XSF Communications Team - 2019-02-26

I still want to create a pubsub module for converse.js that can be used to add comments to a website

Just don't have the time at all 😢

jc, yeah helping on that pubsub thing is also in my todo somewhere. That would force people to get XMPP accounts, so we also need to work on the onboarding story I guess

Converse already supports OAuth login, so that could be extended upon to make it easier for people to comment

Hmm, would that application be attached to the blogger's XMPP server or sth?

Could provide a hosted service and if people want to set it up themselves they can as well

How does the OAuth thing work? You can limit authorized providers right?

yes

Ok. That would still mean duplication (of accounts) I guess, if some people use the hosted service, and some others use self-hosted services. People using oauth would create accounts on all of these instances

*confusion ensues*

Not if federation is enabled

How do I know as a self-hoster what is the identity authority for the guy using oauth?

Why do you care?

If you're federating you don't have anything like that for other XMPP servers

I don't understand

You need an XMPP server which supports OAuth login, so ultimately it is still an XMPP account

Sure

And if you federate, then there's not much difference between an OAuth account or a normal account

There is

Well

Ok we're not aligned here

Ah, you mean the client doesn't allow all authority providers

well, then that's the way it is

No I'm saying,

HosterA, HosterB, Github, userA. userA first creates an account at HosterA using their Github identity,

They now have access to AccountsA

userA goes to HosterB, do they create an account? What if they don't understand anything at XMPP and they just try to login using OAuth again, creating AccountB on HosterB

How does HosterB knows in the first place that AccountA is even a thing

Depends on how HosterB is set up

But yes, it could happen

That's why I was talking about account duplication, federation or not

Or you'd create another big node of users, that hosted service

Comments aren't federated currently anyway, so either you have a centralized account on Disquss, or on each site that uses its own comments you have a new account

If you look at things on the web, that's true

If you look at things done in XMPP currently, that's less true

Yes, I was thinking of having a de facto XMPP server handling OAuth accounts, and people could delegate to that

And if they really want to self-host OAuth accounts, then they can, then there's account duplication

Well the best would be for github to have their own xmpp server ✏

Best, yes and no

The way I set up OAuth is for each OAuth provider to have it's own VirtualHost on the Prosody server

That would be yet another huge hub of users

And you could configure converse.js to use those hosts by default

Rigth ✏

That doesn't really solve my problem, but then I don't know if much can be done for that either

what is your problem?

Having all users at the same place?

SouL, that's a problem that arises while trying to solve my problem :/

My first issue is,

I would like userA to be able to reuse the first account they created on HosterA, while not especially being XMPP-savvy ✏

That's fine, as long as the client is using the default configuration

Then it'll route Github logins to the right XMPP sever

And I don't want to limit userA to the one big hoster out there

Well, that's really the issue 🙂 In that case, they shouldn't use OAuth, and 99.99% of the people who use OAuth wouldn't care about it IMO

True..

By using OAuth they're indicating that they don't care

But then,

Do "we" the community "design" somebody who's going to play the github identity provider? :/

Because that's essentially what you're saying no?

I'm not thinking of doing this for the XSF

sure, XSF or not

This is a personal project, and maybe I can charge for hosting

And I'd be happy to work with people on it

Since I'm overloaded as it it

Since I'm overloaded as it is

Yeah that's also something I'd like to work on tbh

It is something we need, so..

I'm looking for sustainable ways to work on Converse.js, and that means generating income

Not just for me, but for everyone involved of course

One other thing, you say "as long as the client is using the default configuration, then it'll router Github logins to the right XMPP server", that means you expect self-hoster to also route github logins to that one big hub?

pep. Well, once you have time, let me know and we can discuss how to go about it

pep. Unless they configure the client to not do it

It's the default

Most people want to allow people to log in with OAuth, because most bloggers want to lower the barrier to entry for spam

Most people want to allow commenters to log in with OAuth, because most bloggers want to lower the barrier to entry for spam

Most people want to allow commenters to log in with OAuth, because most bloggers want to lower the barrier to entry for comments (haha

Most people want to allow commenters to log in with OAuth, because most bloggers want to lower the barrier to entry for comments (haha)

Freudian slip

:D

I was thinking about spam

Ok, so really the identity provider I'm trusting is BigHoster, not Github

You're trusting BigHoster, but I'm not sure it's correct to call it the identity provider

Github is the identity provider

In the case of XMPP it isn't. as self-hoster if I have them create an account on bighoster, I'm trusting bighoster :P

I don't even have to know about github

You're gonna have an order of magnitude more spam from normal XMPP accounts, than from OAuth/BigHoster accounts 🙂

true

Yeah it's not a case of "I'm worried about spam"

what are you worried about?

Just trying to understand and make things clear

Trust is always an issue :P

Any other XMPP server you're federating you have to trust

BigHoster is just another one

Any other XMPP server you're federating with you have to trust

True

btw, unrelated, these 4 messages above were supposed to be LMC?

Yes

I only got the first one corrected

20:40:59 jc1> Most people want to allow commenters to log in with OAuth, because most bloggers want to lower the barrier to entry for spam 20:41:07 jc> Most people want to allow commenters to log in with OAuth, because most bloggers want to lower the barrier to entry for comments (haha 20:41:09 jc> Most people want to allow commenters to log in with OAuth, because most bloggers want to lower the barrier to entry for comments (haha)

Bug in poezio 😛

Impossible!

Oh, Converse.js allows editing earlier messages than the last

Could be that

jc, poezio too.

nah, poezio should also

jc, my guess is that you corrected the first id three times, while poezio replaces the entire message with the correction as per the XEP, including the id.

Link Mauve: that sounds right

So Converse is not spec-compliant?

:P

I don't actually see that the XEP says this explicitly

Link Mauve: Can you quote where in the XEP this is said?

Hmm, “It is expected that the receiver SHOULD then treat the new stanza as complete replacement for all the payloads received in the original stanza.”

That may mean only payloads, and not attributes of the outer message.

But then, why?

why what? What this SHOULD?

I guess it's mostly for consistency?

Well well well...

😛

Should I make a bug report for Poezio? 😉

Booom

Haha

jc, or a fix to the XEP to specify that the stanza replaces the old one, period?

I'm not sure that this is better...

err, do you really want to do that?

pep., that’s what we do yes.

They all replace the original stanza

I can see arguments for both ways of doing things

It avoids having to go back in the history tree up to the root stanza and modify it again.

What about all other payloads in the stanza? That means you can remove anything outside of <body/>?

(well it's already used for xhtml-im etc., I guess, and also omemo, pgp, and whatnots)

Or wait no, not OMEMO

Or at least it shouldn't, privacy [blah blah]

pep., yes, all of the payloads, and here I argue that it should also replace the attributes of the stanza.

That's not generally something I'm really fond of, mutability :x

Also, "hijack commteam@ for your new pet bug 101", available today in your syllabus

Nothing we've talked about this whole conversation is relevant to this MUC

True

"How to put XMPP MUCs to good use"

So.. open a bug on poezio, and converse, with a "This needs to be resolved by trial by combat on standards@"?

Well, Converse is spec-compliant as it's currently written

xD

jc, https://lab.louiz.org/poezio/poezio/issues/3462 :)

😇