XMPP Council - 2013-03-20

01:04:44 m&m has joined
01:15:24 Tobias has left
01:22:57 Zash has left
01:59:10 m&m has left
06:55:59 Tobias has left
09:11:34 Tobias has joined
09:16:25 Tobias has left
09:16:28 Tobias has joined
09:35:07 Tobias has left
09:36:11 Tobias has joined
10:40:48 Tobias has left
10:48:48 Neustradamus has left
10:53:43 Neustradamus has joined
11:51:31 Tobias has joined
12:49:02 Neustradamus has left
13:02:52 Neustradamus has joined
13:14:22 Zash has joined
13:31:14 Kev has left
14:04:03 Peter Waher has joined
14:21:07 Kev has left
14:24:33 Kev has left
14:28:00 jabberjocke has joined
14:31:33 Kev has left
14:36:35 Neustradamus has left
14:40:10 Neustradamus has joined
14:41:37 Peter Waher has left
14:41:55 Peter Waher has joined
14:42:36 Peter Waher has left
14:42:46 Peter Waher has joined
14:44:02 Tobias has joined
14:44:38 m&m has joined
14:57:28 fippo has joined
15:07:32 MattJ has joined
15:08:30 Tobias has joined
15:24:07 Peter Waher has left
15:57:12 m&m might be a tad "late"
15:57:20 m&m or unfocused right at the start
16:00:36 Kev OK.
16:00:41 Kev I'm *still* reviewing stuff.
16:01:29 Dave Cridland has joined
16:02:30 Dave Cridland Kev, Anyone would think you were busy these days, for some reason.
16:03:00 Kev How little they would know.
16:03:16 ralphm has joined
16:03:44 Kev Right. 'tis time.
16:03:46 Kev 1) Roll call.
16:03:55 yusuke.doi has joined
16:03:58 m&m present physically
16:04:14 m&m er … logically
16:04:27 ralphm hey
16:04:40 ralphm from pycon
16:04:44 Kev Ah.
16:04:48 Kev Hail, pycon.
16:05:15 Kev MattJ / Tobias?
16:05:27 MattJ Present
16:05:32 Kev Tobias is auto-away, I can tell because Swift has put a Zzz icon over his avatar :D
16:05:53 Kev Right. So let's start.
16:05:53 MattJ Does that mean he's asleep?
16:05:58 Kev Probably.
16:06:20 Kev 2) Let's start with the completely uncontentious one. LC on 220?
16:06:26 MattJ +1
16:06:39 m&m +1
16:06:40 Kev I'm +1
16:06:44 ralphm yea
16:06:56 Kev Magic.
16:06:58 m&m as I work on making db irrelevant (-:
16:07:05 Kev 3) 308 to Draft?
16:07:28 Kev I have, I believe, addressed all the LC feedback in one way or another.
16:08:01 m&m I think so, too
16:08:04 m&m I'm +1
16:08:09 ralphm +1
16:08:21 MattJ +1
16:08:30 Kev Amazing.
16:08:46 MattJ That wasn't the contentious item, was it? :)
16:08:50 Kev 4) http://xmpp.org/extensions/inbox/dtls-fingerprint.html Accept as Experimental?
16:08:51 Kanchil Kev: http://xmpp.org/extensions/inbox/dtls-fingerprint.html: XEP-xxxx: Use of DTLS-SRTP in Jingle Sessions
16:09:00 m&m no objections
16:09:15 Kev I know nothing about the subject matter, but that presumably just means I have no meanginful objections.
16:09:23 Kev Or spelling.
16:09:38 Dave Cridland I thought we had something like this already.
16:09:45 Dave Cridland Or was that ZRTP?
16:09:50 m&m ZRTP, IIRC
16:09:54 Kev ZRTP.
16:09:59 fippo dave: 0262 -- dtls is significantly different
16:10:08 MattJ I've no objections so far, but that's likely because I only saw the document this morning and haven't read it through yet
16:10:31 ralphm No objection
16:11:15 Kev 5) http://xmpp.org/extensions/inbox/roster-management.html Accept as Experimental?
