-
Link Mauve
Ugh, https://infosec-handbook.eu/blog/xmpp-aitm/
-
Link Mauve
They’re mostly right, but I dislike their conclusions.
-
Ge0rG
Link Mauve: they also had a rant about how bad XMPP is, recently
-
Ge0rG
https://infosec-handbook.eu/blog/federation-myths/
-
Link Mauve
Ge0rG, this is another.
-
dwd
Link Mauve, "Furthermore, he is convinced that most XMPP server and client software is more a leisure project than secure software." - there's at least three companies working with XMPP in high security environments.
-
Zash
Uh, worth reading?
-
daniel
To be fair the companies you are talking about aren't the companies and products most end users are using
-
daniel
But still at least ejabberd and Conversations are products created by for profit entities
-
daniel
> Uh, worth reading? Not really
-
Zash
> Links > * How to use Signal more privacy-friendly
-
Zash
Uuuuuhu
-
edhelas
> solution, don't use Signal
-
jonasw
> solution, stop doing those computer things and become potato farmer
-
Ge0rG
jonasw: potato seeds are generticaly manipulated by Monsanto to not reproduce after the first generation, forcing you to buy new seeds from them
-
Zash
Plant potato, get more potato
-
dwd
Still don't quite understand why "Don't trust an XMPP server operator, they can monitor your traffic really easily!" can be combined with "Use this centralized service, because the admins and hosting providers are totally trustworthy."
-
Zash
dwd: You dare question our lord and saviour, Moxie?! /s
-
Zash
Something something praise be crypto-jesus
-
edhelas
never question Father Moxie
-
dwd
Well, right. That's why pretty much every *other* cryptographer is working on MLS.
-
edhelas
and the Signal centralized backend deployed on AWS instances :p
-
edhelas
but it's "Snowden Approved ©"
-
Zash
and Schneier approved(?)
-
dwd
Yeah, because a guy who dumped a load of stuff he hadn't even read onto a bunch of journalists is a good source of judgement.
-
Zash
The holy trinity giveth unto us Signal
-
edhelas
by the way, the centralized-xmpp-based-omemo Cryptocat client is not maintained anymore ? https://github.com/cryptocat/cryptocat
-
jonasw
dwd, (being devil’s advocate): "because we can deploy useful e2ee"
-
dwd
jonasw, Sure, but the remaining problems still exist - anyone reading the cleartext Signal traffic can read out the routing info.
-
daniel
edhelas: does that surprise you given the three preceding iterations of that project?
-
Zash
dwd: wait, what?
-
Ge0rG
Zash: Facebook paid TWO MILLION DOLLARS to get moxie's Stamp Of Approval. It must be good!
-
Ge0rG
Zash: if your "wait, what" relates to Signal: the Signal admins can access exactly the same kind of metadata as your XMPP server admin, except with phone numbers instead of JIDs. But they Totally Promised Not To Do It.
-
edhelas
so this is fine
-
Zash
I read what dwd wrote as an implied lack of transport encryption
-
Ge0rG
Zash: I think "cleartext Signal traffic" was supposed to mean the post-decryption stream
-
Zash
Noise?
-
Ge0rG
wouldn't that be pre-decryption?
-
Zash
Were they the funny people who named their transport protocol "Noise"?
-
Ge0rG
Zash: drink some more coffee. Or drink less, if you've had some today.
-
Zash
Post-lunch nap perhaps
-
dwd
Zash, No, I did mean inside the service. I assume it runs TLS etc.
-
Zash
dwd: I have this feeling that they invented their own TLS and named it Noise
-
dwd
With that bunch, that's entirely possible.
-
Zash
http://noiseprotocol.org/index.html hmmmmm, doesn't say Signal anywhere?
-
Zash
But WhatsApp
-
Ge0rG
https://blog.powerdns.com/2018/03/22/the-dns-camel-or-the-rise-in-dns-complexit/ - this is so similar to XMPP
-
Zash
DNS, complex? But, but, it's being HTTP&JSON-ified! That's the simplest thing evar!!!
-
Ge0rG
Zash: take your nap already
- ralphm waves
-
ralphm
set the topic to
XSF Board Meeting | Logs: http://logs.xmpp.org/xsf/ | Agenda https://trello.com/b/Dn6IQOu0/board-meetings
-
ralphm
0. Welcome
-
ralphm
Who do we have?
-
ralphm
I'm back from vacation.
