XSF Discussion - 2018-02-20

If a server would like to be able to let its clients look up a semi-static, web-based resource, do we have a mechanism for that?

XEP-0215?

I’m not sure

HTTP over XMPP?

what are you trying to achieve?

The MUC participants list?

I'm trying to let clients figure out the URL for a webrtc conference service that can be used

ah

hm

no idea :-)

put it into the server's disco#items

I think the issue is that we have multiple mechanisms for that

but basically a well-known location to lookup, if it's disco#info, xep215 or just a defined IQ

Ge0rG, for it to be useful in disco#items it needs to reply to disco#info (to discover its identity and features)

jonasw: right.

is an external webrtc based conference really an identity of an XMPP entity?

guess it depends on how tightly coupled they are

flow, no

but the issue is that the disco#items item has ~no information

jonasw, you mean only crude hacks would allow the URL of the webrtc conference service to be included in disco#info?

flow, I’m confused

yeah, me too

so you are actually takling about the item, hmm

ok, sure you need a follow up disco#info on the item, as you already said, then you could possibly put the URL into a form field of the disco#info response

the question is, what would be the JID+node of the item?

well if you want MUCs to announce a related webrtc conference, then it would be simply the MUCs bare JID I'd say

Guus, does that help?

Sorry, got dragged into a phone call

well, it's not always related to an existing MUC. I'd also like to use this for people to invite each-other into a new 1-on-1 call

Flow brought up the same alternatives as that I found

plain discovery doesn't feel quite right. I'd like to prevent running something custom, so that leaves 0215 - my concern there is that it's highly geared towards STUN/TURN - or at least, that's how I've used it.

I'll try to see where 0215 gets me, and work from there.

Thanks guys.

\o/

make sure to report back, so that we can maybe get that Un-Deferred

I've actually implemented it in Openfire

In some setups, Jitsi is also using it

so, yeah, maybe dusting that off isn't the worst idea

I think Prosody has two modules for it

so what do people do against subscription spam?

One idea is requiring a CAPTCHA ...

what clients support that? ✏

I've actually not had spam in along time

I did blacklist some domains though

i get 2-3 spam requests a week or so

I'm also reaching out to server admins from where I see spam, with mixed results.

I've added xep-0157 support in the last release of Openfire, which should gradually start to help with that, in the future

I usually check if source servers have in-band registration enabled and if there's any 157 addrs, then block.

and yeah, I want to do the captch thing too, server-sided, but haven't found the time yet.

Tobias: Well you'd include an HTTP(S) URL in the <body/> for those clients that don't support it. (But quite a few do I think.)

captcha-like thing that's just an user-set question with a predefined answer sounded promising, anyone looked into having that serverside?

Zash, there's a XEP for it that appear to cover it pretty well

Oh?

I don't know if I like it's suggestion of tying it in with privacy lists, but at least it's a definition that we can already use, today.

let me find it

-0159

-xep 159

Zash: Spim-Blocking Control (Standards Track, Deferred, 2006-07-11) See: https://xmpp.org/extensions/xep-0159.html

it doesn't explicitly tell you to do CAPTCHA, but it does explain how the server-sided blocking process should work, and when it should start spim recognition procedures

I like user-set questions, but the problem on the other hand maybe providing several questions, one for each language you speak, for instance.

I haven't check the XEP though

-xep pars

Zash: Pre-Authenticated Roster Subscription (Standards Track, Experimental, 2017-02-16) See: https://xmpp.org/extensions/xep-0379.html

Zash: can we have automatically maintained JID whitelist for all JIDs that a local user ever sent messages to?

Also I really dislike the word "spim".

seriosuly pointless instant messages

Ge0rG, 0159 refers to those lists as 'correspondents lists'

Ge0rG: Technically, with MAM, you do.

`SELECT DISTINCT "with"` pretty much

Zash: are we talking `SELECT DISTINCT with`?

Eww.

That has O(fail) complexity

Ge0rG: My point is, it can be derived from MAM data already.

Zash: except for the "ever" part

Ge0rG: Privacy people won't like you keeping such metadata forever!

Ge0rG: Why tho?

Holger: bloom filters everywhere!

