Policy-Discussion

[Peter Saint-Andre <stpeter AT jabber.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Philipp Gühring wrote:
> Hi Peter,
> 
>>> How's tricks?  How's the IM world?  Did they ever get
>>> their crypto sorted out?
>> In the Jabber world we use TLS for channel encryption and have been
>> making good progress with Duane on including the right ASN.1 bits (see
>> Section 5.1.1 of RFC 3920) in domain certificates to use CAcert-issued
>> certificates for secure server-to-server federation. Then we do SASL
>> EXTERNAL for auth and Bob's your uncle.
> 
> I had some weird problems trying to get that running. Some servers still 
> have 
> serious troubles with TLS handling, and some clients don´t tell you, 
> whether 
> you are actually using TLS or not. 

This is true. But various server implementations are being brought up to
compliance with the RFCs on this point. Both Wildfire and ejabberd are
quite close to compliant among the open-source servers.

> (A friend of mine, who is a security 
> specialist was a surprised, when I showed him, that his supposedly 
> encrypted 
> connection to his Jabber server was plaintext instead. He had activated 
> "use 
> SSL when available" in the configuration, but it didn´t worked, and he 
> didn´t 
> noticed.)  Things like that make you loose the trust in Jabber as a whole.

"Jabber as a whole" is an entire set of protocols, technologies,
software, and deployments. That's like saying you used a bad browser and
a broken web server, and "things like that make you lose trust in the
Web as a whole".

>> Of course, if you don't trust the servers (and naturally you shouldn't)
>> then we need end-to-end encryption, but we still haven't worked out a
>> commonly-used system for that. :(  (Some clients do OpenPGP, none do the
>> S/MIME stuff in RFC 3923, and the OTR-like protocol in JEP-0116 is still
>> experimental.)
> 
> Then I suggest the following for you:
> 
> You should start a "Jabber compliant" campaign. Setting up a small 
> test-center, and verifying the Jabber protocol compliant-ness and certain 
> usability requirements, before a product can call itself "Jabber 
> compliant". 
> Define some minium "quality of service" that a product has to support, to 
> be 
> officially Jabber compliant.

We will be holding our first interoperability event in July.

> Create a automated test-suite that helps you testing it.

Yes, that's on the list too.

> If you don´t do it, the Jabber world will consist of interoperability 
> issues,  
> and the users won´t be happy about Jabber in the end, having too many 
> issues 
> with each different software package.

Thanks for the feedback.

Peter

- --
Peter Saint-Andre
Jabber Software Foundation
http://www.jabber.org/people/stpeter.shtml

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFD9PB/NF1RSzyt3NURAvCfAJ4qESNixFUgEwFX9JXSFvI1rauU5ACeLubU
3vZsthz5V0pAPBVau/caA5M=
=XmfY
-----END PGP SIGNATURE-----

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature