jdev - 2020-05-01

hi, I have a question about forwarding IQ in semi-anonymous rooms. As per https://xmpp.org/extensions/xep-0045.html#bizrules-iq "If an occupant wants to send an IQ stanza to another user in a semi-anonymous room, the sender can direct the stanza to the recipient's occupant JID and the service SHOULD forward the stanza to the recipient's real JID. However, the MUC service MUST NOT reveal the sender's real JID to the recipient at any time, nor reveal the recipient's real JID to the sender." such IQ should be forwarded to FullJID or BareJID? (DMs for example stipulate FullJID)

hahahaha

it depends™

and it’s written down nowhere what the right thing is

I know ]:->

Wojtek, for example, you’d want to route PEP and vCard requests (if you let them pass through) to the bare JID, but disco#info and ping should go to the full JID.

of course, the fun really starts when there’s more than one full JID behind the same nickname

yup, and I was driving at that because we forward everything to FullJID, which obviously breaks vCard...

and a followup question - should server handle vcard requests send only to BareJID or also to FullJID? 0045/00153 mentions "send to BareJID" but there is no MUST nor mention that sending to FullJID is invalid

Wojtek, we forward everything to the full JID unless it looks like a protocol we understand to require the bare JID

It should only handle vCard requests to the bare JID

Wojtek, I’m pretty sure that a server handling IQ requests to the full JID would violate RFC 6120

Sending to the full JID is not invalid, but per the RFC that stanza must be routed to the client

and forwarding IQs also has implications re privacy ✏

ejabberd also got this the wrong way around in some ancient versions

As a server dev I'm not sure I'd want to forward any IQs tbh, in semi-anon rooms

It's up to clients if they choose to respond

(and how)

also you need to somehow keep routing info in the stanza so that you know where to route the response to. do server’s do that (in the @id?), or is that based on luck?

id

is it really up to me the client if you query pep?

@MattJ "unless it looks like a protocol we understand to require the bare JID" that does feel kinda inflexible

someday I'll write that script to deanonymize contacts :p

if you want the correct flexible solution, invest in MIX ;)

does mix fix this in any way?

pep., it’s supposed to by making resources addressable, removing the ambiguity

It fixes it by not fixing it?

"realjids everywhere anyway"?

↑

pep., oh, I wasn’t talking about the privacy thing

jonas’: ah

I was talking about the flexibility thing

Wojtek, I totally agree, but it has worked this way for 20 years, and here we are :)

pep., build that script and donate it to sjn so that we finally get accurate user counts ;)

The amount of flexibility that has been required is quite low

jonas’: haha, and you deal with privacy laws? :p

Didn't ejabberd "solve" that by handling vcard requests sent to full JIDs?

Zash, yes, in the olden days

pep., something about infomration manifestly made public and me not storing it, just counting

And Prosody currently redirects vcard, vcard4 and PEP requests to the bare JID

@jonas’ MIX - it's basically ready, with MIX-MUC ;-)