XSF Discussion - 2018-09-16

hi

hi

my friend need help for xep-0368

https://wiki.mattrude.com/SRV_records_for_XMPP_over_TLS

my friend has apache2 how he can make it work.

neshtaxmpp: haven't seen that one, there is also https://wiki.xmpp.org/web/Tech_pages/XEP-0368

Nothing specific to web server involved though if you use sslh

moparisisthbest... dude dont know we are trying from 4 hours run sslh and cant run on debian. thrre is not decent manuals

That's not my experience, what's the problem

moparisthebest we dont have decent manuals how to do it.

neshtaxmpp: copy paste the example from the wiki I linked

moparisthebest‎ first we find this: https://wiki.debian.org/InstallingProsody#XMPP_over_HTTPS aqnd this is false, this is second: https://wiki.xmpp.org/web/Tech_pages/XEP-0368 and here they say first is false.

What is false

On the second link

moparisthebest‎: not according with truth or fact; incorrect. made to imitate something in order to deceive. "the trunk had a false bottom"

moparisthebest my friend use apache2

EPARSEFAILURE

neshtaxmpp: I can fix that page though, so I'd something is wrong let me know

neshtaxmpp: so what? Use the sslh example not the nginx example

It's sslh OR nginx, not both

moparisbest it dont work. when my friend use wiki xmpp and start sslh it comment error on line 16

error line 16 is this: );

bellow: { host: "0.0.0.0"; port: "443"; },

and sslh refused to start

neshtaxmpp: are you running the minimum version it requires?

my friend download from debian apt-get install sslh

Either that or you don't have ipv4 on that box

So check the version

my proposition was maybe he dont have installed sslh alpn, but there is no sslh with alpn

'debian' goes from ancient to new

sslh -V: sslh-fork 1.18-1

That should work, run it as verbose as possible and look for errors

moparisbest my friend question is: in /et/default/sslh what is correct:

#DAEMON_OPTS="-F /etc/sslh/sslh.cfg"

or this: DAEMON_OPTS="--user sslh --listen 0.0.0.0:443 --ssh 127.0.0.1:22 --ssl 127.0.0.1:443 --pidfile /var/run/sslh/sslh.pid"

No you want to use the config file

But don't worry about that for now, run it directly from the command line to see if it works

moparisthebest he know but first manual state he should change for that he ask.

moparisbest what are the command to run it directy. me friend use service sslh start there it comment error line 16

You want to use the config file

Not specify anything else on command line

Just try it

It won't blow up your computer if you pick wrong options

so my friend write: sslh and it comment this:

At least one target protocol must be specified.

Try help and see how to use a config file

moparisbest run with sslh.cfg: /etc/sslh/sslh.cfg:16:syntax error

maybe this is line 16 " there is );

Maybe try commenting out

commenthing this: ( { host: "0.0.0.0"; port: "443"; }, );

Whatever, just try things, like I said it won't explode

wait

Maybe the last `,` is too much

If it's like json

comment out ); it comment other error: /etc/sslh/sslh.cfg:25:syntax error

error line 25 is this: protocols:

Probably look at other examples from the sslh website

daniel my paste it 100 % 1:1

my friend

Ah could be, try removing last comma

daniel: does conversations.im use sslh anymore?

moparisbest you mean from here: { host: "0.0.0.0"; port: "443"; },

moparisthebest: no

Ejabberd does it natively now

And we have a second IP for http

That is where the error is isn't it neshtaxmpp

daniel: ah nice, yea nginx is an option now too

Haven't tested it but I assume it's faster

daniel but compliance.conversations.im complaint xmpp over tls is not enabled.

daniel for that my friend want to enable xmpp over tls.

moparisbest in line 25 there is no coma

neshtaxmpp: different topics

So, they don't care about why, they just want all the green?

Zash: obviously

neshtaxmpp, that checks only srv records afair for 368

I find it somewhat dishonest of that site to advertise itself as "XMPP compliance", when it's more like "Conversations server feature wishlist/requirements"

zash if you start think. yes xmpp over tls is important becouse ther is airport who block port 5222 so xmpp will not work if it is not enabled.

maranda what check... the web site... i get it from pix-art.de

Zash: that doesn't have such a nice ring to it tho

neshtaxmpp, O_o

‎[16:23:36] ‎neshtaxmpp‎: daniel but compliance.conversations.im complaint xmpp over tls is not enabled.

so guys is it important to enable xmpp over tls or not... please help my friend enable it, if this is important.

