XSF Discussion - 2019-04-23

jabber.org certificate is expired if anyone knows how to ping admins

They know

Cool

moparisthebest: there are tickets on github :) https://github.com/stpeter/jabberdotorg/issues

Are they new or from previous periods? 🤔

jonas’: One of my team just noticed the new XEP rendering and commented how neat it looks. JFYI.

Ge0rG, looks like both! needs more cron

or, systemd timers, whatever the latest hotness in scheduled jobs is

you can't cron everything.

Also privilege separation. I don't want certbot to have enough privileges to restart/reload my xmpp server.

but devops today just install a docker that hooks into your other docker and then everything sinks and...

I mean you can give it *just* enough priveleges to tell it to reload the certificate

Sounded like there weren't any way to only reload the cert.

then 'just enough' is restarting the server ¯\_(ツ)_/¯

is it better to have an admin remember to renew manually and restart the server manually? because you know where that gets you

Zash: did I mention yet that the documented way of reloading certs in prosody doesn't work? Except when I do it twice.

Ge0rG: Not that I remember. Is there an issue for that?

Zash: no. Maybe a pastebin on the prosody@ MUC. I've got a "complicated" setup, and I never had enough evidence to feel that pulling a number would be actually useful

I might have seen it to, or at least wondered why it only works when directly observed.

Zash: https://issues.prosody.im/1346

Thanks

> MASQUE (Multiplexed Application Substrate over QUIC Encryption) is a mechanism that allows co-locating and obfuscating networking applications behind an HTTPS web server.

new IETF mailing list set up for it, expect a XEP soon >:)

new ALPN I guess?

Saw the mail. I cried.

hey you didn't want everything going over TLS on 443 right?

now it'll just all go over UDP instead

Is that even going to work?

only because all browsers and CDNs will add support at the same time yes

ie, the same reason TLS on 443 worked

TLS on 443 works because nobody dare block it ... yet.

can't have anything nice, unless you are 1 of the 2ish major browser vendors, and then you can have whatever you want

Browser vendors being the driving force behind anything, and everything becoming browser based is what depresses me.

Browser vendors being the driving force behind MTA-STS...

DANE or DIE!

Wait how is MTA-STS different from POSH?

Zash, it also requires DNS, and a subdomain.

alsam

oops