XSF Discussion - 2018-03-18

  1. Neustradamus

    For info: https://dev.gajim.org/gajim/gajim/blob/gajim-1.0.0/ChangeLog

  2. edhelas

    Dave Cridland hi :)

  3. Zash

    Where do I vote for having Dave be put in charge of naming things?

  4. Kev

    Try the having-vote-place.

  5. Zash

    So I just put "Dave gets to name things" on a blank vote in the coming general elections?

  6. jonasw


  7. jonasw

    I wasn’t sure whether he was drunk and whether I should really merge that :-)

  8. goffi


  9. Ge0rG

    Pigeon, one of the two big players in xmpp.

  10. tim@boese-ban.de

    looking at my roster, its still widely used :(

  11. Ge0rG

    tim@boese-ban.de: I've heard of a client called Pidgin, which has a pigeon logo.

  12. tim@boese-ban.de

    Ge0rG, I think the author wanted to say pidgin

  13. waqas

    I've also heard about it

  14. Ge0rG

    tim@boese-ban.de: I don't know. Maybe. But even then, claiming that pidgin and empathy, of all, are the important clients, is a very wide stretch

  15. Neustradamus

    Ge0rG: ah ah

  16. Neustradamus

    gaim :D

  17. Ge0rG

    It's like I would use my HN karma to advertise yaxim, which nobody has ever heard of.

  18. Neustradamus


  19. Ge0rG

    ,oO( https://du7ybees82p4m.cloudfront.net/5710e5c78b7945.23147303.jpg?width=910&height=512 )

  20. Neustradamus


  21. Zash

    Ge0rG: The are or have been shipped by major distros as The Default, so it's safe to assume that they are widely used.

  22. Ge0rG

    That sounds like the Internet Explorer argument.

  23. Zash

    Ge0rG: I suppose "important" isn't the right word

  24. Zash

    But something

  25. Zash

    The IE situation is not too far off tho.

  26. Ge0rG

    The new bookmarks looks like a sensible cleanup of the old mess, but it's not going far enough in my eyes. It would be nice to have some kind of per device / per device class autojoin, and the nickname should be stored either centrally or in each bookmark to prevent conversations from automatically using my local part

  27. Zash

    There's a XEP for that

  28. Zash

    The Centralized Canonical Nickname

  29. Zash

    -xep user nickname

  30. Bunneh

    Zash: User Nickname (Standards Track, Draft, 2012-03-21) See: https://xmpp.org/extensions/xep-0172.html

  31. Ge0rG

    So all the user's clients should subscribe to the pep node.

  32. moparisthebest

    Ge0rG: that sounds good, I have mucs I want to autojoin everywhere but also mucs I only want to autojoin from the desktop

  33. lovetox

    but this seems a bit complicated to me

  34. lovetox

    how would you identify the devices?

  35. lovetox

    with resource seems a bit flaky

  36. MattJ

    I think clients should just keep their own overrides

  37. MattJ

    trying to categorise clients is too complex

  38. lovetox

    yeah so if you bookmark a channel from your phone, and you have a checkbox "autojoin only from this device", the client should set autojoin=false to pep, and save a override for this bookmark localy in the db

  39. lovetox

    so this works also now, no need to add anything to the xep

  40. MattJ


  41. MattJ

    and clients don't have to support this if they don't want to, so it keeps the protocol simple

  42. lovetox

    so how far are we in prosody with publish options and persistence support?

  43. MattJ

    persistence is in trunk, if you enable mod_pep_plus (this is still considered 'beta', and will be merged into mod_pep after more people have tested it)

  44. MattJ

    publish-options is in progress, mostly done I think, I just need to test it

  45. lovetox

    what i also thought when ready the new xep, would it not be easier to let the server just set the correct node config for the new bookmark namespace

  46. lovetox

    instead of hoping that every dev reads the xep and applies publish options

  47. lovetox


  48. Holger

    Then again the client dev can't just blindly publish bookmarks hoping the server will do that.

  49. lovetox

    if its written in the xep that the server must do this ..

  50. Holger

    It's not today.

  51. Holger

    Ah the new one.

  52. lovetox

    its also not mentioned there

  53. lovetox

    but there is something in there, that the server has to merge items or stuff

  54. lovetox

    so server has to do something for this xep anyway

  55. MattJ

    oh really?

  56. MattJ

    I'd better read it then...

