Modern XMPP project discussion - 2023-01-02

RESOURCE GENERATION The client should generate a unique random identifier per device or client instance. The identifier should be reused between sessions, and should not reveal any information about the user, their device, or their location.

↑ Why ?

Trung, because the resource is visible to contacts and anyone you communicate with

it's not visible to people who doesn't have sub grant though does it?

I think user should be able to change their own resource identifier

I think it should be an opaque session identifier assinged by the server!

Trung, as I wrote, it's visible to contacts and anyone you communicate with

most client runs on specific platform|OS and they are setting their branding+random identifier in the resource part anyway. it's not hard to guess their device.

Exactly, that's why they shouldn't put that info in the resource part :)

The new Bind 2 XEP has more stuff about this

But, for example, I believe Siskin used the device name as the resource identifier. If I tried to create an anonymous XMPP account, "anon4891@example.com", and then I sent you a message, it would be from "anon4891@example.com/Matthew Wild's iPhone"

woaw =]]]]]] that's not very anonymous

There's not much that can be done about leaking the client name, it's trivial to fingerprint client software by the features they support and various other quirks

But exposing anything more than that is unnecessary and potentially dangerous

I agree. I think by default it should be a hash. But allow user to change as they want and give them a warning when they choose to do that. Anonymous should always be a hash though

lol

Why allow the user to change it?

sometime people want to let their partners know what they are using.

u know, i'm on the phone, don't send me 10Gb of film footage

No, that's not how it works. For starters, people would ignore it and send you 10GB anyway (like how people traditionally ignore the "do not disturb" status)

Instead, mobile clients should be sensible about not auto-accepting large transfers

and indeed they will prompt you

It's better if your contact can just send you the file offer, and you can choose when and where to receive it

yeh there's a point in that

well in that case resource is not very useful as UX feature all together

Agreed. That's why we recommend it shouldn't be displayed to users at all.

it's just for technical as in server knows there are multiple devices.

Correct, it's basically a session identifier

>Zash: I think it should be an opaque session identifier assinged by the server! We might as well do this then ↑

Yes. And we are :)

in next version? I still see my resources lol

i use profanity. can set it to whatever i want.

Next version of what? Many clients already don't display resource (prominently, or at all)

I've never used profanity, but console clients are often targeted at "power users", people who like being able to tweak things like that :)

The ModernXMPP guidance is about improving the experience for the majority of people who don't understand protocols and session identifiers (and who shouldn't be forced to learn)

if Profanity wants to be more user-friendly in that way, the developers should consider the guidance

I think if we decide that resource is no good for UX, server should reject resource set by client (Profanity|Poezio|…) and give them random hash anyway in the protocol layer.

Yes, Prosody has a plugin/option to do that I believe

oh ok. I'll look then thanks

https://modules.prosody.im/mod_compact_resource.html I think

and XEP-0386 is on the way which will enforce server-generated resources

aye thanks mate

Is labelling OMEMO keys considered to be important? (it's local data on client side I would imagine)

Maybe

I like the idea of Signal's "safety numbers", it's a bit simpler for people than showing them lists of long fingerprints ✏

> Some sleuthing from engineer and app researcher Jane Manchun Wong unearthed evidence that Reddit is experimenting with Matrix for its chat feature — a move more or less confirmed to TechCrunch by Reddit. A spokesperson said that it’s “looking at a number ways to improve conversations on Reddit” and was “testing a number of options,” though they stopped short of name-checking Matrix specifically.

anyone feel like contacting them?