Zash: as a whitelist against incoming spam

Isn't the MAM data is good enough in practice for whitelisting people from anti-spam mechanisms? In case that was the idea.

Holger: maybe, except if you don't use mam

Then you're an unhappy person anyway.

if you haven't talked to someone long enough for them to still be in your mam archive... yeah.

Ge0rG: I'm still bit undecided on whether to like how we can offer an IM solution with server-side storage being optional vs. hating this fact because we need to solve everything twice, for the MAM and for the non-MAM case.

Can't we be happy with rosters (and directed presence) as whitelist?

If I bug you with a Prosody question despite you not being on my roster, I'd prefer you not also having to cope with a CAPTCHA because you're probably annoyed by my question anyway.

We have a chatroom for that :)

But I'm a user, I prefer bugging you in private.

Not that I really believe in CAPTCHAs anyways

Yes they're not the proper solution. But a hack that works better than other hacks, in my book.

I still think the proper solution is SpamAssassin. Auto-classifying traffic based on as many factors as we can get hold of.

Well the proper solution is ditching capitalism.

does SpamAssassin work for non-email environments?

Guus: No I just meant the concept.

kk

Holger, I'm less convinced that will work with IM, since messages are shorter

All it takes is spammers to adapt to sending 'Hi' messages, although what they currently send is pretty email-like (whole advert in a self-contained message)

MattJ: But then again we have things email doesn't have, such as the roster, and proper s2s authentication.

There's no one silver bullet here. We'll likely need multiple, partial solutions.

MattJ: The email body is just one of *many* things SpamAssassin looks at.

That is true, but in any "learning" anti-spam system, it's just going to learn that not being on the roster is a very high indicator of spam

which is just what we knew already :)

I can count the number of times I get legitimate out-of-roster messages in a year on the fingers of a single hand

Exactly? I'm just proposing to take all such indicators into account, add them up and divide by 42, look at the resulting score and decide.

and for a normal user, I'd expect that to be even lower

So you'd rather not look at other indicators and just block strangers or what?

Single hand per year sounds realistic to me (actually it's a bit more for me I think), and I'd rather not kill that communication off.

No, I'm just saying I don't think the added complexity is worth it compared to a human figuring out the same factors (and there aren't many)

I think there are actually quite a few factors a server can look at but a user can't.

Traffic frequency, blacklists, I don't know.

And I believe we could get a good classification rate without having to bother the user. Like we can for email. I might be wrong of course.

Stick all the classifiers we know into a tag on the message?

Wasn't one of the spam XEPs something like that?

-xep spim markers

Zash: Multiple matches: Spim Markers and Reports https://xmpp.org/extensions/inbox/spim.html Spim Markers and Reports https://xmpp.org/extensions/xep-0287.html

Bunneh: how about you skip the inbox one if it's published?

Holger: the problem with a server-side classifier is that it needs to delay messages

Ge0rG: Because?

Holger: to gain sufficient context to identify spam patterns

Holger: like "(presence followed by message with a link) sent to ten users"

Well this sounds like just one of many things you could check, to me. If it seems too undesirable, don't do it.

I heard of someone getting good results with simpler mod_firewall rules.

Holger: mod_firewall can't block presence that comes right before the spam message.

Holger, Ge0rG: It stops being Instant Messaging if you gotta hold on to stuff for checks before delivering.

Zash: let me tell you about the irony of your response taking over three hours.

:)

I was out

Zash: with CSI, that presence subscription will be delayed anyway.

Subscription request should not be delayed.

Still, I'm sure we could delay spammy looking things for like 10 seconds

And that would give us a window of opportunity to detect spammy patterns

But imagine someone says something WRONG and you can't respond IMMEDIATELY.

THE HORROR

That would just violate the entire purpose of the Internet !

I'll violate the purpose of the internet now and go offline.

Don't overreact guys. There will still be images of cats.

well then spammers would just wait 11 seconds Ge0rG

it's *always* going to be an arms race

there is no solution, only 'good enough for now'

as long as the incentives and the roi are there

https://www.eveonline.com/article/p4g5k3/preparing-for-the-future-retirement-of-eve-voice

OK, this was not a channel I expected to see linking to Eve.

That ejabberd?

