XSF Discussion - 2019-04-12

jonas’: XSLT isn't the only thing that's turing complete. I believe CSS is too. I think SVG might be. PDFs certainly are.

https://matrix.org/blog/2019/04/11/security-incident/

> However, if you use server-side encryption key backup (the default in Riot these days) or take manual key backups, you’ll be okay.

Say what now

Is that e2e where the server holds your key? Am I missing something???

moparisthebest: Search for "What is Key Backup?" on this page: https://webcache.googleusercontent.com/search?q=cache:4nsVLi1uc0AJ:https://about.riot.im/help+

If I'm reading that right, it means keys are encrypted via a password and stored on Riot's servers

So then your chats are simply encrypted with a password and not a key? Why still pass keys around?

ugh. i am so over debating xmpp vs matrix.

or whatever new hotness is out

https://upload.yax.im/upload/Y1CNWHyhNHs01sU8/Screenshot_20190412-074154_Firefox.jpg

This is not how it's supposed to be, is it?

waqas, CSS is turing complete? how that?

https://lemire.me/blog/2011/03/08/breaking-news-htmlcss-is-turing-complete/ — whether that's actually correct, I'll leave as an exercise for you

https://github.com/matrix-org/matrix.org/issues/358

ouch

edhelas: there's a box full! https://github.com/matrix-org/matrix.org/issues/created_by/matrixnotorg

Yeah, it's pretty sad.

thanks for cheering me up

hi Arc!

how've you been?

Everybody: harden your XMPP servers!

+1

Is a good warning for the rest of us

Oh, my.

Guus: great. I applied to add MIX to Prosody for a gsoc project

so that's a thing :-)

I've noticed 🙂

ive been reading up on MIX

And still alive?

actually Im liking what im seeing.

Nice.

MIX looks pretty clean, overall.

I haven't exactly grokked how jingle is intended to work over it..

Arc, It mostly is, but there's some details that are off, and it's still a fork-lift.

dwd: sure. thats expected. but I assume that changes that happen from this point will be minor and easily trackable

vs earlier when there was legitimate concern (and retrospectively, prophetic) that MIX would undergo an almost complete rewrite

speaking of forklifts... is anyone working on IM-NG?

Arc, Maybe... I certainly think implementing it will shake a lot out. I'd like to see ESL and Andrew Nenakhov put their ideas on the table and see if we could merge in some of their experiences.

you mean the new serverless E2E decentralized chat system running on blockchain that some gen-z'er "invented"?

Arc, No, Erlang Solutions have a MUC-lite (I think) over XMPP in Mongoose IM. Andrew Nenakhov is Xabber, and other something similar-but-different.

ah ok.

Arc, Both, AFAIK, run without the home server being aware, so less fork-lifty. I think the user's home server being aware is very useful, but I'm worried about it being mandatory.

yea I was concerned to learn that the users XMPP server needed to be updated. that's concerning.

"benefits from" I think is a winner. "needs" is a blocker.

hmm.

well I'm happy to grab a pitchfork.

i mean, er, to start some heavy lifting, not in a frankenstein sense with torches

(I reserve the option to switch the meaning of that lol)

dwd: have all the "needs" issues been sorted out? I've stopped taking care at some point, after repeating my arguments didn't lead to the results I hoped for.

hehe

but seriously I love the concept behind MIX and have been wanting to work on it for awhile.

all the better to be paid for the work

Ge0rG, I genuinely don't remember your arguments.

dwd: me neither. There were things about making it possible to expose a MUC-style API and about who's storing the authoritative MAM archive

also things like putting MIXes into the roster.

Ge0rG, The MUC interop was sorted. MAM cropped up recently, it's currently meant to be on the user's server sometimes and sometimes the MAM itself.

KISS

Ge0rG, And I think it's still a special roster thing.

sometimes is the best kind of specification.

dwd: special roster things require user server support to work.

and break all the pre-mix clients.

But I've made that argument, repeatedly, years ago.

Ge0rG, That's the smallest part of the server support, really.

Ge0rG, FWIW, Andrew Nenakhov's thing in Xabber also puts group chats into the roster. That alone doesn't strike me as a terrible thing, as long as they behave mostly like other roster entries.

dwd: if it is such a small part, I'm sure we can figure out an alternative approach that is not a "needed" in your above sense.

Ge0rG, Yes, sure. Or we can ensure that on a naive server you can plonk a MIX into the roster without ill-effect to your server or other clients.

here's the crux of it - if there's sorting to be done for client, or client's server capabilities that are needed, lets get it sorted now. because the longer we mosh on it the longer it'll take to get that software updated.

Ge0rG: how does MIX break pre-mix clients? Wouldn't you just not be able to use MIX unless it had a muc-mirror setup?

dwd whenever I try to send messages to your JID, I'm getting "Sorry, an error occurred: <remote-server-not-found xmlns="urn:ietf:params:xml:ns:xmpp-stanzas"/>"

Guus, My abuse filtering is working perfectly? ;-)

Haha

dwd: yes. This would be great. But the put-it-in-roster approach essentially guarantees that MIX elements get exposed to pre-MIX clients, and I'm not sure you can test them all for brekage

it probably is.

Guus, More seriously, that and many other things are on my todo list.

still, I'd like to abuse you.

Arc: when a client goes online, its presence-available gets sent to the MIX, so the client will be probably automatically subscribed to all MIX traffic

Can I have a quick chat in private? 🙂

(also: how?)

Guus: MUC-PMs!

Guus, I have sent messages to your other account.

oh, is that enabled here? we disabled it on ignite for abuse

Guus: you disabled yourself for abuse?

... no?

(maybe I should)