XMPP Service Operators - 2025-05-09

> Wow, there's four servers still using RSA ciphersuites instead of AES That sounds useless and your snippet does not show that

Actually, it's nice (although probably useless with TLS) that it's AEC in GCM mode and (good even with TLS) (EC)DHE with RSA only for signing ✏

Actually I once brought up during an interview the question whether every TLS segment with AES in GCM mode uses an GCM authentication tag an/or SHA. I don't know the answer and the interviewer didn't know either.

> Operators of these servers you may want to consider updating your TLS implementation library. If this is intentional could you explain why your using these odd ciphersuites? Quicksy.im also doesn't support TLSv1.3. I wonder why as afair Daniel said it runs on debian stable and even oldstable (maybe even oldoldstable?) can do TLSv1.3.

> matrix server discussion, in an xmpp server muc > if i had a penny Where else would you go and ask for help when it breaks? :p

Did that a couple times myself in a MUC just for that.

> Actually I once brought up during an interview the question whether every TLS segment with AES in GCM mode uses an GCM authentication tag an/or SHA. I don't know the answer and the interviewer didn't know either. Because RSA is slow and requires massive key sizes to still be secure. We would have switched away from it back in the 2000s had the NSA not of backdoored dual_ec_drbg scaring everyone away from elliptic curve cryptography for roughly a decade or two ✏ ↺

The ciphersuite matrix is using though is considered weak. There are several vulnerabilities from it, most of which are denial of service vectors but one being information leakage in a edgecase due to how their using DHE

>> Actually I once brought up during an interview the question whether every TLS segment with AES in GCM mode uses an GCM authentication tag an/or SHA. I don't know the answer and the interviewer didn't know either. > Because RSA is slow and requires massive key sizes to still be secure. We would have switched away from it back in the 2000s had the NSA not of backdoored dual_ec_drbg scaring everyone away from elliptic curve cryptography for roughly a decade or two The question was absolutely unrelated to the asymmetric cryptography and thus RSA

Just a heads up, I've been having to implement additional filtering both at the application level and network level due to ddos attacks from AI companies.

The filters I'm setting up are very conservative and shouldn't have false positives but just in case a real person is caught in the crossfire you can report it here.

I'm probably going to have to block China.

I don't think I have any legitimate traffic at all coming from China.

90%+ of the attacks are also coming from China

They will switch to IPs from Sychelles and other places if you block them.

Country level block is ineffective and mostly hurts legitimate users

I don't have any legitimate china users.

btw, I just implemented a whole bunch of additional checks at my network perimeter. If they have affected any legit users speak up now.

I also had to block AS45102

Anybody using chinese cloud servers from Alibaba for a LEGITIMATE & legal purpose please speak up now.

> Country level block is ineffective and mostly hurts legitimate users Kris, Untrue. See https://www.spamhaus.org/blocklists/do-not-route-or-peer/. It's very useful for an ISP to use these lists as part of their infrastructure protection service to protect their users. ↺

There are some networks that are setup explicitly for cybercrime, Or just do not care about handling abuse on their end at all and are bad stewards.

It makes sense to drop or refuse to route these nets & ASNs in those cases.

> Country level block is ineffective and mostly hurts legitimate users In the majority of cases, you cannot obtain legitimate users from China.

In my experience a connection willing to circumvent region blocking is almost always a real user

and I can't imagine chinese internet users even finding let alone being interested in a lot of the services we host here

they already have their own walled garden