16:11:16 Kanchil Kev: http://xmpp.org/extensions/inbox/roster-management.html: XEP-xxxx: Remote Roster Management
16:11:31 Kev I have assorted issues with this, but I don't think they're fundamental to the design, they just need maturing on the vine.
16:11:44 Kev I think fundamentally "use iq:roster" is right.
16:11:54 m&m I haven't read it yet
16:12:10 MattJ I'm +1
16:12:26 MattJ It does have questions, but it's implemented in places and working
16:12:36 ralphm No objection
16:12:49 Kev I read something that I thought was broken, but I don't remember what it was. But I'm not objecting anyway.
16:13:01 ralphm heh
16:13:08 Kev It wasn't show-stopping.
16:13:16 Kev m&m: So, a fortnight for you to object :)
16:13:35 Kev 6) http://xmpp.org/extensions/inbox/sensor-data.html Accept as Experimental?
16:13:36 m&m I'm not objecting now
16:13:36 Kanchil Kev: http://xmpp.org/extensions/inbox/sensor-data.html: XEP-xxxx: Sensor Data Interchange over XMPP
16:13:37 m&m (-:
16:13:42 Kev m&m: Noted, ta.
16:13:57 Kev This was the last on my list, and I've not got to it yet. Objections, or lack thereof, within a fortnight.
16:14:18 m&m I glanced over this earlier … no objections
16:14:44 ralphm No objection
16:14:51 MattJ I've no objection to accepting
16:14:57 MattJ I think it needs some work though
16:15:04 ralphm indeed
16:15:17 Kev I'd encourage people to post comments to the list :)
16:15:22 ralphm but I like people are working on this stuff
16:15:27 Kev In fact, not only would I, but I do!
16:15:37 Kev 7) http://xmpp.org/extensions/inbox/exi.html Accept as experimental
16:15:38 Kanchil Kev: http://xmpp.org/extensions/inbox/exi.html: XEP-xxxx: Using Efficient XML Interchange (EXI) Format in XMPP
16:15:45 MattJ Yay!
16:15:58 ralphm I haven"t looked at the exi stuff yet
16:16:08 Kev I have some issues with this.
16:16:17 Kev I'm trying to work out if they're sufficiently fundamental to object or not.
16:16:32 Dave Cridland I'd note that while I think EXI may be mature enough (and useful enough) to consider now, I don't think this fits as a compression mechanism - ie, within the XEP-0138 model.
16:16:32 ralphm right
16:16:47 Kev I /think/ that at least none of this stuff can happen pre-auth.
16:16:55 MattJ Dave Cridland, because of bootstrapping?
16:16:59 MattJ Kev, why not?
16:16:59 Kev (And pre-TLS)
16:17:04 m&m dwd: I agree with you
16:17:08 Dave Cridland MattJ, There's some negotiation going on, and all sorts.
16:17:10 m&m also http://www.quickmeme.com/meme/3tfmdg/
16:17:11 Kanchil m&m: http://www.quickmeme.com/meme/3tfmdg/: Southpark Instructor - if youre going to compress after encryption youre going to
16:17:30 ralphm Dave Cridland:how would you use it, roughly?
16:17:31 Zash m&m: haha
16:17:39 Kev MattJ: Because you're sending assorted stuff to the server
16:17:49 Kev m&m: Negotiation and layering don't need to be equivalent.
16:18:07 Dave Cridland ralphm, What, use EXI? Or use EXI within the context of XMPP?
16:18:12 Kev But you need to have verified the server's identity before you're going to be willing to download schemas.
16:18:19 Kev And similarly it'll need to have authenticated you for the same.
16:18:35 MattJ Good point
16:18:43 m&m right
16:18:47 ralphm Dave Cridland: latter
16:18:55 Kev I do understand the basic principle that compressing data that's indistinguishable from random is a Really Good Idea.
