XMPP Service Operators - 2023-10-22

Hi everyone, I'm new here, say hi.

hello you

MattJ: We need to have just the moderators and and admins to comment on what's on topic, off topic, etc.

I cannot have every Tom, Dick and Harry preaching.

sagaracharya: stop trolling then

Guus: should do his gu at his home

Exactly this clown here.

Licaon_Kter: shhhhhh

>> raver, I’m curious how you check this > I've checked the supported mechanisms here: https://connect.xmpp.net/ 👍🏻

The STARTTLS protocol is still in use, isn't it less secure than TLS? ...…… ✏

华南网友: I'm not sure but I don't think so

XMPP As a communication protocol, the speed of iterative updating is too slow in the face of new situations. XMPP for QUIC, DOH, DOT support, has been unable to keep up with the demand.

华南网友: DOH DOT is the responsability of the OS mostly QUIC yeah, maybe, but it's pretty fast already

well democracy and consensus are tricky arent they? i always prefer them to the alternatives anyway

Somehow it is still the fastest instant messaging, can't be soo slow... Also starttls is equally secure as any other.

assuming no downgrade

Yeah, don't use clients last updated 2010

Or wait. My server also requires encryption

Not only the clients

that can be faked

Is there any proof that STARTTLS is better than TLS or DOH? STARTTLS for XMPP is a thing of the past. Email configurations enforce TLS.

You must ask is there proof it is worse then direct tls? I wouldn't know that proof. Especially because it is likely implementation dependent 华南网友

It is unbroken. In security, long time unbroken is something good, better then something fancy new, as far as I know.

(im not against direct tls and also think it's godz and actually many severs now use direct tls everywhere, just talking against people saying it is somehow bad jsut because it's older)

Also I don't know why you mention DOH, that is totally unrelated to xmpp or other software using tls for whatever

Assuming that this channel is crawling with new-found experts on CAA DNS records: can someone do a quick query on igniterealtime.org to see if its CAA record looks somewhat sane?

Guus: better use dns-01, but it looks ok to me

there are online services to check and parse CAA

sadly, dns-01 isn't an option for us

thanks

Guus, you should add the iodef line so you get emails if a CA tries but stops to issue a ca for it iodef "mailto:caa@igniterealtime.org"

you might also want to move validationsmethods before accounturi and put space after each ;

certbot is having a problem with my config

华南网友: starttls isn't less secure than direct TLS as long as servers and clients enforce TLS, which all do today, it's important to note this attack man-in-the-middled TLS so that doesn't actually matter That said, most XMPP software today supports direct TLS, and a few even support XMPP over QUIC (again this wouldn't have stopped this attack though)

I feel like you 华南网友 threw all the related buzzwords in a post and call it "modern" as that would "fix everything". While last days incidents was more about yesterdays boring solutions and a couple of DNS entries.

Hi!