XSF Discussion - 2021-07-19

https://github.com/Syndace/python-omemo Is this warehouse one of ours?

wuuko, what do you mean?

> mathieui wrote: > wuuko, what do you mean? If we need to update, can we update it? If it's not one of the team, we can't.

but what team are you talking about?

and what kind of update

> mathieui wrote: > but what team are you talking about? XMPP, xsf

> https://github.com/Syndace/python-omemo > Is this warehouse one of ours? Yes

> Daniel wrote: > Yes Ha, okay.

wuuko, there is no difference in terms of communication if the people are part of the XSF or not, except maybe the channels

(it’s not like being part of the XSF grants the XSF team(s) or anyone else any more power over the repos)

and as Syndace is in there, the question is already answered :p

> mathieui wrote: > (it’s not like being part of the XSF grants the XSF team(s) or anyone else any more power over the repos) > and as Syndace is in there, the question is already answered :p Now that I'm ready to open a server, I don't want to have any questions left in my head.

Hi everyone. I am a iphone user but recently acquired a few androids for researching opensource. Im a user now on conversations and has my accounts linked on Siskin and Monal on ios also. I currently develop for Filemaker Go on ios and would like to know two things: 1. How do i get involved in assisting/developing xmpp messenging for android and ios. 2. I would like to integrate xmpp into my current filemaker apps, to kick off, what do I need know, where do i start?

babacb, hi, welcome :)

Probably the best way to help out is just like with any open-source project. Find one that you like, hang out in the community, identify some open issues you could help out with, etc.

If you're interested in helping out with development of the XMPP protocol itself, here is a good place to be, as well as the standards@xmpp.org mailing list: https://xmpp.org/community/mailing-lists.html

babacb: As a user with an iPhone you are especially welcome helping the development and bugs of the xmpp iPhone apps, as there are much less people testing these IMO.

just a friendly reminder for those who have to reapply this quarter: https://wiki.xmpp.org/web/Membership_Applications_Q3_2021

> Sam wrote: > I mean that they have their own implementations, not that they have their own encryption. Could that mean that some XMPP clients wouldnt' be able to exchange OMEMO-encrypted messages with each other because of client differences?

That's a hypothetical possibility for every protocol extension

Ok. But the better known clients all work with each other, I guess? ✏

Yes

So they're all using the same protocol 'edition'? Or just fixing the issues?

both

Ok, thanks.

The point of XMPP being an open protocol is that we document how the clients should interact, so that they work with each other

Great.

oh hey, the XMPP tunnel is open

https://eta.st/xmpp/file_share/641fc779-2ee3-485b-a2cf-1b9824bad83b/FS5XojnfSHuriFiA5fDPaw.jpg

Oh, nice

eta, so they can change colors? camp out until the colors match the xmpp logo, replace the one on the website, ???, PROFIT^H^H^H^H ETTY

babacb: Monal developers are really happy about Alpha and Beta testers with professional background. If you can develop for Apple devices I guess thats also welcome.

where is that tunnel, btw?

King's Cross station in London

ha nice - would love to see xmpp colors

Zash: the issue is there are usually people

and I think they close it during the night etc

As Sam points out, what the heck is the point of an empty corridor anyways?

I guess you probably could ask them to display the XMPP colors?

We could all go there and take a photo with us crowding about

😀

👍️

That would be kind of fun (and at least make it have some relevance, though I still think it just takes up too much room on the home page)

Sam, but I think we have many other issues with the website, than this

I kinda liked this version: https://web.archive.org/web/20100713024339/http://xmpp.org/

I don't disagree

(with waht emus said)

interesting

ouh Google was a sponsor?

Yes

Google gave an office right next to one end of that tunnel, btw (LON-6PS)

so that might be why that image was chosen?

have*

What?? The website once told you about upcoming expirations of XEPs? :O

I think it suits as an interlink, which communication and internet is kinda, right?

vanitasvitae: Now we have it in the Newsletter, right? 😉

wurstsalat: ^ ?

Sure, but even that does not include expirations, right?

"only" updates 😛

Weren't there even an .ical with all the events?

