XSF Discussion - 2021-01-31

https://burtrum.org/up/53831ae2-c479-4137-a8c6-d2007b0680df/IMG_20210130_203835.jpg

^ Looks like XMPP isn't the only one with, eh, styling problems cc SamWhited jonas’

Does matrix really use pseudo-xml for markup in it's text?

For context, this is an IRC channel I'm joined to via conversations and biboumi and those people are joined from matrix

It's a subset of HTML, not XML

https://matrix.org/docs/spec/client_server/unstable#m-room-message-msgtypes

> Clients should limit the HTML they render to avoid Cross-Site Scripting, HTML injection, and similar attacks. The strongly suggested set of HTML tags to permit, denying the use and rendering of anything else, is: ...

Yikes, well, nothing could possibly go wrong there right?

> Not all attributes on those tags should be permitted

There's an open proposal for a replacement (although I think it still uses HTML? I dunno, I haven't really read it): https://github.com/matrix-org/matrix-doc/pull/1767

It's cool how when that PR is merged all clients will be instantly updated

Since that was the point of not doing xeps I mean

moparisthebest: It's HTML embedded in JSON, so it's perfectly safe. Mastodon does it that way too. But XHTML in XML is impossible to secure!!!!kk!!

Both are impossible to secure. reusing the layer your client is built in (possibly) internally is just a bad idea period.

Speaking of impossible to secure, add mam and carbons to the list https://monal.im/blog/cve-2020-26547/

Welcome to the club!

The list of clients that haven't had that vuln is probably shorter

That list is probably the list of clients where nobody has looked yet. 🙁

Likely

Ge0rG can confirm 🙂

Anyone look at siskin yet

https://wiki.xmpp.org/web/XEP-Remarks/XEP-0280:_Message_Carbons#Client-Side_Processing

Add it to the list! Any similar note for mam?

https://wiki.xmpp.org/web/XEP-Remarks/XEP-0313:_Message_Archive_Management looks like

IIRC similar issue with rosters have been a thing in the past

> The list of clients that haven't had that vuln is probably shorter Conversations is on that list

Possibly alone

Daniel: 🥇️

A winrar is you!

BTW, I've recently added those lists to the wiki because of the "new" pidgin Carbons code being vulnerable

Maybe somebody can add the Monal link?

On it

Done

Hope the link title is ok. If not, fix it! 😉

👍

moparisthebest, since you mentioned it here the other day, pester your XMPP client developer about supporting the color vision deficiency fixes for '392 :)

https://www.nic.at/media/files/News_and_PR/BachelorArbeit.pdf

DE-crypted?

Ah, nm, some kind of fore-word

on the topic of programatically generated avatars instead of colors from the other day, lol https://social.tchncs.de/@cark/105651953031693352

I don't speak german but the gist seems to be gitea generated a swastika for some users cc jonas’

Praise the sun.

Can't have nice things or rotational symmetry.

1. randomly generated avatars 2. not offending users; pick 1

And whatever you do, don't let the Internet train your AI!