"that checks only for srv records afair"

maranda srv " you mean dns, newbiew will not understand it, you have to be simpler " are enabled.

dns are like this: _xmpps-client._tcp.example.org. 86400 IN SRV 5 0 443 xmpp.example.org. _xmpp-client._tcp.example.org. 86400 IN SRV 10 0 443 xmpp.example.org. _xmpp-client._tcp.example.org. 86400 IN SRV 15 0 5222 xmpp.example.org.

moparisbest so what you referr with " the last coma " ," "

neshtaxmpp, it seems it a problem with parsing the config file, it should not be hard to find out what the syntax error is here

just look at other examples of config files on the net, and see where its different

actually it does, nm

lovetox for hackers and developers it is not problems, but for peoples who are not hackers and developers this is matter issue

listen: ( { host: "thelonious"; port: "443"; } );

there this line

after the } remove the " , "

try again

lovetox ome moment.

dont copy what i posted into your config, it was just an example from the net, to show you how its different to the one you are using

( { host: "0.0.0.0"; port: "443"; }, );

see there is a " , " at the end

so my fiend remove "," as lovetox suggestion and not it comment other things.

so where is decent manual that my friend peter can follow and configure sslh

i guess on google if the wiki is not enough for you

lovetox this is issue: becouse this is second manual that we found: first was that: https://wiki.debian.org/InstallingProsody#XMPP_over_HTTPS and second was that: https://wiki.xmpp.org/web/Tech_pages/XEP-0368 in second they comment first web site is false.

Another (incorrectly named) example can be found at the Debian Wiki

and debian wiki is this: https://wiki.debian.org/InstallingProsody#XMPP_over_HTTPS

the name is incorrect

not the example i guess

the name is false.

do you think someone would link to examples that are wrong?

lovetox yes fake informations will do.

this is not first time my friends found fakes web site complaing do this and it will do...

Turn on your brain for a second try to understand the syntax of the config and fix it

include i had to safe my friend from 2 day seeking in front to make his server work, becouse he follow fake news.

im not sure to what "name" the author refers, but i dont think it means, "This example is wrong"

Semantically the example file is probably correct

daniel my friends are not hackers and developers they are just normal users who want to have they privacy... much to look in the code it will be the same.

So for the xmpp wiki I adapted my config, I could have accidentally left in an extra comma

neshtaxmpp, they dont need to be hackers or developers, but they have to learn a minimum about tools and how they work and how to configure them

I'll check later at a computer

you cant run a xmpp server with ZERO knowledge about computers

what lovetox said,

lovetox belive me they can do it.

Yea you have to be comfortable with trying things

Your complaints sound very preposterous to me tbh.

lovetox, moparisbest when there is 100 % true manual everything will work.

For sslh specific problems, have you tried sslh website/docs

Mistakes != Fakes

maranda Your complaints sound very preposterous to me tbh.

There is a lesson in the fact that a lot of people tripped over the bad examples in XEP 156

there can be errors in manuals too

Both of them...

and if you have that minimal knowledge you need, you can easily spot 'em.

daniel i have compiled lineage latst 14.1 without developer knowledge. how i do that.

I'm not sure what lesson though...

daniel i say it before...

maranda how person will compile 100 % working lineage without developer knowledge.

I'll ensure the sslh example on the xmpp wiki is correct later, but it's close enough that no one has complained in years so

neshtaxmpp, no idea never compiled Lineage.

neshtaxmpp, what is the problem with the config file on the debian site ?

does it also show syntax errors?

or any other Android ROM

lovetox wait im gonna my friend what was problem with debian wiki... something was false.

my friend say: he follow debian wiki... and when run sslh apache2 stop working... when apache2 start working sslh stop working all the same: port is busy

Maranda: I assume that's a language thing rather than get offended meh

for that i find my friend this second site: https://wiki.xmpp.org/web/Tech_pages/XEP-0368

moparisthebest, me knows thnx :P

neshtaxmpp: right you can't have 2 servers on same port

neshtaxmpp: Apache must listen on a different port

I use 442 in that example

moparisbest wait... so you mean... running sslh with 442... and apache2 runnin on port 443

Or on a different IP

The other way round

neshtaxmpp: you have to read and understand the example rather than copy+paste

moparisthebest why in xmpp example they dont say " sslh has to use port 442, becouse it will be used by apache 2 port 443 "

moparisthebest so sslh will liste in port 442 and apache2 in port 443 -> this mean, when someone say open yourdomain.com it will open port 442 - > 443 and will open website

neshtaxmpp: it says Apache or nginx on 442 right?

moparisbest ‎[04:46:33 PM] ‎moparisthebest‎: neshtaxmpp: right you can't have 2 servers on same port ‎[04:46:55 PM] ‎moparisthebest‎: neshtaxmpp: Apache must listen on a different port

neshtaxmpp: read the sslh config comments on xmpp wiki

It specifically says that

moparisbest so i see why there is no understand.

