XSF Discussion - 2021-02-26

Hi there, I have some very good news. Libervia (formerly "Salut à Toi") has received a grant from NLnet for a big project in 2 parts: 1) an ActivityPub <=> XMPP gateway and 2) updating e2ee implementation and working on e2ee for Pubsub. In both cases protoXEP should be proposed to cover the missing features. I'll make a public announcement on my blog next week with more details.

Very nice! Congratulations :)

thanks

Looking forward to the activitypub bridge.

goffi, Congratulations, that sounds exciting on both counts. You're looking at purely encryption on Pubsub or signing as well?

dwd: signing as well

goffi, That's awesome. I think there's a lot of applicability in signed/authenticated public pubsub.

yeah me too

wow, congrats! That's going to be very useful!

goffi, For example, software release announcements, which are a *big* topic in cybersecurity right now due to software supply chain concerns.

goffi, I'd be very happy to help out there if I can, and might be able to find you some other interested parties.

yes, and even for simple blogging, today we have to trust the pubsub service to know who is the publisher (and I think many of them/clients are not checking publisher), it's really easy to fake a blog comment.

dwd: sure with pleasure. I'll start with ActivityPub, Pubsub will be the second part, probably not before a couple of months.

goffi, Oh, for sure it's really useful in lots of places, but I'm most interested in the cases where the lack of authentication in a comms pipeline makes other, existing security issues worse. Vulnerability announcements and updates are both really critical path items in this area.

yeah make sense

I'll publish early protoXEP to have feedback from community as soon as possible, we'll have a chance to discuss use cases and avoid design mistakes.

goffi, That'd be great, I'm really looking forward to that.

goffi: that is awesome, congrats

thx

goffi: 👏

goffi, dwd: thats awesome! I'd be interested in signing pubsub stuff as well 😉

goffi: congrats!

goffi: let me know if I can help, too, I may have some more time to get back to working on PubSub, Twisted stuff, in the coming weeks.

ralphm: thx, and sure I will. Beside this grant, I'm willing to fix pubsub collection, each time I've wanted to use it I've been blocked because the collection access_model override leaf nodes ones. But I'll talk at some point about that on the list, and propose a fix.

👍