On Tue, Oct 29, 2013 at 6:17 PM, Jonas Wielicki < xmpp-operat...@sotecware.net> wrote:
> Will there be a reminder for the action days? Because I don't trust > myself to keep an electronic reminder actually functional until Jan 4th > (yeah I know). I'm only operating a small service though (<20 users), so > if I'm the only one with that problem, just don't mind. > > Hm, actually I only wanted to ask for the reminder, but now I see more > questions arising, so I'll just continue. > > Speaking personally, I'd like to see this effort well publicised, so I'd hope there'll be plenty of reminders. > In fact, most of my s2s is already TLS (although I don't require it). > The only exceptions are google+talk and (weirdly) ddg.im (duckduckgo). > I've already raised that issue to their attention[1], no fix yet, as far > as I know. > > By TLS, is that including proper authentication? > I already have DNSSEC deployed, so I think the only pending move is > implementing DANE from my side. Then waiting for prosody et al. to gain > DANE-ability. I “only” have a CACert certificate though, but for moral > reasons I decline to move to StartSSL or others. Does CACert qualify for > the “well-known and widely-deployed” CAs? (And shouldn't that rather be: > “well-trusted and widely-deployed”?) > > Ugh. The problem here is that we want turn-key security as much as possible. So we want the certificates to be deployed by the operating systems et al, it's not a list that we can provide. (If we did, we'd be the moral equivalent of a CA anyway). For whatever reasons, CACert have not been put into the default cert stores of any major browser or OS, as far as I'm aware, making its use problematic. If you'd like to have a different CA in those lists, it's actually quite easy, but requires money and effort to get through the audit processes. (That's money for paying for the auditors, not paying to get on the lists). > There is cipher suites with forward secrecy. For me on Fedora, this > means diffie-hellman, as elliptic curves are still problematic[2] (and > I'm not yet sure whether they're to trust, but I guess, noone is). I > wonder whether this is considered okay? > > I thought (possibly wrongly) that all PFS suites were based around a DH exchange, whether EC or not. > For c2s I do require encryption already. > > Are there any requirements for signing, like, minimal user count, > influence on development of XMPPish software or whatsoever? And by > “requirements” I mean, does it make sense to officially sign if you are, > like, a 20 user hobby server operator? ;) > I see no requirements. And 20 users is 19 more than I have, and I'll sign (once it's all settled; I won't sign a moving target). Dave.