I gotta go now, I'll review chat later though

moparisbest... you base on conclusion that giving small information can peoples understand they understand it is gonna work.

neshtaxmpp, we assume that this is stuff that only people touch that have a minimal knowledge of what they do

moparisbest if i say 400 W. motor will fit in... do you know where it will fit.

but feel free to write a step for step guide, that even your grandmother can execute

lovetox That is exactly what peoples want. Step by step, becouse this is how linux work, linux for everybody.

lovetox linus in interview say debian is too complex...

yeah if "people" want it, they should write it

lovetox they will write if they know what to write.

lovetox again how i say how i without developer knowledge i compile full lineage 20188 version.

a endless circle, so you are saying without guide you cant learn something, and because of that you cant write guides?

lovetox do you know what it pathfinder...

lovetox this is endless circle for you... i know it is gonna help other peoples.

nobody undertand that i came here with my friend seek how to run sslh and you guys just jump in aggresive manner.

im not saying you shouldnt help other people

but to tell other people that they should help other people because you think they dont help enough ..

lovetox how much it will get from your precious time to write " apache has to be on different port "

write it yourself

lovetox i;m sure you didnt catch it.... but lets ignore this for the moment.

lovetox with pleasure will write it if i know how.

great !

lovetox if i was hacker i will bring on light what militarry do... peoples deserve to know the true...

but that is other topic.

its seems this is a reoccuring thing with you, always "IF i was a .. ", "IF i had the knowledge"

seems you should do something about that IF

I think there's some misunderstandment due to some language issues, like telling people they write "false" things isn't the best way to start an argument even if it's not intentionally offensive, it sounds so ;)

lovetox you sound like usa " american "

maranda everybody think differently. I think women kick peoples... so you see everybody think differently.

. . . never mind.

lovetox peoples who calculate other peoples... they try be mastermind... but how i say... education in 21 century is worse. there is no respect and humankind.

we came we peace... and solution.

and we receive... aggresions and manipulations...

it doesnt mean if i;m african, ot german, or serbian...

it is just how we are... multicultural... if you can't respect foreigener... then you can't respect yourself.

neshtaxmpp, I've read most of the backlog and couldn't find any aggression. Mostly a discussion involving a language barrier

flow... [04:58:42 PM] ‎lovetox‎: its seems this is a reoccuring thing with you, always "IF i was a .. ", "IF i had the knowledge" ‎[04:58:50 PM] ‎lovetox‎: seems you should do something about that IF

and possibly some more politeness

flow " [04:46:10 PM] ‎moparisthebest‎: Maranda: I assume that's a language thing rather than get offended meh"

flow... so this is how i comment " politeness " this is not politeness.

im sure there is wonderfull peoples...

neshtaxmpp, sorry I wanted to write "and possibly *missing* some more politeness"

flow sorry i wanted to write " bad peoples " but it was writed aggresions and manipulations.

and I ultimately lost track if you are now able to run sslh or not

flow my friend in the moment is in stand off, we try sslh from maybe 5 hours and no go...

until someone comment remove ","

neshtaxmpp, the syntax and especially the error reporting mechanisms of many configuration files is often a source of frustration, if it is of any help

hackers and developers on you peoples depend... if you explain it 100 % peoples will undestand it. If you write it bad, false it will not work. So now we need to exit becouse there is much too negative energy ...

flow... hmmm is this indirect my fiend is frustrated... no my friend is not frustrated...

flow... how i say this is 3 time... i dont have developer knowledge and compiled 100 % include it run in the moment on my mother smartphone lineage latest version. how i do this.

flow if manual was bad writed, peoples will not make it. But if it was explained step by step i assure you will make it.

possibly because compiling lineage is close to following a cooking recipe

flow include to be for other peoples example: the manual of developer process was in cyrrilic

it is not really comperable to complexity that is involved with a proper XMPP service setup

not english language

flow so this person who write in non-english cyrrilic language was so correctly writed that lineage was compiled.

Holger, what's the default max number of stanzas queued in ejabberd's csi out of curiousity?

flow... if peoples still try bypass what other peoples tell, and dont allow they ego win they will understand the peace can be possible.

