XSF Discussion - 2026-06-22

so, does "away" status correspond to an "idle" kind of state?

and "xa" is essentially "busy"? or is "dnd" more closely aligned with telling people you're busy

> It's should be standard functionality provided by the desktop environment/shell - has the current user been active in the past 'n' minutes (activity is counted as using the keyboard or mouse, or a program explicitly saying "we're still active" like for playing a video) if a client tries to detect idleness/inactivity based on some heuristics, maybe a potential issue is it can lead to frequent presence flapping? i'm not sure how these systems prevent that ↺

by the way, is there yet some system in xmpp where hosted files are authenticated before fetched? the use case is to prevent abusing upload services as open CDNs for content The last I've heard was some attempt at implementing some SOCKS proxy to fetch media, and handle authentication there. This is from the media-fetching server, though

> by the way, is there yet some system in xmpp where hosted files are authenticated before fetched? the use case is to prevent abusing upload services as open CDNs for content > > The last I've heard was some attempt at implementing some SOCKS proxy to fetch media, and handle authentication there. This is from the media-fetching server, though We can decouple links and files, and instead having links be a reference (with a short lifetime) of the longer lifetime file ↺

Then whenever a link expires, a user can request a new link for that specific file

> so, does "away" status correspond to an "idle" kind of state? i interpret them in theory as "i am active and ready to talk"(default), "i am temporarily inactive for a short time (i.e. minutes or hours)"(away), "i am inactive for a long time (i.e. hours, days, longer)"(xa), and "i am active but actively focusing on something else right now"(dnd). "away" seems to be used for idle state in most clients i see ↺

Associating a link reference to a file can be as easy as inserting the ID of that reference into the link's query parameters (like `?id=<whatever>`) ✏

> i interpret them in theory as "i am active and ready to talk"(default), "i am temporarily inactive for a short time (i.e. minutes or hours)"(away), "i am inactive for a long time (i.e. hours, days, longer)"(xa), and "i am active but actively focusing on something else right now"(dnd). "away" seems to be used for idle state in most clients i see but in practice i interpret all of them as "i am online but who knows if i'm actually active or willing to talk or not lol" ↺

This can be abused though, to associate whoever has hot-linked a file to the specific XMPP account who got that link (in a MUC) ✏

> by the way, is there yet some system in xmpp where hosted files are authenticated before fetched? the use case is to prevent abusing upload services as open CDNs for content > > The last I've heard was some attempt at implementing some SOCKS proxy to fetch media, and handle authentication there. This is from the media-fetching server, though this isn't much of a problem in reality because most xmpp infra assumes everything is ephemeral and specific to one server anyways, unlike matrix where its expected that everything exists forever across all servers. its harder to abuse effectively when i only need to manage files uploaded by my own users, and those files will disappear after a few days even if i do nothing ↺

>> by the way, is there yet some system in xmpp where hosted files are authenticated before fetched? the use case is to prevent abusing upload services as open CDNs for content >> >> The last I've heard was some attempt at implementing some SOCKS proxy to fetch media, and handle authentication there. This is from the media-fetching server, though > this isn't much of a problem in reality because most xmpp infra assumes everything is ephemeral and specific to one server anyways, unlike matrix where its expected that everything exists forever across all servers. its harder to abuse effectively when i only need to manage files uploaded by my own users, and those files will disappear after a few days even if i do nothing What if it isn't "a few days"? ↺

What if the expiry time is variable?

> What if it isn't "a few days"? if its a longer period of time then idk pay more attention to the files your users upload, or stop being a public server if you can't be bothered to be responsible for your users ↺

and asking if its variable isn't a particularly useful question on its own

Well it could be something like 0x0, where the expiry depends on the size of the file

i know some servers will fill their global quota and then rotate out the oldest files to make room for newer ones, but then i mean spam uploads will just last even less time at that point

> Well it could be something like 0x0, where the expiry depends on the size of the file then i think the same thing applies. either it won't last long enough to be useful for a spammer, or you should be responsibly maintaining your server ↺

