XSF Discussion - 2020-01-17

dwd: > For what it's worth, there are plenty of Open Source developers who > haven't bullied the XSF or tried to reinterpret its documents and > practice to claim it allows them to do whatever they want. now that's a little childish isn't it? and after our discussion here where I clarified I was after none of these things. I'm not going to derail the email thread and I'll be happy to just forget about it, just please realize we are on the same team here, I honestly just wanted some things clarified, if discussion is in any way harmful to any type of open standards organization then it's in bad shape

You don't want things simply clarified, you want them significantly changed - this is evident from your actions and messages. You'rve consistently argued that any kind of encumbrance is acceptable to you and therefore should be allowed by the XSF, and argued that the documents describing our process either allow this already or should be changed to allow it. I don't really see how this is mischaracterising anything.

dwd: seems to me you're also in the business of telling people what they think (that you criticized yesterday in this channel). Maybe we can all put an end to the pettiness

pep., If you'd like to explain why you think I'm wrong, please do so.

I don't actually care if you're right or wrong here

Of course not.

that's not how we keep the dialogue going

and yes I disagree with your statement fwiw

pep., I've done my level best to explain why radical changes to the XSF will damage it. I have, nevertheless, provided a proposal to compromise on this to a significant degree. The reaction has been to continue pushing to reinterpret existing rules and change them.

For example: ‎[18:30:14] ‎moparisthebest‎: as I stated before, GPL is not an encumbrance in my book

dwd: so what, GPL is also not an encumbrance in my book. That's why we're asking for that to be rephrased, explained differently maybe

dwd, I don’t see a problem with that statement

that’s not asking to change anything

that’s just explaining their viewpoint

nothing wrong with that.

Out of curiosity and to determine how much effort to put into this, I'd really like to see a member opinion vote on that. Of course, the question is what 'that' should be. Maybe "Should a XEP requiring GPL-compatible licenses be disallowed to enter the experimental stage (Yes / No)"

jonas’, Encumbrance has a legal definition that's really quite easy to find, as these things go.

dwd, for someone who has no problems with GPL, it’s still not an encumbrance maybe?

I’m not a native speaker, but you and moparisthebest are, I think

(though from different locales methings)

jonas’, For someone with an astonishing amount of money, high patent licensing would not be an onerous encumbrance, but it would still be an encumbrance.

jonas’, I'm happy to clarify these things, of course, but they have a defined meaning.

flow, I would still argue that allowing encumbered specifications (by the usual and legally-accepted definition of encumbrance) onto the Standards Track is dangerous, and I will resist that heavily.

dwd, which is fair and good, I think

but I also think you’re putting words on the "Goldwaage" (as we say in germany) here, meaning that you’re being overly precise about interpreting other people’s statements and not giving them any leeway (which, I think, would be appropriate given the medium and intensity of discussion)

jonas’, I have to assume that what people are arguing for is that the GPL is an *acceptable* encumbrance. That is an opinion, and while I disagree, I accept it's not a right or wrong thing in any absolute terms. But the fact that the GPL requires particular licensing on derived works, for example, is factual, and the fact that also counts as an encumbrance in the usual meaning of that term isn't contraversial in the slightest.

dwd, I see. The viewpoint makes sense.

I’m just worried about the level of hostility on both sides in this discussion.

yeah i think the omemo debate has brought up some underlying friction that has been there for a while. plus classic bike shedding i mean as far as omemo is concerned this debate could have been already over. The OMEMO Team(tm) has already announced that they are planning on working on a second iteration that is gpl free and fixes many other problems with the spec (for omemo, gpl is only one of multiple issues)

Daniel, I'm trying, probably unsuccessfully, to seperate OMEMO from the general case, and seperate any technical issues in OMEMO from its licensing. I have no stake in the technical issues; work-wise we can't use any PFS/PCS solution, so MLS is equally out. Obviously I like to have high-quality XSF specs, but I have no personal/work aims here.

(Our end-users do want E2EE; they also want nothing held on the device and a search function. You can imagine my fun.)

dwd: may I quote that one?

winfried, Not publicly please.

I actually have a candidate solution, but it's horrendous.

dwd: OK, Was already including it in my e2e encryption presentation at fosdem, scrapping it again :-D

winfried, Without attribution and company name is fine.

dwd: (y)

Good thing this room is not archived publicly. 😜

dwd, you are aware that this room is publicly logged?