Maranda: 100

neshtaxmpp, I'm sorry, I am a bit lost. But if your point is "we need better manuals and easier to use software" then I'm 100% with you, but that goal is not easy to achive for assorted reasons

Holger, ok thanks

flow i just remember. I was with a woman, that she directly hate men. Every time " look how this men is smiling, look how this men has children, look how this men look, and i told her. Piss off if i see you again i will complaint in justice system jail you.

flow. i had friend from gym. who was guy guy, smiling... developer and hacker... one week i didn;t see him and do you know what his face was...

I'm just not sure how UX pleasing it is in a mobile client to see a massive amount of message coming in during the backlog update after state is switched back to active though.

Maranda: Easy way of eating tons of memory :-) Also mobile clients probably won't appreciate being flooded after going in the foreground again, yes.

(although it will help on battery saving)

Maranda: You woulnd't usually queue actual *messages* though, right?

Holger, I'm trying to queue groupchat messages until highlighted.

Eww.

flow his face was aggresive... he didn't was he... i talk with him and he told me his boss. So from guy smiling he was change in assasin... why so. in 21 centuty happy dont exist. there is no respect anymore, without respect and peace peoples will be more aggresive.

Holger, it's configurable via adhoc, just deciding how useful it is on the battery.

Maranda: But it's the default?

Holger, for now yes, that's what I need to decide based on usefulness.

Maranda: Won't make the typical WhatsApp user happy I guess.

cause UX it doesn't look stellar indeed.

"XMPP just never works. Now groupchat notifications are broken."

flow... and if say how bad was my life book will be little to write... iclude i was illegaly investagiated by secret service for something that if you didn't like love in woman. but one day she will be in jail, for much secret service she can work there is jail for them too.

Holger, Maranda: I missed the beginning of this, so pardon me if this was explained, but does your system if a phone comes online for its regularly scheduled radio time and does a stream resume presumably it gets the queue dump then too?

Holger, well conversations only actually shows a toaster notification if I get highlighted anyways. That won't break in that case. ✏

Maranda: That's not the default in Conversations, at least not for private groups.

Maranda: Conversations will notify by default on all messages in private groups

Which is the type of group it will create by default

hmm

SamWhited: The question is whether the CSI queue is dumped on 0198 resume?

Holger: yah, or on CSI active or whatever signal you're using

SamWhited, it's not the same queue but "yes"

Whatever the message queue is, yah. Thanks

Yes, both on CSI <active/> and on SM <resume/>.

That seems like it would be "good enough" to me

You get your messages once a minute or whatever it is, and if, in the mean time, something important like a highlight happens you can get an out of band push or whatever the case may be.

SamWhited: Once a minute?

Holger: whatever it is; I don't know what Android does by default

But I think it's every minute or two

Not sure what sort of Android event you mean.

Holger: I assumed that's what you were talking about; Android gives every app a window of time every minute or two when the radio is on and it is allowed to use it.

Its part of its battery saving measures.

I wasn't aware. No idea whether Conversations listens to that.

So presumably a message queue would only build up until the app could get to its network window and do a resume or a MAM query or whatever it decides is the best way to fetch messages for a particular room

And being smart about highlights would negate the feeling on the users part that it was no longer realtime, I would think

Anyways, just thinking out loud; I'd be really curious to see the results of your battery saving experiment Maranda.

Well no idea, as I said I wasn't aware of these network windows. My assumption was that Conversations either manages to keep the TCP connection alive, or if it doesn't, waits for FCM notifications.

SamWhited, sure, you actually made me find a bug too.

There has been a new major Android version or two since I looked at any of this too, so it's possible I'm just spouting out of date lore. I vaguely remember daniel saying he was going to update to the new battery savig things, which could be different.

SamWhited: But Conversations' implementation isn't really relevant anyway. The server can't assume the client will behave one way or another, so I think it's hairy for the server's CSI/push code to suppress groupchat notifications if you're not highlighted.

I dunno, the server has to pick some behavior for the client to work against; this seems as good of a behavior as any. It at least gives the option for mobile clients to manage their network usage efficiently.

(I'm also operating under the assumption that this only applies to mobile, but I have no idea if there's even a reasonable way for the server to know that)

my friend looking closely in https://wiki.xmpp.org/web/Tech_pages/XEP-0368: find this # 442 is a https port (nginx, apache, etc) " If writer think that write only 442 is a https " reader will not know what this mean. becouse in first please when my friend was reading say what is this: 442, when apache2 run on 443, but after conversatoin with didn't remember name is some sort or filter becouse apache2 use 443 and sslh need to pass this information from 442 to 443. In the moment it didn't explained better, becouse include it lost in writing this message

SamWhited: Sorry but this sounds weirdo to me.

