Subject: [xmpp] Proposed XMPP Charter Update

From: Ben Campbell <[email-masked]>
Date: Thu, 21 Feb 2013 13:59:14 -0600

Hi Everyone,

We need to do a minor charter update to add the XMPP/WebSockets work. 

Here's the proposed new text. This version is the same as before, except it removes the text for XMPP interworking with SIP/SIMPLE, an adds text for WebSockets. The new text is the second to last paragraph.

Please send any feedback to the XMPP mailing list as soon as possible. (If you agree with the text as is, please say that, too :-) )

Thanks!

Ben.

-----------------

The Extensible Messaging and Presence Protocol (XMPP) is an
technology for the near-real-time exchange of messages and presence
notifications, where data is exchanged over Extensible Markup Language
(XML) streams. The original XMPP working group published RFCs 3920-3923.

Implementation and deployment experience since that time has resulted
in errata, clarifications, and suggestions for improvement to the core
XMPP specifications (RFCs 3920 and 3921). Some technologies on which
XMPP depends (e.g., Transport Layer Security and the Simple
Authentication and Security Layer) have undergone modifications of their
own, which XMPP needs to track. Finally, the group needs to define a
sustainable solution to internationalization of XMPP addresses, since
the approach taken in RFC 3920 (based on stringprep profiles) is limited
to Unicode 3.2 characters. Both draft-saintandre-rfc3920bis-* and
draft-saintandre-rfc3921bis-* reflect community input so
far regarding these modifications, but the group needs to complete this
work, especially with regard to internationalization. Because of the
scope of changes involved, it is envisioned that these specifications
will be cycled at Proposed Standard.

Although RFC 3923 defines an end-to-end signing and encryption
technology for use by XMPP systems, to date it has not been implemented.
A goal of the group is to develop an implementable method for end-to-end
encryption, preferably based on well known and widely deployed security
technologies.

XMPP uses TLS for encryption and the Simple Authentication and Security
Layer (SASL) for authentication. In the case of a server-to-server
stream, XMPP is deployed using TLS and the SASL EXTERNAL mechanism,
where each peer presents an X.509 certificate. This model introduces
scaling challenges in multi-domain deployments because RFC 3920 requires
that a stream cannot be reused for more than one domain, thus
necessitating multiple TCP connections. The group will work to overcome
these challenges by defining an optional mechanism for using a single
connection with multiple identities. It is anticipated that most of the
work will consist of defining and providing requirements to the TLS and
SASL working groups.

In addition to the TCP binding defined in RFC 6120, the XMPP community
has long employed an HTTP binding (XEP-0124 and XEP-0206 published by 
the XMPP Standards Foundation).  Given that this binding uses HTTP long 
polling, which has many known issues (RFC 6202), it is reasonable to 
transition to use of the WebSocket protocol (RFC 6455) instead.  Work has
begun on defining a WebSocket subprotocol for XMPP 
(draft-moffitt-xmpp-over-websocket).  The group will complete the 
definition of such a subprotocol, and coordinate reviews with the HYBI WG 
where appropriate.

In completing its work, the group will strive to retain backwards
compatibility with RFCs 3920 and 3921. However, changes that are not
backwards compatible might be accepted if the group determines that the
changes are required to meet the group's technical objectives and the
group clearly documents the reasons for making them.

---

From: Bernard Aboba <[email-masked]>
Date: Thu, 21 Feb 2013 14:44:25 -0800

The Websockets work is badly needed.  So the charter changes look good.

On Thu, Feb 21, 2013 at 11:59 AM, Ben Campbell <[email-masked]> wrote:

> Here's the proposed new text. This version is the same as before, except
> it removes the text for XMPP interworking with SIP/SIMPLE, an adds text for
> WebSockets. The new text is the second to last paragraph.
>
> Please send any feedback to the XMPP mailing list as soon as possible. (If
> you agree with the text as is, please say that, too :-) )
>
> Thanks!
>
> Ben.
>
> -----------------
>
> _______________________________________________
> xmpp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/xmpp
>

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Fri, 22 Feb 2013 00:44:16 +0100

>encryption, preferably based on well known and widely deployed security

(This is very much needed, as far as I am concerned!)
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Ben Campbell <[email-masked]>
Date: Thu, 21 Feb 2013 18:00:13 -0600

> (This is very much needed, as far as I am concerned!)