Yes, of course, but putting it in a presentation is rather different.

winfried, Also a user-story I put on Twitter to explain things to a well-meaning Doctor: https://twitter.com/DwdDave/status/1204395566442135553 - you can use that.

dwd thanks

Daniel: for my information / knowledge, do you have a list of issues with the OMEMO spec? I love to have a better overview...

dwd: > work-wise we can't use any PFS/PCS solution I don't understand this comment, can you explain it?

"Perfect Forward Secrecy" and "Post Compromise Security", which are very similar concepts. I think PCS is a little weaker, but honestly I'm not sure of the details beyond "ephemeral keying".

And what do you mean with 'work-wise'? I believe my biggest lack of understanding is there...

Daniel the fact that OMEMO is already being replaced, as you write, fits right in XSF-defined procedures on how to handle contention like the one we're in now, I think. I just mentioned something along the same lines in a reply to the mailinglist. If we take that out of scope: what issue remains? What are the core issues that we're really discussing here?

winfried, https://github.com/Syndace/xeps/projects/1 that was a list Syndace pasted here

There are probably more

winfried, Oh. As in, for my work. Pando cannot use ephemeral keying because we cannot store data on the device and need a secure audit trail.

dwd: clear.. I thought the 'we' referred to the XSF....

I think it was useful to separate the two discussions currently going on in the mailinglists, btw. Thanks for that.

We need the Hats XEP! :)

pep.: thanks, gives a clear picture already

Guus, There's at least three things to consider: Experimental, [Non-]Open Standards, and OMEMO itself. I'm hoping that by dealing with the first two the last just happens.

I'm thinking Experimental is at best only sideways-related to the rest - or am I missing something?

Guus: Experimental is (currently) the entry point, so it's definitely related.

Guus, Yes, I agree with Kev, these are all interrelated.

I ment 'side-ways' in the sense that discussing 'experimental' primarily affects _when_ checks against XSF principles/objectives are made - not what those principles/objectives are?

Yes, that's true.

Meaning that any discussion on experimental should not affect the eventual outcome of a progression of a XEP through the stages.

we could optimize that flow, making sure that things that we don't want are out earlier, while the barrier to add new things is lower.

And those would be all good improvements.

Modulo that, as stated, I will resist anything going onto (opr staying on) the Standards Track if it doesn't conform to our IPR policy.

I'm thinking I've just took a harder line on that than you did earlier, in my last email. ✏

I think that's roughly in line with my original stance, which I have tried to compromise on.

As I wrote: I appreciate you trying to find a compromise - but I think this one will hurt us more than benefit, in the long run

On an unrelated note: today is the last day that the Thon EU hotel offer is valid. If you want to make us of it, act now!

> Well, yes, but the majority of our end-users are probably Fortnite players, and they're not talking to us. My kid gave up 30 seconds into me trying to explain IPR.

I probably should have expanded on that. But "consumer-grade" instant messaging is pretty small beans for XMPP. Embedded use of XMPP into games is, I think, the largest use by numbers of users, and I'm not sure what would be next - probably military, though possibly financial trading.

That doesn't mean I don't think consumer-grade messaging isn't important, or that we should ignore enterprise messaging (ie, Slack) because we're barely present. Strategically, both those make more sense to concentrate on than gaming (and won't harm gaming either), at least in terms of features.

(no argument from me)

Shit me. "That doesn't mean I don't think [...] isn't important". I'm turning into Kev. Sorry.

You're only realizing this now? 😃

Guus, I wasn't unaware of it.

that's my boy

Unrelated: you've disappeared from my roster again.

ah, no

sorry

my client is acting up

dwd I'm trying to push a subscription request your way

dwd: On the contrary, I get the right number of negatives into my incomprehensible mess :p

Kev, I never said I didn't disagree.

I propose a member vote: any negation in a sentence beyond the first costs 2^n EUR, where n = number of negations in that sentence. To be paid to all non-native english speakers in the XSF. ✏

(each)

So that first sentence of you costs 4 EUR to each non-native speaker?

Kev, huh, where is the second negation there?

aaaah

s/any negation in a sentence beyond the first costs/any negation beyond the first in a sentence costs/

better?

'any negation' = 1, 'number of negations' = 2 :)

I’m gonna leave now

I'm gonna sit here, be quiet, and become rich.

Guus, You're Dutch, you count as a native speaker. :-)

Will me exclaiming "no no no!" count against jonas’ rule?

