XSF Discussion - 2017-09-23

Ge0rG: sorry to disappoint you. 😉

Ge0rG, I also strongly had the impression that the Opportunistic TLS term is wrong

but then I looked at wikipedia, and following the wikipedia definition it seems to be right

it just isn’t what it is used for everywhere else, from my perception

Opportunistic TLS is using TLS whenever it's available, and not caring about authentication.

pretty much, yes

at least that’s my understanding of it

which is why I think that term is massively incorrect and misleading for XMPP.

"Opportunistic TLS (Transport Layer Security) refers to extensions in plain text communication protocols, which offer a way to upgrade a plain text connection to an encrypted (TLS or SSL) connection instead of using a separate port for encrypted communication. Several protocols use a command named "STARTTLS" for this purpose. "

Guus, that’s the wikipedia definition, I don’t think wikipedia is necessarily right in those matters.

I’ve been in the SMTP community for quite some time, and there the term Opportunistic TLS definitely refers to "we just do STARTTLS if available and don’t care about authn"

Please fix Wikipedia then. :)

on a completely different subject: our domain is having trouble doing s2s to both jabber.org as well as xmpp.org

did something chagne there/

can someone help me debug on that end what's going on?

What Kev said plus that you continue without TLS in case it's not available (at least that's my understanding)

Flow, indeed

So a xmpp client library set to "TLS required" performing STARTTLS successfully would not be "Opportunistic TLS"

indeed

I don't that's bike shedding, after all, there seems to be some confusion about what it is

I agree

jonasw: :)

and given what Opportunistic TLS means in e.g. SMTP context, I think it would be *very* bad to have that tacked on XMPP

and somebody should clarify it on wikipedia

agreed

hard to find reliable sources though

well psa gave some references to RFCs

I'd possibly do some wikipedia editing myself

but after i've mowed the lawn

> Most SMTP clients will then send the email and possibly passwords in plain text, often with no notification to the user. In particular, many SMTP connections occur between mail servers, where user notification is not practical.

that sentence from the article is also highly misleading

I think we keep calling it STARTLS and just explicitly link to that part of the xmpp rfc

That seems like it would prevent any confusion?

https://xmpp.org/rfcs/rfc3920.html#tls

Any Dev reading xep368 will know that and it uses STARTLS

moparisthebest: did you just use the old RFC on purpose?

Maybe servers should deliver old RFCs only after filling out at least two paragraphs on why the download is necessary. Or a quiz about relevant content of the updating RFC.

Flow: no just first search result :)