XSF Discussion - 2014-02-20

00:01:20 xnyhps Their auth is a pile of stuff, including HTTP. Facebook too, btw.
00:05:40 Tobias i thought FB was full on the MQTT train now
00:10:10 waqas has left
00:14:47 Jef has left
00:27:14 Link Mauve has joined
00:47:33 waqas has joined
01:05:55 Neustradamus has left
01:11:26 Neustradamus has joined
01:23:34 Lance has joined
01:24:25 Neustradamus has left
02:04:48 Santiago26 has left
02:06:47 Lance has joined
02:08:05 Neustradamus has joined
02:10:56 jabberjocke has left
02:26:06 Lance has joined
03:09:06 Tobias has left
03:11:01 waqas has left
03:12:10 Lance has joined
03:13:15 emcho has left
03:19:59 waqas has joined
03:30:04 Lance has joined
03:35:17 Lance has joined
03:38:00 Lance has left
03:44:21 stpeter has left
04:06:34 Tobias has left
04:12:49 Lance has joined
04:32:48 Lance has left
05:07:08 waqas has left
05:16:47 Lance has joined
05:35:27 Lance has left
05:57:28 fippo http://xmpp.org/2014/02/second-security-test-day/ <-- I don't get the 12.5% ... it's the percentage of servers that now requires encryption, right?
07:03:37 Simon has joined
07:19:18 emcho has joined
07:45:02 emcho has left
07:45:02 emcho has joined
07:45:18 emcho has left
07:46:10 Link Mauve has joined
07:49:32 emcho has joined
07:56:44 Lance has joined
08:08:50 Alex has joined
08:21:25 emcho has left
08:21:25 emcho has joined
08:38:05 Ge0rG fippo: I would suppose so... even though the wording in the blog post implies traffic, not servers
08:59:23 Lance has joined
09:08:55 Simon Still getting over the WhatsApp price. (works out at $40/user)
09:09:06 Laura has joined
09:09:24 Simon considers selling off users on my family XMPP server.
09:09:28 Jef has joined
09:09:51 Laura Just wanted to share the meetup link for the London XMPPUK Meetup http://www.meetup.com/XMPP-UK-Meetup/
09:11:58 fippo laura: you should prod lloyd about showing webrtcish stuff and invite https://twitter.com/disruptivedean/status/436063951932379136 :-)
09:13:05 Laura fippo: Off to prod Lloyd
09:13:16 Kev Laura: Thanks. I'd have thought a mail to some lists would probably be appropriate (unless you already have, and I missed it).
09:13:44 Zash has joined
09:13:46 Laura I am talking to Lloyd about lists to send to. I managed the XMPPUK mailing list, but something tells me Lloys has others!
09:14:41 intosi No doubt some lists we don't want to know about ;)
09:16:40 Lloyd has joined
09:22:09 Kev Laura: Thanks.
09:27:18 Lloyd aslso http://lanyrd.com/2014/xmppuk/
09:59:19 Lloyd fippo: I'm probably not going to be able to attend this meetup. Will still be organising with Laura though.
10:02:24 Jef has left
10:11:21 fippo lloyd: you don't need to get dean bubley to that particular meetup, just convince him that the xmpp meetup is where the cool webrtc stuff happens in london :-)
10:13:12 Simon Get James Body there, and Dean Bubley will be in tow.
10:13:24 Lloyd fippo: tweeted him about it. Thanks.
10:53:51 Ge0rG are there any known xmpp servers that break if a client does not set the from attribute on outgoing message or presence stanzas?
10:58:16 ralphm xnyhps: have you ever looked into cryptocat?
10:58:38 xnyhps I've looked over it, yes. Why?
10:58:59 Ge0rG it's full of cats
11:00:04 ralphm xnyhps: wondering how well it was made, security-wise and overall
11:01:20 Ge0rG it's had a bunch of security issues in the past, but the developers promised to do it better
11:01:32 xnyhps I only looked at it from the context of iq-spoofing, which they aren't vulnerable to, because they don't send any iqs except for IBR. I did report that the usage of an incrementing counter for iqs leaks information about yourself, and that was promptly fixed.
