Gajim - 2023-09-20

https://upload.va1der.ca:5281/upload/Nljno11mfoeLBP1j/omemo.png

@lissine it is supported

Oh, sorry, OMEMO2. Bleh, I read that wrong.

thisss

omemo 2

Yes, I understand now. Sorry.

hey! dont worry ab it

i didnt even know omemo existed until a while ago

i mean

omemo 2

opal, was just telling me about it

Do you run your own server?

nope

https://suchat.org:5443/upload/72100d426ee0a341f79cb126f62c325d03f117fb/4RmQCeDHuJmZxKcUiSmXkbaWGr1ISVjn0g9YEwD9/Gajim_error.png

https://im.ebala.net:5821/upload/tIhW-3opex4Y-pSR1SaJp4Yt/2dcfd31e-aaa7-475c-b0b4-668d796a86e5.png

this is OTR conversation in Gajim via plugin

but developers hardcoded allowed encryption plugins

def get_encryption_menu() -> GajimMenu: menuitems: MenuItemListT = [ (_('Disabled'), 'win.set-encryption', ''), ('OMEMO', 'win.set-encryption', 'OMEMO'), ('OpenPGP', 'win.set-encryption', 'OpenPGP'), ('PGP', 'win.set-encryption', 'PGP'), ]

how to deal with it?

☭Mike Yellow: I can imagine that this DB file contains characters not allowed by windows? Could you check in that user's %appdata%/gajim folder?

I will do it.

Just recently I saw a bug report about someone with a '?' in their JID, which also crashes gajim because it cannot create a file containing '?' in its filename on Windows

Emmm... This user said that this happens when the first time starting Gajim.

Could that mean there is nothing wrong in the folder? ✏

☭Mike Yellow: gajim can't create the file, because the username probably contains characters which are not allowed in filenames on Windows

This user is the fourth hoop in this ask-chain. Now I have to wait the third person be free to reply to me.

Philipp Hörist pushed 1 commit to branch _refs/heads/master_ of _gajim_ < https://dev.gajim.org/gajim/gajim >: *71940ca4* < https://dev.gajim.org/gajim/gajim/-/commit/71940ca4c2b4ac95ac234b945021d4b8b6d2ea8f > cq: StatusIcon: Ignore some pyright errors

Is there a way with gajim 1.8.1 to use adhoc commands on a biboumied IRC server? AFAIK, the adhoc command menu is only available in gajim's roster view, but trying to add irc.example.lol@biboumi.example.prout in the roster fails, because gajim thinks it'a MUC: `ValueError: Trying to add GroupchatContact irc.libera.chat@irc.example.im, but contact already exists as irc.libera.chat@irc.example.im (example.im1) (in roster: False)` It's not that I _want_ to have this in my roster, but how do I get adhoc commands for this entity?

service discovery window

How do I write to a full JID? The fancy modern "start chat" window freezes when I attempt this.

you cant

because this make no sense for a user

Why? I want to write to a certain resource with no carbon copies.

as i said, makes no sense for a user to do this

you can use the xml console if you want

I just specified the use case and you deny it, just as usual lol.

you didnt state any usecase, you just said you want to do it ✏

so please enlighten me, whats the reason behind you wanting to do this, and how can all other Gajim users benefit from this?

It avoids unnecessary undecipherable messages on all the resources.

And it allows to pick a certain resource to write for if several are online.

> service discovery window lovetox: that doesn't work, it's not commands on the component directly but on something@component

nicoco, you can type any jid into the service discovery window

if the jid supports commands it should show up

bodqhrohro, let me guess you talk about OTR

lovetox: of course :P

see you slowly discover why OTR is a bad fit for any modern messenger

lovetox: ho right, I didn't know that, nice. but how do I pick which of my gajim account is used for these commands now? :D

users dont care about resources, and carbon copies

lovetox: why do you assume what users care about lol?

well it looks like it picked the right account automatically, good

From time to time here jump in users who want an OTR support.