  57. lovetox

    When a client publishes a new item, the server MAY collate all items, casting them into the 'storage:bookmarks' namespace and setting the jid attribute to the item id in each case.

  58. lovetox

    but yeah all optional

  59. pep.

    Dave Cridland, what are the "security reasons" mentioned for the password field? Is it because you don't want that to be clear on the server? Or on the client? (or both)

  60. pep.

    Also SamWhited ^

  61. lovetox

    i find this a bit overboard to remove password from the xep

  62. pep.


  63. lovetox

    only because the admin of the server can read the password?

  64. lovetox

    so what nobody cares

  65. lovetox

    regular people just set the password to hinder other regular people to join the channel

  66. lovetox

    not to protect super secret information from bad server admins

  67. lovetox

    its probably easier for the admin to just read the logs

  68. MattJ

    If you're protecting from the admin, they can just reset your password and log in as you and join a members-only room anyway

  69. lovetox

    also the description: Unencrypted string for the password needed to enter a password-protected room.

  70. lovetox

    it would not help in any way if the password would be unkown to the admin

  71. waqas

    There's technically sasl for MUC, but I think Prosody is the only implementation, don't think any clients implement it.

  72. lovetox

    admin can do what he wants

  73. waqas

    But as MattJ said, admins can usually reset passwords, and often just modify the server if they want to

  74. lovetox

    so i even question the "not recommended"

  75. lovetox

    i think this stems from a time, where xmpp connections where not TLS secured

  76. lovetox

    or it was not that common

  77. lovetox


  78. MattJ

    but then an attacker would see the password when you send it to the room anyway...

  79. MattJ

    and so would the server admin :)

  80. MattJ

    mod_log_room_passwords would be trivial :)

  81. MattJ

    so yes, I don't think this is really protecting anyone from anything

  82. lovetox

    no i meant the warning about sending passwords unencrypted stems from a time where TLS was not common

  83. MattJ


  84. lovetox

    today i see no problem with it because we can assume everything is TLS

  85. lovetox

    and we cant do anything against admin anyway

  86. MattJ

    The only other thing you might be protecting against is someone who gains access to your account

  87. MattJ

    If passwords are not in bookmarks, a new device has to ask for passwords for autojoin MUCs on initial use

  88. lovetox

    first thing that will happen if we dont sync passwords, people will come and ask for password sync xep :D

  89. pep.

    MattJ, I think at this point you've pretty much lost already

  90. pep.

    I wouldn't worry about some random MUC's passwords

  91. MattJ

    The MUC owner may :)

  92. pep.

    You can just change the password..

  93. lovetox

    is there any client that has some cool concept for message type "normal" ?

  94. pep.

    I think psi has a different view for them

  95. lovetox

    gajim now opens a single email like window, where you can answer and prev message is quoted

  96. Ge0rG

    lovetox: will that window steal focus?

  97. pep.

    MattJ, one issue I can see is another user gaining access to the muc, and then mam_muc

  98. lovetox

    Ge0rG, depends, default you get only a notification and if you open the notification the window opens

  99. pep.

    Not sure what to do exactly for this, but I don't think the issue is the password

  100. lovetox

    so no, its not that horrible

  101. Ge0rG

    Ah, that's okay I suppose

  102. lovetox


  103. lovetox

    i mean i could make a window like a email client

  104. lovetox

    that looks like a inbox

  105. lovetox

    and all messages go in there

  106. lovetox

    but this really feels weird, like if you want email just use email

  107. Ge0rG

    lovetox: and are there still dialogs in 1.0 where the JID is split into two input fields for local part and host?

  108. Ge0rG

    lovetox: and are there still dialogs in 1.0 where the JID is split into two input fields for local part and host?

  109. Ge0rG

    lovetox: and are there still dialogs in 1.0 where the JID is split into two input fields for local part and host?

  110. Ge0rG

    Sigh. I really need to fix this race condition.

  111. lovetox

    wow you sent this message 3 times

  112. pep.


  113. lovetox

    am yes i know its a wish of yours, but account creation assistent has not been reworked

  114. lovetox

    but i guess its a good idea to add for the gajim 1.1 milestone

  115. Ge0rG

    lovetox: I wrote it during a stream resume, so it was first delivered normally but didn't count for the stanza counter, then it was delivered again by 0198 and then again by the sync after connect code. It's a nasty race condition I really need to fix

  116. pep.

    Ge0rG, at least you're not losing the message :-°