11:02:09 ralphm are they involved with the XSF?
11:02:38 xnyhps Don't think so
11:03:08 ralphm I noticed they are working on a new protocol for groups, but it doesn't seem based on xmpp
11:05:05 xnyhps Groups? You mean encrypted group chat?
11:06:41 Kev are there any known xmpp servers that break if a client does not set the from attribute on outgoing message or presence stanzas? Ge0rG @ 10:51 No, and clients should generally not do it, as it adds no value. The server has to overstamp it anyway.
11:06:47 Tobias multiparty OTR
11:09:15 xnyhps They have an implementation of mpOTR, yes, but even in the OTR community it is still controversial.
11:13:52 Ge0rG Kev: I'm currently working on http://issues.igniterealtime.org/browse/SMACK-538 - and I have a report from one person running ancient ejabberd (2.1.5 forked) that forwards presences without adding the from field, making some clients on the other side crash
11:14:17 Kev Ge0rG: I wasn't aware that there was ever a server that broken.
11:14:27 Kev It's very clear in the RFC that the server has to do this.
11:15:12 Ge0rG Kev: me neither. But I need to triangulate that to have a strong argument against adding from=ownJID for conservative compliance reasons.
11:15:38 Kev The strong argument is that if you get it slightly wrong, your server will start bouncing your messages, I think.
11:16:31 Ge0rG whoops, that was the wrong SMACK issue. http://issues.igniterealtime.org/browse/SMACK-547 is right, sorry
11:17:06 xnyhps Hm. It was mentioned in the original Pidgin security issue that started the iq spoofing thing that the 'from' could be spoofed too, but I didn't investigate that.
11:17:25 Kev xnyhps: Spoofed in what way, though?
11:17:47 Ge0rG Kev: as I read the spec, the server may not bounce if the from field is wrong
11:17:47 xnyhps They weren't specific.
11:18:01 Kev Servers either reject messages sent from the wrong JID, or overstamp the right one.
11:18:02 xnyhps But it was suggested they could override it to anything.
11:19:05 Ge0rG Kev: do you know servers that reject?
11:19:20 Ge0rG I would assume it is against the spec
11:19:49 Kev https://tools.ietf.org/html/rfc6120#section-4.9.3.9
11:21:35 Ge0rG Kev: thanks very much
11:23:17 Kev (But I agree that just reading 8.1.2.1 implies that you can't bounce a client trying to spoof other addresses)
11:24:25 Ge0rG so both behaviors are technically "right"?
11:25:31 Kev I think the two bits of the RFC aren't entirely consistent - but yes, I would expect either to be right.
11:26:00 Kev If a client starts trying to spoof 'from' addresses, it would seem sensible that a server can start rejecting the stanzas (or balefiring the user), to me.
11:33:35 Ge0rG This is sensible indeed. Though it might be just caused by a client failing the IDNA nodeprep of its resource string, or forgetting to add a resource to its JID
11:34:23 Kev Which are good reasons for clients not to try to do this themselves, given that servers have to do it form them anyway.
12:11:30 Tobias has joined
12:41:04 emcho has left
12:41:04 emcho has joined
12:41:04 emcho has left
12:41:59 Lance has joined
12:45:09 fippo lloyd: challenge accepted... :-p
12:45:22 fippo seven cameras + four headsets
12:45:28 Lloyd :)
12:56:05 Jef has joined
13:03:34 Tobias has joined
13:04:41 Tobias has left
13:04:45 Tobias has joined
13:07:57 Ge0rG Just got a user request for yaxim: "Please rebrand xmpp instant messaging to 'Xmpp Texting' To help people escape from mobile carrier sms texting extortion"
13:08:03 Ge0rG maybe XMPP needs a new fresh look?
13:09:52 Zash has joined
13:10:31 Simon XMPP Texting, XMPP IoT, XMPP Social, XMPP Video… All ™'d of course.
13:10:43 Simon has left
13:10:49 Simon has joined
13:11:21 intosi Naturally.
13:11:40 intosi A real Internet of XMPP, or IoX™
13:17:01 ralphm I'm still not sure about using 'XMPP' for branding.
