On 03/19/2009 11:01 PM, Peter Saint-Andre wrote: Hi,
> Given that I've received no feedback on the proposed (slight) > modifications to XEP-0124, I've checked in version 1.8rc1: Sorry for not reacting on this (neither on other important discussions elsewhere), I only have some lame excuses like 'busy', 'ill children' and 'holliday' ;-) > http://xmpp.org/extensions/tmp/xep-0124-1.8.html imho the changes are ok, but there is only one thing we should keep in mind when talking about BOSH: I see two typical use-cases for BOSH: 1) From out a web application/browser. Here you are (or should be) sandboxed, so the browser-side part of the application should connect back to its server of origin. This server must then at least proxy to a connection manager. The fast majority of BOSH installations will be used like this. 2) From out a stand-alone application, eg to solve problems like firewalls or flaky connections. The new version of XEP-0124 states: === Because there is no way for the client to be sure that the BOSH service encrypts its connection to the application, it is RECOMMENDED for the client encrypt its messages using an application-specific end-to-end encryption technology; methods for doing so are outside the scope of this specification. === This is only sensible in the use case of a stand-alone application. In the context of a web application this recommendation makes little to no sense: - in much cases the web application will connect to a back-end on the same server or a server within a trusted network, without an other end to do end-to-end encryption to - when the web application facilitates connections to an end that does or might) support end-to-end encryption, the trustworthiness of the browser-side part of the web application is very debatable: it is almost impossible to audit the web application on cryptographic weaknesses or backdoors each time it is loaded in the browser (opposed to a stand-alone application, where auditing is more or less possible). So in the context of a webapplication end-to-end encryption makes little sense. NB: the only situation I can imagine where it might make sense is in the project I am maintaining (HelpIM). There the users might trust me with software and servers, but still don't want me to be able to see, sniff or store in readable format the content of the chats. In other words: they trust me in serving a correct end-to-end encryption from my server, but still don't want me to be able to see the content of the chats. Now back to the changes in XEP-0124: Maybe it is better to limit this recommendation to the use in stand-alone clients. When using BOSH in the context of a web application, it only is only in esoteric situations a useful recommendation. greetings, Winfried -- http://www.tilanus.com xmpp:[email protected] tel. 015-3613996 / 06-23303960 fax. 015-3614406
