jdev - 2023-06-28

selurvedu: yes, that's right. we had a long discussion about this in XSF room the other day. The XEP clearly says that a MUC must have room id and a service and that they are room@server but it's not written with MUST have localpart like you might expect

singpolyma, thanks for clarifying!

Although 2119 language is useful for clarity, text doesn't need to say MUST for it to be a requirement ;)

selurvedu: there are notes about this at the bottom of https://wiki.xmpp.org/web/XEP-Remarks/XEP-0045:_Multi-User_Chat

MattJ thanks for the mail on the ML about publish-options !

👍

Kev, right

nicoco, it says "technically nothing prevents it", but it says nothing about Room ID being required by 0045, as discussed here.

selurvedu: I didn't mean to get involved more than saying that there's a page on the wiki that mentions this ;-)

nicoco, thanks for letting me know ;)

hi jabber devs

does anyone think in-band registration should be deprecated for security reasons? (spammers)

Yes and no

why?

Unrestricted, unmonitored open IBR is a disaster

yes

i'm noticing that in MANY mucs today

But IBR is just a protocol, and it doesn't have to be unrestricted, unmonitored, or even open

i do think IBR shouldn't be unrestricted

I'm just preparing to submit a XEP proposal right now that would help automate defences against the current attacks

techmetx11, at JabberFR, it is unrestricted and open, but monitored quite closely.

And if you ever encounter a spammer from our servers (some always slip through), please report it to us. :)

Link Mauve: i registered an account at one of the reported XMPP servers that the current spammer was using (yax.im)

i was shocked how easy it was, just a name and password and "Registration successful"

XMPP: "I was shocked how easy it was!"

PR the website!

techmetx11, that’s to be expected, why would creating an account be hard?

Link Mauve: the problem is, if it's TOO unrestricted

you can't keep up

seriously the spammer rn, registers an account, uses it for only a few seconds, and stops using it to register another one

Ah sorry, you probably know better than I do that I can’t keep up for the past six years.

sorry sorry

techmetx11, if you see any further yax.im accounts involved in that (unlikely) please report them

you don't have to be sarcastic

Link Mauve: i wonder what you did?

tip: if someone decides to add email verification to the registration process, there are services online that provide temporary email addresses for free. (lookup "tempmail" or "10 minute mail") There probably is a blacklist of the domains used in email addresses somewhere though.

That’s a secret~

ah i see

sorry if i'm rude and all, this has just been a problem

it has. but we cant just close public registrations. yet 😉

Or just mailinator.com

Link Mauve: hopefully i wasn't too bad :P

I hold the unpopular opinion that IBR doesn't actually buy us anything, but I know I'm a minority of ~= 1 on that.

Do any servers still allow anonymous login?

Lots, but hopefully not with s2s enabled

(lots == every web support chat for instance)

Ditto

I wondered if i could use it for crash reporting

I guess not

Sure, don't need s2s there

But do need a server

Yep

Like Conversations does?

Except, opening a new c2s for it? Hmmm

There, https://logs.xmpp.org/ now defaults to _not_ showing joins and parts

Are y'all happy now?

Never. But thanks :)

> 2 files changed, 43 insertions(+), 15 deletions(-)

I could not be happier

I do wonder if this could just be a raw MAM query and some XSLT ...

xslt is turing complete. so yes.

Only if you enjoy pain

After doing stuff with OAuth2, JSON Schema, OpenAPI, k8s for a bit, some XSLT would be nice and relaxing ✏

Zash, a tiny cosmetic issue is that this website still creates links for days with no message at all, such as https://logs.xmpp.org/xsf/2020-03-22

Link Mauve, there's joins and parts on those, shush

Hence cosmetic. :)

Like this was a minor usability issue? ✏

Yeah.

Which has taken multiple failed attempts over sevral *years* to fix?

Oh, I see.

So, yeah, maybe that can be fixed in some 7 years

Oh

Link Mauve, it's fast and efficient becasue it just grabs an existing index of days that has any data at all

filtering out "empty" days would require actually looking at the data

Yeah, I know mod_storage_xmlarchive’s structure. :)

Link Mauve, how about the lazy mode, where just assumes that *every* day has content? :)