16:18:58 Dave Cridland Kev, I'm not sure that's true. You can exchange which schemas you're willing to support for compression without security risk, I *think*. Not sure though.
16:19:18 Dave Cridland ralphm, I think it's possibly a new binding, as PSA discussed.
16:19:23 Kev Dave Cridland: If I MITM to add somehow malicious schemas, and you download them after auth, that still seems bad.
16:19:32 ralphm right
16:19:50 Dave Cridland Kev, I don't know - the data is still authenticated, it's just it may be compressed in odd ways.
16:20:23 m&m I could be wrong, but the compression could be to the point where a MITM could inject a schema that fundamentally changes the data
16:20:29 MattJ You could start with a common mandatory schema for auth, and negotiate others after TLS+auth
16:20:49 Kev I'm at least not sufficiently knowledgeable on this to be confident that it's not introducing some really nasty issues.
16:21:05 MattJ Nevertheless, I don't object to accepting it
16:21:12 MattJ I think it would be good for people to poke at it
16:21:23 MattJ Enough are interested that I think it'll happen
16:21:38 m&m exactly
16:21:46 MattJ Though "enough" are a vocal minority I think :)
16:21:54 Dave Cridland Right, I'm not sufficiently knowledgeable either. But I do think this is generally wrong; a "pure" EXI binding seems the appropriate construction.
16:21:55 Kev I'll hold off for today, and get my thoughts in order within the fortnight.
16:22:13 MattJ nod
16:22:22 m&m dwd: that's my feeling, too
16:22:30 Dave Cridland FWIW, I note yusuke.doi is present and might have some opinion.
16:22:42 yusuke.doi Hi, am I allowed to speak?
16:22:46 Kev yusuke.doi: Of course.
16:22:47 ralphm yes
16:23:00 ralphm Dave Cridland is not on the council, either
16:23:35 yusuke.doi Thanks. I believe this proposal should be discussed more, either in experimental state or pre-XEP.
16:24:16 ralphm having it on the list wouldnbe awspme
16:24:30 yusuke.doi I have no clear opinion to accept or not, but I feel this proposal have slight variation from 'regular' EXI.
16:24:32 ralphm yay lag and tablet
16:24:47 m&m yusuke.doi: ??
16:25:17 m&m that's a little concerning to me … XMPP already abuses XML stacks enough
16:26:09 yusuke.doi m&m: I see :-) If it's okay for the committee, I don't object.
16:26:10 MattJ m&m, for that suggestion I'll deal with you later :)
16:26:30 Kev So, I think we need to take this to list. I'll try and post something soon, and see if I can form a sensible opinion within a fortnight.
16:26:48 ralphm yeah
16:26:48 MattJ Sounds good
16:26:51 fippo m&m: shall i propose a asn.1 binding for xmpp? :-)
16:26:59 ralphm sure
16:27:04 m&m my problem is that I don't understand EXI enough to feel comfortable commenting
16:27:08 Kev I'm not fundamentally opposed to the idea of EXI for XMPP, at least.
16:27:10 yusuke.doi You need to invent namespace in asn.1 :-)
16:27:17 ralphm and a protocol buffers oene
16:27:21 Kev Right. I think we're done.
16:27:29 Kev 7) Date?
16:27:29 m&m protobuff!
16:27:34 Dave Cridland yusuke.doi, X.693
16:27:37 Kev 8) Date, rather
16:27:38 Zash JSON!!
16:27:47 m&m next week works for me
16:27:49 ralphm sbtsbc
16:27:53 yusuke.doi Dave Cridland: Thanks
16:27:55 MattJ wfm
16:28:00 Kev OK.
16:28:03 Kev 9) AOB?
16:28:13 MattJ nack
16:28:22 m&m the IETF meeting was rather uneventful
16:28:25 ralphm glad about per's message
16:28:31 m&m mostly because it was the very last session of the week
16:28:37 m&m and we were all brain-dead
16:28:50 MattJ I noticed :)
16:29:16 Kev OK, that's it then.
