XSF Discussion - 2023-02-23

Any way of blocking them? It's getting very tiring opening the gallery and getting "surprised"...

I'm using a fork of Conversations on Android. Just wondering if I can do that at the app level.

You can configure your fork to not download pictures in public channels. Beside the spam that is also a security risk.

Menel: Security? How so? ✏

And thanks, just disabled that 👍

Viruses are possible... There was a bug not long ago that clients just believed the size of the picture, but if the sever continues to send data, they would continue until their storage is full. Especially conversations forks were vulnerable for a longer time after it was known.

Oh, right. They didn't use hashes?

hashes?

Looks like we've made it into GSoC again. Congrats to everyone involved.

\o/

└⁠|⁠∵⁠|⁠┐⁠♪

jonas’: some kind of hash to check the properties of the file match what the server is giving them?

nah, simpler than that.

they ignored the Content-Length header

Right

Are there any public security audits of XMPP that have been done recently?

XMPP is tricky to audit, as it's a protocol

a rather modular protocol to make things trickier

I don't know if there are audits of specific applications though

probably there are

I bet it is always per application. Or are there audits for https?

Menel, I wouldn't be surprised if there are audits of TLS

protocols can be fatally broken, too

(e.g. with downgrade attacks or so)

> Kev: > 2023-02-23 09:19 (GMT+01:00) > Looks like we've made it into GSoC again. Congrats to everyone involved. good to know, havent had the chance to check yet 🚅🇧🇻

Kev: but kev, where you got the information from exactly?

When the mail went out about accepted orgs I checked the site.

I see they published already: https://summerofcode.withgoogle.com/programs/2023/organizations/xmpp-standards-foundation then is fine. Just saying because we are not allowed to tell before Google has published on the website

I know, I've done this before ;)

Kev: Perfect 😊👌

khirput: my fork of Conversations includes the ability to permanently block any image or media or avatar in the current pre-release, as well as some other moderation related stuff, if you're interested