jdev - 2020-04-15

I'm looking for public servers that have: - IBR with a captcha - Redirection from IBR, https://xmpp.org/extensions/xep-0077.html#redirect - IBR and run ejabberd

Maybe also ask in operators

Martin: right, thanks

jonas’, your ToS thing is up for the taking I assume? Talking about IBR

I'm finally working on opening up my service and that's a requirement to me. (at least if we get things going I know I won't be stuck with http redirects forever)

pep., -v please

Long ago when we did gdpr stuff you proposed a tos spec

I know

you can invent something better than that, sure

I don’t intend to continue to work on it

Right that was my question. I might as well reuse the name :P

I'm going to implement XEP-0373. Just tried to add my JID like xmpp:user@domain.tld. https://xmpp.org/extensions/xep-0373.html#openpgp-user-ids gpg> adduid Ihr Name ("Vorname Nachname"): xmpp:test@domain.tld Email-Adresse: Kommentar: Sie haben diese User-ID gewählt: "xmpp:test@domain.tld" Bitte keine Emailadressen als Namen oder Kommentar verwenden It's not possible, because gpg says: The name look like a email address. --quick-adduid is working.

DebXWoody, that's more of an gpg API issue

Yes, but it should look like I did?

Add the xmpp URI as name and keep mail and comment empty.

I haven't verified that gpg will then produce the according rfc4880 subpacket, but it's not unreasonable that it does

IIRC gpg provides a dump command to inspect the rfc4880 structure

you potentially want to use that to verify that the result is compliant to xep373 ✏

I think I used xmpp URIs in the email last time I tried ✏

I'd guess either of name or mail address is fine

flow, hmm, that'S gonna be slightly problematic if gpg doesn't accept it. Assume most implementations will use gpg / gpgme or similar for this :/

pep., well they should use the high level gpg api for taht

besides older gpg versions are known to have a problematic api

mostly because older gpg versions had no api, so gpg APIs where build around the gpg command line interface and parsed the gpp output

every reasonable OpenPGP API lets you create the User ID Packet with an arbitrary string

cause that is what rfc4880 specifies: https://tools.ietf.org/html/rfc4880#section-5.11

ok

in the example DebXWoody gave, gpg is trying to prevent the user doing something uncommon (assuming the user wants to use gpg as gpg believes it should be used)

they should use the high level gpg api for taht → they should *not* use the high level gpg API for that

gpg lets you do this

you just have to pass the proper commands

there is a command that lets you skip all those checks

for example --allow-freeform-uid

Disable all checks on the form of the user ID while generating a new one.

lovetox, yep, DebXWoody already mentioned --quick-add-uid

One wouldn't use gpg directly though right? :/

I mean gnupg

if the command line app will not support something,i think your chances are low that you can do it programmatically

pep., yes, you would want to use an library providing an OpenPGP API

for gnugp there is gpgme, but I can't comment on its suitability nor usability

but there a dozens of alternatives

dozens?

https://neopg.io/

https://sequoia-pgp.org/

paul's pgpainless (java)

https://www.openpgp.org/software/developer/

gpgme is not very advanced

i remember when i implemented gpg in gajim, it didnt even had an api for importing a key

the python bindings i mean

the situation of python openpgp APIs was not good a few years ago, I hope that changed

i think someone worked on the python gpgme bindings

and it can do now more but didnt look since a year

Yeah last time I checked was the berlin sprint last year

Using the Rust binding of gpgpme. I might use sequoia someday if I tackle this again

sequoia is in very good standing

definetly something to look out for

It's been a few years I've known about them, just never had the chance

gpgme is ok: https://codeberg.org/xmpp-messenger/xmppc/src/branch/master/src/mode/pgp.c#L99

I like the idea of XEP-0373 and 0027 is obsolete. But I don't get why there is https://xmpp.org/extensions/xep-0373.html#synchro-pep within XEP-0373? Is it ok to skip it or is the client in those case not XEP-0373? My key is on a Nitrokey / Smartcard and I would like to use this key for 0373. There is no need to sync the private key and there is also no need to create a new one for me.

DebXWoody, nothing in xep373 mandates that this is mandatory-to-implement

ok

the xep(s) deliberately keep a degree of freedom here, while sketching a scheme that could work to get the average users to use OpenPGP encrypted XMPP messages (without ideally even being aware that she/he does) ✏