16:29:18 Kev Thanks all.
16:29:20 m&m someone has to be the sacrificial goat; RAI likes to rotate which group that is
16:29:23 MattJ Thanks Kev
16:29:26 yusuke.doi Thanks
16:29:28 ralphm people at pycon are really cynical about Google's plans with XMPP
16:29:35 Kev bangs the gavel.
16:29:48 m&m I just want to know I think EXI for XMPP is interesting, but I'm not sure this is the right a approach
16:30:00 Kev ralphm: Oh? This because of the somewhat political "Google Bad, Mkay" thing prominent people have done this week?
16:30:11 m&m ralphm: I can't blame them
16:30:32 ralphm yeah, many misinformed opinions
16:30:38 fippo ralphm: as long as google doesn't put jarkko (the irc guy) in charge there is no reason to worry :-)
16:30:45 ralphm hah
16:31:39 m&m no comment (-:
16:31:56 ralphm google reader thing and caldav didn't go over well, and then this came up
16:32:32 Dave Cridland CalDAV isn't being dropped, though.
16:32:57 Zash Just require you to be whitelisted to access?
16:33:03 Dave Cridland I'm told that it's being moved to an Oauth2 based service, but the transition just happens to be a bit rough.
16:33:34 ralphm well that's entirely different from what they wrote themselves
16:33:35 Dave Cridland Once it's OAuth2, it will have per-application keys, though I don't know the details.
16:33:37 yusuke.doi m&m: I'd like to propose different port approach for EXI with XMPP soon.
16:33:59 m&m yusuke.doi: that sounds like the alternative binding route … which is probably the right approach
16:34:15 ralphm in the announcement they said move to the google calendar api
16:34:33 yusuke.doi m&m: depends on use case (is the fair answer, I believe alternative binding should be better :-)
16:34:58 Dave Cridland ralphm, Yes, they did. I think the road to OAuth2 CalDAV is long and rocky.
16:35:27 ralphm ok, but communicating that would've been nice
16:35:32 ralphm oh well
16:36:01 ralphm gotta walk to sprints now
16:36:05 Kev Enjoy.
16:36:07 MattJ m&m, by the way - a question that came up after IETF: as an implementor, how would I actually use POSH? Am I supposed to fire off HTTPS requests every time I see an invalid cert?
16:36:10 MattJ See you ralphm
16:36:28 fippo mattj: i think so
16:36:35 MattJ m&m, or will we have a way in XMPP to hint that POSH should be used to verify?
16:36:39 m&m MattJ: or everytime you see a new domain
16:36:39 Dave Cridland yusuke.doi, I don't see nearly as many benefits for in-stream negotiated EXI, since you need a traditional XML parser, fallback cases, and so on. Feels all wrong.
16:37:08 Zash MattJ: Just as we would need to fire off a DNS lookup for DANE
16:37:24 MattJ Do both at the same time, and see which returns faster? ;)
16:37:30 m&m basically, yes
16:37:32 yusuke.doi Dave Cridland: Personally I agree. But Peter should have different answer
16:37:46 m&m Happy Eyeballs for Everyone!
16:38:04 MattJ Doesn't it essentially make everyone with a cert their own CA? :)
16:38:06 fippo mattj: you might even do traditional dial-back in parallel :-)
16:38:10 m&m it's the Oprah paradigm for protocols
16:38:22 Zash MattJ: DANE? Yes. :D
16:38:46 m&m DANE definitely does, POSH could depending on what other HTTP-based things you support
16:38:48 fippo even though i think that the samecert stuff might be faster than POSH (less secure though sincc it works with self-signed certs)
16:39:02 m&m fippo: dialback is not a prooftype
16:39:11 MattJ fippo, samecert?
