Guusalso, we're currently rewriting all of the s2s code...
Guus(not doing dialback would actually save us a lot of time...)
ZashIn theory having multiplexing would be very nice, but in practice I've never seen that be used, except for that one time dwd tried and found a bug in Prosody.
ZashSo I've been leaning towards depoying XEP-0288 - Bidi instead and being happy enough with that.
Holger> I'd not be a fan, as it'd break backwards compatibility.
HolgerI think Tigase still doesn't support SASL EXTERNAL at all, for example. (Not entirely sure though.)
ZashAre any of the Tigase folks here or in jdev@?
jonas’fun question: those hosts which can only do dialback, what TLS version can they do?
jonas’is it likely that they will become unreachable "soon" either way because libssl drops support for that version?
GuusI don't think we should remove support for people that for one reason or another don't want or can't set up certificates. Dialback offers better security than no security.
GuusI can think of deployments that are deliberately not internet-facing, or have other reasons to not want to depend on Let's Encrypt
GuusAlso, everyone having valid certificates very much is an effect of one single organisation providing a service, I think. What happens if, for whatever reason, Let's Encrypt stops doing their thing (or stops being trustworthy)?
GuusTheir certificates are only valid for 3 months - having dialback as a fallback to a service that pretty much hinges on one organisation isn't the worst of ideas, maybe.
ZashI'm not a fan of this single point of failure either
ZashHowever it is the current reality
Guuswould making it easier to disable dialback be a compromise to be considered?
ZashI did word it as "phase out", meaning not instant.
Guussecurity-minded setups can then disable it, while others might opt to choose interop over security. It boils down to that question, right?
ZashFWIW it's pretty easy in Prosody already, just comment out that module.
GuusSure, not saying it wasn't 🙂
ZashNo idea about other servers, but if it's not easy then making it easy seems like a good idea.
GuusHaving given this 5 minutes of thought, I'd not be a fan of phase out Dialback though.
Maranda> Guus, Holger, other server devs: We Prosody devs have been thinking about phasing out Dialback, for reasons written down in https://issues.prosody.im/1471
> (Metarelated: We need that Hats XEP implemented)
Agreed with Guus phasing out DB is a horrible idea, I already more than once expressed my opinion on it
GuusI think it's good to discuss these things though. Thanks!
GuusMaranda : I never said it was a horrible idea.
!XSF_MartinZash: Didn't you recently talk about disabling dialback in prosody?
MarandaPlenty of cisco jabber deployments only do DB for example
MarandaAnd not sasl external
Maranda> Same here.
> I think Tigase still doesn't support SASL EXTERNAL at all, for example. (Not entirely sure though.)
I'm not sure if it doesnt support it for sure I never seen any deployment I know of using it with my server