XSF Discussion - 2017-02-17

I wonder if we could use this for gathering IPR releases from people automagically (and only the first time for all future submissions): https://cla-assistant.io/

Hmm I don't think I ever did that

Oops…

moparisthebest: > so based on a clients support or mix or not, could a server allow them into a mix channel if supported or throw them into some type of muc compatibility layer for the mix jid if not? This is exactly what I'm asking for for half a now! :)

hyvää päivää, guten morgen, god morgonen, good morning, bonjour!

jonasw: you forgot the UGT zone reference 😜

I was busy with remembering swedish and french ;-)

*(UGT)

moparisthebest: would you prefer language comments to your XEP(s) as comments on github, PRs or via email?

@all how much have we (the XMPP communities) discussed around zero-knowledge messaging in the past?

jonasw: any are fine but PRs are probably the least work for me so I'd prefer those :-)

nyco: what is that? Haven't heard that term applied to messaging before...

moparisthebest, well that is indeed the same, but applied to messaging, some pretend to do that, not sure of the details

It doesn't quite make sense to me when applied to messaging, remote file storage yes, messaging no...

basically no metada that allows to build some social graph?

Ah so it just means protecting metadata from the servers?

moparisthebest, maybe more, as I said, not sure about the details

That seems impossible with xmpp

so, for XMPP, for example it could be with MAM nor Offline

and anonymous connections

That's just data

plus some kind of encryption

and no logs

And yea so listening via tor

tor is just blurring tracks, not removing them

No logs isn't something enforceable though, it's just trusting people...

so not zero-knowledge, but minimal-knowledge, indeed

The only metadata free type of messaging I know about just kind of publishes huge blocks of encrypted data at regular intervals to something public

So it's not instant messaging, more like email

interesting

And a lot of wasted data and such but point is an onlooker doesn't know who the data is for, how much, or if it's actually anything at all

Now what was that called.....

so, how about some sort of guidelines document, where we describe how to do: minimalist logs, no offline, minimalist mam, e2e encryption, perishable messages

Is offline/mam a problem with e2e?

not sure about this question: I guess it is needed to buffer some messages in case the guys are not online, for later reading?

"buffer", like in "temporarily store"

https://en.m.wikipedia.org/wiki/Ricochet_(software) that's one solution

Xmpp could be used the same way

Where each user has their own server listening on a .onion domain

I didn't read this yet but a paper about metadata conscious instant messaging http://jmlr.org/proceedings/papers/v48/fanti16.pdf

Another https://www.cs.cornell.edu/~tyagi/papers/stadium.pdf

https://www.microsoft.com/en-us/research/video/charles-river-crypto-day-building-anonymous-messaging-systems-that-hide-the-metadata/

oh nice

doing "fast search engine based research" in parallel: some instant messaging apps pretend to do zero-knowledge, but this is just "hey we can't read your stuff, you are protected from us"