XSF Discussion - 2020-06-19


  1. Neustradamus

    Wojtek: ^

  2. Neustradamus

    vanitasvitae: Stork + Siskin IM

  3. mukt2 has joined

  4. neshtaxmpp has joined

  5. thorsten has left

  6. adiaholic_ has left

  7. adiaholic_ has joined

  8. stpeter has left

  9. lskdjf has left

  10. mukt2 has left

  11. thorsten has joined

  12. stpeter has joined

  13. alameyo has left

  14. alameyo has joined

  15. bear has left

  16. debacle has left

  17. arc has left

  18. arc has joined

  19. stpeter has left

  20. mukt2 has joined

  21. Wojtek

    It's not implemented in none of our clients (Siskin, Beagle, Stork)

  22. alameyo has left

  23. alameyo has joined

  24. mukt2 has left

  25. Neustradamus

    Wojtek: - https://github.com/tigase/stork/blob/master/app/src/main/res/xml/features.xml - https://github.com/tigase/siskin-im/blob/master/SiskinIM/settings/server_features_list.xml

  26. Wojtek

    as you can see, this is complete list of XEPs without indication whether it's implemented or not...

  27. bear has joined

  28. neshtaxmpp has left

  29. neshtaxmpp has joined

  30. Wojtek has left

  31. moparisthebest has left

  32. moparisthebest has joined

  33. neshtaxmpp has left

  34. neshtaxmpp has joined

  35. andrey.g has left

  36. mukt2 has joined

  37. Yagiza has joined

  38. mukt2 has left

  39. stpeter has joined

  40. stpeter has left

  41. andy has joined

  42. arc has left

  43. arc has joined

  44. arc has left

  45. arc has joined

  46. arc has left

  47. arc has joined

  48. murabito has left

  49. mimi89999 has left

  50. mukt2 has joined

  51. mimi89999 has joined

  52. murabito has joined

  53. mukt2 has left

  54. mukt2 has joined

  55. alexis has left

  56. waqas has joined

  57. mukt2 has left

  58. mukt2 has joined

  59. lovetox has joined

  60. alexis has joined

  61. arc has left

  62. arc has joined

  63. lovetox has left

  64. emus has joined

  65. stpeter has joined

  66. neshtaxmpp has left

  67. werdan has joined

  68. lorddavidiii has joined

  69. wurstsalat has joined

  70. werdan has left

  71. winfried has left

  72. winfried has joined

  73. jcbrand has joined

  74. winfried has left

  75. winfried has joined

  76. stpeter has left

  77. paul has joined

  78. pep.