We're not talking about if it's useful for a spammer, but for a hotlinker

A hotlinker doesn't use up space, they use up bandwidth because they link the files somewhere where others will download off your server

Or outsource any liabilities to you, by using your server as a CDN

hotlinking a file definitely uses up space though? there has to be a file upload to even link to to begin with. i can't see an xmpp server being an effective place to hotlink files from to be honest, because they'll just disappear anyways, even if it takes months. and if they're stupid enough to do it anyways, and you don't like it, then again that's just up to you being responsible for maintaining your own server

"Months" or "a few days" is enough for a hotlinker

If it expires, then they can reupload it again

mind you i'm not arguing against auth media on xmpp per se (although i do hate the idea), but i'm just saying its not really a problem if you're not genuinely incompetent as a server admin

If they upload prerelease leaked movies for example, months is plenty of time to get tons of ad revenue off your back while you're left with a DMCA notice ✏

If they upload prerelease leaked movies for example, "months" is plenty of time to get tons of ad revenue off your back while you're left with a DMCA notice ✏

then comply with the dmca notice, ban the user, and then start managing your server properly

Shady pirated sites are used to whatever hosts they use being ephemeral

That's why they use a shit ton of them

But that's just one example

Now say if links (not the files themselves) expired after an hour or whatever short time

At that point, it would be unfeasible to hotlink

i think there was an idea in ringen or lounge for making file uploads disappear after being downloaded a certain amount of times. that'd solve your problem as well

but i don't mind whatever as long as it doesn't make media a genuinely unusable pain in the ass to deal with like it is on matrix

> Does <iq> mean you're giving an entity an IQ test? btw i got distracted earlier but i meant to send this: https://xmpp.org/extensions/xep-0148.html ↺

>> Does <iq> mean you're giving an entity an IQ test? > btw i got distracted earlier but i meant to send this: https://xmpp.org/extensions/xep-0148.html > While once common, these terms are now considered politically incorrect. Was confused because they didn't say the R-word at all in the table ✏ ↺

> but i don't mind whatever as long as it doesn't make media a genuinely unusable pain in the ass to deal with like it is on matrix which part of that protocol is the problem? i mean, an admin panel to manage your server's upload would benefit both protocols equally ↺

> so, does "away" status correspond to an "idle" kind of state? I believe the original intention was: away = automatic away / idle; xa = intentional user-selected "I'm not here right now"; dnd = busy (as used by other IM at the time.) All of this has now become quite fuzzy, with different interpretations by different clients, and more recent mobile-first apps for other platforms having their own versions, influencing what 'most people' expect them to mean ↺

I don’t remember ‘away’ as originally being for autoaway, FWIW. ISTR something else (ICQ, I *think*) had it as two types of user-selectable away (briefly AFK and really not here) and Jabber copied that, although I admit this is fuzzy.

(dnd was also called dnd in other things like ICQ at the time, ‘busy’ was a newer phrase coming in with MSN type stuff, IIRC (which I might not))

From ~the horse's~ RFC's mouth (RFC 6121, §4.7.2.1): > away -- The entity or resource is temporarily away. > chat -- The entity or resource is actively interested in chatting. > dnd -- The entity or resource is busy (dnd = "Do Not Disturb"). > xa -- The entity or resource is away for an extended period (xa = "eXtended Away"). With nuances for interpretation.

6121 being over a decade after such decisions, of course ;)

But yes.

Swift just does ‘available’, ‘away’ and ‘busy’ in the UI, I don’t think we’re in the same ICQ-inspired world we were 27 years ago :) ✏

what if away → auto-away / brb xa → vacation

away -> brb/vacation xa -> dead ✏

Death would imply being _unavailable_

https://xmpp.org/rfcs/rfc6120.html#stanzas-error-conditions-gone

>afterlife.example.net

Don't tell me they have XMPP in the afterlife too

heaven and hell are decentralised networks that need to communicate somehow :3

Cynthia

> Don't tell me they have XMPP in the afterlife too there's a XEP for that https://xmpp.org/extensions/xep-0183.html ↺

We should have a xkcd for XEPs the same way we have one for Emacs.