Agreed--but unless I really messed something up, that paragraph was in the old (that is, current)  charter, too :-)

---

From: "Matt Miller (mamille2)" <[email-masked]>
Date: Fri, 22 Feb 2013 00:28:11 +0000

This looks good to me.

- m&m

Matt Miller < [email-masked] >
Cisco Systems, Inc.

---

From: Richard Barnes <[email-masked]>
Date: Thu, 21 Feb 2013 19:29:28 -0500

+1

On Thu, Feb 21, 2013 at 7:28 PM, Matt Miller (mamille2)
<[email-masked]>wrote:

> > Please send any feedback to the XMPP mailing list as soon as possible.
> (If you agree with the text as is, please say that, too :-) )
> >
> > Thanks!
> >
> > Ben.
> >
> > -----------------
> >

---

From: Philipp Hancke <[email-masked]>
Date: Fri, 22 Feb 2013 07:42:30 +0100

Hi,

> We need to do a minor charter update to add the XMPP/WebSockets work.

I think we should update the paragraph on s2s as well. See below...

> Here's the proposed new text. This version is the same as before, except it removes the text for XMPP interworking with SIP/SIMPLE, an adds text for WebSockets. The new text is the second to last p…

LGTM btw.

[...]

 > where each peer presents an X.509 certificate.

XMPP was not widely deployed that way in 2009 and is not today.
s/is deployed/can be deployed/

> This model introduces
> connection with multiple identities.

I think we have identified the operational problem of "secure 
delegation" as the issue we need to solve. The overview section from the 
DNA draft describes it quite well, but is way too long. Mh...

The multiple-tcp-connections problem for s2s is a non-issue for me. bidi 
(xep-0288, currently in LC at the XSF; reviews appreciated) and the 
piggybacking mechanism from dialback (xep-0220) should solve it when it 
is clear how to solve delegation.

> It is anticipated that most of the

We took a different path, it is safe to remove that sentence.

---

From: Kim Alvefur <[email-masked]>
Date: Fri, 22 Feb 2013 07:47:06 +0100

> Here's the proposed new text. This version is the same as before, except it removes the text for XMPP interworking with SIP/SIMPLE, an adds text for WebSockets. The new text is the second to last p…

The new paragraph looks good to me.

--
Kim "Zash" Alvefur

---

From: Dave Cridland <[email-masked]>
Date: Fri, 22 Feb 2013 10:14:52 +0000

> We need to do a minor charter update to add the XMPP/WebSockets work.

Proposed new text looks fine, but has anyone considered the option of
spinning out a new WG to handle this work?

It seems to me that a smaller, more focussed WG might get the work done
quicker (it worked for IMAP MOVE), and in addition the WG members might be
drawn from both HyBi and XMPP circles that way, whereas working on it here
might exclude the HyBi community to a degree.

If this has already been considered, I'm not going to fight this one.

Dave.

---

From: Ben Campbell <[email-masked]>
Date: Fri, 22 Feb 2013 07:54:47 -0600

On Feb 22, 2013, at 4:14 AM, Dave Cridland <[email-masked]> wrote:

> Proposed new text looks fine, but has anyone considered the option of spinning out a new WG to handle this work?
> 
> It seems to me that a smaller, more focussed WG might get the work done quicker (it worked for IMAP MOVE), and in addition the WG members might be drawn from both HyBi and XMPP circles that way, whereas working on it here might exclude the HyBi community to a degree.
> 

Hi Dave,

It had been discussed among the chairs and ADs. We were of the opinion that the work needed expertise from xmpp, and we weren't sure if we would get the same expertise in a separate working group (or as an AD sponsored draft). Your point about  hybi is true to some extent, although I think we already get some crossover.

We could certainly reconsider that if other's share your opinion. What do other's think?

Thanks!

Ben.