SamWhited: You can't seriously argue the server's CSI code should blindly assume the client will go <active/> once a minute just because there's some Android feature some Android client might or might not be using.

It has nothing to do with an Android feature specifically, but yah, giving them the option to enable/disable sending large volumes of messages (whether that's with a stream resume, an active CSI element, etc.) seems reasonable.

I don't know what specific configuration will work best though with what specific platforms

Holger, SamWhited: what Holger is mostly correct. The doze windows are much wider apart than a minute. So Conversations tries to get an exception or if that doesn't work rely on push

Push will always wake up the device

No matter the doze state

Maybe only sending a push every X messages (unless there's a highlight or other important event) is the trigger then

I like the idea of queuing messages anyways and would love to see how that plays out. I doubt most people need strict realtime (or maybe you could be smart about the type of room: if it's a private room with 3 people in it, push for every message, if not every 3 minutes in which there are 100 messages, or something)

SamWhited: If we think clients should have the option to suppress/throttle actual message delivery then we need a new XEP, IMO.

I don't think the clients need the option, that's too granular. I think servers just need to be smart about the state of a client

SamWhited: This is not about strict realtime. With Maranda's solution you won't be notified of groupchat messages until you re-open the app manually. At all.

And clients can of course work within that behavior to get whatever results they desire

Totally disagree :-)

Holger: that's what I'm questioning. You'll get it when doze wakes you up, or when you get a push notification as well

I'm wondering if that's "good enough"

I agree that if you only get it when you open the app that is a problem

Is battery consumption even a problem?

Holger, or until you get hilighted visually that'll affect the number on the conversations icon

SamWhited: I'm basically never mentioned explicitly in the WhatsApp groups I'm in. Yet I definitely want notifications. "Hey all, the meeting tomorrow is cancelled!"

That can be fixed by limiting the messages

SamWhited: And I believe that's an expectation many typical WhatsApp users have.

Holger: but do you need it right this minute, or 5 minutes from now? I suspect that for most people a few minutes is okay.

Which I'm not sure about the usefulness of, but if by default private groups always toast well

But what daniel said is also a good point, I have no idea maybe this is solving a problem that doesn't exist.

which is why I'd be curious to see the result of the battery drain experiment Maranda mentioned

I should find an IRC bridge and subscribe to #arch or some other huge active channel and see what happens to my battery

There are a few mobile specific optimizations that I would like to see eventually. But throttling the number of stanzas is not really one of them

SamWhited, it's configurable via adhoc anyways here it's just question to decide if it should be by default enabled or not.

Maranda: does this already exist somewhere that I could experiment with?

SamWhited, I added also the configurable option to filter all bodyless chat states in CSI in any state

Metronome's tip but I need to fix a quirk with SM I just found :P

(or rather you made me find)

Glad I could be of service

neshtaxmpp: clearly if you expect sslh to multiplex 443 it has to listen on 443

That doesn't need spelled out

You don't need to be a programmer, but you do need to understand ports to host services

SamWhited, ok fixed the possible desync with SM queue, now you can play with it if you want ;)

... and also fixed inadvertedly broken presence queues 🤷‍♂️ hehe

this is my friend log sslh: https://bgzashtita.es/tefter/?67c4fee71371a4b6#aoQA4OGoy4+iiqfa3hmXYe48ST8nyz1IDO+D9n2Ptag=

SamWhited, ok all sorted the other thing I need to figure is how much resource usage increase that causes on the server and the right default queue limit to use before flushing, for now I'm going with a large default queue limit (1000)

we are nearly there....

Secure Connection Failed An error occurred during a connection to bgzashtita.es. SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG

sslh[20369]: forward to ssl failed:connect: Connection refused it is becouse apache2 443 is bussy with sslh

SamWhited: oh also this stuff non is also currently running on lightwitch.org you could create an account there too, sorry forgot

s/non//

neshtaxmpp: if you come back, sslh must use port 443

Meaning Apache has to go to another port, it doesn't have to be port 442 but it can't stay here

moparisbest yes we know that from 30 min.

2 computers isn't a problem, but that might mean if Apache isn't on the same server as sslh both can use 443

Just put the actual hostname instead of localhost

Sslh has to run on port 443

Ah now I look insane like I'm taking to myself because you are whispering and I just noticed

I blame that on daniel :D

neshtaxmpp: you really only need sslh on 1 computer, probably the one publically accessible