Automated

vanitasvitae: Then we might have a new second at its best?

?

vanitasvitae: sorry, a new option

section

not second

Is this really relevant to subscribers of the newsletter?

Probably not

I was just amazed by the detail of the old site :P

I wasnt seriously proposing to add it back

Apropos the webiste discussion, I would be more enthusiastic about the website discussions if there were people willing to make whatever changes are desired. The site we have took about a year of wrangling. I've no objection to changing it, but there's always been more interesting in changing it "from", rather than changing it "to".

As far as the XEP info goes, I'd be a lot more interested in something like the IETF's Datatracker. If we had that, then the Editor's life would be simpler, and it'd provide the data we need to drive lists of expiring XEPs (or last calls, or whatever).

I tend to agree with that, but also don't think we have the ops team to maintain something like that

IETF's mailing list browser is also very nice

I think it's somewhat wishful thinking that not having the ops team is the limiting factor.

Sure; I meant "even if we did have volunteers to build something like that"

Zash, As far as I know, the IETF's mailing list browser is an anonymous IMAP client; it might be relatively easy to find out what they've done and get copies of the codebase if it's not already open source.

Zash, dwd: could you guys write that into at least an issue? 2 months ago I was trying to call for a task force in the mailing list. However, no one replied, what I can understand

And I am really supportive on these improvements in general

vanitasvitae: would it make sense to have is somewhere else?

dwd, is open source afaik

emus, "Supportive" is nice, but it doesn't get code written and maintained, sadly, which is really our fundamental problem I think.

Maybe, maybe not

Zash, Yes, although I have a feeling it's runnign against M-Box (M-Link's IMAP cousin). SHouldn't be a blocker though.

Also a while ago I was putting the XEP site data into a samole dashboard. Maybe it would be interesting to combine these ideas Plotly Dash offers an opensource dashboard

dwd: Yes, I know, just saying

emus, And I was just moaning. :-)

(I'm sitting on a train that's now reached England on "Freedom Day", and somewhat releaved to see most people are still wearing masks)

I think it would be easier to organise work and get people into it if we point out and plan what work it would be. At least the maintenance work would be a great start. wurstsalat has some knowledge, but the does not want to build on the current system for example. And maybe this is another good point to discuss if we may should discuss if we pay someone for this work. I guess the situation is not getting better. But in general, making such a plan could be a think. Im.happy to support and do a lot, but still lack many knowledge here.

maybe board can discuss if they see things where they can support. Maybe making this more public in the xsf

you mean the current website system? ✏

(Ugh, laptop keyboards are horrible)

Why?

dwd: I think so. Just take a look at the PRs and issues

Zash: why what?

Why are all laptop keyboards so terrible?

Thinkpad keyboards are formidable

I mean, I'm not wholly sold on the website system, but I'm utterly unsold on another year where someone rewrites it to the systeme-du-jour and we end up back at square one again.

And why is Let's Encrypt having trouble? Is it time to panic? Is this the End Times?

https://github.com/xsf/xmpp.org/pull/942 ✏

No, all laptop kyeboards suck. I only use them on the train. Normally I've a nice wireless mechanical, but it's in my bag.

But then again I don't like mechanical keyboards so I might not have a say i .this discussion :P

cmon guys, offtopic ☺

Topic is key™

dwd: which one? The only wireless mechanical I know of is terrible at wireless.

vanitasvitae, Ah, which mechanicals have you tried? I'm on a tactile G915 TKL, and the lack of click is lovely.

dwd: Would be okay to support an evalutation pro / contra and I help up writing things up? Who was involved in doing the website?

Keyboards are very relevant to XMPP. Can't chat without one!

vanitasvitae, I don't like the clicky keys. But that's OK, because nor would anyone else for a 20 mile radius.

I'm not sure which ones I tried, but I'm just not used to the long travel anymore. It tires my fingers :D

emus, Lots of people who are no longer here. I think maybe ralphm was on the Board back then.

dwd, brown switches?

emus, Personally, I don't mind what system we use as long as we actually use it - if it's maintained, has useful info that we *and* casual visitors find useful.

Zash, In efcect, yes, but it's Logitech and they don't use Cherry.