---

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 22 Feb 2013 09:27:36 -0700

On 2/22/13 3:14 AM, Dave Cridland wrote:
> Proposed new text looks fine, but has anyone considered the option
> of spinning out a new WG to handle this work?
> 
> It seems to me that a smaller, more focussed WG might get the work
> done quicker (it worked for IMAP MOVE), and in addition the WG
> members might be drawn from both HyBi and XMPP circles that way,
> whereas working on it here might exclude the HyBi community to a
> degree.

A separate WG to define a simple WebSocket sub-protocol?

- -1

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 25 Feb 2013 16:08:03 +0000

Hi,

I've no objection to this charter but do have a question:

Q: loads of us use OTR, but there's no mention of that
in the charter - why don't we just spec that in an RFC?

Or two RFCs if need be, one for what's done now, one with
any changes the WG think are needed and will be deployed.

A quick web search leads me to believe that this [1]
might be how OTR works, but I could be wrong. Even having
an informational RFC as a stable reference would seem
to be an improvement.

Sorry if there's an obvious answer and I've not got the
history.

Ta,
S.

[1] http://www.cypherpunks.ca/otr/Protocol-v3-4.0.0.html

---

From: "Matt Miller (mamille2)" <[email-masked]>
Date: Mon, 25 Feb 2013 16:34:38 +0000

We have talked about OTR, but from what I remember, various folks haven't been interested in doing the work to bring it in.  Peter Saint-Andre might be able to speak more on that front.

- m&m

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 25 Feb 2013 09:54:46 -0700

On 2/25/13 9:08 AM, Stephen Farrell wrote:
> Q: loads of us use OTR, but there's no mention of that in the
> charter - why don't we just spec that in an RFC?
> 
> Or two RFCs if need be, one for what's done now, one with any
> changes the WG think are needed and will be deployed.
> 
> A quick web search leads me to believe that this [1] might be how
> OTR works, but I could be wrong. Even having an informational RFC
> as a stable reference would seem to be an improvement.
> 
> Sorry if there's an obvious answer and I've not got the history.

I have reached out repeatedly to the OTR folks. I shall do so again
right now, since there was some discussion on the otr-dev list
recently about someone working on an Internet-Draft.

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 25 Feb 2013 10:06:53 -0700

On 2/25/13 9:54 AM, Peter Saint-Andre wrote:

> I have reached out repeatedly to the OTR folks. I shall do so
> again right now, since there was some discussion on the otr-dev
> list recently about someone working on an Internet-Draft.

Done. I'll let you know if anything concrete (like an effort to
publish an Internet-Draft) comes of it this time...

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/

---

From: Ben Campbell <[email-masked]>
Date: Mon, 25 Feb 2013 11:14:30 -0600

(As individual)

On Feb 25, 2013, at 11:06 AM, Peter Saint-Andre <[email-masked]> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 

If we are talking about potential _future_ OTR work, does it make sense to go ahead with the proposed charter as is, then worry about OTR when there's a concrete proposal? That is, rather than holding up the adoption of the currently proposed charter for something that might happen in the future?

Thanks!

Ben.

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 25 Feb 2013 10:24:13 -0700

On 2/25/13 10:14 AM, Ben Campbell wrote:
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>> 
>>> again right now, since there was some discussion on the
>>> otr-dev list recently about someone working on an
>>> Internet-Draft.
>> 
> If we are talking about potential _future_ OTR work, does it make
> sense to go ahead with the proposed charter as is, then worry about
> OTR when there's a concrete proposal? That is, rather than holding
> up the adoption of the currently proposed charter for something
> that might happen in the future?

IMHO, let's get this small recharter done (which is only to add the
WebSocket item) and then consider rechartering again if the OTR work
surfaces. Initial hints based on my pokage earlier today are
promising, but I wouldn't want to hold up the WebSocket work.

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 25 Feb 2013 17:23:52 +0000

> If we are talking about potential _future_ OTR work, does it make sense to go ahead with the proposed charter as is, then worry about OTR when there's a concrete proposal? That is, rather than hold…

Just in case its not clear: I'm not at all suggesting holding
anything up.

S.

---

From: Kim Alvefur <[email-masked]>
Date: Mon, 25 Feb 2013 18:24:41 +0100

+1

Would that even require require any change to the charter, or could it
be covered under the existing paragraph?

--
Kim "Zash" Alvefur