jdev - 2020-02-26

Hi everyone

I'll like to create a jabber account

Can someone please tell me how to do that?

step 1: find a provider

jonas’, and where do we find a list of servers?

Search the web for "public xmpp servers" ?

really?

that leads me to a list maintained by jabber.at

https://list.jabber.at/

which is better than nothing i guess

but this is the only result on the first page that would be helpfull

now jabber.network, shows you randomly servers, not sure though if its clear to a user that this are compliant servers

this shows me that its good to have a small maintained list of servers within Gajim that i offer registration for

lovetox, have a look at the lists Dino and Kaidan and wiki.xmpp.org have independently been trying to come up with.

hm if a server does not use 0156, does that mean i cant connect to it via webclient?

You could if you were to have a fallback BOSH proxy configured as an open relay.

so this means no

then i dont get why the compliance tester lists those providers as 100% compliant

using a webclient with your provider is a basic use case i think many people have

so it seems it really was not in the compliance XEPs before but it is now for 2020

not sure how this was missed in the years before

when all BOSH xeps where there for compliance, but no way to discover the bosh service

lovetox, another possibility is the service having a sanctioned web client which hardcodes their BOSH or WebSocket endpoint.

XEP-0156 “just” allows the user to use any web client of their choice.

lovetox, you can direct that request to Daniel, I think he’s the one maintaining the Conversations compliance tester.

it is the *Conversations* compliance tester

why would Conversations care about BOSH

If only we had an *XMPP* Compliance Tester.

if only

I once performed all the relevant set operations on CS2020 vs CCT

Isn't it weird to run tests on deployments when compliance is supposed to apply to implementations?

but then I only wrote the results into the xsf@ MUC

Zash: no

Zash: are you only asking this because it's prohivitively complicated to set up a prosody to be 100% compliant?

"prohivitively" yet everyone seems to manage

Also, see Snikket

it makes total sense

I'm asking because something being in an compliance suite doesn't mean everyone absolutely needs it in their deployment

why would i want to know if prosody x.x is theoretically complicant if i enable the right modules and do the right configuration

Zash: that's actually a great example... https://compliance.conversations.im/server/snikket.chat/ --> 94%

As a End User i dont even care what software runs on the server

Case in point, your private server doesn't /really/ need 157

Zash: I know that you are happy with the XMPP of 2006 and you don't need all the extra modules.

snikket.chat is not "your private server".

haha, from the snikket homepage: Secure communication on snikket.chat

It has a dozen or two of users who maybe just happened to be in Brussels on a certain day.

It's not a public server afaik

Firefox: Your connection is not secure

Ge0rG, the one dropping it from 100% to 94% is actually XEP-0368, aka direct TLS.

Direct TLS SRV records.

It only lowers the amount of roundtrips by one on a connection.

Which are undergoing Last Call right now

That’s really not something that is absolutely mandatory.

Ge0rG, not CFE?

Link Mauve: unless you can't parallelize SRV lookups, in which case it adds another rtt

Link Mauve: sorry, CFE

Are there SRV implementations which can’t do that? /o\

Link Mauve: yes

Isn't it more about circumventing firewalls doing deep packet inspection?

Good resolvers will give you A/AAAA when you ask for SRV

Then again ALPN ...

Link Mauve: because the useful API abstraction is "open me a secure socket to $service on $domain"

Holger: No, it's whatever you want it to be

Holger, you can do that with WebSocket or BOSH with probably a lot more success rate in the wild.

Ge0rG, so case in point, a deployment doesn’t need 0368.

Link Mauve: no, but then it will add one more RTT on clients that support 0368

because clients that care about RTTs will first try the direct tls srv

Ge0rG, implement SASL2 and Bind2 and you’ll get a wildly more reduced RTT.

Ge0rG, then they don’t respect the XEP, since it says to mix them and to obey the SRV order.

Link Mauve: see the CFE discussion

I’ve read it yes.

Ge0rG, its only tried if there is a record

lovetox: but checking for the record is an extra RTT

yes but that does not depend what the server has deployed or not

lovetox: yes, it's added alone by the fact that the client supports 0368

yes

so, if the server has deployed 0368, you have one RTT less than without

if the client first checks for 0368, then doesn't receive a record and does STARTTLS, it's one RTT more than without

true ✏

only if it cant ask records in parralel ✏

lovetox: which was claimed as very complicated on standards@ in the CFE

but either way i think this does not matter at all

one roundtrip more or less

if you then join 20 MUCs, and are forced to receive a few hundred presences

you can pipeline presences, though

hm itś not very complicated just adds complexity for not much gain

it's complex and complicated.

is not everything a pipeline in xmpp?! dont know what you mean by that

if you mean to manually delay or queue joins

i dont think this makes much sense

lovetox: you authenticate (several RTTs), attempt to restart 0198 (one RTT), bind (one RTT), and then you can send all the joining presences

as a server can not send you stuff in parallel anyway

so in requesting 20 joins at once, this is already a queue

and then you'll get a long stream of presences back

yeah and? i would not want to delay that process even further with delaying joins

not what I said

what my argument was this takes much more time, than one asking for one more srv record

like magnitueds more

lovetox: let me tell you about mobile connectivity on Deutsche Bahn

i think i have to leave now :D

if you have multi-second RTTs, they soon add up into your "connect to server" timeout

SASL2 would let you do auth + bind in one fewer roundtrip

is the idea at least

A Resume198-or-Bind operation?

also what about 0198 auto-resume

Zash: I've been asking for that for years

in the context of MAM - https://mail.jabber.org/pipermail/standards/2017-January/032016.html

from a library view this random extension thing in bookmarks is a bit work

the easy way is i give the client a list of all the child nodes of the extension node

I'd be glad already if clients stopped butchering my *mandatory* bookmark elements

its harder if i want to give some abstraction over the extension elements to the client

because then i have to mix xml lib objects, with some structs i create

hm i could split it into known extensions and unknown

or maybe this is so crazy custom that i simply should not care as library

and the client just has to operate on the xml lib object

hm what my lib is missing a way to compare xml objects