4 ms·

From a previous thread on XMPP: http://news.ycombinator.com/item?id=426581 http://news.ycombinator.com/item?id=426581 Even the specs for XMPP+extensions seem

by axod 17y ago

From a previous thread on XMPP: http://news.ycombinator.com/item?id=426581 http://news.ycombinator.com/item?id=426581 Even the specs for XMPP+extensions seem to be written in XML, running to thousands of pages due to the overly-general-underly-practical nature.

jmillikin 17y ago
Yes, it's difficult to establish a secure connection. This is due to the nature of security in general, and is not inherent to XMPP. If you want to just write plain-text messages without authentication, you could do so with netcat. If you want to use digest-auth and SSL, obviously the client and server will be more complicated. Many servers will outright refuse to authenticate a connection unless it's using TLS and digest auth, which is an excellent idea. I don't think expecting any modern protocol to support typing commands in by hand over netcat/telnet is reasonable.
- axod 17y ago
  $ openssl s_client -connect irc.mibbit.com:6697 Works for me... In comparison, it's not possible to use a general tool to do anything like this with XMPP, because it's all wrapped in endless XML complexity.
  - jmillikin 17y ago
    You've yet to state how using XML as a serialization layer introduces any additional complexity into XMPP. Your example doesn't support TLS upgrading, forcing TLS and plaintext connections to be handled on separate ports. You also ignore authentication and authorization, which are much more important than merely opening an encrypted socket to some arbitrary server. IRC is a nice protocol for things that don't matter, but it's utterly unsuitable for applications that require security or features beyond "send text and hope some client receives it, eventually".
    - axod 17y ago
      It's about 3 times the bandwidth for a start. I agree @TLS, authorization etc, but often those just aren't a priority. email is often used without any security but it's far from something that "doesn't matter". IM protocols have barely any security, yet we all use them.
      - jmillikin 17y ago
        3 times epsilon is still epsilon. The bandwidth taken by plain text, even assuming worst case overhead of many small one-character messages, is inconsequential compared to images or videos. E-mail has optional security for things that do matter, namely GPG/PGP for client <-> client and the STARTTLS extension to SMTP for server <-> server. Wave, as a replacement for E-mail, provides pervasive security. "IM protocols have barely any security" -- given that this discussion is regarding an IM protocol with a built-in high-quality security infrastructure, I don't see how this statement is at all valid.
        axod 17y ago
        >> "IM protocols have barely any security" -- given that this discussion is regarding an IM protocol with a built-in high-quality security infrastructure, I don't see how this statement is at all valid. I was talking about the main IM protocols in use today - yahoo/msn/aim. You'd be surprised @ plain text. It quickly adds up. I do around 3.5TB of plain text IRC/http a month, and if I could reduce that, I would. If we were all using jabber instead of IRC my bandwidth would be more like 10TB. Quite a difference. >> "E-mail has optional security for things that do matter, namely GPG/PGP for client <-> client and the STARTTLS extension to SMTP for server <-> server. Wave, as a replacement for E-mail, provides pervasive security." That comes back to my original comment - I'm not sure it solves any real world problem users have. Users don't care about security like that.
        youngian 17y ago
        >> "That comes back to my original comment - I'm not sure it solves any real world problem users have. Users don't care about security like that." I'm not sure that's accurate. Maybe users don't care about security, but I would venture that's because they don't know any better. I don't think most people understand that their emails and IMs are crossing the web in plaintext, or just how easy it would be for someone unintended to get access to those messages. I don't think it's an informed lack of concern.

by axod 17y ago

jmillikin 17y ago

Yes, it's difficult to establish a secure connection. This is due to the nature of security in general, and is not inherent to XMPP. If you want to just write plain-text messages without authentication, you could do so with netcat. If you want to use digest-auth and SSL, obviously the client and server will be more complicated. Many servers will outright refuse to authenticate a connection unless it's using TLS and digest auth, which is an excellent idea. I don't think expecting any modern protocol to support typing commands in by hand over netcat/telnet is reasonable.

axod 17y ago
$ openssl s_client -connect irc.mibbit.com:6697 Works for me... In comparison, it's not possible to use a general tool to do anything like this with XMPP, because it's all wrapped in endless XML complexity.
- jmillikin 17y ago
  You've yet to state how using XML as a serialization layer introduces any additional complexity into XMPP. Your example doesn't support TLS upgrading, forcing TLS and plaintext connections to be handled on separate ports. You also ignore authentication and authorization, which are much more important than merely opening an encrypted socket to some arbitrary server. IRC is a nice protocol for things that don't matter, but it's utterly unsuitable for applications that require security or features beyond "send text and hope some client receives it, eventually".
  - axod 17y ago
    It's about 3 times the bandwidth for a start. I agree @TLS, authorization etc, but often those just aren't a priority. email is often used without any security but it's far from something that "doesn't matter". IM protocols have barely any security, yet we all use them.
    - jmillikin 17y ago
      3 times epsilon is still epsilon. The bandwidth taken by plain text, even assuming worst case overhead of many small one-character messages, is inconsequential compared to images or videos. E-mail has optional security for things that do matter, namely GPG/PGP for client <-> client and the STARTTLS extension to SMTP for server <-> server. Wave, as a replacement for E-mail, provides pervasive security. "IM protocols have barely any security" -- given that this discussion is regarding an IM protocol with a built-in high-quality security infrastructure, I don't see how this statement is at all valid.
      - axod 17y ago
        >> "IM protocols have barely any security" -- given that this discussion is regarding an IM protocol with a built-in high-quality security infrastructure, I don't see how this statement is at all valid. I was talking about the main IM protocols in use today - yahoo/msn/aim. You'd be surprised @ plain text. It quickly adds up. I do around 3.5TB of plain text IRC/http a month, and if I could reduce that, I would. If we were all using jabber instead of IRC my bandwidth would be more like 10TB. Quite a difference. >> "E-mail has optional security for things that do matter, namely GPG/PGP for client <-> client and the STARTTLS extension to SMTP for server <-> server. Wave, as a replacement for E-mail, provides pervasive security." That comes back to my original comment - I'm not sure it solves any real world problem users have. Users don't care about security like that.
        youngian 17y ago
        >> "That comes back to my original comment - I'm not sure it solves any real world problem users have. Users don't care about security like that." I'm not sure that's accurate. Maybe users don't care about security, but I would venture that's because they don't know any better. I don't think most people understand that their emails and IMs are crossing the web in plaintext, or just how easy it would be for someone unintended to get access to those messages. I don't think it's an informed lack of concern.