XMPP Service Operators - 2022-02-06

Menel: I think it's this

presence_broadcast: [moderator | participant | visitor, ...] List of roles for which presence is broadcasted. The list can contain one or several of: moderator, participant, visitor. The default value is shown in the example below: Example: presence_broadcast: - moderator - participant - visitor

https://docs.ejabberd.im/admin/configuration/modules/#mod-muc

Tbh the room is half borked like that and will cause Bifrost issues

(They already prohibit IQs to occupants) ✏

So... As long as they're aware 🤷

Well. They fixes the presence sometimes today in the morning /last night. Its as it was now.. I didn't realize it was a config option.

> all ~300,000 XMPP servers found on Shodan yay https://bishopfox.com/blog/xmpp-underappreciated-attack-surface nay 🙁 Stay safe... fix stuff!

the whole "vulnerability" is "oops we forgot to disable IBR on our private instance" 🙄

yes, also some anon logins

Signal/Slack/Teams: can't run your own infrastructure poorly if you can't run your own infrastructure 🤔

Without knowing how many of the scanned servers have anon and open registration because its intended, any conclusion there (in the last sentence) is worthless IMHO

(Not a bug, but a feature)

I like the # of servers though, that's huge

Hmmmnope, still dead

Hmm it'd be pretty easy to write a script to harvest all publicly federated XMPP servers but is that a good idea or not :/

Monitor cert renewals since they are all public, check each domain for XMPP service

Since many of those don't federate _intentionally_ it would be pretty bad for those

You'd have most XMPP serving domains within 60 days and all of them within a year

Oh and I shouldn't have said federated, they still may not federate, but rather "on the internet with trusted TLS cert"

Yea, I mean many are probably in the internet by virtue of misconfiguration :shrug:

Probably not nice to list indiscriminately

It's already public though?

Mmhyeah

A script registering on every public IBR-supporting server to say "I'm in ur server, versioning ur rosterz" to everyone in the default roster might be funny, useful and kinda ethical

No that's not what I'm saying

Nah, my thought just wandered

I see your point, I'm just not sure all server operators would be okay with what practically is scraping. S.j.n. requires operators' consent for a reason

Xmpp really needs robots.txt equivalent :)

They might not be happy but they probably don't realize that info is already just there for bad actors already

Why X on 198 and 352 and 411 though? https://compliance.conversations.im/server/jabberfr.org/

well the 411 might be because of the new modue that obsoletes that.. its the compliance tester thats outdated there.. but for mobile devices 198 and 352 are nice...

I wanted to add Bifrost on disco on lightwitch.org, but that'll cause it to lower the score... Apparently if you advertise multiple MUC services it wants all of 'em to be supporting MAM.

(although it also advertises the gateway category so it could be a bit more assertive, if it's not the only MUC service there)

it just wants you to get mam support to the bridge ;)

.. and finally if they would stop the annoying DDoSes, that would help on not wasting time on tweaking infrastructure configuration, role placement and applying mitigations and leave more to actually code. ✏

xmpp ddos or matrix? is there a post somewhere, does anyody know who and why?

Matrix mostly

Some more chipping over XMPP, but nothing of note. And initially it was trolls from stopdronebl.org, now it's just trolls following the tail period.

I didnt know, people woud do it without agenda

mjk: > the whole "vulnerability" is "oops we forgot to disable IBR on our private instance" 🙄 Well, they also mention other stuff like user-search, and mismatched user-expectations about MUC default settings?

rozzin: those seem like deliberate things for an internal company server that go horribly wrong once registration is free for all

mjk: yeah, or if you just make them available to external users with no local registration required. So you can mess those up without having IBR or anonymous login.

They didn't really show all of the angles very clearly....

ah, it seemed they were talking in a context of non-federating services, so I didn't consider external users, yes