-
Guus
o/
-
Guus
welcome back
-
Guus
(MattJ is always here if you mention him 😛 )
-
Guus
😰
-
Guus
*tap* *tap* is this thing on?
-
MattJ
Hey
-
Guus
😅
-
MattJ
Sorry, was temporarily distracted by the doorbell :)
-
ralphm
Quorum, yay
-
ralphm
Agenda items?
-
Guus
I don't have any
-
MattJ
I haven't looked at Trello in a while
-
Guus
at what point are we going to send someone over to Martin's house to check if he's OK?
-
Guus
(not you, Martin. The other Martin)
-
MattJ
He did reply to my email fairly promptly, so he's "around"
-
Ge0rG
so no need to send a SWAT team?
-
ralphm
Didn't we discuss this back in June?
-
ralphm
21, specifically
-
MattJ
Probably
-
ralphm
Any updates on your side MattJ?
-
MattJ
No, the only thing on my side is GDPR, and I'm afraid I've not had time to work on it
-
ralphm
Now vacation is over and summer is coming to an end, we should be able to get back in motion.
-
MattJ
Yes, hopefully
-
MattJ
Just before the end of the term :)
-
Guus
which reminds me: should we start looking for the next Board?
-
ralphm
That was going to be my only thing for today. Ask Alex when he wants to start that process.
-
ralphm
We can already start poking people for interest.
-
Guus
sounds like a plan
-
Guus
maybe we should also curate our to-do list, see what things we can reasonably expect to get done this term, and what not
- ralphm nods
-
ralphm
I'll have a look at it for next week.
-
ralphm
Anything else?
-
Guus
And, while on the subject:
-
MattJ
Nothing else from me
-
Guus
Should we consider putting in place a system where we do not replace the entire board each year?
-
Guus
have two-year terms, staggered - something like that?
-
Guus
I'm hoping that that'll prevent ramp-up and shut-down overhead, by making it more of an ongoing process.
-
ralphm
Not sure. I don't think it has been a problem before.
-
ralphm
All boards I was part of had overlap
-
dwd
ralphm, Yes, but not by design, and there's always a feeling that Board can't do anything that goes beyond its term.
-
ralphm
That's a good point. This would require changes to our Bylaws, though. Not sure if we can do that before these elections.
-
Guus
oh, I'm not in a hurry
-
dwd
ralphm, I have occasionally wondered about staggered terms, or an "executive team" that actually does the work, that can be recalled by subsequent boards.
-
Guus
shall I post on the members list, see if there's support or not?
-
MattJ
We really don't have any kind of executive team
-
ralphm
dwd: well, yeah, but since we currently don't even have an Executive Director, we'd to figure out what that all means.
-
ralphm
Guus: please do.
-
Guus
k
-
ralphm
Ok. My last thing was more of a note: FOSDEM has posted a CfP for 2019. Dates are February 2 and 3.
-
Guus
ah, someone should kick SCAM in action
-
ralphm
So was penciling in Jan 31 and Feb 1 for our own stuff.
-
Guus
Sounds good. I've marked it on my personal calendar
-
ralphm
Ok.
-
ralphm
Cya next week!
- ralphm bangs gavel
-
ralphm
set the topic to
XSF Discussion | Logs: http://logs.xmpp.org/xsf/ | Agenda https://trello.com/b/Dn6IQOu0/board-meetings
-
Dave Cridland
So, I've been debugging XEP-0198 support. And I tried - because it seemed easiest - including XEP-0198 data on the stanza itself, as namespaced attributes. Gajim seemed to ignore it - anyone any idea if any clients would choke?
-
Dave Cridland
(I was doing this as debugging info I was *hoping* would be ignored, mind...)
-
Link Mauve
I still can’t understand how clients could choke on this proper usage of XML, while we are already doing it e.g. for @xml:lang.
-
Ge0rG
Dave Cridland: that smells of protocol abuse. But if you give me credentials / IBR, I can test yaxim
-
Dave Cridland
Link Mauve, We've avoided namespaced attributes in general because people do screw it up, or at least have historically.
-
Link Mauve
I’d really like to see data on that.
-
Link Mauve
Please deploy that in the wild. :)
-
Ge0rG
I also need to debug an SM anomaly that I've encountered, where messages get duplicated on resume. Sometimes.
-
Dave Cridland
Link Mauve, They're a bit of a weird one, in terms of XML, since <x xmlns='foo' attr='blah'/> is entirely different from <a:x xmlns:a='foo' a:attr='blah'/>.
