XSF Communications Team - 2023-02-04

Hi all, there is a problem, impossible to edit the new pad: https://pad.nixnet.services/oHnY_ZvLT8SoFyCqIC2ung

I think it's on purpose for this link

What's the issue

On https://yopad.eu/p/xmpp-newsletter-365days -> https://pad.nixnet.services/oHnY_ZvLT8SoFyCqIC2ung Here: "<emus> We have a new online pad, please only use the new one from now :-) https://pad.nixnet.services/oHnY_ZvLT8SoFyCqlC2ung" But it is locked by xsfcommteam.

And is there anything you want to correct? What's the issue with it?

It is locked by xsfcommteam, we can not edit.

What do you want to edit?

ouh, maybe i put the published link

lbocquet: thx

https://jabbers.one:5281/upload/gMg4IrRrw_c324umaxy4qTTN/20230204_121616948_80f3..jpg

I see the file content here https://pad.nixnet.services/oHnY_ZvLT8SoFyCqIC2ung

have you tried selecting the pencil? ✏

lbocquet:

Indeed, although I click on the pencil, I cannot write because the file results locked

https://share.nicfab.chat/upload/StiHsGUC45IS1cZ0yc81rhw4/sshot_2023-02-04_12.21.57.jpg

> I understand, we must to click on "Publish" https://pad.nixnet.services/oHnY_ZvLT8SoFyCqIC2ung/publish to open a new window and after click on the pen to edit... It doesn’t work

I understand, on https://pad.nixnet.services/oHnY_ZvLT8SoFyCqIC2ung, we must to click on "Publish" https://pad.nixnet.services/oHnY_ZvLT8SoFyCqIC2ung/publish to open a new window and after click on the pen to edit... ✏

I will check in a few minutes when I arrive at fosdem

Hi

Hello

https://indieweb.social/@joinjabber/109807298904396408 < https://joinjabber.org overhaul !

pep.: nice design, but at migrate.modernxmpp.org runs in your browser, right MattJ? So _"Please be aware that it currently requires your user-credentials to function, so giving those to an external service might be problematic for you."_ is FUD :) ✏

Here https://joinjabber.org/docs/servers/#migrating-accounts

It's never really clear to the user what happens tbh.. Unless they're tech-savvy. But sure we'll change that

The site, once opened, says as much.

Yes, a matter of trust.

So it's not FUD is it? :P

:)

We'll try to make it slightly less alarmist, but we're keeping the bulk of it

(just discussed in the JJ room)

pep.: danke/merci :)

I don't really know what to do about that. Yes, I made it safe, but no, I don't want to train users that it's okay to enter your XMPP credentials in any random web form

But it's just an in-browser XMPP client. It's no different to signing into Converse.js, xmpp-web or any other JS web client

Yes, MattJ I was thinking about that. Not sure how to train/explain that sometimes it can be safe but most of times it's not ¯\_(ツ)_/¯

Yeah. Also why I wouldn't want to propose a web client with account login

But, but..

Okay, so you would also warn users away from web clients, I was going to ask ✏

I mean I wouldn't want to personally host that

Because?

I don't know. Many people use web clients and are happy with them. Look at Mastodon..

It's a HTML file. Would it be better if people downloaded it and ran it from file://?

Even though really here you're using the client of the service hosting you

MattJ, for security purposes, definitly. For convenience no that would be terrible :P

(I don't think that actually works in modern browsers though)

Why is it better for security purposes? 🙂

hmm, you're right it may not be. It's the same issue.

Whether you load the code from the server or from your disk, it is the same code, right

Though.. you may only have to check the file once

Whether when it's served to you it can be different every single time

Okay, tell the users to check the source before they use it. And every app they install 🙂

Sorry, I don't have good answers

I don't either

And neither does anyone, really

Signed web apps would be nice

except the browser is completely controlled by the developer and has an always on internet connection

compared to local apps which dont have to have an internet connection and you can customize/override behavior

also at least you have the option to check the source locally. Thats why non-browser stuff should be reccomended most of the time

i wish we had migration built into the clients

It's like one could also host Movim locally :-°

yeah which would be better than in a remote data center

but not sure if its doable

Running Movim locally is absolutely doable

with docker whatever yeah

without it Im not sure if any person that starts to self host would be able to do it

Anyway, re the original sentence on the website, I think I'd want to make the user aware that they're giving away credentials and that there's no good way to make sure it's safe. But no clue how to do that without sounding alarmist of not scaring away many of them or the opposite, encouraging them to do so..

Well, do you want them to use it or not? 🙂

I don't think having a thing saying it's there but don't use it is really going to achieve anything other than confusion

Sure, but why would they trust me when I tell them "this one is ok" "this one isn't", and what if I'm wrong

"Trust no-one"

Wait so what about, hold on, _Migrate - the Electron App_? Only 144Mb /jk ✏

MattJ, which I know isn't also the best answer. Users be even more confused.

Even with a hypothetical Electron app, it changes practically nothing from a security perspective ✏

yeah

I don't have an opinion on whether you should link to it. I wrote it as a prototype, and last resort for people who don't have any other way to get/migrate their data. I hope it serves the needs of people who require it. I know it's secure, but I don't know any magical way to prove that to users, so... it just is what it is 🙂

If someone wants to wrap it in Electron, Tauri, or similar... go ahead. And/or pester client devs to implement the same thing into clients directly.

Best would be for operators themselves to host it

I guess, yes

agreed

Thankfully it couldn't be easier to do 🙂

(I don't understand ^)

I mean that it is extremely easy to do

So there are no barriers to operators hosting it

Yeah no, apart from them actually hosting it

MSavoritias (fae,ve): I run movim locally with just php. No docker, no web server or reverse proxy

You do need postgres installed but I apt install postgres on my workstation always anyway

I liked when sqlite was a thing

Sqlite is a thing. It's like the most popular thing in tech news the last year or so it seems

I mean for movim

But I wouldn't want to use it when I have a choice