jdev - 2024-06-21

https://mov.im/node/pubsub.movim.eu/Movim/195d732f-a7b7-44ba-b0cc-caa68b6b4426

:)

Nice

noob question: would you reccomend a SAX or a DOM parser for xml?

For XMPP, always SAX

Opinions may differ, you can work with a DOM API if you're prepared to do handle some XML lexing yourself, but I wouldn't implement it that way if I had a choice

ok. apparently guile offers just a simple example of a DOM parser and then a toolkit to build your own with SSAX

so i will have to build my own parser anyway it seems. and i have the options of: > (sxml ssax) is a package of low-to-high level lexing and parsing procedures that can be combined to yield a SAX, a DOM, a validating parser, or a parser intended for a particular document type.

XMPP over websocket is made so you can use a DOM parser

Sounds like quite the toolbox :)

> Opinions may differ, you can work with a DOM API if you're prepared to do handle some XML lexing yourself, but I wouldn't implement it that way if I had a choice right. it also says SAX is more efficient it says so

Yeah, you can (should) definitely do DOM-only parsers with websockets

ah i dont plan to support websockets

i think at least so i should be okay

> Sounds like quite the toolbox :) its a functional toolbox it says with a bunch of monads seems interesting :P

Just be careful about using an off the shelf XML parser for XMPP, you have to disable a ton of things or it'll be insecure. Processing instructions, comments etc etc etc

So SAX will give you a stream of events like "A tag was opened", "A tag was closed", etc. and most implementations use these to update a stanza object

Ignore moparisthebest :P

After the final tag of the stanza is closed, it then processes the stanza

> Ignore moparisthebest :P Are you saying you don't need to disable those... ↺

> Just be careful about using an off the shelf XML parser for XMPP, you have to disable a ton of things or it'll be insecure. Processing instructions, comments etc etc etc at least it seems the simple one they have is not security sound to use

it just says: > The (sxml simple) module presents a basic interface for parsing XML from a port into the Scheme SXML format, and for serializing it back to text.

moparisthebest: of course. The fact that any spec even implies you should is brain damage

which doesnt sound very encouraging

at least they have SSAX which means i can define something special case for me

XML has a bunch of additional features... which aren't used (or even permitted) in XMPP, so disable everything you don't need, which is basically everything except namespaces

or wait actually i think its unrelated. i need that one to write xml in scheme

Any sax parser should do the job. Obviously if it has insane XML extensions enabled like DTD disable those, but most don't even support that stuff to begin with ✏

You would probably benefit from having it shoot out chunks of sxml per stanza or something, but it depends on the use case

makes sense. since i dont want to get everything together

also the moment i am thinking of parsing stanzas i understand how important framing is :/

Luckily we have framing built in and the sax parser does the counting for you 🙂

what is the built in framing?

XML

Stanza start to stanza end is unambiguous

ah. i meant that i have no idea how big the stanza is going to be ahead of time

No, that's true. We have boundaries not sizes

I guess you will be sort of a server right because p2p?

yep

gnunet says > The size of an element’s data is limited to around 62 KB.

So if the size gets past your limit mid-stanza you have to close the connection

so i guess 62kb

Ah, if you limit it to single elements in your protocol then you may not have this issue yeah

yeah i was thinking i dont need to manage it if the layer underneath does it

since xmpp will be over gnunet. specifically cadet

i think its bigger than current federated xmpp limits anyways

Smaller. Usual limit is ~256kb

damn. there goes my idea :/

singpolyma: you have to disable those things or you'll get https://en.wikipedia.org/wiki/Billion_laughs_attack and a ton of other things

MSavoritias (fae,ve): XMPP over websocket is framed ;)

heh

moparisthebest: that attack and others like it are based on things like DTD which aren't part of base xml

and from reading gnunet doesnt seem to be framed so i cant delegate it there exactly :/ but maybe i can hack something since the 64kb is basically the equivalent layer of ethernet frames

singpolyma, DTD is part of XML 1.0, it's not an extension (nitpick).

which is why many parsers actually do support it.