I couldn't possibly count it out.

dwd: oops, in that case I've been lying quite a bit

ralphm, Ik ben het daar niet mee oneens.

dwd: :-D

Jonas never limited it to any specific language. I'm guessing the first round at the hotel bar is on you. 🙂

dwd, just tried a different email address for the Eurostar website, same error

The only other thing it has is my phone number, I could try my landline

or it just hates my name

Is your last name Null?

"What do you mean, your surname is just 'J'?"

Oh my, I did it

Who did you bribe?

Huzzah!

Different browser, incognito mode, paypal and my "other" email address... winning combo I'll have to remember for next year

Same train as me?

15:04?

Cheap afternoon one? Sounds right.

Yep

Last train back on Sunday?

No, coming back on Monday

Otherwise getting home that late is too difficult

and crossing the border might take the whole day, etc.

Isn't it still EU?

oh; i had forgotten about that

Lovely timing.

Daniel, Yeah, I haven't.

Great timing indeed

!XSF_Martin: Doesn't matter, it's Shengen that you can thank for painless border crossing and the UK was never part of that

i mean not about brexit in general. but the fact that it is - this time for real - happening right during fosdem

MattJ, Right, I figured I could use travel insurance if needs be. Or get my son to fly into Belgium under the radar in the dead of night.

dwd: the latter sounds ideal.

> !XSF_Martin: Doesn't matter, it's Shengen that you can thank for painless border crossing and the UK was never part of that Yeah, that's right. I think Switzerland and UK are the both exceptions of schengen == EU.

Switzerland != EU.

dwd, pilot licence valid in the EU?

Daniel, It has been on my mind since that particular date was announced, and is also part of the reason Kev isn't coming at all.

> Switzerland != EU. But Switzerland is Schengen.

TIL

MattJ, Yes, he has an EASA-issued license, so he's fine. He could transition it to a CAA one after Brexit, but there's no point.

!XSF_Martin, Ireland isn't Schengen either, and I believe there are other countries.

I suspect flying under the radar might put his license at risk, though.

dwd: paradrop?

Although, if he isn't caught doing so...

intosi, Only in the EU. ;-)

intosi, Flying in the dead of night is probably worse for his license, actually, given he doesn't have night qual.

> !XSF_Martin, Ireland isn't Schengen either, and I believe there are other countries. Really? Afaik it was Schengen. I travelled to Switzerland without any control.

Wikipedia says it is https://en.m.wikipedia.org/wiki/Schengen_Area

!XSF_Martin, No, Ireland is in the CTA with the UK, which is one of the precursors along with Benelux.

> Or get my son to fly into Belgium under the radar in the dead of night. Isn't that basically an invasion at that point?

Ah, thought your talking about Switzerland. Sorry.

I'll be there on Wednesday too.

Guus, Well, yes, but only of Blegium so that doesn't count. Everyone invades Belgium.

true.

dwd, matter of perspective I guess, from your perspective I'm trying to radically change things, from my perspective I already thought they were that way, hence the asking for clarification etc, I don't think this is in any way unreasonable

clearly XEP-0001 fails at being clear enough on critical definitions like "open standard"

so that should be fixed and let's move on

As I've pointed out before, XEP-0001 doesn't exist in a vacuum, and our definition of open standard *is* clearly defined in our IPR Policy.

only in your mind

it's not clear to me at least, for instance

it's also not clear to me.

It could be it's clear to the people who've been involved in the XSF for 15+ years and less so for the newcomers. ✏

no, it should be crystal clear to the newcomers, or even anyone reading XEP-0001, or it has failed at it's task

I think you misread what I said.

yes I did, I'll agree with that one :)

to be honest, I never cared much about what exactly constitutes an open standard, but I agree that we need a clear definition if we want to make decisions based on this term

exactly jonas’ , I never really thought too hard about it either until just recently

The discussion has mostly focussed on OMEMO being based on the Signal Protocol, implies that the protocol can only be implemented such that the end result is considered to fall under the GPL. I see this as a 'restriction', as per the IPR Policy, and this is why I believe that means it is encumbered. I hear people find this to be unclear, and I'd like to understand why.

as I've stated, I don't find the GPL to be an encumbrance, additionally "the protocol can only be implemented such that the end result is considered to fall under the GPL" is a legal opinion that I think the XSF has no business making, lastly I would personally clearly count GPL as an "open standard" and since there is no definition in XEP-0001...

