• chevron_right

    How to choose you Jabber service?

    debacle · 4 days ago - 01:38 edit · 1 minute

Aren't we all envious of users of #Whatsapp, #Signal, #Telegram or #Threema? The choice of service is easy for them. There is none! Happy users!

Instead we use #Jabber or #XMPP, because we love self-hosting, don't we? Well, it is important to have the option to self-host, but in most cases it is not the best option to actually do it. So we need to select a server, based on our priorities.

I suggest to look out for:

  1. More than one admin? A single admin might be in holidays, when you need them most. Or they outburns and closes the service on short notice. Beware of the lorry factor.
  2. Sound financial base? If you pay for the service, you have a higher chance, that the service is here to stay. A service based on donations might work as good as a commercial one.
  3. Good uptime history?Here is some limited informtion about it. Also, the longer a service exists, the longer it will survive, because of the Lindy effect.
  4. Good #LTS grade? Use only A grade servers from the IM Observatory.
  5. Acceptable data privacy statement? IANAL, but you know, #GDPR and so on...
  6. High XMPP compliance? This XMPP Compliance Tester lists many servers.
  7. Cool domain name? and other details like how much server space you have for sharing cat content, how long messages are archived, whether an .onion domain is available, or transports (gateways) to #IRC or other networks are provided.

Useful lists of servers can also be found on Freie Messenger and JabberEs.

  • favorite

    7 Like

    minhlab , kryptos , ericbuijs , Timothée Jaussoin , DebXWoody , Baragan , Xabi

  • Ar chevron_right

    Wormable code-execution flaw in Cisco Jabber has a severity rating of 9.9 out of 10 / ArsTechnica · Friday, 11 December - 12:43

Wormable code-execution flaw in Cisco Jabber has a severity rating of 9.9 out of 10

Enlarge (credit: Getty Images)

Cisco has patched its Jabber conferencing and messaging application against a critical vulnerability that made it possible for attackers to execute malicious code that would spread from computer to computer with no user interaction required. Again.

The vulnerability, which was first disclosed in September , was the result of several flaws discovered by researchers at security firm Watchcom Security. First, the app failed to properly filter potentially malicious elements contained in user-sent messages. The filter was based on an incomplete blocklist that could be bypassed using a programming attribute known as onanimationstart.

Messages that contained the attribute passed directly to DOM of an embedded browser. Because the browser was based on the Chromium Embedded Framework, it would execute any scripts that made it through the filter.

Read 5 remaining paragraphs | Comments


Dino 0.2.0 in Debian

#jabber (or #xmpp) client #dino-im is now in #debian 11 ( #bullseye or testing) and Debian 10 ( #buster or stable). The latter via:

$ echo "deb buster-backports main" \
  | sudo tee /etc/apt/sources.list.d/backports.list
$ sudo apt update
$ sudo apt install -t buster-backports dino-im
  • favorite

    3 Like

    indyradio , DebXWoody , Timothée Jaussoin