Historically users of XMPP clients did not communicate with external servers run by the app developer, by having plaintext passed from their own server to the app developer. Although the 357 specification is great because it allows arbitrary clients to receive pushes from any supported server, it does not mention the potential privacy issues with last-message-sender and last-message-body being sent to the app developer.
I noticed that mod_push (ejabberd) defaults to not sending these, but mod_cloud_notify (prosody) currently defaults to true. I think it would be good to mention in the XEP the potential issues for centralized information leakage and suggest to default these values to false in server modules. Ideally I'd want to reject last-message sender and body on my pubsub node and inform the sending server not to include these, but that would definitely make things too complicated.
_______________________________________________ Standards mailing list Info: http://mail.jabber.org/mailman/listinfo/standards Unsubscribe: [email protected] _______________________________________________
