jdev - 2025-03-17

No, yes looks better why was it not send to the inbox?

lovetox, I think because the second one depends on the first one being accepted, and it’s sitting in Kev’s inbox since 2023 apparently. :D

Op will deliver ™

It just fell through the cracks, if you’re interested you can probably push it again.

It was a big chunk yes, but I really think we need a serious quote system in XMPP, @all @admins @username, that kind of things.

edhelas, that’s just an input format for mentions, other ways to trigger that can exist.

Like a right click on a message with a “alert the mods” in the context menu.

edhelas: but the spec has @all what do you think is missing

lovetox Which one ?

https://bouah.net/specs/mentions.html#groups

I have @here, @mods, and @username already heh

But I guess the way I do @mods some may not like

> https://bouah.net/specs/mentions.html#groups So yes its from pep proposal, that relies on the PR I did above ↺

So let's get this going

The mention story in xmpp is really bad 😞

Is it? I've never had a user even notice

doesn't it basically wash out if the usually-offline clients are also MAM/MUC MAM clients?

Maybe because pep does not use your client

lovetox: poezio with smacks and mam both enabled is not pleasant, indeed

Not sure what you are trying to say singpolyma a User sending a mention will not notice if you provide good UI. The bad story is about receiving one

But what about the receiving story is bad right now?

> Maybe because pep does not use your client Ah, so specifically for people with nicks that overlap a word or such ↺

You don't receive it at all if you don't pull all of mam History. And of course false positives

Although I get why this does not happen to you using a phone client which is always online

Also i can not draw a mention received in a special way, say with @ in front

Because I don't know if it was the goal of the sender to mention

That's another downside, you can not type a name without mentioning

I mean, we do in practice draw in a special way. I'm not saying it wouldn't be better if we had extra metadata

All workarounds for a bad story

Though I expect we'll need the option to keep the current way for a long while on incoming

And with occupant I'd now it's a trivial standard

Not much to discuss at all, except the format on the wire

> That's another downside, you can not type a name without mentioning You mean an upside, to always know when someone is talking about you? ↺

That will not go away if your client provides such feature

The huge downside of mentions not in text is the massive abuse potential

I can ping lovetox with every message I send in here, and that client keeps buzzing, yet no one sees anything including the mods

How?

Im not seeing it

How about some rate limits and cooldown timers

You can send me a message that mods don't see, sounds like a client bug

Don't PMs already do that

If the mention bit is hidden I can send it along with every message

We are discussing mentions ✏

moparisthebest: ok so your argument is, if client dev does not know what he does than other users can abuse

What can the client dev do about it?

Never would have thought

moparisthebest: not buzzing?

But user wants notifications for the channel

Did you read the spec?

If you include a mention in a message with a body i will print the username bold into the message. If I don't print it in the message there is no notification

Mods see it, and if not that means there was no notification

Yes, the <reference> bit is hidden by all current clients, and the security considerations mentions part of the problem: > Being able to notify groups of people at the same time may also be used by malicious entities.

Don't shift the goal post

You said mods don't see it

I can spam you also without mention

So you are saying mods will see it if they all upgrade to the latest version of gajim right when it comes out?

Is there any reason mods couldn't see random "hidden" mentions

Yes

I don't find that helpful

Not a problem at all for me

Who cares if mods see it? You can say "hey mods ban this asshole"?

It's the reactions discussion all over again

I remember rough agreement that was okay for new features to not work all that great in legacy clients.

> Who cares if mods see it? You can say "hey mods ban this asshole"? You can't, cheogram is an example of this implemented poorly, as a user you have no idea which message the notification came in ↺

New features not working in old clients is ok, but new features opening up massive abuse not so much, it at least needs thought about

I don't see a massive abuse potential

You need to send a message for every mention

If someone spams the chat they will get banned

If a mod is not on the newest client I send him a screenshot from mine

I can't actually run gajim on my phone though

>> Who cares if mods see it? You can say "hey mods ban this asshole"? > You can't, cheogram is an example of this implemented poorly, as a user you have no idea which message the notification came in You do because the client highlights the message ↺

I suspect most are in a similar situation

And also you get a notification. So two ways you are told which message it is

And then you can block the user

Note to self, implement local muc user blocking

Yup, also that

Highlight isn't enough, there's no indication why a message is highlighted

Abuse will always happen, we need to give the users the right tool to fight it

It's only highlighted for one reason so... It's that reason?

But that's GUI client stuff, we are here talking about wire protocol stuff

Where does it say that in the manual? Did they only highlight me or everyone?

> But that's GUI client stuff, we are here talking about wire protocol stuff This is the most worthless distinction that exists but I see it brought up often sadly ↺

I'm not saying no one should implement this, I'm saying there are real security considerations to consider while doing so, both in your client and the wider ecosystem, that's all

That's great, nobody says don't write stuff into security considerations

They aren't there now and still need considered though

moparisthebest, "PRs welcome" 😏

theTedd: where (:

Document it first, then point people to it