And it makes sense to avoid deciphering messages on other devices as it opens possibilities for an attacker to steal the decryption keys.

this is only a problem with OTR which cannot handle multi device setups

Do you fanatically claim everything should be copied on every device or users should better not use their accounts on untrusted devices at all? :P

we will not adjust the GUI of our Client, to satisfy some ancient encryption method which does not support any modern features of XMPP

i really wish you would stop working on this, or at least dont bother me with it, Gajim is open source you can fork it and implement everything you wish for

Smells like Conversations with 100500 forks no one from which is perfect because different forks implement different things.

The whole point of plugins is allowing users to combine all features they want in one software rather jump on different software for different features.

It would make sense if this instilled UNIX Way, but similarly looking forks with 99% of common codebase have nothing to do with UNIX Way.

i tried to tell you that OTR is not just another encryption, its incompatible with modern XMPP features

which needs special UI just for operating OTR

and finally there is zero reason to use OTR over PGP or OMEMO, i dont even know where this wish comes from, probably because people want to use pidgin?

lovetox: there's an OMEMO plugin for Pidgin too. ✏

it is called lurch, and it sucks

I told you already about the benefit, the lack of a key exchange mechanism guarantees that no one intrudes into the session.

> lovetox a écrit : > i tried to tell you that OTR is not just another encryption, its incompatible with modern XMPP features > which needs special UI just for operating OTR OTR is one end to one end

OTR is used by people who actually care about privacy, not about lazy ordinary users you care about.

Lightning Bjornsson (they, he, xe/hir): yeah, but the OTR plugin for Pidgin has usability problems too. Lurch has a deep commands system, at least.

omemo requires more effort than otr in the case of caring about security afaik

but both can work

bodqhrohro, if you want to write to a single device of your contact, you can also do that with OMEMO, it’s just that no client exposes that in its UI but you totally could.

If that’s your problem with OMEMO, it’s just a UI thing.

Link Mauve: I don't remember any problems with writing to a full JID in other clients, I had used that many times in early 10s for the purpose of testing or not annoying users who were at the certain most full-fledged client for sure. Totally unrelated to OTR, as I had never used it myself.

Including Gajim 0.16.

And now I see the first time an explicit obstacle for that because of some blahblablah, yet the window technically allows to enter a full JID, and a user could copy it from somewhere, so it merely looks like a usability problem.

jabber clients are cisgender and cisgenders are awful /s

bodqhrohro, good luck doing that in Dino or Conversations, even in poezio we removed resource locking because everyone uses Carbons nowadays.

Lightning Bjornsson (they, he, xe/hir): you mean there are only two of them already? ×D

But it does not compute, Conversations, Gajim and Dino make at least three.

bodqhrohro, you can go back to 2010 if you want, but the ergonomy of clients improved so much since then.

We could exclude Gajim from this list though, it does not even have calls yet.

No more lost messages because you received them on your other client which you forgot to check.

bodqhrohro, Gajim had working video calls circa 2010 exactly.

In 0.14 at least.

Link Mauve: yeah, the point is that it *had* them. I still keep 1.3 for a reason, y'know? :P

A bad reason probably.

Whatever, Gajim of the time was the most advanced XMPP client for sure, among others.

Especially due to the bunch of fancy plugins, now long broken.

> Link Mauve a écrit : > bodqhrohro, you can go back to 2010 if you want, but the ergonomy of clients improved so much since then. Verschlimmbessert*

Perfect word ×DDD

Jabber client ergonomics have verschlimbettered since the early 20-teens.

We've got a similar one in Ukrainian during the Yanukovich era: «покращення» (which means improvement, but in reality the opposite).

bodqhrohro: other MUCs?

> bodqhrohro, you can go back to 2010 if you want, but the ergonomy of clients improved so much since then. Link Mauve: the point of compatibility is crucial for open protocols. Would you break sending plaintext messages in e-mail clients because clients which don't support HTML messages because such clients are considered outdated nowadays? Or clients which don't support OAuth, or don't even support IMAP and only POP? I don't get this fanatic "modern XMPP" movement which emerged last years and is used as an excuse to break things. XMPP is backwards compatible, and that's wonderful.

Lightning Bjornsson (they, he, xe/hir): time to create one? :P (for what?)

