XSF Discussion - 2015-11-28

00:08:20 dwd has left
00:08:35 dwd has left
00:13:38 dwd has left
00:13:38 dwd has left
00:17:10 boothj5 has joined
00:20:48 boothj5 has left
00:20:52 boothj5 has joined
00:22:40 boothj5 has left
00:22:45 boothj5 has joined
00:24:43 boothj5 has left
00:25:42 boothj5 has joined
00:30:21 boothj5 has left
00:30:37 boothj5 has joined
00:32:27 m&m has left
00:43:43 dwd has left
00:43:58 dwd has left
00:53:18 m&m has joined
01:04:26 foss81405971 has joined
01:12:28 dwd has left
01:13:24 dwd has left
01:15:17 tim@boese-ban.de has left
01:25:32 m&m has left
01:28:20 arty has left
01:28:20 arty has joined
01:28:21 dwd has left
01:37:18 dwd has left
01:41:43 Lance has joined
01:47:18 google-is-lord has left
01:52:30 dwd has left
01:53:37 dwd has left
01:54:15 Neustradamus has joined
01:55:42 boothj5 has left
02:01:14 Tobias has joined
02:01:15 dwd has left
02:01:16 Tobias has joined
02:01:33 dwd has left
02:14:43 dwd has left
02:16:36 daniel has joined
02:23:29 dwd has left
02:32:44 dwd has left
02:35:10 dwd has left
02:41:12 dwd has left
02:45:40 dwd has left
02:54:36 dwd has left
03:05:46 dwd has left
03:19:31 dwd has left
03:22:16 dwd has left
03:27:56 dwd has left
03:35:35 dwd has left
03:41:39 dwd has left
03:59:50 Jef has left
03:59:51 dwd has left
03:59:51 dwd has left
04:07:12 dwd has left
04:17:26 dwd has left
04:17:27 dwd has left
04:25:27 dwd has left
04:25:53 dwd has left
04:31:09 dwd has left
04:38:01 dwd has left
04:43:43 dwd has left
04:54:08 dwd has left
04:54:25 dwd has left
04:55:58 SamWhited has left
05:07:08 dwd has left
05:14:09 dwd has left
05:19:42 dwd has left
05:26:00 dwd has left
05:39:39 dwd has left
05:40:43 dwd has left
05:50:14 dwd has left
06:09:01 dwd has left
06:09:01 dwd has left
06:16:32 dwd has left
06:18:50 dwd has left
06:27:27 dwd has left
06:28:39 dwd has left
06:35:02 dwd has left
06:38:00 dwd has left
06:40:34 sezuan has left
06:42:50 dwd has left
06:50:25 daniel has joined
06:53:08 dwd has left
06:53:08 dwd has left
07:10:14 dwd has left
07:16:01 dwd has left
07:16:02 dwd has left
07:23:58 dwd has left
07:33:08 dwd has left
07:41:48 dwd has left
07:47:26 intosi has joined
07:53:01 dwd has left
08:11:53 dwd has left
08:25:57 dwd has left
08:31:23 dwd has left
08:37:34 waqas has left
08:44:00 dwd has left
08:44:29 tim@boese-ban.de has left
08:44:32 tim@boese-ban.de has joined
08:49:42 dwd has left
08:51:51 ralphm has left
08:53:06 dwd has left
08:55:20 dwd has left
08:57:28 Flow has joined
09:04:01 dwd has left
09:09:33 Lance has joined
09:15:31 dwd has left
09:25:01 dwd has left
09:27:09 dwd has left
09:30:55 xnyhps has left
09:34:42 xnyhps has left
09:36:37 sezuan has left
09:36:37 sezuan has left
09:36:37 sezuan has left
09:36:38 dwd has left
09:36:39 dwd has left
09:36:57 sezuan has joined
09:39:11 sezuan has left
09:39:11 sezuan has left
09:39:28 Alex has joined
09:39:32 sezuan has joined
09:41:07 Alex has left
09:47:56 intosi has left
09:48:01 dwd has left
09:49:32 dwd has left
09:52:22 intosi has left
09:58:27 dwd has left
10:04:06 dwd has left
10:18:21 dwd has left
10:18:41 dwd has left
10:28:53 dwd has left
10:31:10 sezuan has left
10:34:27 dwd has left
10:47:03 dwd has left
10:47:03 dwd has left
10:48:24 dwd has left
10:57:43 sezuan has left
11:02:21 dwd has left
11:09:58 Kevish has left
11:10:51 intosi has joined
11:11:19 intosi has left
11:11:30 intosi has joined
11:14:10 xnyhps has left
11:20:34 dwd has left
11:22:07 dwd has left
11:25:41 daniel has left
11:26:13 daniel has joined
11:26:43 daniel has left
11:26:48 daniel has joined
11:29:52 daniel has left
11:29:58 daniel has joined
11:36:41 intosi has left
11:37:02 dwd has left
11:37:06 intosi has joined
11:39:11 daniel has joined
11:49:27 dwd has left
11:49:47 dwd has left
11:57:34 dwd has left
11:57:34 dwd has left
12:01:28 daniel has joined
12:06:12 dwd has left
12:06:28 sezuan has left
12:10:13 dwd has left
12:15:21 daniel has left
12:15:27 daniel has joined
12:20:22 daniel has joined
12:20:28 daniel has joined
12:22:19 daniel has left
12:22:25 daniel has joined
12:28:08 Neustradamus has left
12:29:05 Lance has joined
12:31:03 intosi has left
12:31:08 intosi has joined
12:31:19 intosi has left
12:31:43 intosi has joined
12:32:01 dwd has left
12:53:33 dwd has left
