XSF Discussion - 2024-03-12

> Consider that an observing entity can see the certificates and pubkeys used in a TLS negotiation, so if we were to simulate SMTP or XMPP we do not just need certificates signed by a credible authority, they also need to have the respective bits set. Maybe many XMPP sites actually do not care, but XMPP certificates were supposed to have a specific XMPP flag set.

anyone knows what this means? i have never heard xmpp needing "special" certificates

There are ways to issue certificates that includes the intended protocol, which is great because then a compromised email cert couldn't be used to intercept web traffic or vice versa. However this whole area is forbidden by the Cabal so the whole thing is moot. Feel free to forget all about it.

ah. so that message is again a decade out of date probably :P thanks

I vaguely recall that TLS 1.3 may also have hidden the certificate exchange, so it may be further out of date

Plus XMPP services need HTTPS services these days, so you need HTTPS certs anytway.

right http upload and such

Fwiw Conversations certificate checker actually supports that. But no CA will issue such a certificate

SRV names? Prosody too. It is mandated by the RFCs after all.

> Plus XMPP services need HTTPS services these days, so you need HTTPS certs anytway. Those could be hosted on a separate domain though

As the owner and operator of a domain hosting services having srv recoded certificates would be nice actually

"keyUsage" not srvnames right?

But nothing we can do about it

Both?

key usage is something else

There are two methods

Srv and something more specific to xmpp irc

But doesn't matter really

and why Prosody / LuaSec has hacks to allow a client certificate to be validated as if it were a server certificate...

> and why Prosody / LuaSec has hacks to allow a client certificate to be validated as if it were a server certificate... Haha yes this was "fun" in Rust too ↺

Tangent https://www.openwall.com/lists/oss-security/2024/03/11/2

Seems good

> tmolitor, why is Monal marked as "wontfix" for XEP-0377 (spam reporting)? MattJ: that's a bug, it should be planned

When establishing an audio/video call, should push notifications be sent to the intended recipient?

yes.

Definitely. In some cases Prosody even prioritizes them (e.g. sending such notifications even while the client is connected)

I need better triggers for push notifications, I think.

we currently only send them for messages with a body

are there any guidelines on what to push, when?

0357 only describes the 'how' I think.

Hahaha, how long have you got? :)

crap.

If you want to do the minimum amount of work today, wait for Push 2 to arrive, which specifies this a lot more clearly

If you want to match what Prosody and ejabberd are doing today, you can start here: https://hg.prosody.im/prosody-modules/file/tip/mod_cloud_notify/business_rules.markdown

No guarantee that is up to date or includes everything, though

And by wait for I mean implement it today 😉

Well yes, implement Push 2, but no clients support it yet :)

No production grade clients

Which would be more likely to happen if it were a XEP already

Thanks