> Jabber client ergonomics have verschlimbettered since the early 20-teens. Quite the opposite, in my opinion.

> ☭Mike Yellow: gajim can't create the file, because the username probably contains characters which are not allowed in filenames on Windows This is caused because the user themself has a character not allowed by Windows, or the user met someone who has such a character?

If you want to use 2010s messengeners, then please do so. But leave me alone with old-client nostalgia. They won't come back. Gajim moves on. No OTR.

Proprietary XMPP-based messengers had separated with similar intents.

☭Mike Yellow: by the user, because gajim tries to create a DB with that name. That's a known issue

cal0pteryx, Thank you.

And Kaidan supports only OMEMO 2 because OMEMO is outdated already, despite no other client, including Gajim, supports OMEMO 2 yet.

Moxxy does

But yes Kaidan is a bit funny with their xep support choices.

Is there already a client which does only support MIX on principle and doesn't support MUC?

Kaidan I think.

At least that is their roadmap. I don't think they actually support MIX yet

It was my test client when I played with MIX once.

just released OTR plugin for Gajim 1.8: https://dev.narayana.im/narayana/gajim-otrplugin for now it supports only basic functions like establishing encrypted session and encrypting/decrypting messages, no key verification et cetera implemented at the moment. credits to bodqhrohro:

https://im.ebala.net:5821/upload/7D-fA7qwcQYhtxCrv9HTR8FV/0611a582-13e0-48b1-ae70-e1088e119066.png

by the way, $10000 bounty for implementing DTLS-SRTP calls compatible with Dino/Conversations/Cheogram is still active

OTR is good 4u

OTR is a niche within XMPP, which is a niche itself. And no, it is not good for you.

In fact, I have some IRC contacts, who would like to use OTR with their XMPP contacts. Yet a smaller niche, though :-)

cal0pteryx: billions of WhatsApp users don't count, right? :P

bodqhrohro: whatsapp is not the xmpp I am referring to.

WhatsApp is using a type of libsignal like omemo

I see no reason not to support one more encryption protocol, PGP and OpenPGP existing somehow

cal0pteryx: I already got you have some specific notion of XMPP which includes only a few clients :P (or only one, actually)

Kris: only for encryption.

ann: simple: it has been proven to have terrible user experience in modern instant messaging

> PGP and OpenPGP existing somehow that's more terrible than OTR

They're not terrible in terms of multi-device support, up to the point if someone steals the keys they can decipher everything. Perfect multi-device support, even for devices not added yet ×DDDD

bodqhrohro: not sure what you are implying, but mentioning whatsapp in the context of implementing OTR or not isn't helpful

cal0pteryx: you told that XMPP itself is niche.

Also, many people would tell for sure that open XMPP has a terrible user experience because it does not support stickers, animated emojis or whatever.

It does though 😅

wut?

Well maybe not animated emojis

Let's add more terrible UX then, right ;)

> Also, many people would tell for sure that open XMPP has a terrible user experience because it does not support stickers, animated emojis or whatever. this is true

But stickers are definilty a thing

stickers are just images tho

Depends on the implementation

there is experimental XEP

for stickers

cheogram implemented that afaik

cheogram supports them today

:)

:)

The main difference is the client presentation of how to choose the sticker.. Otherwise it's just a file

ah too slow :P

cheogram is kind of a mess tbh

at the moment

that's why we forked conversations

Oh another one /s

I think gajim needs to fix those image previews before we have any kind of sticker implementations

what's wrong with image previews?

cough cough 20mb gif files

a lot

I can't list them all because that wouldnt be so good

umu, reporting bugs is always good.

should compress it wtih modern codecs as telegram does

and 20mb gif becomes 2mb webm

would b nice

first of all need to implement XEP-0447 (Stateless file sharing)

another thing bug worthy is the audio player

just test the hell out of it for like an hour

I don't really have the time to write reports I'd rather just get my chemical rewards here for a quick fix

I'd recommend file previews and audio previews be disabled by default

until they're ready for more people to use

umu: what are you saying? At the moment you're just pointing at things without any proof. If there are bugs, please report them, and do it properly.

ann I very much prefer OX over OMEMO (and OTR), because it does not have PFS. I want to read my MAM stuff on a new device. The problems with OX are: 1. No support for HTTP upload, 2. not widely implemented (only Gajim and Profanity more or less).