    vanitasvitae, it's not implemented. there's many things to fix in that XEP :(

  79. mukt2 has left

  80. mukt2 has joined

  81. citizenzibb has joined

  82. winfried has left

  83. winfried has joined

  84. winfried has left

  85. winfried has joined

  86. winfried has left

  87. winfried has joined

  88. winfried has left

  89. Guus has left

  90. Guus has joined

  91. winfried has joined

  92. arc has left

  93. arc has joined

  94. sonny has left

  95. sonny has joined

  96. Alex has joined

  97. Mikaela has joined

  98. j.r has left

  99. j.r has joined

  100. sonny has left

  101. sonny has joined

  102. waqas has left

  103. karoshi has joined

  104. marc has left

  105. karoshi has left

  106. karoshi has joined

  107. stpeter has joined

  108. mukt2 has left

  109. sonny has left

  110. sonny has joined

  111. j.r has left

  112. karoshi has left

  113. karoshi has joined

  114. karoshi has left

  115. karoshi has joined

  116. karoshi has left

  117. mukt2 has joined

  118. robertooo has joined

  119. arc has left

  120. arc has joined

  121. sonny has left

  122. sonny has joined

  123. arc has left

  124. arc has joined

  125. sonny has left

  126. sonny has joined

  127. sonny has left

  128. sonny has joined

  129. j.r has joined

  130. stpeter has left

  131. karoshi has joined

  132. Steve Kille has joined

  133. arc has left

  134. arc has joined

  135. karoshi has left

  136. Mikaela has left

  137. Mikaela has joined

  138. govanify has left

  139. govanify has joined

  140. karoshi has joined

  141. arc has left

  142. arc has joined

  143. mukt2 has left

  144. mukt2 has joined

  145. debacle has joined

  146. debacle has left

  147. debacle has joined

  148. karoshi has left

  149. lskdjf has joined

  150. karoshi has joined

  151. sonny has left

  152. sonny has joined

  153. karoshi has left

  154. Abbe has joined

  155. karoshi has joined

  156. Shell has joined

  157. Dele Olajide has joined

  158. karoshi has left

  159. karoshi has joined

  160. Nekit has left

  161. Nekit has joined

  162. Shell has left

  163. Shell has joined

  164. marc has joined

  165. Nekit has left

  166. arc has left

  167. arc has joined

  168. Nekit has joined

  169. arc has left

  170. arc has joined

  171. Shell has left

  172. Shell has joined

  173. arc has left

  174. arc has joined

  175. mukt2 has left

  176. arc has left

  177. arc has joined

  178. mukt2 has joined

  179. karoshi has left

  180. karoshi has joined

  181. Dele Olajide has left

  182. Shell has left

  183. Shell has joined

  184. stpeter has joined

  185. karoshi has left

  186. karoshi has joined

  187. Shell has left

  188. Shell has joined

  189. stpeter has left

  190. Nekit has left

  191. karoshi has left

  192. karoshi has joined

  193. emus has left

  194. emus has joined

  195. mukt2 has left

  196. Nekit has joined

  197. karoshi has left

  198. karoshi has joined

  199. mukt2 has joined

  200. andrey.g has joined

  201. andrey.g has left

  202. karoshi has left

  203. Nekit has left

  204. bear has left

  205. mukt2 has left

  206. Nekit has joined

  207. karoshi has joined

  208. Nekit has left

  209. thorsten has left

  210. flow

    should xep156 .well-known lookups over http be allowed? rfc6415 says so, but I think this is an issue, as an attacker could redirect you to a websocket endpoint under his control

  211. flow

    I guess the question is how wss: certificates are validated by xmpp clients

  212. jonas’

    I seem to recall to have read something about that in the websocket rfc

  213. flow

    but I think most websocket libraries will use the name in the websocket url, and not the xmpp service name

  214. jonas’

    I think it says you MUST use https for the well known lookup

  215. Nekit has joined

  216. jonas’

    1. As described in Section 4 of this document, the method for discovering a connection endpoint does not use DNS SRV records as in the TCP binding but instead uses Web-host Metadata files retrieved via HTTPS from a URL at the XMPP service domain. From a security standpoint, this is functionally equivalent to resolution via DNS SRV records (and still relies on the DNS for resolution of the XMPP source domain).

  217. jonas’

    https://tools.ietf.org/html/rfc7395#section-6

  218. thorsten has joined

  219. mukt2 has joined

  220. flow

    yeah, but if websocket libraries do not correctly verify the certificate, then this is not comperable to (unauthenticated) DNS SRV RRs

  221. flow

    yeah, but if websocket libraries do not "correctly" verify the certificate, then this is not comperable to (unauthenticated) DNS SRV RRs

  222. Zash

    So you could do something like the SRV/DNSSEC thing, ie not accept a pointer to something other than ws(s)://maindomain.example/* unless the .well-known lookup is over https

  223. flow

    Zash, right, but not sure if I like the complexity of this

  224. Zash

    Presumably wss://this.example must present a cert for dns:this.example

  225. flow

    sure, but what if my xmpp service address is example.org and well-known delegates to wss://websocket.example.org

  226. flow

    or http-non-tls looked up well-known delegates to wss://evil.attacker.org

  227. sonny has left

  228. sonny has joined

  229. sonny has left

  230. sonny has joined

  231. flow

    of course if wss://evil.attacker.org presents a cert with dns:example.org it should probably authenticate, but given that websocket is somehow related to http, i would not be surprised if a lot of websocket libraries simply authenticate if a valid certifcate for evil.attacker.org is presented

  232. Zash

    Same problem as with an insecure SRV record pointing to evil.attacker.example

  233. flow

    not really, we do authenticate using SAN there

  234. jonas’

    http-non-tls for well-known is forbidden as per websocket spec, we can ignore that

  235. jonas’

    because of exactly that issue

  236. Zash

    so no problem then

  237. flow

    jonas’, ok, I still would not ignore it, as I was unable to find it

  238. flow

    it should probably be mentioned in xep156

  239. vanitasvitae has left

  240. flow

    jonas’, also ref to the part of the spec pls :)