12:54:54 intosi has left
12:54:58 intosi has joined
12:59:55 SouL has left
13:01:05 SouL has joined
13:02:41 dwd has left
13:07:57 intosi has joined
13:10:21 arune has left
13:14:41 dwd has left
13:20:56 xnyhps has left
13:36:17 dwd has left
13:37:04 dwd has left
13:41:00 waqas has joined
13:47:48 foss81405971 has joined
13:48:35 google-is-lord has left
13:53:06 dwd has left
13:53:20 dwd has left
13:55:05 daurnimator has left
13:55:38 ralphm has left
14:01:05 ralphm has left
14:11:37 dwd has left
14:12:16 dwd has left
14:19:42 ralphm has left
14:25:04 xnyhps has left
14:31:00 dwd has left
14:39:47 dwd has left
14:46:17 dwd has left
14:52:28 dwd has left
14:58:08 Link Mauve Sigh… https://github.com/candy-chat/candy/issues/445
14:58:43 daniel has left
14:58:48 daniel has joined
15:00:23 SamWhited This is why XHTML-IM needs to be replaced. I know technically it's secure, but it's too easy for people to screw it up.
15:00:53 xnyhps has joined
15:02:37 Link Mauve Web people manage to screw up without its help, you know.
15:03:00 SamWhited Exactly, the situation is bad enough as is without us encouraging it :)
15:03:25 daniel has joined
15:03:29 Jef has joined
15:03:47 Link Mauve I think on the contrary, specifying a whitelist helps people get things right.
15:04:29 intosi has joined
15:04:59 SamWhited Oh yah, the xep does it right, but no one actually reads standards.
15:06:19 daniel has left
15:06:23 daniel has joined
15:06:55 Link Mauve Meh, Candy’s latest version seems actually pretty buggy.
15:07:05 SamWhited (I'm only sort of being facetious now...)
15:08:26 intosi has left
15:09:35 daniel but hey html in text message is a really good idea
15:10:27 Zash So are you submitting a patch? ;)
15:11:45 Kevish I'm not convinced that removing xhtml-im would improve anything.
15:12:26 Kevish People who just want pretty text and don't care about how they do it are no better off without a spec telling them they're being silly, certainly, and for people who want pretty text and do care, it's helpful to give a 'right way' to do it.
15:12:56 Link Mauve I fully agree with that.
15:13:20 daniel has joined
15:18:00 daniel has left
15:18:01 dwd has left
15:18:05 daniel has joined
15:19:08 daniel has left
15:19:14 daniel has joined
15:26:00 dwd has left
15:27:40 daniel has left
15:27:45 daniel has joined
15:30:33 daniel has left
15:30:39 daniel has joined
15:31:06 SamWhited Nah, if we gave them basic-formatting-language-im I don't think they'd add script tags too it or inject out straight into the dom.
15:31:53 sezuan has left
15:32:04 daniel has joined
15:32:10 Link Mauve You seem to be overestimating them.
15:32:11 Zash That's exactly what would happen
15:32:39 Link Mauve innerHTML is easy to use, and there is nothing that could harm the user in this new language right!
15:33:50 daniel has left
15:33:56 daniel has joined
15:35:45 daniel has left
15:36:08 daniel has joined
15:49:09 dwd has left
15:49:09 dwd has left
15:49:59 SamWhited Fair enough :(
15:51:43 SamWhited Yah, it's true; no idea where that burst of optimism came from, but you're right of course.
15:52:41 daniel has joined
15:54:17 Kevish Nor me, but it's obviously not healthy :)
16:03:26 daniel has left
16:03:34 daniel has joined
16:03:34 dwd has left
16:04:04 dwd has left
16:06:12 xnyhps has joined
16:12:11 daniel has left
16:12:33 daniel has joined
16:15:39 daniel has joined
16:15:45 daniel has joined
16:17:10 bjc has left
16:17:11 dwd has left
16:18:02 daniel has joined
16:18:07 dwd has left
16:18:08 daniel has joined
16:21:46 daniel has left
16:21:51 daniel has joined
16:22:06 dwd has left
16:22:40 xnyhps has left
16:23:30 Flow has left
16:24:57 daniel has left
16:25:06 daniel has joined
16:32:12 dwd has left
16:44:02 SamWhited has left
16:49:44 dwd has left
16:50:14 tim@boese-ban.de has left
16:50:55 tim@boese-ban.de has joined
16:51:09 dwd has left
16:53:12 xnyhps has left
17:01:36 Jef has left
17:06:12 daniel has left
17:06:13 dwd has left
17:06:13 dwd has left
17:06:19 daniel has joined
17:09:43 edhelas has joined
17:12:28 dwd has left
17:13:17 dwd has left
17:19:35 dwd has left
17:20:15 dwd has left
17:22:22 Link Mauve edhelas just reminded me that his client used to pass the body itself to the DOM. :p
17:22:27 Link Mauve Without implementing XHTML-IM.