13:17:15 Ge0rG ralphm: what else? "Jabber"?
13:17:38 Ge0rG intosi: I like that. from ox to yaxs it is merely a small step
13:17:44 waqas has joined
13:18:41 ralphm Ge0rG: Of course the Jabber trademark has some issues, but it can be licensed through the XSF.
13:19:09 ralphm Ge0rG: I personally like it a lot, some in our community don't. I can see that.
13:19:34 Zash has joined
13:19:38 Ge0rG ralphm: to me, Jabber sounds old and un-snappy. Maybe it is because people often say "do not use that any more, use XMPP instead"
13:19:47 ralphm Ge0rG: but there is a reason I had the Jabber bean bag made. As a word, leaving the TM things aside, Jabber is way better for branding than XMPP ever will.
13:20:01 Ge0rG ralphm: +1
13:20:06 ralphm Ge0rG: yeah, there is a lot of confusion around it
13:22:05 Simon Developers seem to talk about XMPP now. This is the discussion on Hackernews about WhatsApp - https://news.ycombinator.com/item?id=7266618 (Jabber: 1 XMPP: lots more)
13:23:26 Ge0rG they also talk about threema there. and what not.
13:23:43 Simon googles threema
13:23:51 ralphm Simon: yes. Developers is not the target audience for Whatsapp users.
13:23:58 Ge0rG ralphm: we could reinforce the "Jabber" term by naming the compliance suite accordingly
13:24:25 Ge0rG I wish it were... hundreds of millions of developers all over the world!
13:24:34 ralphm XMPP — Jabber is exactly like HTTP — Web
13:25:02 ralphm Ge0rG: oh, don't take me wrong, I think it is fine that devs talk about XMPP
13:26:19 ralphm Also, the figure of hundreds of millions of developers would mean that roughly 5% of the entire worlds' population is a developer. That seems a bit too much.
13:26:23 Ge0rG ralphm: sure. but a compliance badge would be something visible to end-users
13:26:46 Ge0rG ralphm: do not stomp onto my dreams!
13:27:05 intosi ralphm: but now that there are RasPi's, every kid is a developer again, right?
13:27:22 ralphm intosi: do the math
13:27:57 Ge0rG with raspis, NAT and owncloud-everything, it is high time to mandate s2s-0198
13:27:59 intosi ralphm: nah, it's more fun not doing it and imagining most kids around the world programming and creating stuff.
13:28:18 ralphm there are roughly 2 million Pis sold in total
13:29:19 intosi ralphm: don't spoil my dream with proper facts and reason, please ;)
13:46:38 Lance has joined
13:51:30 emcho has joined
14:04:10 Lance has joined
14:04:51 Maranda has joined
14:09:42 Simon has left
14:09:54 bear has joined
14:10:42 Simon has joined
14:11:58 ralphm https://display.ik.nu/xmpp?max_items=20
14:12:03 ralphm sure is busy today
14:13:36 Tobias The site's security certificate is not trusted! :D
14:14:55 ralphm Tobias: I trust it
14:15:01 ralphm so that's false
14:15:24 Tobias honest achmet trusts it too, i suppose
14:16:02 ralphm Tobias: I suppose the question is, who do you trust (more): me or a random list of CAs?
14:16:10 Zash ralphm: Get you some DNSEC & DANE :)
14:16:27 Tobias surely the random list of CAs.... :)
14:17:26 Kev ralphm: How can we trust that the list of CA's is cryptographically random?
14:17:29 Kev -'
14:18:11 Tobias Key Chain lists them in a rather sorted, not random fashion
14:18:18 intosi I trust that cert, but that might be because I also generated the key ;)
14:19:01 Tobias intosi, are you sure it's the same key it was when you've generated it? :)
14:22:35 Simon has left
14:22:51 intosi Tobias: fairly sure, yes.
14:28:50 bear has left
14:29:11 waqas has left
14:37:53 emcho has left
14:41:14 emcho has joined
14:41:50 ralphm Kev: point.