  241. vanitasvitae has joined

  242. jonas’

    flow, https://tools.ietf.org/html/rfc7395#section-4 step 1

  243. jonas’

    > 1. Send a request over secure HTTP to the path

  244. flow

    ahh I thought you where referring to the websocket rfc

  245. flow

    not the xmpp websocket transport binding rfc

  246. Nekit has left

  247. jonas’

    oh sorry, yeah, I meant the xmpp-over-websocket rfc

  248. jonas’

    the websocket rfc obviously wouldn’t know anything about the xmpp-specific well-known things

  249. flow

    i still wonder if we should, at least recommend, https only well-known lookups in xep156

  250. jonas’

    that sounds reasonable

  251. jonas’

    can never hurt

  252. flow

    and why rfc7395 does not use a normative 'MUST' to state that well-known must only be retrieved via https

  253. Nekit has joined

  254. adiaholic_ has left

  255. adiaholic_ has joined

  256. karoshi has left

  257. karoshi has joined

  258. bear has joined

  259. debacle has left

  260. thorsten has left

  261. thorsten has joined

  262. thorsten has left

  263. thorsten has joined

  264. Steve Kille has left

  265. emus has left

  266. emus has joined

  267. karoshi has left

  268. karoshi has joined

  269. Steve Kille has joined

  270. Nekit has left

  271. debacle has joined

  272. Steve Kille has left

  273. thorsten has left

  274. thorsten has joined

  275. karoshi has left

  276. karoshi has joined

  277. Nekit has joined

  278. Steve Kille has joined

  279. Shell has left

  280. Shell has joined

  281. karoshi has left

  282. thorsten has left

  283. thorsten has joined

  284. thorsten has left

  285. thorsten has joined

  286. stpeter has joined

  287. karoshi has joined

  288. sonny has left

  289. sonny has joined

  290. stpeter has left

  291. xecks has left

  292. xecks has joined

  293. Shell has left

  294. Shell has joined

  295. xecks has left

  296. xecks has joined

  297. thorsten has left

  298. thorsten has joined

  299. Shell has left

  300. Shell has joined

  301. govanify has left

  302. govanify has joined

  303. govanify has left

  304. govanify has joined

  305. thorsten has left

  306. j.r has left

  307. j.r has joined

  308. govanify has left

  309. govanify has joined

  310. thorsten has joined

  311. govanify has left

  312. govanify has joined

  313. Shell has left

  314. Steve Kille has left

  315. j.r has left

  316. j.r has joined

  317. govanify has left

  318. govanify has joined

  319. govanify has left

  320. govanify has joined

  321. govanify has left

  322. govanify has joined

  323. govanify has left

  324. govanify has joined

  325. lovetox has joined

  326. govanify has left

  327. govanify has joined

  328. Shell has joined

  329. karoshi has left

  330. karoshi has joined

  331. Steve Kille has joined

  332. Shell has left

  333. Shell has joined

  334. sonny has left

  335. sonny has joined

  336. lovetox has left

  337. jonas’

    moparisthebest <-> vanitasvitae

  338. jonas’

    (cue Teamspeak 1.x "Link engaged" sound)

  339. vanitasvitae

    😀

  340. andy has left

  341. Wojtek has joined

  342. Shell has left

  343. Shell has joined

  344. Shell has left

  345. Shell has joined

  346. lovetox has joined

  347. Zash has left

  348. j.r has left

  349. flow

    wiki.xmpp.org has 1661 pages

  350. flow is currently git cloning wiki.xmpp.org

  351. stpeter has joined

  352. pep.

    git cloning mediawiki? :o

  353. lorddavidiii has left

  354. flow

    try that with wikipedia.org ;)