I have a das keyboard with brown switches. Now I'm even more allergic to all my laptops.

Zash, Ah, nice.

I agree. Im gonna write up something

Sam, Also, yes, it's wireless. Bluetooth and a low-latency USB-A dongle.

dwd: what's it called?

😑

Sam, "Logitech G915 TKL". It was... not exactly cheap. But my fingers love me.

Sam, The main disadvantage is that it weighs slightly more than my car.

Thanks. I got an Anne Pro II (I think?) for travel and it's nice in terms of weight and size, but the bluetooth is bad enough to be worthless (drops keys constantly)

Maybe I should go all Diva and insist work buys me another if they want me to come into the office....

Sam, Previous wireless was a Bluetooth thing by Jellycomb, one of these bulk brands. Low profile keys but full-size, surprisingly good.

Sam, And yeah, I'm really really set in my ways with keyboard layouts. Can't do 60%, and have to have a UK style return key.

I love my Thinkpad keyboard so much that I bought a Thinkpad desktop keyboard because I couldnt get used to my old one anymore :D

The Venn diagram of 88 keys, wireless and blue switches is extremely small

Likewise the Venn diagram of Brown/UK layout/full-size/TKL.

emus, dwd: the website was mostly Adam for content and Simon for tech.

And I'll be passing very close to that tunnel shortly.

(Currently just pulled into Reading)

Maybe I should take the longer route on the tube and take a selfie in the tunnel?

As for keyboards, I am rocking a Logitech K810. One of the best they ever made, and until they do a MX Keys tenkeyless, I am sticking with it.

ralphm: Thanks, but there is no contact available to these persons anymore?

at least for questions?

Sure, but why? I don't read the whole discussion.

Didn't

Not impressed by the MX Keys at all. Tempted by the MX Master mouse, but figures I'd go the Logitech G route for that too, and been very happy.

My desktop uses a wired Roccat Isku and Tyon; lovely but both showing their age and the Isku isn't close to the G915, except for the programmable thumb buttons.

Not sure about the rise, indeed. The K810 is nice and flat, and I got a great sheath for it from sfbags. Really don't understand why they discontinued it. I only read praise about its quality and sadness on it being discontinued.

Maybe it is too good

ralphm: If I create a list and collection actions we might can raise questions for their opinion and break down efforts, system-evaluation

Nah. Just do what you deem appropriate.

We don't need design by committee, just people putting in the work

And both of them have moved on

dwd: ohh, I didn't realize there's a tenkeyless version of the G915. That's interesting

ralphm, Yes, and it - unlike it's companion mouse - does do Bluetooth. Not that I've ever tried it; perhaps I should.

Right. Whatever next keyboard MUST have Bluetooth. I am ok with it also supporting some proprietary RF

This was my first mechanical keyboard https://www.moparisthebest.com/images/keyboard.jpg

The biggest issue is getting US ANSI layout in Europe.

I still use the same layout (which I call Unix programmer's Dvorak) but on an IBM Model M which I'm convinced is the best keyboard ever made

Unless you work around other people, in which case it's just rude

hehe

I used a keyboard with blue switches for a while. Then it mysteriously disappeared.

It was very nice to type on tho

Blues are my second favorite after buckling springs

Anyone got the OTR xep to hand?

https://xmpp.org/extensions/xep-0378.html ?

There's not really an OTR XEP. It's a third party thing that's chat-system agnostic.

The one Zash linked and https://xmpp.org/extensions/xep-0364.html contain a tiny bit of XMPP specific stuff describing it, but really you probably just don't want to use OTR these days.

Oh, it was the expanded name

I just ^F OTR

And then there's OTRv4, which will if I understand correctly, have all the requirements of OMEMO, but none of the benefits.

As in, no multi-device support.

qy - why OTR?

Oh, hmm

Was just thinking since im being so slow at implementing omemo i could knock out otr or pgp in the mean time so theres at least *something* ✏

Pgp is easy, at least xep-27

Then i can drop blabber maybe

For all intents and purposes

Hmm

How do clients do with pgp?