Gif playback is already listed in the issue tracker, because someone tookt the time to test and report back.

Disabling things by default also means that nobody tests them.

Saying that the preview is unusable is pretty far fetched, given the bug reports we receive

hello, i'm using gajim but it's not syncing chats

other clients (conversations, cheogram) sync fine so i think it's a gajim issue

hmm i have an old gajim install, i'll try the latest one

is there a way to get the conversation history in gajim? i think it's stored in prosody but (new) gajim is not fetching it

(i used the flatpak version for latest release)

procastinator, Gajim 1.8 definitely fetches MAM history, but with limits and not the first time you use it.

hmm this is 1.8.1 -- can i fetch user-user messages ?

hmm mam is disabled in prosody conf, but somehow conversations is fetching messages

i've enabled it -- i hope now it'll work

procastinator: gajim only supports MAM for message history

oh, ok

that seems fine -- i should have enabled mam in prosody

(we should really add a notification if it's disabled)

will gajim 1.4.7 also work with mam ?

my system has old libcario (48 or something) so i can't use 1.8 yet

except with flatpak

🗿 Yes.

thanks!

procastinator, I would recommend you to upgrade your system instead, there have been many improvements to Gajim since the 1.4 branch.

yeah i've been waiting slack to upgrade cario, but maybe i should do it myself :)

debacle, wut is OX and where is it implemented?

umu OX = OpenPGP for XMPP, implemented partially (but working!) in Gajim (openpgp plugin) and Profanity.

The public key is stored in PEP, so that there is no need for key servers or WKD etc.

The private key can be optionally stored in PEP (encrypted, of course), so that users can sync it between devices.

oic

tyty

I would probably not store my private key in PEP, if I'm not the server admin ;-)

But storing the public key in PEP is nice. Just like OMEMO.

encrypted private key storage is a good idea didn't think ab that

yeah its how matrix got some of its security vulnerabilities :D

doesn't mean it's a bad idea tbh they just didnt properly implement it the first time around

> tyty ry

of course. im sure we can do it properly without issues /s

wym

https://im.ebala.net:5821/upload/M0NNWA16Xe0ZHHEOPP1NQQRL/RECORDING_20230920_204120913.m4a

its not a big deal if someone gets the pgp key you use for xmpp tbh

same with getting the private key of a webserver

Hi, are there any plans for bringing omemo 0.8.1 to gajim?

https://www.kaidan.im/2023/05/05/kaidan-0.9.0/

kaidan has it implemented

but it wont work with older versions of omemo

yes, but its currently not a priority

what is the current priority?

reafcoring our database code

MLS is the new protocol for e2ee, so it is possible that omemo 0.8 is skipped in favor of MLS

What version of omemo does Gajim support?

no idea, the one most clients support

VA1DER: Te axolot one or something

Its pre standard omemo kind of

> What version of omemo does Gajim support? 0.5.1 I believe

from 5 years ago i think

> MLS is the new protocol for e2ee, so it is possible that omemo 0.8 is skipped in favor of MLS Reading the rfc of mls too thats what i am thinking personally yeah. For my client. There is no point implementing omemo whatever ↺

where is mls used

You can see here exactly which one https://xmpp.org/extensions/#xep-0384-implementations

Its 0.3

> where is mls used Wickr, wire, matrix, google chats. ↺

It gives you metadata protection and also group participants confidentialityand integaity

honeypots basically

Integrity*

While scaling to large group chats

> honeypots basically Its an ietf standard. ↺

Based on signal protocol

I see, what matrix client do you use?

if you dont mind me asking of course

Good heavens - 0.3 is from 2018 and predates double ratchet and ed25519

mls?