  355. andy has joined

  356. Shell has left

  357. Shell has joined

  358. karoshi has left

  359. karoshi has joined

  360. lorddavidiii has joined

  361. stpeter has left

  362. karoshi has left

  363. karoshi has joined

  364. j.r has joined

  365. Shell has left

  366. Shell has joined

  367. emus has left

  368. emus has joined

  369. emus has left

  370. emus has joined

  371. Nekit has left

  372. Nekit has joined

  373. eevvoor has joined

  374. lovetox has left

  375. vanitasvitae has left

  376. werdan has joined

  377. vanitasvitae has joined

  378. lovetox has joined

  379. vanitasvitae has left

  380. vanitasvitae has joined

  381. lorddavidiii has left

  382. sonny has left

  383. sonny has joined

  384. Andrzej has left

  385. karoshi has left

  386. karoshi has joined

  387. Shell has left

  388. Shell has joined

  389. lovetox has left

  390. Zash has joined

  391. stpeter has joined

  392. Nekit has left

  393. waqas has joined

  394. Zash has left

  395. Nekit has joined

  396. govanify has left

  397. govanify has joined

  398. govanify has left

  399. govanify has joined

  400. andrey.g has joined

  401. Shell has left

  402. Shell has joined

  403. andy has left

  404. andy has joined

  405. jubalh has joined

  406. lovetox has joined

  407. andrey.g has left

  408. lovetox has left

  409. Andrzej has joined

  410. andy has left

  411. mukt2 has left

  412. andy has joined

  413. mukt2 has joined

  414. bear has left

  415. !XSF_Martin has left

  416. !XSF_Martin has joined

  417. karoshi has left

  418. karoshi has joined

  419. lskdjf has left

  420. karoshi has left

  421. karoshi has joined

  422. lovetox has joined

  423. goffi has joined

  424. Zash has joined

  425. debacle has left

  426. Unlife has left

  427. Unlife has joined

  428. stpeter has left

  429. lovetox has left

  430. lskdjf has joined

  431. alexis has left

  432. citizenzibb has left

  433. citizenzibb has joined

  434. eta has left

  435. eta has joined

  436. lorddavidiii has joined

  437. bear has joined

  438. vanitasvitae has left

  439. vanitasvitae has joined

  440. krauq has left

  441. lovetox has joined

  442. lorddavidiii has left

  443. krauq has joined

  444. karoshi has left

  445. karoshi has joined

  446. Zash has left

  447. Zash has joined

  448. Shell has left

  449. Shell has joined

  450. Zash has left

  451. sonny has left

  452. sonny has joined

  453. karoshi has left

  454. debacle has joined

  455. karoshi has joined

  456. Shell has left

  457. Shell has joined

  458. karoshi has left

  459. sonny has left

  460. sonny has joined

  461. sonny has left

  462. sonny has joined

  463. werdan has left

  464. karoshi has joined

  465. lovetox has left

  466. mukt2 has left

  467. mukt2 has joined

  468. Shell has left

  469. karoshi has left

  470. karoshi has joined

  471. stpeter has joined

  472. lovetox has joined

  473. Zash has joined

  474. karoshi has left

  475. Zash has left

  476. Zash has joined

  477. sonny has left

  478. sonny has joined

  479. mukt2 has left

  480. karoshi has joined

  481. andy has left

  482. sonny has left

  483. sonny has joined

  484. arc has left

  485. arc has joined

  486. vanitasvitae has left

  487. vanitasvitae has joined

  488. arc has left

  489. arc has joined

  490. Zash has left

  491. Zash has joined

  492. stpeter has left

  493. andy has joined

  494. adiaholic_ has left

  495. Shell has joined

  496. vanitasvitae has left

  497. stpeter has joined

  498. karoshi has left

  499. Nekit has left

  500. Zash has left

  501. Zash has joined

  502. stpeter has left

  503. karoshi has joined

  504. vanitasvitae has joined

  505. vanitasvitae has left

  506. vanitasvitae has joined

  507. karoshi has left

  508. karoshi has joined

  509. karoshi has left

  510. karoshi has joined

  511. jubalh has left

  512. karoshi has left

  513. karoshi has joined

  514. stpeter has joined

  515. karoshi has left

  516. Shell has left

  517. Shell has joined

  518. karoshi has joined

  519. vanitasvitae has left

  520. vanitasvitae has joined

  521. vanitasvitae has left

  522. vanitasvitae has joined

  523. karoshi has left

  524. karoshi has joined

  525. mukt2 has joined

  526. stpeter has left

  527. vanitasvitae has left

  528. vanitasvitae has joined

  529. karoshi has left

  530. karoshi has joined

  531. andy has left

  532. karoshi has left

  533. Andrzej has left