that's kind of why I tried to seperate the conversations, if we don't make legal opinions, then we don't have to worry about the GPL stuff at all

if we do make legal opinions, then we need to edit XEP-0001 to clarify a ton of stuff

you are right about the legal opinion on "the protocol can only be implemented such that the end result is considered to fall under the GPL"

and decide what to do about GPL

we’re not qualified for htat

what we ARE qualified for is to detect a situation where forming such a legal opinion is very much required in the first place

which is an encumberance

all on its own

this

if you need DEFINITELY need a legal opinion to figure out if you can implement something under free software license X, then it’s encumbered, period.

you have to form a legal opinion anytime you implement anything

that’s a restriction and something very scary to legal departments

and of course I'd have no problem at all with some disclaimer saying what we think might be possible encumbrances (is that a word?)

moparisthebest, I am not asking you whether you think a specification requiring the end result to be GPL is an open standard. I'm asking if you can see that this requirement can be considered as a limitation as per the *XSF's* definition.

the XSF doesn't have a clear enough definition for me to decide

"open standard" appears 1 time in XEP-0001, and no times in the IPR policy, and no definitions anywhere

is this the third or the fourth round we are doing here?

From the IPR: > However, the XSF must ensure that XMPP Extensions do not pollute the free and open nature of the protocols. Preventing such pollution means that in perpetuity any entity may independently, and without payment or hindrance, create, use, sell, distribute, or dispose of implementations of XMPP and of any XMPP Extension. Such is the intent of this policy. To me, that leaves little room for interpretation of this. Having a protocol that requires an implementation to be of any type of license that for whatever reason someone would be unwilling to comply to, breaks with the above. ✏

Ge0rG, sixth, methinks

Ge0rG I'm thinking we're in the double-digits.

Ge0rG, isn't it just one long discussion?

moparisthebest, a long discussion would move beyond re-iterating the same points each and every day

moparisthebest, do you understand the piece that Guus copied from the IPR Policy?

what jonas said

oh god this train wifi at 200km/h is lagging

I don't think we are, I'm being accused of trying to do things that I am not trying to do, and attempting to make that clear

and poezio is re-connecting all the time. Sigh

I mean yesterday dwd accused me of "bullying the XSF into my interpretation [sic]" and I'm clarifying that's not my intent

In fairness, I was quoting Daniel there.

moparisthebest: fwiw I don't think he did. And I was the one who brought up the term

And I wasn't referring to you

yep that's fair, I'm not personally insulted, it's just clear my intent has not came across how I had planned

What do we need to resolve this?

A deep breath. (first)

on all parties, please

Actually I was partially referring to myself and/or myself from a couple of years ago when we first had the omemo debate

jonas’: You would like me to breathe on all parties? I could try speaking Welsh at people, although that would be more spittle than breath.

I'll see Kev's Welsh and raise him with my Dutch.

Kev, I ... I ... this is the second time you trolled me today! (in a good way) ✏

that statement from the IPR policy is clear, but XEP-0001 doesn't make it clear that that is the particular definition of "open standard" we are using

jonas’: Someone once made the (insightful) observation that the reason I don't enjoy speaking Welsh is that I'm not fluent enough to be able to play silly games with it in the way I do with English.

some type of update to XEP-0001 with some clarification would be good

When I said a deep breath, though, that bit wasn't flippant. I think the best thing we could do would be to step back for a few days (I think everyone's position is now clear).

moparisthebest: that we probably all can agree on

Kev, that seems realistic

maybe we can just call out the weekend, then?

and then the next step is to continue trying to figure out how we can document things that *currently* have IPR concerns but might be fixed later

I think that then, once we have an obvious break from the current discussion, in which some tensions have run somewhat high, one of the people who's been around a while attempts to add a clarification to XEP1 - hopefully one that doesn't involve adding too much prose.

And then the people who've found it confusing can comment on whether it helps as a clarification or not

Kev: yes, it should be done by somebody who doesn't involve too much prose.

that sounds perfect Kev

(And if we get to the stage that our status quo is documented reasonably, we decide that the status quo should be changed, I think that is the time to consider it) ✏

I think I've probably been around for long enough to have a reasonable first stab at a PR or two, so I propose that, as recompense for missing the Summit, I will submit something in a couple of weeks, assuming we can manage the first part of calming the flames in the interim :)

And I would try very hard not to write too much prose, at least in part because I very much don't enjoy writing such things.