-
flow
Ge0rG, duplicates send *after* resume?
-
Dave Cridland
Ge0rG, This ought to help track that one down. I'll throw you my IBR-enabled test server's details.
-
flow
Dave Cridland, care to share why those elements are different?
-
Link Mauve
Dave Cridland, first one would be equivalent to <a:x xmlns:a='foo' attr='blah'/>, because non-prefixed attributes are in the null namespace.
-
Link Mauve
flow, ↑
-
Link Mauve
But you can perfectly have them in other namespaces.
-
Dave Cridland
flow, As Link Mauve says. But thanks for being an exemplar case of not understanding the things.
-
Link Mauve
<x xmlns='foo' xmlns:b='bar' b:attr='baz'/> works, but it’s a totally different element.
-
Link Mauve
And thus you can also have <x xmlns='foo' xmlns:b='bar' attr='blah' b:attr='baz'/>, with no conflict.
-
Dave Cridland
Link Mauve, I'm not sure that a non-prefixed attribute is in any namespace at all, as such.
-
Link Mauve
Which is equal to <a:x xmlns:a='foo' xmlns:b='bar' attr='blah' b:attr='baz'/>.
-
Dave Cridland
Link Mauve, So you can't, for example, say <x xmlns='foo' xmlns:null='' null:attr=blah'/>
-
Link Mauve
Indeed.
-
Link Mauve
Instead of “the null namespace” I should have said “no namespace”, but null is how this is represented at least in JS and Java.
-
Dave Cridland
Link Mauve, Right, but "attr" is "The attr attribute of x", whereas your "b:attr" is the "attr attribute of the bar namespace".
-
Link Mauve
Hmm…
-
Dave Cridland
But in any case, corner-cases like <a xmlns:a='a' xmlns:b='a' a:a='bar' b:a='foo'/> can easily slip through.
-
Dave Cridland
Since that XML happens to be legal if you're not processing namespaces, but illegal if you are.
-
Link Mauve
Why? :/
-
Link Mauve
Ah, missed that both are the same namespace.
-
Dave Cridland
Link Mauve, Right.
-
Link Mauve
But are there really XML libraries which fail on that?
-
Link Mauve
I’d expect they to be fixed by then.
-
Dave Cridland
Link Mauve, I'd fully expect that XML to traverse most servers.
-
flow
possibly depending on the layer where the XML is embedded. Not all intermediate hops parse each and every part of the stanza
-
Dave Cridland
flow, Right. Or at least, not to the namespace level.
-
Link Mauve
% nc 82.226.255.187 5222 <?xml version='1.0'?><stream:stream xmlns:stream='http://etherx.jabber.org/streams' xml:lang='en' xmlns='jabber:client' to='linkmauve.fr'> <?xml version='1.0'?><stream:stream xmlns:stream='http://etherx.jabber.org/streams' xml:lang='en' from='linkmauve.fr' id='a8ccb26b-51b5-4a48-b1cb-ea4734f61a7f' xmlns='jabber:client'><stream:features><starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'><required/></starttls></stream:features> <a xmlns:a='foo' xmlns:b='foo' a:coucou='abc' b:coucou='def'/> <stream:error><not-well-formed xmlns='urn:ietf:params:xml:ns:xmpp-streams'/></stream:error></stream:stream>
-
Link Mauve
At least Prosody correctly rejects it.
-
Ge0rG
flow: yes, because smack3+0198 was miscounting.
-
flow
Link Mauve, even if it is embedded deep down in an extension element within a stanza?
-
Dave Cridland
Link Mauve, I'd expect Prosody to, because it's using Expat underneath, right?
-
MattJ
Correct
-
Dave Cridland
Link Mauve, But ejabberd uses RapidXML, as does Metre. I'm not sure about Openfire actually - but it wouldn't surprise me if it passed them through unscathed.
-
Holger
ejabberd uses Expat.
-
MattJ
I thought so. I thought dwd was implying they switched
-
dwd
Holger, Oh, I thought the new stuff was using an Erland-wrapped RapidXML?
-
dwd
Erlang, even.
-
Holger
dwd: Nope still Erlang-wrapped Expat, I'm not aware of attempts to switch.
-
Holger
There was a major rewrite of the wrapping itself, which is now mostly in C.
-
dwd
Ah! MongooseIM, not ejabberd. exml is now RapidXML.
-
dwd
But confusingly, I don't think they use my fork.