XSF Communications Team - 2018-11-30

arnaudj I'm writing the newsletter currently, will ping you once I'm done, if you'd like to translate

hi jc‎ !

thank you for pinging me!

Sure! 🙂

what is the estimated date of publication?

Today, this afternoon

We always publish on the last Friday of the month

"always' being interpreted loosely

OK :-)

Sorry that you don't get much time

Ideally we should write the newsletter throughout the month

no problem

That would also make it easier for you and require less crunch time at the end of the month

but so far I haven't been able to get into the habit of doing it like that

By nature I procrastinate until the last minute

What I wanted to add to this newsletter

was to mention the section of translated newsletters

I also wanted to translate some, so we would have more content

apart from French

I've added a reminder in my calendar, to put some time aside every last Friday

cool

Would you guys describe Movim as an XMPP client?

Or should it be mentioned under "Other software"? 🙂

I'm adding this month's releases

jc‎: I asked edhelas‎

tx

This has been a good month, lots of stuff happening

he said "other" is perhaps the best choice

since it's a bit more than a client

ok thanks, I thought so

arnaudj, SouL: Here's the latest newsletter https://github.com/xsf/xmpp.org/blob/newsletter-2018-11-30/content/posts/newsletter/2018-11-30.md

I would appreciate a proofread. I'll take a break and then read it again myself

THe Monal..

Just that capital H

jc, the link in the Monal part to "empty state screens" appears to have the incorrect URL

It links to feeds.opkode and prompts for auth

Thanks SouL and MattJ. Fixed

Sorry for not better proofread, I'm ina meeting I can't escape :(

no problem

Guus is worried about this section: https://github.com/xsf/xmpp.org/pull/484/files#diff-45ce3b70f855ee8884f189d7b4742fa6R28

That it might look like XMPP is insecure, even though their server might have been hacked in all kinds of ways unrelated to XMPP

Any suggestions on how to change the wording?

I personally think it's kind of OK the way it is

jc: are you sure iron chat is a conversations fork?

It doesn't look like that at all

I read it in twitter

I can remove that part

jc, the problem was users not verifying fingerprints, at the end of the day

MattJ: Yes, that's mentioned in the paragraph

That and the fact that their server (the OS) was somehow compromised

Every end-to-end encryption method is vulnerable to this (you need to identify the other end somehow)

No, I don't think that covers it

I read the newsletter and did not find any error

OTR and OMEMO are precisely valuable because they can remain secure in the event of server compromise

In theory 🙂

Wasn't there an essay by a gchq guy recently who proposed to make mitm the new standard way of intercepting comms?

But as was shown here... users don't verify so they get compromised

jc, in practice, if users verify fingerprints

I think the fact that the server was compromised is relevant though

Because it's a necessary (but not sufficient) first step

In practice, they don't. And I think this is the point that should be called out in the newsletter, the server compromise is not the weak point

Ok but did you read the paragraph? I do mention that they didn't verify

As far as preventing any perception that XMPP is insecure

I can update it further

I'm being called for lunch now though 🙂

Oh, I didn't see that when I read it earlier

I'll work an an alternative proposal for that paragraph

Another source online says IronChat was based on Xabber

iirc the Xabber author confirmed this in xsf@

"jc> I think the fact that the server was compromised is relevant though" < I think it's very important to specify that, if this gets in the newsletter. Not verifying fingerprints is one thing and we know users don't care anyway but still want e2ee [blah blah], but if the server wasn't maintained by an $evil party in the first place, they would have had to break TLS. (or use the law) ✏

As I understand it the police (or gouvernment entity) controlled the server right?

pep. yes