No idea.

Ah so I learnt from Neustradamus that this is old stuff. Wasn't aware and the article's date says 2018-02-20 ...

not convinced

the forum thread it links to is also recent

Holger: It's not old stuff, it's newly announced today.

And yes, it's a fork of ejabberd.

Or, at least, CCP have a fork of ejabberd on github.

Kev: Yes but an upgrade of ejabberd, not a new service, XMPP is used since a long time :)

Why would CCP lie?

I think some sort of reference is in order here.

That's something we need to put on our marketing banners either way!

"listen, KDE dudes and dudettes! Eve Online is using xmpp, and you can too!"

as are riot games, right?

League of Legends (or what's it called)?

Guus: yes and yes.

Is there an online gaming imperium running in the matrix?

I suspect the KDE peoples use case is significantly different from an online game's chat system, unfortunately

Although it's probably still good marketing

Some other game engine (maybe unreal?) also has an xmpp client build in for team chat

I think the strength is rather in match making, where you need to have a real time connection to many thousands users, and not so much for chats in a small team that's exchanging data all the time anyway

Oh yeah that might by right. Just stumbled over the api docs one days. Never really questioned what exactly they are using it for

daniel, game-wise, I know that Quake-live used it.

I'm actually considering parsing the user-input provided in our setup field named 'database URL' to drop [ and ]

The template that we provide is: jdbc:postgresql://[host-name]:5432/[database-name]

we just had someone with problems, connecting to [localhost]

are those valid characters for the database-name part though?

but you could also just change that to HOST-NAME-HERE

I'm guessing that we save more people from their own stupidity than bother those machosists that actually use [ or ] in a database name.

you can change some stuff, but in the end, you can't fix stupid :)

maybe don't ask for the URL, but use explicit fields for hostname and databasename

in my experience that's a bad time, unless you only ever support postgresql or something

because different jdbc drivers take different crazy arguments you can only supply via URL

nah, a couple different ones. but all basically require a host, port and some kind of database identifier. We can change the input field label where needed.

I have to do this for example jdbc:mysql://localhost:3306/rcrdit?user=rcrdit&amp;password=rcrdit&amp;serverTimezone=America/New_York

and the people that want to use a URL, are savvy enough to simply use our XML config instead.

databasename=username=password, nice :)

oracle has a whole thing about using a host:port:instance-or-something vs host:port/service-name

and you can't set those seperately without tying your code exclusively to oracle at compile-time, if you don't just use the URL

yea as long as you keep a URL an option it should be fine

also on everything matching this is example config :)

my point being had to set the serverTimezone in the URL which is obnoxious

(on a side-note: can't you configure that server-side in mysql - something like: 'these are the default client connection params')

you'd think, the jdbc driver still crashed though, didn't look into it much

https://oldforums.eveonline.com/?a=topic&threadID=665867 :)

it's probably like charset in mysql where you have to set it all 16 places

yeah, mysql is fun :)

migrating to postgres has been on my todo list awhile now

hard to fix what ain't broke though when other stuff needs fixing :)

I know the feeling all to well

Neustradamus: What's the relevance of that link?

That Eve corps commonly use XMPP servers for pings is common knowledge, and unrelated to Eve chat.

it says "It's an Instant Messaging server for EVE players, with some EVE API integration."

Some player ran an XMPP server and sold access to Eve players.

I'm still missing the relevance.

ah I see

https://engineering.riotgames.com/news/chat-service-architecture-servers 2015 here

"and thanking opponents for a good game." haha

I'd be interested to have stats for that, I believe insults are more frequent

Neustradamus: Than one I'm aware of, but Riotgames is unrelated to CPP/Eve, no?

Yes.

Kev: http://uu.diva-portal.org/smash/get/diva2:408940/FULLTEXT01.pdf maybe better here?

If i'm making a online game why on earth would I roll my own chat system when something like XMPP already exists?

with a long list of deployments serving huge numbers of users :)

Did RIOT employees ever write or contribute any XEPs?

Is that important? If every user of XMPP needs to write a bunch of XEPs, we're probably not doing a great job.

no certainly not - just interesting

riotgames .. same as riot entertainment? :D

"I survived riot entertainment" :o