJ: I'm not sure what I should say about mod_muc_ban_ip in there

Guus, I guess I could

Thanks mattJ!

for reference, we've been tracking the effort in https://github.com/xsf/xmpp.org/issues/101

BOSH endpoint?

or WEBSOCKETS

I don't think there's currently one on xmpp.org, unless I'm mistaken

I possibly still have SSH access there so I could set it up

MattJ: Can I convince you to get rid of mod_muc_log_http?

and replace with?

mod_http_muc_log :)

MattJ, could you arrange that with the powers-that-be in the infra team (Kev, Intosi, Tobias, others?)

Unless I was quietly kicked out, I think I'm still a (dormant) member of iteam :)

Haven't worked on it for at least a year though, I reckon

Could you arrange that with yourself then? :)

I'll do whatever is necessary to make the web chat work, and I won't stop till I'm done!

But first, meetings...

Close shave.

that reminds me, I need to go to the barber.

any opinions on that one? https://github.com/xsf/xmpp.org/pull/302 I didn’t even know that page existed…

am I the only one who can't click on the menu items on xmpp.org?

worksforme, but I have 1st party JS enabled

you're not the only one; anytime menus are made with javascript bad things happen.

it also works without though

jonasw: hmm 100k users

Doesn't jabber.org have on the order of 1M users?

I do have JS enabled, the menups properly pop up and show the link, but clicking only makes the menu collapse, on Chromium 57

jonasw: I was somewhat unsure of that one too. I can't find any references to it on wikipedia (english nor italian)

Ge0rG: all items or only specific ones?

not sure if that proves anything.

jonasw: all items. I can click on the menu itself, and then click through from that category page

Maybe the number of users column should go away since it's a thing that will change and probably hard to verify anyways?

Maybe the page should die in a fire before it becomes used for marketing

SamWhited, sure.

Zash, sure.

what Zash said

Like how XEP support pages usually end up

Guys - make it so.

remember to check for links to that page before burninating it

I’m not available for any website patches anymore today, EBUSY

(perhaps dropping the table instead of the entire page would be a good compromise)

chatme is on the xmpp.net list already, so duplicating it on that page seems weird to me

Maybe that page should only list XMPP-based services that are not XMPP servers?

but I'm fine with killing it as well

it advertises WhatsApp!. kill it with fiiiiireeeeee. (well, okay, it may make people think "uh, whatsapp uses XMPP, maybe it isn’t *that* bad)

A clearly defined purpose / scope would be good

jonasw: "it isn’t *that* bad" - WhatsApp or XMPP? :P

Ge0rG: your choice

But HN says that WA is no longer XMPP

jonasw: I take "neither".

Zash, It hasn't been in ages, though. Question is whether it's still fundamentally based on XMPP or not.

As in, "they switched to Signal Protocol", which doesn't even make sense

I haven't seen any credible proof that it's not still "FunXMPP"

I don’t care either.

https://twitter.com/backlon/status/845327874928238593 -- did i miss the obituary notice?

fippo: No, you've forgotten about it because it was soooo long ago

https://q.zash.se/86ed5344ab0a.txt .. seems Facebooks XMPP isn't entirely killed yet either

https://twitter.com/markb/status/845328381117956097 ... hrm... brb, I need to ask someone about this...

i need help, i tried to read RFC6121

about IQ stanzas

when using in band bytestream

can it make sense to adress the stanzas to a barejid?

where does the server route such an iq stanza

im terrible with the whole filetransfer thing

that doesn't make sense. you need to figure out the full jid of someone before sending them a file

thats what i thought

the xep also has only examples with full jid, but it is never mentioned explicitly that stanzas have to be adressed to full jids

maybe because its obvious

https://xmpp.org/rfcs/rfc6121.html#rules-localpart-barejid

> For an IQ stanza, the server itself MUST reply on behalf of the user with either an IQ result or an IQ error, and MUST NOT deliver the IQ stanza to any of the user's available resources.

so in an ibb there can never be a iq involved that is not adressed to a fulljid

In theory you could send the data in messages, but don't do that.

no gajim does not do that

Okay?

https://xmpp.org/extensions/xep-0047.html#message

thanks zash, but we thats not an issue, gajim does not use messages for ibb

I don't understand

I'm saying that the XEP says you can if you really want.

my question was about IQ stanzas and ibb, you posting of the rfc was the help i needed

official announcement is out, gtalk will be officially killed off this summer

arc: it's more akin to a merciful finishing off isn't it? It's better than staying running as broken as it is and giving xmpp a bad name

Most people think it's already turned off