  534. vanitasvitae has left

  535. vanitasvitae has joined

  536. emus has left

  537. emus has joined

  538. andy has joined

  539. karoshi has joined

  540. karoshi has left

  541. karoshi has joined

  542. karoshi has left

  543. karoshi has joined

  544. karoshi has left

  545. karoshi has joined

  546. karoshi has left

  547. karoshi has joined

  548. Shell has left

  549. Shell has joined

  550. karoshi has left

  551. karoshi has joined

  552. karoshi has left

  553. karoshi has joined

  554. karoshi has left

  555. karoshi has joined

  556. karoshi has left

  557. karoshi has joined

  558. mukt2 has left

  559. mukt2 has joined

  560. Jeybe has left

  561. adiaholic_ has joined

  562. lovetox has left

  563. Shell has left

  564. Shell has joined

  565. karoshi has left

  566. karoshi has joined

  567. karoshi has left

  568. karoshi has joined

  569. karoshi has left

  570. karoshi has joined

  571. karoshi has left

  572. karoshi has joined

  573. karoshi has left

  574. karoshi has joined

  575. karoshi has left

  576. karoshi has joined

  577. karoshi has left

  578. karoshi has joined

  579. Shell has left

  580. Shell has joined

  581. Jeybe has joined

  582. karoshi has left

  583. karoshi has joined

  584. karoshi has left

  585. karoshi has joined

  586. Yagiza has left

  587. david has left

  588. david has joined

  589. debacle has left

  590. debacle has joined

  591. stpeter has joined

  592. karoshi has left

  593. karoshi has joined

  594. neshtaxmpp has joined

  595. arc has left

  596. arc has joined

  597. mukt2 has left

  598. mukt2 has joined

  599. stpeter has left

  600. karoshi has left

  601. karoshi has joined

  602. neshtaxmpp has left

  603. Jeybe has left

  604. neshtaxmpp has joined

  605. karoshi has left

  606. karoshi has joined

  607. karoshi has left

  608. karoshi has joined

  609. Lance has joined

  610. alexis has joined

  611. stpeter has joined

  612. karoshi has left

  613. karoshi has joined

  614. karoshi has left

  615. karoshi has joined

  616. karoshi has left

  617. karoshi has joined

  618. karoshi has left

  619. karoshi has joined

  620. karoshi has left

  621. karoshi has joined

  622. Zash has left

  623. Shell has left

  624. Shell has joined

  625. stpeter has left

  626. Zash has joined

  627. Shell has left

  628. Shell has joined

  629. karoshi has left

  630. karoshi has joined

  631. mukt2 has left

  632. Shell has left

  633. Shell has joined

  634. alameyo has left

  635. alameyo has joined

  636. LNJ has left

  637. mukt2 has joined

  638. neshtaxmpp has left

  639. robertooo has left

  640. karoshi has left

  641. karoshi has joined

  642. Lance has left

  643. robertooo has joined

  644. neshtaxmpp has joined

  645. vanitasvitae has left

  646. vanitasvitae has joined

  647. karoshi has left

  648. karoshi has joined

  649. karoshi has left

  650. karoshi has joined

  651. vanitasvitae has left

  652. karoshi has left

  653. karoshi has joined

  654. Shell has left

  655. Shell has joined

  656. eta has left

  657. eta has joined

  658. mukt2 has left

  659. vanitasvitae has joined

  660. mukt2 has joined

  661. karoshi has left

  662. karoshi has joined

  663. alameyo has left

  664. alameyo has joined

  665. goffi has left

  666. eevvoor has left

  667. Mikaela has left

  668. karoshi has left

  669. arc has left

  670. karoshi has joined

  671. neshtaxmpp has left

  672. karoshi has left

  673. karoshi has joined

  674. Shell has left

  675. Shell has joined

  676. karoshi has left

  677. karoshi has joined

  678. adiaholic_ has left

  679. adiaholic_ has joined

  680. Nekit has joined

  681. karoshi has left

  682. karoshi has joined

  683. paul has left

  684. karoshi has left

  685. karoshi has joined

  686. stpeter has joined

  687. Shell has left

  688. Shell has joined

  689. karoshi has left

  690. karoshi has joined

  691. Shell has left

  692. Shell has joined

  693. karoshi has left

  694. karoshi has joined

  695. wurstsalat has left

  696. Zash has left

  697. Zash has joined

  698. karoshi has left

  699. karoshi has joined

  700. karoshi has left

  701. karoshi has joined

  702. stpeter has left

  703. debacle has left

  704. karoshi has left

  705. karoshi has joined

  706. karoshi has left

  707. karoshi has joined

  708. karoshi has left

  709. karoshi has joined

  710. mukt2 has left

  711. karoshi has left

  712. karoshi has joined

  713. mukt2 has joined