XSF Discussion - 2014-03-01

00:39:20 Lance has left
03:13:28 emcho has joined
03:13:28 emcho has left
03:18:20 Tobias has left
07:13:03 emcho has joined
07:13:03 emcho has left
07:13:03 emcho has joined
07:35:37 Santiago26 has joined
07:41:24 emcho has left
07:41:24 emcho has joined
07:51:41 Santiago26 has left
07:58:22 emcho has left
07:59:23 emcho has joined
08:04:35 Santiago26 has joined
08:08:59 xnyhps has left
08:16:08 emcho has left
09:19:50 Santiago26 has left
09:27:47 fsteinel has joined
09:52:19 emcho has joined
09:58:30 dwd Kev, WHile I remember, you had objections to my XEP-0001 pass; could you post them to the list so others can agree/disagree?
09:59:04 Kev Yes. It's in my todo system. This isn't particularly time-critical though, is it?
09:59:49 dwd Kev, I think that the correct thing is that Editor approves Humour, but will run things past COuncil members and other advisors individually to ensure sanity. Possibly mandate that it's never me, since it hasn't ever been as far as I know. :-)
10:00:24 dwd I'd like to keep momentum up on the discussion, if possible, then we can get it all over with.
10:00:53 Kev OK. I'll try to get to it sooner than later, then.
10:01:26 dwd Ta.
10:01:44 Kev I'm not really sure I like the thought of there being any XEPs for which the approving body isn't either Council or Board.
10:03:17 dwd These *are* Humorous ones. Maybe it needs "in consultaion with the XMPP Council Chair" specifically?
10:04:02 Kev It seems somewhat self serving, but I'd be happy with direct approval by council chair, yes.
10:04:33 Kev Although TBH I'm not sure what the problem with just using Council is.
10:05:15 Kev What usually happens is just someone says to Council, quietly, "I'll be writing along these lines" and Council says "Fine, go ahead".
10:05:59 fsteinel has left
10:06:08 Kev The counter to "These *are* Humorous ones." being "These *are* XEPs".
10:09:13 Kev If we went with XEP Editors, we'd need to put in place some sort of rules for meetings and approval process, I think, which we don't currently have.
10:09:51 Kev And being able to take a XEP through every step of the process autonomously dramatically changes the scope of the Editor team.
10:24:10 emcho has left
10:25:16 xnyhps has left
10:29:37 Zash has joined
10:39:29 Zash has left
11:22:52 Tobias anyone happen to know if XEP-0027 also works for MUCs? and wether that's implemented?
11:23:18 Kev 27 doesn't even work for presence :)
11:23:34 xnyhps 27 doesn't work.
11:23:39 Kev And no, it wouldn't work for MUC.
11:23:46 Kev Basically, don't go near 27.
11:24:27 Tobias ok
11:25:08 Tobias with doesn't work for presence you mean you can't encrypt presence messages?
11:25:31 Tobias with doesn't work for presence you mean you can't encrypt presence stanzas?
11:25:34 xnyhps You can sign presence or encrypt (but not sign) messages. That's all.
11:25:45 Kev No, I mean that there's no protection against replay attacks.
11:26:05 Kev It's full enough of holes that we should just stay well away.
11:26:16 Kev Thus the mail I just sent to council@ about getting rid of it.
11:26:17 Tobias PGP for email doesn't have that either, not?
11:26:45 xnyhps Tobias: PGP signatures contain a datestamp.
11:26:56 xnyhps in email.
11:27:12 Tobias Kev, http://wiki.xmpp.org/web/XMPP_E2E_Security i've started to collect an overview about all proposals out there
11:27:24 Tobias xnyhps, ahh..ok
11:27:49 Kev You should probably mention that OTR doesn't have clean discovery.
11:28:33 Kev Unless you know the person you're talking to has OTR from out-of-band discovery (e.g. talking to them), the experience is quite horrid.
11:28:54 xnyhps I disagree with the "Yes"es for Authenticity and Integrity with PGP.
11:29:06 Kev Right.
11:29:15 Tobias xnyhps, it doesn't provide those?
11:29:52 xnyhps Nope.
11:30:09 Kev We should really forget 27 exists, and get rid of it.
11:30:17 xnyhps Your messages aren't signed, any attacker can replace them with any other encrypted message.
11:30:20 Kev Presumably in the other order, or we wouldn't remember what we were getting rid of.
11:30:40 Tobias xnyhps, that's for XEP-0027, not for email usage of PGP right?
11:30:46 xnyhps Yes.
11:30:49 Kev Tobias: It provides complete protection as long as you have absolute faith in your server, their server, and all the networking in between.
11:30:51 Tobias maybe i just expected XEP-0027 to be too much like email PGP
11:31:02 Tobias Kev, right...why do i need e2e then
11:31:03 Tobias :)
11:31:07 Kev Yes.
11:31:12 Kev See earlier question about burning 27 with fire.
11:31:20 xnyhps +1 for fire.
11:31:21 Kev s/question/comment/
11:34:04 Tobias !xep 27 doesn't have discovery support either it seems
11:34:12 Tobias at least i see nothing about disco in the XEp
11:35:05 Kev Fire
11:35:06 Kev It
11:35:07 Kev Burn
11:35:09 Kev With.
11:35:57 Tobias updated the table...will add a couple sentences in the section above
11:37:07 xnyhps I also disagree with the "No" for multiple resources for OTR.
11:37:17 xnyhps But maybe it's also not "Yes". :P
11:37:50 Tobias right..the detailed answer probably doesn't fit in a table cell
11:38:05 Tobias but i could add a paragraph above in the section of OTR to it
11:38:23 Tobias also wondering what version we should describe there? OTRv2 or OTRv3?