And with switching from pgp to omemo and back?

i wouldn't bother with anything but omemo

i've never seen pgp or otr in the wild

But as a stopgap, cause i cant reliably use my client for PMs until i do

But most clients implement pgp right

So i could use that for the few folk i talk to

i can't think of any that do pgp

unless gajim does? i've never set it up if so

I think gajim does or used to? That's the only one I know of.

Definitely not "most" or even "many" though.

Gajim does, think dino does? Conv and forks do

Thats basically all i care about

pretty sure dino doesn't

and i didn't know that conv did

Conversations doesn't, it used to IIRC but not for a long time

Doesn't what?

Implement PGP

https://cerdale.zash.se/s/H9GrMqy4hTMNLVeW/a5d5167e-d4a8-44f5-9771-14f025ee16de.png

from Dino ↑

oh nevermind, apparently it still does, ignore me.

Yeah, thou,ht so

So literally all the clients that matter do, so i could do it

I've been considering deprecating my GPG/PGP key, ever since I tried to set up per-device subkeys.

pgp is such a hot mess ui/ux -wise

That's a big step down from "most" (but still, fair enough, more than I expected)

Meta: Sure would be nice to have more DOAP so we could answer questions like this

Idk i think i know a grand total of 2 other clients that i actually know people regularly use

So yeah thats "most" for my PoV at least

huh, Profanity does too, guess I'm just wrong and it actually is wide spread and no one is talking about it

And Mcabber, apparently.

Year of the OX? :)

Sam: Ready your keys ;)

nope, never again, PGP is hot garbage

Sam, you're thinking of GPG

*nods* fair.

Tbf to use it with conversations you need that extra app, and a key on your android

Basically everything GNU touches turns into a usability nightmare, so maybe I should use other implementations first before saying that

i've heard good things about sequoia?

OpenPGP - the specifications and stuff could probably be salvaged

> Zash wrote: > I've been considering deprecating my GPG/PGP key, ever since I tried to set up per-device subkeys. How did this go bad?

Heh, I missed that. I think that's the point at which I decided I din't care to use it anymore too.

qy: GPG encrypts to the most recent subkey. *Only* that key. Thus I must find that machine to read anything encrypted. (Which is less than one email per year.)

Oh

This looks neat

> ben wrote: > i've heard good things about sequoia?

Usually this is the laptop with the broken keyboard, that I don't use as much because of the broken keyboard.

(Laptop keyboards! Aaaaargh)

looks like conversations needs openkeychain to also be installed for pgp

Oh and now when the keyserver network is basically defunct and gone ... how are you going to get my new subkeys?

i've gotten like 3 pgp-encrypted mails ever

ben, with 2/3 sent during a keyparty?

i mean yeah

> ben wrote: > looks like conversations needs openkeychain to also be installed for pgp > I wrote: > Tbf to use it with conversations you need that extra app, and a key on your android

I do use it for signing software releases tho

too much hassle

i don't want to bother getting my yubikey out and finding an OTG adapter

yeah i use it for gpg-agent --ssh and signing git commits

not for mail or chat though

> Whatever next keyboard MUST have Bluetooth. https://www.keyboardco.com/keyboard/filco-convertible-2-tenkeyless-tactile-action-usa-ascii-keyboards.asp

The problem with trying to replace gpg with sq i guess would be the number of things that hardcode gpg

And looks like they dont share a keyring?

i wouldn't bother with pgp at all but it's your client :P

I dunno. Im just looking for ways to be lazy

Personally I love it, but of course, existing UX is unusable for non-geeks.

Gpg? Or xmpp-pgp

XMPP-PGP. Gives me E2EE with history access on new devices.

> Oh and now when the keyserver network is basically defunct and gone ... how are you going to get my new subkeys? tofu, just like omemo

> XMPP-PGP. Gives me E2EE with history access on new devices. exactly, different users land differently on the history access/forward secrecy tradeoff

Neat.

Yeesh. Ripping my key out of openkeychain was not fun

Note to self, next time do it the other direction

qy: termux has a thing to use openkeychain as a gpg agent

I haven't gotten it to work for my usecases, but it exists

https://github.com/DDoSolitary/okc-agents

Hm