14:48:46 Lance has joined
14:49:56 waqas has joined
14:59:21 m&m has joined
15:00:50 waqas has left
15:06:48 Lance has joined
15:09:54 Zash has left
15:23:16 Maranda has left
15:34:31 emcho has left
15:34:44 emcho has joined
15:38:03 waqas has joined
15:54:36 Zash has joined
16:00:09 dwd Since the BBC has declared WhatsApp as an "incredibly useful" massaging service, should we ensure that everyone knows XMPP is a fully federated massaging service?
16:03:07 Lloyd I think there might be a link between WhatsApp and XMPP too
16:03:32 dwd Right, WhatsApp being like XMPP except less secure and generally screwed up.
16:04:06 Zash "If you think WhatsApp is good, wait till you see a Proper XMPP Client"
16:04:06 Lloyd None of the advantages and more of the mistakes
16:04:09 Zash whenever that happens
16:04:35 Lloyd We need to get Laura to spam all the blog posts / news stories with XMPP-aganda
16:06:09 Ge0rG a massaging service is something I could need right now
16:06:40 Ge0rG hey dwd, you wanted to do some major yaxim rebasing! :D
16:06:48 intosi WhatsApp is to XMPP what fish fingers are to actual fish.
16:12:23 fippo intonsi: tweet that!
16:12:34 intosi Will do :)
16:14:01 Ge0rG is the bad quality of fish fingers a widely-accepted fact among the tech community?
16:14:13 ralphm Zash: I'm so good at waiting. Please make it happen.
16:14:33 intosi https://twitter.com/EdwinMons/status/436533610666270720
16:15:23 intosi In any case it's fish morphed beyond recognition.
16:16:14 Zash oh lawd https://raw.github.com/github/dmca/master/2014-02-12-WhatsApp.md
16:17:26 ralphm intosi: WhatsApp is to XMPP what Chicken McNuggets™ are to chicken?
16:17:52 intosi Same thing, really.
16:17:58 ralphm I see a meme coming
16:18:11 intosi Cut it up, batter it, deep fry, …, profit.
16:18:51 intosi Where … probably is "let CMOT Dibbler convince people it's as good as saussage-in-a-bun"
16:19:11 Zash Deep-fried XMPP
16:19:11 Zash wut
16:19:14 ralphm intosi: if it was only cut/batter/deep fry, it wouldn't be so bad
16:19:46 ralphm in fact, I'd love using such a client
16:20:41 intosi Call it Kibbeling.
16:20:54 ralphm WOAH
16:21:05 ralphm that's so cool on so many levels
16:21:09 intosi :)
16:21:12 intosi I know.
16:21:17 ralphm For those that aren't Dutch speakers:
16:21:54 ralphm Kibbeling is battered cob, but also the verb for, well, petty arguing
16:22:07 Zash :D
16:22:23 Kev Looking at the IETF89 mail, there's no Early-Bird for Day passes, is that right?
16:22:37 emcho has left
16:22:40 ralphm Kev: I don't think so
16:22:54 Kev You don't think it's right, or you don't think there's an early-bird for day passes?
16:22:56 ralphm Of course Jabber is also etymologically dutch
16:23:05 Kev But we don't hold that against it :)
16:23:38 emcho has joined
16:24:47 ralphm intosi: please make a great mobile client named Kibbeling
16:25:16 dwd Kev, Are you an ISOC member?
16:25:23 Kev I am not.
16:25:51 dwd Kev, You could join ISOC, and the England Chapter (there's no Wales), and then turn up on Tuesday for free. :-)
16:26:21 Kev Oh. That sounds like a cunning wheeze. ISOC member get free day passes, or ... ?
16:26:27 dwd On Tuesday.
16:26:54 Kev If only it was a day that's more useful to me...wait, no.