11:38:27 Tobias what's used out there?
11:39:25 xnyhps I don't actually know, beyond Pidgin and Adium.
11:42:00 xnyhps (I'd also say "Malleable encryption" should be "n/a" for PGP, as it doesn't even have authenticity. Sorry for pestering you, I can't find my xmpp.org login.)
11:45:08 Kev I wonder if it'd be interesting to do a 'real' gpg spec.
11:46:19 Tobias it'd at least have great support for offline messages :)
11:47:49 Kev It would.
11:47:56 Kev And at least the methods for trust are established.
11:53:34 dwd In fairness, XEP-0027 is better protection than many of the recent commercial "secure IM" services that seem to have sprung up.
11:54:11 Tobias dwd, to what are you referring exactly?
11:54:59 dwd Tobias, Most of the new security bandwagon services seem based around similarly, or worse, flawed models.
11:56:02 Tobias *most* probably qualifies here, considering the ton on new services
11:56:24 Tobias you guys know of any implementation of RFC 3923?
12:01:47 dwd I don't. I have heard people say there hasn't ever been one.
12:02:09 dwd In fairness, 3923 isn't even a bad design, as far as I can tell, it's just ugly.
12:05:40 Tobias don't RFCs require implementation at some level?
12:08:03 dwd Only to move to Draft, IIRC.
12:08:21 Tobias ah..ok
12:08:29 dwd Which is vaguely silly - they shifted the meaning of each level while keeping the requirements largely the same.
12:09:52 Alex has joined
12:33:42 Zash has joined
13:04:48 Ash has joined
15:20:57 Ge0rG isn't it finally time to consider one-to-one chats as a subclass of multi-user chats, security-wise? After all, you have your smartphone and your desktop connected (or connecting later) and want all your IM backlog there
15:22:04 Ge0rG btw, how did WebRTC solbe the certificate/identity management problem for DTLS?
15:22:09 Ge0rG *solve
15:40:12 Zash There's a fingerprint in the SDP blob.
15:42:45 Ge0rG Zash: how is that supposed to solve anything?
15:43:37 Tobias users obviously will meet in person to validate those
15:43:45 Zash And I don't know if there are actual certificates.
15:43:57 Ge0rG if I meet my users in person, what do I need WebRTC for?
15:44:14 Zash Ge0rG: Define "anything".
15:45:52 Ge0rG Zash: anything is the set of IT security properties that a cryptographic protocol should be able to solve: integrity, authenticity, privacy, nonrepudiation|deniability, and one or more unimportant ones
15:48:12 Zash Ge0rG: And a DTLS fingerprint does not?
15:48:30 Zash Assuming you shuffle that securely to the other party, along with the rest of the SDP stuff
15:49:26 Ge0rG Zash: so you are assuming a secure channel between two parties, which you use to construct a secure channel between these two parties?
15:50:11 Zash The connection to a common server, yes. :)
15:50:32 Ge0rG Zash: a trusted common server that does not manipulate your packets
15:50:42 Zash Yes.
15:51:00 Kev If you don't trust the server, when it's the server providing the application, you're in some amount of trouble.
15:51:13 Zash That.
15:51:34 Ge0rG ok, now that's where XMPP is different from WebRTC
15:51:40 Kev Yes.
15:52:54 Ge0rG does WebRTC support federation?
15:53:13 Kev Different layer.
15:53:20 Kev Or, kinda.
15:53:21 Ge0rG (actually, that question does not matter.)
15:53:52 Ge0rG I just realized that me trusting my own server does not help at all in establishing a federated session through a different, untrusted, server
16:17:14 emcho has joined
16:17:15 emcho has left
16:17:15 emcho has joined
16:17:15 emcho has left
16:17:15 emcho has joined
16:23:17 Maranda has joined
16:25:19 Ge0rG who can contribute to the xmpp.org wiki?
16:30:13 Zash A bunch
16:30:24 Zash You, if someone gets you an account :)
16:33:27 Ge0rG ah, so the formal requirement is "get yourself added"
16:34:28 Tobias right
16:38:47 emcho has left
16:42:25 Alex has left
16:45:18 Maranda has left
16:49:30 Tobias basically you just ask for an account in the jdev chatroom and some admin will likely create an account for you
17:08:56 Jef has joined
18:10:27 emcho has joined
18:10:27 emcho has left
18:10:27 emcho has joined
18:33:46 emcho has left
18:59:22 intosi has left
19:20:19 Zash has left
19:21:59 Tobias has joined
19:42:50 dezant has left
19:45:13 dezant has joined
20:38:04 Jef has left
20:49:49 dwd has left
21:03:35 intosi has joined
22:05:36 emcho has joined
22:11:10 emcho has left
22:11:14 emcho has joined
22:12:38 emcho has left
22:12:42 emcho has joined
22:14:28 emcho has left
22:14:29 emcho has joined
22:16:25 emcho has left
22:16:29 emcho has joined
22:18:20 emcho has left
22:18:21 emcho has joined
22:19:59 emcho has left
22:20:00 emcho has joined
22:21:53 emcho has left
22:21:54 emcho has joined
22:25:30 emcho has left
22:25:31 Emil Ivov has joined
22:28:12 Emil Ivov has left
22:38:59 emcho has joined
22:40:55 emcho has left
22:40:56 emcho has joined
22:42:34 emcho has left
22:42:36 emcho has joined
22:44:13 emcho has left
22:44:18 emcho has joined
22:45:59 emcho has left
22:46:00 emcho has joined
22:47:41 emcho has left
22:47:42 emcho has joined
22:50:23 emcho has left
22:50:25 emcho has joined
23:07:18 xnyhps has left
23:23:58 Ash has left
23:41:13 Tobias has joined
23:49:10 xnyhps has left