XSF Discussion - 2018-12-30

TIL https://xmpp.org/extensions/xep-0209.html

I knew about the feature but I always thought it was a custom client thing

didn’t we talk about it at the meetup?

wait what

amazing

same here, pep.

now let’s move that to multi-item PEP and it’s actually useful.

jonas’ <3

pep., if you feel bored, don’t hesitate to fix https://lab.louiz.org/poezio/poezio/issues/2557

mathieui, I don't think so. Or I didn't understand it like that. I'm discussing this with sasza just now

a proper solution for metacontacts of which the information lives server-side is somthing I wanted

and then I ditched it. and now it doesn’t fit in my roster data model anymore.

but given that it can greatly improve UX for those of us with (friends with) multiple accounts ... :)

There doesn't seem to be much security concerns for this meta-contact thing. owl was wondering if it was possible to use this as a pre-condition (but not requirement) for <moved/>. I also think it would be interesting

At the moment it seems I can just send a meta-contact tag for any other jid as long as I know their identity tag?

what?

send to whom?

Say I, userA, sends a meta-contact thing to userB, <meta jid='userA@jid1' tag='foo' .. />. Now userB knows my identity tag right, they could use it to send userC <meta jid='userB@jid1' tag='foo' ../> ?

There doesn't seem to be any auth mechanism(?)

/verification

XEP-0209 does not specify anything for sending a meta-contact thing to another user.

so why should there be an auth or verification mechanism?

oh

I see

did you only look at the examples? ;-P

Yes and I was confused

heh

Because it's not what I thought it was

With owl we were picturing something else, users would be able to say "This is another account of mine"

That would need another XEP then.. and would probably need to interact with this

put it in vcard?

hmm?

I bet you can put a JID in a vcard

put all your accounts in all your vcards

also allows cross-validation

Yeah cross-validation should be a thing

The issue owl had was that with <moved/> (and even with what's being discussed, https://wiki.xmpp.org/web/Sprints/2018_November_Dusseldorf/Pad grep for moved), it's not possible to say "hey I moved to that other JID" anymore if the first server is down

Ge0rG, ^

pep.: yes, also if you actually delete the old account. Moved is full of hairy corner cases of xmpp.

Next time I have a bit of time to tackle it, I'll prepare a proposal for a new Moved, probably based on a mix of messages and pep

is stream compression still a thing in XMPP ?

It has dubious security properties. Prosody got rid of it. Dunno about others.

FWIW https://github.com/horazont/aioxmpp/issues/249#issuecomment-435442679

(scroll to the bottom of that comment for a summary)

TL;DR: if you do it right™, the benefits are rather slim, but it can at least revert the base64 overhead

edhelas, I'd say yes, and I believe that the side channels can be closed

jonas’, you consider 12% bytes saved in the worst case "rather slim"?

Or am I misreading the stats and its 1.2% or something?

Does it consider the extra memory usage on servers?

yes, 12% is rather slim IMO

12% is low enough that I’d be interested if the additional CPU time involved on the client side isn’t worse than transmitting the extra bytes

(not to mention the memory overhead)

As a server dev, I'd rather avoid more memory usage

I saw some security issues regarding TLS + compression as well

Yeah, you don't want SASL / password anywhere near compression.

"password or password-equivalent" is probably more fitting, given that SCRAM for example is safe-ish even without encryption, IIRC.

Depends on what you wanna protect or be safe against

XML namespaces containing multiple occurences od ':' (eg. "urn:xmpp:bob") are valid, are they? https://github.com/dino/dino/issues/394#issuecomment-450573159 Maybe someone can shine some light on this issue?

s/od/of

this is indeed wrong vanitasvitae

So such namespaces are not allowed?

as you see on the captcha node

namespace and node name are exchanged

the thing is the namespace is not as namespace declared

as you can read <urn:xmpp:captcha xmlns='captcha'>

but it should be

<captcha xmlns='urn:xmpp:captcha'>

if this comes from an ejabberd, this is a major bug

ah 😀

Okay, I understood it wrong then

I thought "xmlns='urn:xmpp:bob'" would be illegal.

are you not running a stable version?

Thanks for clarifying.