(it's worth pointing this out so that people actually go and check for that, instead of thinking that $niecheParser won't support it)

(this notably includes entity declarations, i.e. billion laughs)

singpolyma: all I said was you shouldn't grab any off the shelf XML parser and use it with XMPP, you likely need to disable things or if they don't have toggles it's unsafe to use

I don't think *that* can be ignored

exactly

and again, DTD *is* part of base XML

(unlike XML Schema)

source: https://www.w3.org/TR/REC-xml/#NT-doctypedecl

Feel free to ignore me when I say things like you should only use purpose built XMPP XML parsers if you want since that's an opinion you are free not to share :) ✏

and here's the grammer for the dreaded entity declarations (read: billion laughs), right there in XML 1.0: https://www.w3.org/TR/REC-xml/#NT-EntityDecl

> (it's worth pointing this out so that people actually go and check for that, instead of thinking that $niecheParser won't support it) Yes this is fair. If you're building a server double check the DTD thing for sure ↺

also as a client.

in IBR or SASL ANON there's not much of a trust relationship to the server.

(and even then, trust is nice, but people _will_ laugh at you if your client breaks with billion laughs in 2024.)

MSavoritias (fae,ve): rather than rolling your own from scratch you could also use bindings to a good one like https://codeberg.org/jssfr/rxml just throwing it out there...

awww

thanks will keep it in mind

although it wouldn't be completely from scratch apparently

Even if you trust your server, servers have bugs too... Here's an example of remote code execution in a client because the server let bad XML through that it shouldn't have https://bugs.chromium.org/p/project-zero/issues/detail?id=2254

Why *should* it be completely from scratch :)

so probably framing is not the answer and i would have to do other checks anyway

moparisthebest, yeah, why would *anyone* write an XML parser from scratch? only madpeople do that!

(looking at you and me)

(and yes, your stanza counting this qualifies in my view :P)

maybe not try to add framing anyways then

Doing that is a fun learning experience sometimes but not something you should do normally

jonas’: to be fair if rxml had existed first I probably would have used it so really it's your fault 😜

heh if i say half the projects i am writing around my xmpp library its all a mad sciense experiment XD

moparisthebest, I refuse to take the blame for that :P

Doesn't stop me from giving it...

Oh no the loophole...

You might be interested at this matter: > Jabber / XMPP · Issue #541 · betrusted-io/xous-core > https://github.com/betrusted-io/xous-core/issues/541

(xmpp-rs is not good apparently for them)

What does XMPP have to do with a kernel/operating system?

> Core files for the Xous microkernel operating system. I don't even get what XMPP has to do with this OS.

Yea nothing at all as far as I can see

Xous is the firmware for the precursor/betrusted

so I guess someone might be interested in using it as a highly secure xmpp dumb phone

> I don't even get what XMPP has to do with this OS. Martin: It appears that they are integrating telecommunication protocols for messeging, so I suggested to consider XMPP.

Ah ok.

MSavoritias (fae,ve), I have asked them to join to groupchat XMPP in Rust and ask for references there. You can convince them.

Martin: I have had the same question when I have read the description of Xous for the first time. ✏

the device in question is a prototype of a dedicated messaging platform or secure enclave (betrusted.io), as an alternative or adjunct to a cell phone

it doesn't really have a general purpose OS

> MSavoritias (fae,ve), I have asked them to join to groupchat XMPP in Rust and ask for references there. You can convince them. im not using rust. I posted as an interesting bit from the issue comments

Where is messaging mentioned https://github.com/betrusted-io/xous-core ?

more informative https://www.crowdsupply.com/sutajio-kosagi/precursor

its for this ^

the xous thing

yeah, precursor is the hardware

xmpp-rs isn't suitable for them in the same way that you'll find it hard to do XMPP if you don't have a networking stack

lol they think that thing will run matrix XD

moparisthebest, I think i twould better be to state, how would they be able to add XMPP to Precursor.

They need to finish implementing their OS before they can move on to that

If it can do http or matrix it can 100% do XMPP

It's not something lacking in XMPP or xmpp-rs but something in their (currently) toy OS

moparisthebest, we shall tolk with them, and hopefully they would prioritize XMPP. This is what I think would be best to do.

Prioritizing IRC would also be good.

yeah, when I think "secure communication platform", I immediately think "IRC" /sarcasm

> more informative https://www.crowdsupply.com/sutajio-kosagi/precursor That's pretty cool ↺

FPGAs are so interesting

not by any means fast computer, but for the role it's intended to be safe computer

saferer computer