MattJ100

7 ms·

1.
by MattJ100 7d ago
I can lend a hand, after spending a painful 10s on the website (which really needs some thought put into it if this is a serious project). If you have any moderate experience with hardware hacking, you would be aware of a handy little hardw
2.
by MattJ100 4mo ago
You can do big data in SQLite. Concurrent writes, sure, I'd recommend something else. If you think the majority of systems require massively concurrent writes, I think you need to look a bit harder. SQLite is, after all, the most wid
3.
by MattJ100 4mo ago
It's a reference to Eternal September, the name applied to the cultural shift of the internet as the general public started gaining access to it en masse in the 90s. Sloptember is clearly a reference to this - the similarity being that
4.
by MattJ100 4mo ago
Each commit should build and pass tests, yes. When I say "partial commits", I don't mean that the commits are arbitrary - each commit should be as small as possible to implement a specific fix/feature. I've also hea
5.
by MattJ100 4mo ago
Yes, Mercurial has a very advanced history editing system via "evolution": https://wiki.mercurial-scm.org/ChangesetEvolution A good way of thinking about it is that every commit is itself version-controlled, allow
6.
by MattJ100 4mo ago
To be clear, Mercurial does not have a staging area, but it does have allow selective commits (and selective uncommits) via prompt-based or interactive UI selection of hunks. Disagreeing with the need for a staging area is not the same as s
7.
by MattJ100 5mo ago
We see this in our open-source community. We've had a community channel for over two decades, where community members help newcomers and each other solve problems and answer questions. Increasingly we have people join who tell us they&
8.
by MattJ100 5mo ago
URL parsing/normalisation/escaping/unescaping is a minefield. There are many edge cases where every implementation does things differently. This is a perfect example. It gets worse if you are mapping URLs to a filesystem (e.g
9.
by MattJ100 6mo ago
Yes, it is. The worst offenders hammer us (and others) with thousands upon thousands of requests, and each request uses unique IP addresses making all per-IP limits useless. We implemented an anti-bot challenge and it helped for a while. Th
10.
by MattJ100 7mo ago
Yes, definitely. To me, the idea of a chat server that doesn't federate is as absurd as setting up an email server that doesn't federate. I understand that today people know more contacts with email addresses than XMPP addresses
11.
by MattJ100 7mo ago
You're welcome! I'm still experimenting with the messaging on the Snikket website. However my general approach with the site was to pitch Snikket to people who don't know what XMPP is, which is, frankly, the majority of peopl
12.
by MattJ100 7mo ago
Yeah, iOS is definitely a weaker spot and we're aware of it. Monal is currently working on an overhaul of their UI (they have a grant allocated for it: https://nlnet.nl/project/Monal-IM-UI/ ). There is also a
13.
by MattJ100 7mo ago
Be aware that this post has known issues that the author is not interested in fixing. In their own words (in response to clarifications by one of the OMEMO folk): "I'll make an edit later about the protocol version thing, but I&#x
14.
by MattJ100 7mo ago
I'm the founder of both the Prosody and Snikket projects. Sorry about triggering alarms :) I can try to explain... Prosody is a popular choice of XMPP server software. It's used for all kinds of stuff, from self-hosted chat server
15.
by MattJ100 7mo ago
As the founder of both projects, explaining the difference between the two projects is roughly 20% of my working day (okay, not quite 20% but sometimes it feels that way). Your description is great :)
16.
by MattJ100 7mo ago
You're not wrong. PKI has better protections against MITM, dialback has better protections against certificate leaks/misissuance. I think the ideal approach would be combining both (as mentioned, there have been some experiments w
17.
by MattJ100 7mo ago
There is a lot of confusion caused by overlapping terminology in this issue. By "client certificates" I mean (and generally take most others in this thread to mean) certificates which have been issues with the clientAuth key purpo
18.
by MattJ100 7mo ago
Yeah, the resistance is outside the XMPP community. However we have a long history of working with internet standards, and it's disappointing to now be in an era where "the internet" has become just a synonym for "the we
19.
by MattJ100 7mo ago
They weren't "HTTPS certificates" originally, just certificates. They may be "HTTPS certificates" today if you listen to some people. However there was never a line drawn where one day they weren't "HTTPS
20.
by MattJ100 7mo ago
Firstly, nobody is actually calling for authentication using client certificates. We use "normal" server certificates and validate the usual way, the only difference is that such a certificate may be presented on the "client&
21.
by MattJ100 7mo ago
Of these, (1) and (2) are already implemented in XMPP. (1) just isn't that widely deployed due to low DNSSEC adoption and setup complexity, but there is a push to get server operators to use it if they can. (2) is defined in RFC 7711:
22.
by MattJ100 7mo ago
Yes, definitely. Prosody supports DANE, but DNSSEC deployment continues to be an issue when talking about the public XMPP network at large. Ironically the .im TLD our own site is on still doesn't support it at all.
23.
by MattJ100 7mo ago
Sorry, it's late here and I guess I didn't word it well. Dialback (these days) always runs over a TLS-encrypted connection, as all servers enforce TLS. The next question is how to authenticate the peer, and that can be done a few
24.
by MattJ100 7mo ago
> Is there a reason why dialback isn't the answer? There are some advantages to using TLS for authentication as well as encryption, which is already a standard across the internet. For example, unlike an XMPP server, CAs typically p
25.
by MattJ100 7mo ago
There might be some confusion here, as there is no refusal at all. As stated in the blog post, we (Prosody) have been accepting (only) serverAuth certificates for a long time. However this is technically in violation of the relevant RFCs, a
26.
by MattJ100 7mo ago
Thanks! I didn't intentionally write this for a broader audience (I didn't expect to see it while casually opening HN!). Our user base is quite diverse, so I try to find the balance between being too technical and over-explanatory
27.
by MattJ100 9mo ago
What logical fallacy, exactly? I think you're perhaps misunderstanding the conversation. This translates just fine to your proposed analogy. In your analogy, the claim would be that some online account is tied to a laptop and whoever p
28.
by MattJ100 9mo ago
You're very wrong, because account takeover can still happen due to a compromised email account. People can and do permanently lose access to their email account to a third party.
29.
by MattJ100 10mo ago
Prosody dev here. Good to know this is useful :) One of my favourite small features we added in the latest release is a 'prosodyctl check features' command which will validate that your configuration is up to date with current bes
30.
by MattJ100 10mo ago
Depends what you call "high", but the risks are far higher than most other drugs relative to availability. "Paracetamol toxicity is one of the most common causes of poisoning worldwide." -- https://en.wikipedi

More ›