Subject: [xmpp] 3921bis adding yourself to rosters.

From: Kevin Smith <[email-masked]>
Date: Wed, 21 Jul 2010 10:47:54 +0100

At the end of 2.3.3 there's some text about MUST return not-allowed if
a user tries to add themselves to a roster. While it seems vaguely
sensible that not many people will want to do this, sampling of
jabber.org users shows that this is something users do a lot - added
to this, it may not be the user's own roster that they're adding
themselves to and I think the text needs an overhaul.

/K

---

From: Peter Saint-Andre <[email-masked]>
Date: Sun, 25 Jul 2010 14:55:56 +0200

> themselves to and I think the text needs an overhaul.

Given that there's no attack here, the MUST is too strong. Indeed,
special-casing the 'jid' attribute adds more work for the server with,
it seems, no real return. Shall we simply remove this case as an error flow?

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Kevin Smith <[email-masked]>
Date: Sun, 25 Jul 2010 13:58:26 +0100

> it seems, no real return. Shall we simply remove this case as an error flow?

Removing it would work - I've seen questions before about the legality
of this, so perhaps something like:

Some servers MAY disallow users adding themselves to their own roster.
In this case, send not-allowed.

only wordsmithed would be better?

/K

---

From: Peter Saint-Andre <[email-masked]>
Date: Sun, 25 Jul 2010 15:07:54 +0200

> only wordsmithed would be better?

I think you want something like this:

      Interoperability Note: Some servers return a <not-allowed/> stanza
      error to the client if the value of the <item/> element's 'jid'
      attribute matches the bare JID <node@domain> portion of the <iq/>
      element's 'from' attribute.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Kevin Smith <[email-masked]>
Date: Sun, 25 Jul 2010 14:15:10 +0100

>      element's 'from' attribute.

WFM, ta.

/K

---

From: Paul Aurich <[email-masked]>
Date: Sun, 25 Jul 2010 09:05:08 -0700

>       element's 'from' attribute.

I think it might be better to use some wording to describe this as the
bare JID of the account associated with this client (or something along
those lines).  (I can just envision a server that short-circuits
stamping a 'from' on IQs like this, and then doing a comparison against
bare_jid(from) and falling flat.)

~Paul

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 26 Jul 2010 08:49:44 +0200

> bare_jid(from) and falling flat.)

I think that's better. Changed to:

      Interoperability Note: Some servers return a <not-allowed/> stanza
      error to the client if the value of the <item/> element's 'jid'
      attribute matches the bare JID <node@domain> of the user's
      account.

/psa

---

From: Kevin Smith <[email-masked]>
Date: Mon, 26 Jul 2010 08:48:42 +0100

>      attribute matches the bare JID <node@domain> of the user's

WFM.

/K