MattJ100

13 ms·

121.
by MattJ100 3y ago
I might be biased, but I self-host both XMPP and email, and XMPP is easier. Roughly equivalent in resource usage for a small private server. Snikket (a project I started) is probably the easiest way to get a modern XMPP setup these days, or
122.
by MattJ100 3y ago
Yeah, the old protocol we're phasing out in favour of mutual TLS auth :) I should attempt to gather some stats from the XMPP network, but I suspect that since Let's Encrypt made it easy to obtain certs, dialback is probably rarely
123.
by MattJ100 3y ago
They do, yes. It's certainly a requirement if channel binding is to work at all. Additionally there is this proposal to also detect attempted downgrade of the channel binding and SASL mechanism lists themselves: https://xmpp
124.
by MattJ100 3y ago
It does not, and we don't plan to push forward on that, at least at this time. The thing is, although it is the focus of that article, it would not actually have prevented this attack (the MITM certificate was CT-logged and had a val
125.
by MattJ100 3y ago
In summary: I trust them no less than practically any other reputable provider. If you look at the turbulent history of providers that won't follow court orders, it's a real bucket of fun. Not one I particularly feel comfortable
126.
by MattJ100 3y ago
Post author here. To clarify, my intention was not to blame ACME for this and certainly not Let's Encrypt specifically (there are many other CAs that will supply certificates via the ACME protocol). I don't consider the pre-ACME w
127.
by MattJ100 3y ago
I don't know what jabber.ru's policy is, it's running a very old version of ejabberd. But you would be hard-pressed to find an XMPP server that would allow authentication without TLS. Starttls makes no difference.
128.
by MattJ100 3y ago
Yes, you can pin the public key instead, which is generally more helpful. But most ACME clients (including the "official" certbot) default to rotating the key too. That can be disabled, but it's a problematic default for this
129.
by MattJ100 3y ago
They were doing their own TLS handshake - that's how the attack was discovered (the attacker presented a different certicate, which eventually expired, presumably due to negligence). They were decrypting and re-encrypting.
130.
by MattJ100 3y ago
XMPP supports channel binding, which is not mentioned in this post but would have prevented this attack. Unfortunately jabber.ru is running server software from 2016, and that old version doesn't support it. Pinning is problematic thes
131.
by MattJ100 3y ago
XMPP has some adoption of channel binding (it could be better, but it's heading in the right direction) which mitigates these kinds of attacks in a different way. It is able to do that because the client and server already share a secr
132.
by MattJ100 3y ago
Not at all. If you mean SCRAM, it was actually pretty novel when it was introduced because it allows the server to store a hash, the client to store a hash, and only a hash is exchanged over the wire. SCRAM also allows the client to verify
133.
by MattJ100 3y ago
It's fairly common for people to obtain multiple certificates for different machines or services, so they can be selectively revoked and they don't have to share keys across machines. More use-cases: - You might obtain a new certi
134.
by MattJ100 3y ago
I mentioned this in the operators channel just now, but also worth noting is that channel binding (e.g. SCRAM-*-PLUS in combination with RFC 9266) also mitigates this attack. Essentially the connecting client is able to detect the mismatch
135.
by MattJ100 3y ago
> but decided it wasn't an avenue worth pursuing To add some colour - there are commercial implementations of that (e.g. https://www.isode.com/whitepapers/federated-muc.html ). But from my perspective as a se
136.
by MattJ100 3y ago
I remember chatting with you at FOSDEM (Snikket dev here). Congratulations on the launch! Generally I agree that the goals of Quiet are sufficiently different to the way XMPP is used/deployed today that your entirely different stack is
137.
by MattJ100 3y ago
That's not true. As the copyright holder they are not bound by the licence that they release it to others under. The reason AGPL isn't being adopted in these situations is that it doesn't sufficiently protect against someone
138.
by MattJ100 3y ago
Yeah, Pidgin has fallen behind significantly with regards to modern XMPP compliance. The developers are still working on Pidgin actively, but the focus is on a big rewrite of the foundations right now (3.0) so they can more easily support m
139.
by MattJ100 3y ago
Which modern conveniences do you find are lacking, out of curiosity?
140.
by MattJ100 3y ago
If you're an irssi/weechat person, I use poezio as my primary client (and profanity is another console client, but I've never tried it). Obviously console clients lack some features (calls, avatars [usable ones, anyway]) but
141.
by MattJ100 3y ago
What XMPP client(s) are you using that are not well maintained? And why?
142.
by MattJ100 3y ago
Compliance with the annual compliance suites would be one definition. This compliance level is discoverable in the xmpp.org software listing, for example: https://xmpp.org/software/conversations/
143.
by MattJ100 3y ago
> https://xmpp.org/software/software-comparison/ This tool is only useful if you know what XEPs actually matter, which is not most people (nor expected to be!). https://xmpp.org/software/
144.
by MattJ100 3y ago
I've created many XMPP implementations, and I've never created a custom XML parser for it (well, some toy ones for various fun things, but not one I'd use in production). You're right that some XML parsers demand the ent
145.
by MattJ100 3y ago
Many SAX parsers support namespaces natively. Expat is a popular choice.
146.
by MattJ100 3y ago
What kind of tooling do you/people use for that? Or just custom scripts?
147.
by MattJ100 3y ago
Your logic seems to imply that any given "diet" leads to either increasing or decreasing weight. If you were overweight but stable, a temporary restriction followed by a return to the original diet would suffice, right? That'
148.
by MattJ100 3y ago
XMPP isn't dead, but quite active: https://xmpp.org/blog/ It's very possible your social circle is not on XMPP though. There's some light at the end of the tunnel with the EU's Digital Markets Act f
149.
Xmpp.rs v0.4 Release(xmpp.rs)
2 points by MattJ100 3y ago|0 comments
150.
by MattJ100 3y ago
I'm eagerly awaiting jmp.chat to branch out into Europe (they have plans, but no concrete timeline). I'm curious why not sipgate, which I currently use, or Twilio which I half-use (it mostly forwarded to my own Asterisk server, wh

More ›