17:30:39 dwd has left
17:33:51 SamWhited Theoretically the body is escaped though, so as long as you're not unescaping it you should be good (though it never hurts to double check).
17:34:33 SamWhited I'm sure your could find a way to exploit it if you're sticking anything straight into the DOM
17:36:09 dwd has left
17:37:53 Link Mauve No, there is no escaping in the strings you get from your XMPP library.
17:38:11 Link Mauve It’s always the application role to escape things as they see fit.
17:38:17 daniel has joined
17:39:28 Kevish Right. The body's escaped on the wire, but what you get out of your XMPP lib isn't going to be.
17:40:34 Zash unless it's a really bad lib made of regexes
17:40:39 Link Mauve :D
17:41:11 Zash Also depends on how you put stuff into the DOM
17:41:24 Link Mauve innerHTML ALL the things. o/
17:42:44 Jef has joined
17:50:15 dwd has left
17:50:42 dwd has left
17:51:20 dwd has left
17:55:55 dwd has left
17:58:25 dwd has left
18:06:36 dwd has left
18:10:39 dwd has left
18:21:17 daniel has left
18:21:24 daniel has joined
18:22:26 daniel has joined
18:22:31 daniel has joined
18:33:03 dwd has left
18:33:04 dwd has left
18:41:19 intosi has joined
18:42:17 Zash has left
18:53:19 sezuan has left
18:54:04 intosi has left
18:54:20 intosi has joined
18:58:21 dwd has left
19:00:11 daniel has left
19:00:17 daniel has joined
19:00:29 dwd has left
19:01:19 dwd has left
19:02:19 daniel has left
19:02:25 daniel has joined
19:03:55 sezuan has left
19:09:38 daniel has left
19:09:43 daniel has joined
19:09:44 dwd has left
19:10:25 dwd has left
19:17:48 xnyhps has joined
19:18:02 sezuan has left
19:25:36 andy has joined
19:32:32 dwd has left
19:41:36 Lance has joined
19:48:42 intosi has left
19:49:08 intosi has joined
19:51:32 tim@boese-ban.de has joined
19:52:08 tim@boese-ban.de has joined
19:57:46 andy has joined
20:00:57 dwd has left
20:09:10 dwd has left
20:19:45 dwd has left
20:20:40 dwd has left
20:29:29 dwd has left
20:33:44 andy has joined
20:35:51 dwd has left
20:41:09 dwd has left
20:47:52 dwd has left
20:48:06 xnyhps has left
20:53:29 intosi has left
20:53:55 intosi has joined
20:59:49 bjc has joined
21:04:34 dwd has left
21:07:12 google-is-lord has left
21:09:14 ralphm has left
21:20:44 dwd has left
21:21:01 dwd has left
21:26:09 foss81405971 has joined
21:27:49 dwd has left
21:29:38 google-is-lord has left
21:30:23 foss81405971 has joined
21:30:38 google-is-lord has left
21:33:49 andy has joined
21:33:59 foss81405971 has joined
21:36:50 dwd has left
21:36:50 dwd has left
21:39:32 daniel has left
21:39:36 daniel has joined
21:40:16 google-is-lord has left
21:40:34 foss81405971 has joined
21:45:09 dwd has left
21:54:47 dwd has left
21:55:07 dwd has left
21:56:40 dwd has left
22:03:59 dwd has left
22:09:38 google-is-lord has left
22:09:47 foss81405971 has joined
22:14:09 sezuan has left
22:26:40 dwd has left
22:27:34 dwd has left
22:32:37 edhelas has left
22:35:37 dwd has left
22:41:21 google-is-lord has left
22:43:48 dwd has left
22:43:54 foss81405971 has joined
22:45:59 bingooo has joined
22:49:53 bingooo has left
22:51:54 dwd has left
22:52:55 foss81405971 has joined
22:57:26 dwd has left
23:02:46 google-is-lord has left
23:04:20 boothj5 has joined
23:04:21 dwd has left
23:14:38 google-is-lord has left
23:15:41 bjc has left
23:15:42 dwd has left
23:15:42 dwd has left
23:16:21 foss81405971 has joined
23:18:12 boothj5 has left
23:19:20 boothj5 has joined
23:27:46 dwd has left
23:27:56 dwd has left
23:32:57 daurnimator has joined
23:32:58 dwd has left
23:42:19 dwd has left
23:42:20 dwd has left
23:46:17 google-is-lord has left
23:48:38 foss81405971 has joined
23:50:05 dwd has left
23:51:09 bingooo has joined
23:52:32 andy has joined
23:55:13 dwd has left