VA1DER, no, you misreading it

https://xmpp.org/extensions/xep-0384.html

says here 0.8.3

2022 january

grin: i dont use matrix. I like xmpp

Gajim's implementation is shown as 0.3 on https://xmpp.org/extensions/#xep-0384-implementations

The current version of the specification is 0.8.3

> grin: i dont use matrix. I like xmpp why not?

VA1DER: thats all xmpp clients as you see btw

Its bad yeah

I dont use matrix either because everyone smart I know uses xmpp and does not like matrix

Well i dont like matrix either so :)

there is nothing bad about it, between those version nothing changed crypto wise

only the wire format was made new so clients dont need to depend on libsignal

Double ratchet is OMEMO's claim to fame. That's the good part of the specification, and the spec says that wasn't implemented until 0.4. 0,4 is also when you get SCE, which encrypts the entire message, header and all, not jsut the payload

> Gajim's implementation is shown as 0.3 on https://xmpp.org/extensions/#xep-0384-implementations > > The current version of the specification is 0.8.3 it says 0.1 for me

this list could be old

Its real time actually

Afaik

i saw a gajim commit saying 0.5

Oh, ya, sorry, I did misread it. 0.1 for Gajim

VA1DER, the spec said use libsignal before which of couse implements double ratchet

That's good at least

only because something is not in a spec , does not mean its not used, it just means someone did not find it worth to write down

0.1 is even older, no?

TBH, I run my own server, so for me end-to-end is the TLS that's in the connection.

i XEP is a document, with a change history

only because a XEP has version X.Y does not mean the protocol has changed

if you correct a typo, then the XEP version is raised

so gajim does not use 0.1?

0.1 is ancient, omemo 0.1 predates encryption

i hope this is not the case

Philipp Hörist pushed 1 commit to branch _refs/heads/master_ of _gajim_ < https://dev.gajim.org/gajim/gajim >: *09fd2fbd* < https://dev.gajim.org/gajim/gajim/-/commit/09fd2fbd1e6e4ec01a376ceadd416f582ab5c402 > chore: Update gajim.doap

grin, yes grin, we implemented omemo without encryption

XD

use kaidan for desktop and moxxy for mobile

it has security updates

simply put our messages are not secure

What you are saying doesnt make much sense. Because these clients dont even implement the same stuff. Gajim is stable though, today.

Namely kaidan implents mix and moxxy muc

Hi guys, just started using xmpp. Why do you use it? What you find here that you can't find anywhere else?

privacy

Nothing, it's barren

never used moxxy

is it any good?

umu, very early days

but has potential

> Hi guys, just started using xmpp. Why do you use it? What you find here that you can't find anywhere else? Easy and lightweight selfhosting ↺

☝️☝️☝️☝️☝️☝️

when is gajim going to update it's xmpp spec?

umu: what do you mean?

0.8.3 thing grin mentioned

umu, read the chat history, starting 40 minutes ago

Hello lissine.

lissine:

Must i still.follow the guide

Use orbot 24/7

Dns.forge 24/8

24/7

lissine: is it good.

And always the advice?

lissine: is it good.and always the advice?

cal0pteryx, lovetox: spammer above ^ ✏

lissine:

The answer is yes?

o

cal0pteryx: is ur avi the south park cow from season 1?

not season 1 specifically, but yes

icic

the episode where the couple wins a trip to south park for the running of the cows

I think

orly

not the one where they get taken by ufos?

damn ur right i guess that 1 is from season 2

hi

what is gajim's logo supposed to be?

the avg users proportions

i am thin albeit

it kind of depends on the angle of your mirror

Kind of reminds me the stylized vague humanoid representation of users that AIM, ICQ, MSN, etc. used to use. I assumed it was something along those lines

is it the AIM guy wearing an oversized green shirt

I don't mean to insult anyone's art but I wouldn't mind if gajim had a different logo

that said, it seems like a difficult task to come up with one

I suppose a logo can be anything

> the avg users proportions lol

yeah a modern logo redesign might be nice

maybe: 𝕐 /s

☝️☝️

Well, "Gaijin" (外人) literally means foreigner and alien. How about a Roswell alien head? Or one with a speech bubble - I'd go for that.

am I a baka for using gajim