XMPP Council - 2020-06-24

1) Roll Call

EHLO

302 Moved

Hi

no dwd?

fun, good thing I can chair

2) Agenda Bashing

nothing? perfect

I’ll still give you a moment, because my MUA is acting up a lot

and I’m trying to open the agenda I sent :)

ok, the MUA does not seem to want to fix itself, so let’s try without

3) Editor’s Update - Calls in progress - LC for XEP-0338 (ends on 2020-06-30)

(where "without" means I’ll be copy-typing from my phone)

4) Items for voting

4a) PR#963: XEP-0178: Clarify SASL-EXTERNAL specification when s2s auth fails URL: https://github.com/xsf/xeps/pull/963

Concerns were raised to the Mailing list about this opening up a downgrade attack vector, which I didn’t have time to look into yet, so on-list

is anyone still here?

Yeeeees

or did muc.xmpp.org fail for everyone except me?

I guess that reflects reality, but on-list.

You're live.

MUC reflection is a thing, isn't it?

Ge0rG, doesn’t help if there’s a very non-equally-distributed s2s failure :)

I'm on-list as well, but I'd appreciate input from people who are into server development and into SASL and dialback things.

I expect Zash to cover all that, except maybe being "into" dialback things.

> I guess that reflects reality

Except Dialback is very rare these days given the success of Let's Encrypt

LE doing dialback for us :-°

no comment from daniel?

Yeah, Dialback is equivalent ish to the verification LE does, so I don't think it's a downgrade attack

Sorry changing trains just no. Will read backlog in a second

if we assume that LE is being used

both fail under the assumption that the attacker is on the network path between you and the other party, right?

so this certainly looks odd, because it mandates dialback if and only if the hostname did not match

Ge0rG, though LE uses multiple vantage points to make that harder

Or at least they will be?

maybe

I'm not sure it has been deployed yet

implementations details of LE are not of concern for the spec anyways

We got a dwd

Hello, sorry I'm late, got pulled into something last minute.

Are we still on 4a)?

dwd: yes

OK, good.

jonas’: I think we need to move that to the list

dwd, no worries

Ge0rG, I tend to agree

maybe explicitly ask for input from server developers.

it would be nice if someone else could start a thread right away, because (a) my MUA is a mess right now and (b) I’ll be heading out right after this meeting

Wasn't there a thread already?

Can continue there

So I'm comfortably +1 on this, but really because whether an initiator decides to move onto Dialback (and whether a Receiver accepts it) isn't predicated on whether SASL EXTERNAL failed or not.

Also i looked for a thread on this earlier and couldn't spot one - what's the subject line?

I wasn’ta ware of a thread either

Subject: Re: [Standards] XMPP Council Agenda 2020-06-24

ah.

well

Well. Not a separate thread.

Ah-ha.

it was just a single mail asking whether that's a downgrade attack

I suppose a separate thread would be more discoverable.

It's not a downgrade attack, but I'll explain there in more detail.

do we have a volunteer to start the thread or shall we delegate that to the editors?

it would be great if somebody who's both a server developer and in Council could do that.

I'll start a thread.

dwd: But is it best practice?

dwd, thank you :)

dwd: +1

Zash, I think whether it's "best" is largely irrelevant.

can we move on?

sure

or do you think there’s need to discuss this here?

taking that as a no

Let's move on.

5) Outstanding Votes

I incorrectly accused dwd for having one

which I take the full blame for, I misread the doomsheet

I've sent a -1 for PR #961

thanks

so we’re clear

6) Date of Next

I hope I'm out of old debt now, any only owe a vote for today's 4a

Ge0rG, you are

+1W WFM

+1w wfm

+1w most-likely wfm, #thankscorona

+1

+1WFM.

excellent

7) AOB

dwd, any news on the video call? :)

Ah, yes. I remember that now.

I’ll take that as a "no" :)

I have scribbled.

I can’t properly interpret that verb

I have written something down to remind myself I need to arrange a time, URL, etc for a Council video chat.

ah, right

any other AOB?

None here.

No

nope

thanks

8) Ite Meeting Est

thank you everyone

thank you jonas’

thank you Tedd

thank you everyone

Thanks all

Thanks jonas’ and Tedd.