jdev - 2020-09-11

hello :)

do you know where I can find some servers to test Direct TLS, I'd like to have cases where the DNS returns the "." SRV

maybe somebody has a test instance, I wouldn't expect anybody using that setup in prod

i guess you need a server that has setup that special dns entry

because almost all servers support direct tls

or lets say, many

edhelas: IgniteRealtime.org has, but I suspect that the s2s direct TLS implementation is broken

oh you mean s2s

C2S is also enabled there

(with direct TLS on port 5223)

(should have the DNS srv records) ✏

lovetox, many implementations support it, that doesn't say anything about deployments

Well, whatever default there is would probably be a majority

I don't remember prosody nor ejabberd enabling that by default

They don't? Curious, what's the downside?

What are you talking about? Xmpps srv records for direct tls?

Martin, yes

Guus, maybe it's just a matter of not doing it "yet", maybe it isn't. Personally I don't have that setup on my own server and I'm still alive and well

Ah, for just s2s that makes sense, yes

I'm talking about c2s mostly

Doesn't direct TLS outdate StartTLS?

pep., alsmost all servers that i see offer direct tls

conversations.im, jabber.fr are the most obvious

Outdate? Where'd you get that from?

I mean outdate as in "is older than". I based that on nothing but the order in which both were implemented in Openfire (where direct TLS was referenced to as the legacy way of doing things)

yes funny in old gajim code direct tls was also named legacy

would it be sensible for a server to remove all pending sub requests when i block a user

Yes

i think ejabberd doesnt do this

Oh right it doesn't say this in https://xmpp.org/extensions/xep-0191.html#impl

Just that it MAY cancel existing subscriptions, which I don't think is a good idea

im not even talking about subscriptions

im talking about requests

I know

ejabberd just sends me peridocally the requests again and again

Can you deny it after blocking?

no

actually i do deny it before blocking

why the hell is ejabberd still sending me this

In prosody the denying would get blocked, which is why we delete pending subscription requests. Something of an implementation detail tho.

Letting you deny it yourself would also have worked.

As someone mentioned yesterday however, it might be a good idea to tell the user/client that the sub request was retracted

Prosody doesn't currently, it just silently deletes

lovetox: This kind of stuff ought to go into that Implementation Notes section

yeah

You probably don't want to reject the sub request before blocking, IIRC this notifies the sender that your account exists which is probably not desirable.

If a user provides a custom host I don't do SRV right? Just A/AAAA if the thing is resolvable even (might be an IP?)

Yes

yes pep.

I'm tried really hard coming up with examples of when sombody would need SRV with a custom host, and I got one, probably not worth handling just yet (until somebody comes grumping, then, maybe.)

An admin could serve a domain foo.bar that doesn't point to their server baz.qxx, which server has a specific DNS setup that needs SRV resolution :x ✏

At this point I'd probably just tell them "use a different custom domain", or PRs welcome

custom host means, connect to that host, not do srv and connect to another host

because then you could just put that host in there

in where

in the custom host field

yeah so what I said

custom host is probably only used if you are to lazy or in a situation where you dont want to setup the dns

Or some cases where you can't access DNS properly, like with Tor

if tor is activated, i just pass domain.org:5222 to TOR

if that fails to connect, there is nothing you can do and need to abort

How do you know it's tor? Is that not handled by proxychains or similar?