16:39:39 fippo m&m: not for the ietf at least ;-)
16:40:00 m&m fippo: not for anyone that actually cares about assurances d-:
16:40:06 MattJ Neither for Prosody, as of the next version
16:40:20 MattJ It's also an open question as to whether we allow dialback by default in the config
16:40:34 fippo mattj: open a reverse connection to the host, starttls, compare certificates. slighty better than 0185, less roundtrips
16:40:44 MattJ But either way it's motioning towards being called "insecure"
16:40:49 fippo m&m: well, 99%+ of server admins don't care
16:40:51 m&m wanders back to his day job responsibilities
16:40:59 MattJ fippo, ah, right
16:41:12 Zash !xep 185
16:41:13 fippo m&m: shall i point out that muc.xmpp.ogr was using an invalid cert until like two weeks? :-)
16:41:14 Kanchil Zash: XEP-0185(N/A): http://xmpp.org/extensions/xep-0185.html Dialback Key Generation and Validation - Informational/Active - Updated: 2007-02-15
16:41:33 MattJ fippo, it wouldn't have been if nobody could connect to it :)
16:41:41 MattJ Someone needs to jump first
16:41:47 m&m right
16:41:53 Zash Is samecert documented somewhere?
16:42:01 fippo yeah. that big hammer called "jabber.org" ;-)
16:42:09 MattJ fippo, well yes, there is that
16:42:28 fippo zash: dave had a blogpost describing it...
16:42:31 MattJ I was thinking of shipping XMPP servers, but jabber.org would be a better hammer
16:42:35 Tobias Kev, yeah..the zZz meant i was asleep..sry
16:42:42 MattJ or Google, but... meh
16:42:58 Zash fippo: orly?
16:43:08 Zash Dave Cridland: orly?!
16:43:33 Zash Wasn't that d-w-d, which iirc was about verifying certs as normal
16:43:48 Zash But in a dialback
16:43:48 m&m that's what I thought
16:43:52 fippo i think it descried samecert, too
16:44:16 Zash Dave Cridland: Your blog, when will it return to the land of the online?
16:44:31 fippo m&m: btw, DNA still needs a turbohalibut prooftype, otherwise that cridland guy will block it :-)
16:44:38 m&m goes off for more caffeine
16:44:48 fippo http://jabber.soup.io/post/88601075/Dave-Cridland-Dialback-Now-without-dialback -- cached version
16:45:28 fippo the third paragraph describes samecert
16:46:47 Zash And as I said at the summit, I'd like to see "If the SRV record is Secure, then the target name is acceptable in the certificate" in a standalone document :)
16:52:31 Dave Cridland Tubrohalibut. Mmmmm.
16:53:37 Dave Cridland Zash, So, my blog is more or less shot. I might resurrect it at some point. Or I might do something odd with having it semi-present and backed onto G+.
16:56:06 Kev nanoc!
16:56:25 Kev (Nanoc really does seem to be quite competent)
16:59:14 Dave Cridland It's really that I'm not sure I can be bothered having a traditional blog, rather than G+.
17:03:06 Zash It wouldn't be the same :(
17:03:30 Zash But then, I'm in the 'doesn't really want to depend on Google'-crowd.
17:04:11 fippo we should have recorded peters statement on open federation at the summit
17:09:58 Zash fippo: summary? not sure I recall
17:16:41 fippo zash: i don't recall exactly either :-( maybe webex was active and is recorded
17:23:23 MattJ One day I'll finish my blog
17:23:37 MattJ http://blog.matthewwild.co.uk/
17:23:37 Kanchil MattJ: http://blog.matthewwild.co.uk/: Matthew Wild's Blog
17:23:59 Tobias haha
17:24:00 Zash !
17:24:41 Tobias that reminds me of http://216.119.142.188/~jbwp/wp-content/uploads/2011/05/2011-05-01-Homer-Web-Page.jpg
17:25:01 Tobias but sure beats the design of my blog
17:25:17 yusuke.doi has left
17:35:31 Zash has left
18:45:38 fippo has left
19:00:32 Tobias has left
19:00:41 Tobias has joined
19:13:19 Tobias has left
19:13:47 Tobias has joined
22:03:51 Lance has joined
23:09:32 m&m has left
23:28:05 Lance has left