16:31:00 stpeter has joined
16:54:37 Lance has joined
17:00:59 Maranda has joined
17:07:32 dezant has joined
17:11:41 m&m has left
17:11:43 m&m has joined
17:14:08 Lance has joined
17:36:46 Tobias has left
17:36:50 m&m has left
17:39:40 m&m has joined
17:43:38 m&m has left
17:44:16 m&m has joined
17:45:59 fsteinel has joined
17:47:42 emcho has left
17:47:42 Emil Ivov has joined
17:54:03 fsteinel has left
17:57:53 Lance has joined
18:05:45 Laura has left
18:17:50 Lance has joined
18:20:48 ralphm has left
18:20:57 Tobias has joined
18:40:58 Lance has joined
19:06:23 Lance has left
19:29:37 Emil Ivov has left
19:36:38 Tobias has left
19:44:28 Tobias has joined
19:44:32 joakim eriksson has joined
20:03:10 Maranda has left
20:16:05 joakim eriksson has left
20:19:32 m&m has left
20:21:21 emcho has joined
20:25:38 bear has joined
20:46:42 Santiago26 has joined
21:25:00 waqas has left
21:25:48 waqas has joined
21:36:07 jabberjocke has joined
21:37:14 Santiago26 has left
21:44:17 emcho has left
21:44:17 emcho has joined
21:44:59 fippo https://code.google.com/p/webrtc/issues/detail?id=2923#c3 -- i'm wondering if that makes me sad... but then, i don't think anyone every liked libjingle
21:46:32 Kev Not the XMPP bits, I think.
21:46:49 Kev I think lots of people like the bits that're going into webrtc.
21:47:16 Kev I really do need to sort out webrtc/Jingle in Swift.
21:58:27 waqas Did we have any jingle-webrtc spec yet?
21:58:54 emcho has left
21:59:34 fippo waqas: we have all the bits required for voice/video. but the sdp mapping is in several specs
22:01:22 Emil Ivov has joined
22:03:22 waqas So if an XMPP client author wants to interop with other clients, what should they look at? Is other clients' code the best thing at the moment?
22:04:13 fippo waqas: test with swift?
22:05:27 waqas Kev just said that still needs sorting out
22:07:18 fippo oh, webrtc related?
22:07:43 waqas Yes
22:07:58 fippo https://github.com/legastero/jingle-interop-demos then -- the strophe is currently my preferred one
22:08:06 fippo that will change next month though
22:08:12 waqas Thanks
22:08:20 waqas You will have your own next month?
22:10:07 fippo nah, i'll steal stanzas jingle module from lance then
22:13:10 fippo it looks like I need to update the interop demo thing to the proper 0338/0339 support though
22:14:22 waqas Is there anything special these clients expect from the server? Jingle Relay Nodes support or anything like that?
22:17:19 fippo mod_turncredentials is nice but for localhost-test or in the same network things should just work
22:25:57 Lloyd has left
22:29:49 Alex has left
22:37:23 stpeter has left
23:14:24 Emil Ivov has left
23:15:14 emcho has joined
23:35:44 emcho has left
23:35:44 emcho has joined
23:43:23 stpeter has joined
23:45:14 ralphm xnyhps: https://twitter.com/booleanvalue/status/436637700280422400
23:47:44 ralphm It is interesting to read that people only now are starting to discover that Whatsapp is based on XMPP. And even though we might feel they messed it up royally, there are things to learn for us.
23:48:27 stpeter ralphm: certainly
23:52:36 ralphm I'd love seeing a mostly exact clone of whatsapp using standard XMPP protocols. I.e. similar easy of set up, identical feature set (not more), similar UI features. But federated. I'm not sure yet how to do some things (like magically having all your friends there if they also run the same app), though. Would be good to do that exercise.
23:53:48 Maranda has joined
23:54:56 fippo ralphm: get enough VC...
23:55:31 ralphm fippo: heh. well, at least maybe we could think about the feature set and if we can do that with existing protocol
23:56:12 ralphm fippo: and figuring out contacts in federation context seems hard. In the centralized case, you can simply look up phone numbers.
23:56:54 Zash Didn't someone do some research into privacy-aware "magically haivng all your friends there"
23:57:00 ralphm I think I am bit worked up on all the myths around XMPP.
23:57:17 ralphm Zash: I'd love to read papers on tht
23:57:20 ralphm that
23:59:08 Zash http://mail.jabber.org/pipermail/standards/2013-February/027060.html