jdev - 2026-08-23

I heard most XMPP servers require TLS or STARTTLS

But what if it's hosting over WebSocket

I don't think it can do STARTTLS in WebSocket, so I'm assuming it's either the connection is already TLS or it won't connect

Cynthia: yea tls over websocket, hopefully no real client in 2026 would connect without tls

I have been working on serving avatars via http instead of in-band in slidge. For "contacts", XEP-0084 specifies how to do that, it's great. For MUC participants however, vcard-temp has no defined syntax. Am I going to jail if I add a XEP-0084 metadata in presences of participants, eg: ```xml <presence xmlns="jabber:component:accept" from="room@aim.shakespeare.lit/juliet" to="romeo@montague.lit/gajim"> ... <x xmlns="vcard-temp:x:update"> <photo>{hash}</photo> </x> <metadata xmlns="urn:xmpp:avatar:metadata"> <info bytes="547" height="5" id="{hash}" type="image/png" url="https://upload.test/profile/{hash}/avatar.png" width="5" /> </metadata> </presence> ``` ✏

i mean, we dont make http queries without user interaction in MUCs

so .. i dont see Gajim doing that for hundreds of avatars

you can add whatever you want to a stanza, i would expect it under a custom namespace though

it is the metadata element, why wouldn't I use the same namespace?

I get your point about gajim not doing anything with it but I suspect edhelas will be interested for movim :)

(arguably, you could whitelist the *.example.com for user@example.com though) ✏

(arguably, you could whitelist *.example.com for user@example.com though) ✏

in theory i would say if you take a namespace and repurpose it in a different context without having documented in a spec, you run the risk that a later spec does something different with it

but i guess the chances of this happening here are low

> (arguably, you could whitelist *.example.com for user@example.com though) its not about downloading something dangerous, its about revealing your IP in public MUCs ↺

also do you not leak the domain of the muc occupant with this?

or is this for private chats only?

> its not about downloading something dangerous, its about revealing your IP in public MUCs sure, but I mean if the gajim user is user@example.com, I don't think leakage to *.example.com is an issue ↺

i guess this is for gateways, and the domain points at a gateway?

it is for gateways yes

and with the most typical slidge setup, the domain is going to be upload.example.com for all participants yeah ✏

but if i have the real jid of the user, why would i need this metadata url? if i dont know the hash, i request the metadata pubsub node and get the url myself

seems like a very micro optimization

i guess you spare one pubsub request vs the additional traffic on all presences

true. but there is vcard-temp already in the presence, so might as well push that metadata in there too. maybe sunken costs fallacy as I implemented "serving avatars through HTTP" and want to make it easy for clients to use them if they feel like it :)

and the reason to do this via http is to not block the xmpp stream?

or what is the problem that this solves

not block is a reason. providing higher res avatars is another

conversations implemented fetching avatars via http to get better resolution (after getting the URL via pubsub, not the in-presence metadata that we discussed)

because the avatar was to big to put it on the stream?

probably, yeah the xmpp stream blocking is a probelm indeed

im not sure where C uses these avatars, every avatar is tiny for me in C

i did not see avatar resolution as lacking until now, but maybe i never saw a client with high res ones :D

What is the most optimal checking a client should do to a TLS/SSL certificate without rejecting a ton of servers?

> im not sure where C uses these avatars, every avatar is tiny for me in C lovetox: Few people have updated their avatars, but if you set a highres avatar, C will upload it fullres (with the 'profile' purpose) and advertise the URL as another metadata/info. ↺

AFAIK C will not fetch anything in band if it sees a metadata/info/url

Also, prosody mod_http_file_share does not support the upload 'purpose' (yet?)

marios, you should leave that to your TLS lib

either your TLS lib notifies you that the cert is invalid, then you abort the connection, or it is fine, then you continue

lovetox: I do leave that up to the TLS lib, but how about the non-standard TLS attributes like the otherName/dNS name

either your TLS lib can validate / use them, or you simple not use them

never heard of that being used or a problem, FYI, do you have a user that reports a problem with that?

they were just mentioned in the RFC6120 and I was curious if they were actually used nowadays and if I need to handle them

hm, reading this the first time, never heard in the last 10 years anyone talk about this, so my gut feeling would say this is not used, but maybe wait for some other opinions, maybe i learn something new today :) ✏

would not be surprised at all, if that actually was the case. Ty tho!

haven't seen them mentioned in any guides for setting up some server certs too

marios: not used because no CAs will issue a cert with them because google forbids it

moparisthebest: I see, thanks, not surprised by google forbidding it ✏

does anyone here know if any XMPP client actually supports sending one message with two different bodies in different languages

Not that I've seen, but it's more likely to be used for automated messages/announcements

how is the experience of xmpp.rs for anyone who used it?

I thought about using it for a project of mine (I won't say much about what it is but it is mainly client-side work)

I had some concerns about using it but it seems to be fine

I used it for a simple command based bot and it worked just fine

good to know

my project is likely gonna be far bigger than that, and it is not a bot, so I don't know how well xmpp.rs will do for my use case

If you want more appropriate advice or feedback maybe ask in xmpp:chat@xmpp.rs?join ?

Or are you looking for other libraries and maybe in other languages

(Or just what other projects in XMPP use)

villain, Are you using LLMs for coding? If so, XMPP's specs are good enough that expanding any existing library is very easy.

(Also here's my little bot for what is worth https://git.lucamatei.com/factorio-restart.git/ )

yeah, I will be using LLMs here

> Or are you looking for other libraries and maybe in other languages I am exploring the options, and I have mostly decided on Rust for the project ↺

In that case I don't think xmpp.rs is for you. At least not for contributing under their guidelines https://gitlab.com/xmpp-rs/xmpp-rs/-/raw/main/CONTRIBUTING.md

I would be consuming the library rather than developing it, but yeah, it would be a problem if I wanted to get fixes into the library

Can always fork

I was planning to do that with one of the libraries if xmpp.rs doesn't work out for me

there are definitely plenty of options to choose from