(in my experience, writing less prose is more work)

Guus: y

I have no issue with that approach. Seems sensible to me. Thanks.

sounds great, so not sure how to "officially retract my PR" while waiting for Kev 's but you can at least unofficially consider it done

and I'll just re-iterate once more before shutting up, no hard feelings from my end, I didn't mean to cause any for anyone else, and I really appreciate the discussion I think it's been productive

moparisthebest: Thanks. If you'd like me to, I could close that request with the comment you've just given. Resubmitting wouldn't be onerous i fyou later wanted to.

Using my almost-the-laziest-Editor-we've-got superpowers.

ah it's unlocked now, I can do it!

👍

Kev: if I take this task, will that free you up to come to the summit?

Hah. Sadly not.

Hey, I tried.

It is kinda uncomfortable to not have a Kev there. ✏

I'm sure Diegem will somehow cope with the great double-negatives drought of 2020.

I don't think I'm not the only one who won't say I'm not disappointed.

Is dwd not coming either?

Nor intosi?

I vote for jonas’' idea of negation jar.

dwd's going, I believe.

I'm going as well.

ralphm, I'll come. Double negatives I can do, but Kev has cornered the market in the triple.

I do not intend to not attent.

I can't promise I won't try avoiding not sneaking in a few n-negatives.

jonas’: the Jan 2nd votes are all tagged as EXPIRED in the spreadsheet of doom

that’s correct

because they weren’t complete

I need to trigger editor actions

but even in incomplete state, I think they all look like decided, right?

yeah, I didn’t code it

right

not trying to blame you, I just wondered

(also reading up on the MAMFC thread, slowly)

Yeah, I never got beyond "expired", and I actually wanted to highlight them even though they might be decisive.

Has anyone ever done / thought about something like BOSH for s2s?

What is the use case?

before you go too far down that rabbit hole, the RFC is still under way, but likely soon there will be a "SRV2" dns record that'll let us combine all of regular SRV, XEP-0368, and the TXT records BOSH/Websockets use

in addition to other nice to haves, ESNI, QUIC

that would make it fairly clean discovery wise for S2S to use other transports

Well discovery wouldn't be my biggest concern with that.

I mean well-know 156 works

https://tools.ietf.org/html/draft-ietf-dnsop-svcb-httpssvc-01 < I think this is the most recent

yep discovery is just the easiest part perhaps, you are right

"[..] Other names might include "B", [..]

Yeah, that sounds like a teriffic idea, having an RR type called "B", next to "A".

That said, I put it on my reading list.

I think most of us would agree anything is better than HTTPSSVC though ? :)

if we have any official contacts with IETF maybe we should push for SRV2, or, anything but HTTP*

Anything is a stretch, but yeah, HTTPSSVC is not great.

yep

While the idea of having official contacts with the IETF for E2EE has come up, that doesn't mean anyone couldn't just participate at standards development at the IETF themselves.

(as well)

Might be good to have a list of RFCs (or other standards) the XSF would like to follow or influence (not have everything become http*, for example), for which we could assign people to represent us (paid?)

the combination of ESNI which uses this HTTPSSVC should *just work* for us, though we might need some more SVCB types which would be defined elsewhere anyway

like priority and weight are missing, the notes say "if you need them define them in another one"

QUIC is another one to closely follow, I doubt we need anything they won't provide though, and I also doubt we could do anything about it if not...

moparisthebest, why not? Just like on standards@ you can simply subscribe to the relevant WG and provide input.

Or show up at IETF events.

I'm very much in favour of the XSF sponsoring people to attend IETFs, but as ralphm says, you can just join the right mailing list and make sensible comments at a good first step. Even just telling them there's an interested community is useful for them.

Yeah, showing up at IETF events is generally a bit harder than showing up at the XMPP summit

MattJ, It's pretty easy, just violently expensive.

I understand why they move around the various corners of the planet, but yeah

Yeah. One of the main reasons I'm not involved with IETF stuff very heavily is that I could never find an employer willing to pay for those trips, and it's very hard to do serious work without the meetings.

I've managed 8 RFCs, and only 3 meetings (and one was a day trip). I may be wrong, but I think I have to be one of very few RFC authors with more RFCs than meetings.

I'm already struggling to get a day off to webex into Summit...

Ge0rG, You couldn't get three weeks off a year for the IETFs, then?

Ge0rG, Plus another three half weeks for interims if they're "that" kind of working group?

dwd: probably not. I'm sure I'd get time and expenses if it was some industrial IT security forum, though.

dwd: great email just now

Thanks

Thanks. There's something about inward investment and economics as well, but I don't think I can phrase it well without sounding like I'm only interested in money.