[jdev] looking for help

2004-11-11 Thread aliban
hi anyone of you is able to port/compile XMPP Client Daemon on a unix or MacOSX platform? Me is not an experienced linux user thus i don't know much about these platforms... project infos are on http://xcd.jabberstudio.org/ cvs is on sourceforge. regards, Edrin JID: [EMAIL PROTECTED]

Re: [jdev] GAIM-Integrated Filesharing

2004-11-11 Thread aliban
... 1. Give Money The sooner you give, the sooner the software will exist for you and everyone else. We are taking donations via PayPal and 100% of what you give will go directly to the programmer. Downhill Battle has a solid track record of getting projects out the door, and we are going

[jdev] Re: GAIM-Integrated Filesharing

2004-11-11 Thread Peter Saint-Andre
In article [EMAIL PROTECTED], [EMAIL PROTECTED] wrote: GAIM-Integrated Filesharing snip/ As far as I can see, this message if off-topic for the JDEV list. If off-topic posts continue to be received from the sender, the list admin (me) will take appropriate actions, which may include holding

RE: [jdev] TLS and self-signed certs

2004-11-11 Thread JD Conley
Allowing self signed (or otherwise untrusted) certs with STARTTLS + EXTERNAL is opening yourself up for a serious security breach. Using it with stream:features over dialback would give you encryption with a self signed cert and trust through the DNS system. STARTTLS + Dialback offers some level

[jdev] Re: TLS and self-signed certs

2004-11-11 Thread Peter Saint-Andre
In article [EMAIL PROTECTED], JD Conley [EMAIL PROTECTED] wrote: Allowing self signed (or otherwise untrusted) certs with STARTTLS + EXTERNAL is opening yourself up for a serious security breach. Well, that's another story. But that claim on the URL I provided was that it is technically

Re: [jdev] TLS and self-signed certs

2004-11-11 Thread Justin Karneges
While JD's comments sum this up nicely, I just want to reiterate loudly that self-signed certificates alone truly are worthless. I'm not even talking about man in the middle attacks either. As a form of identity, a self-signed cert is as effective as the From: header in good old SMTP, and

Re: [jdev] Re: TLS and self-signed certs

2004-11-11 Thread Justin Karneges
On Thursday 11 November 2004 04:53 pm, Peter Saint-Andre wrote: In article [EMAIL PROTECTED], JD Conley [EMAIL PROTECTED] wrote: Allowing self signed (or otherwise untrusted) certs with STARTTLS + EXTERNAL is opening yourself up for a serious security breach. Well, that's another story.

[jdev] Re: TLS and self-signed certs

2004-11-11 Thread Neil Stevens
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thursday 11 November 2004 05:06 pm, Justin Karneges wrote: While JD's comments sum this up nicely, I just want to reiterate loudly that self-signed certificates alone truly are worthless. I'm not even talking about man in the middle attacks

Re: [jdev] Re: TLS and self-signed certs

2004-11-11 Thread David Waite
On Thu, 11 Nov 2004 19:54:49 -0800, Neil Stevens [EMAIL PROTECTED] wrote: Also, remember that different people have different threat models to address. Someone in the old hypothetical revolutionary conspiracy can't afford to depend on large institutional corporations to sign their

[jdev] Re: TLS and self-signed certs

2004-11-11 Thread Stephen Marquard
Peter Saint-Andre wrote: In article [EMAIL PROTECTED], JD Conley [EMAIL PROTECTED] wrote: Allowing self signed (or otherwise untrusted) certs with STARTTLS + EXTERNAL is opening yourself up for a serious security breach. Well, that's another story. But that claim on the URL I provided was

[jdev] Re: TLS and self-signed certs

2004-11-11 Thread Neil Stevens
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thursday 11 November 2004 09:44 pm, David Waite wrote: On Thu, 11 Nov 2004 19:54:49 -0800, Neil Stevens [EMAIL PROTECTED] wrote: Also, remember that different people have different threat models to address. Someone in the old hypothetical

[jdev] Re: TLS and self-signed certs

2004-11-11 Thread Stephen Marquard
Justin Karneges wrote: That said, on the subject of caching, XMPP servers should be a bit more strict than most of us probably are with ssh, if only to curb spam. Using dialback on the first connection might be acceptable. And now that I think about it, the whole use dialback for the first