The XMPP Extensions Editor has received a proposal for a new XEP.
Title: End-to-End Encrypted Contacts Metadata
Abstract:
This specification describes how to encrypt contacts metadata to
minimize server exposure.
URL: https://xmpp.org/extensions/inbox/contacts-e2e.html
The Council will decide in the next two weeks whether to accept this
proposal as an official XEP.
Hi,
I saw a talk by Sophia Longwe, who I believe works at Wikimedia
Germany, at 39C3 (Chaos Communication Congress). I saw the talk in
person, but there is a recording of it here:
https://media.ccc.de/v/39c3-who-runs-the-www-wsis20-and-the-future-of-inter…
The talk is a rudimentary overview of how the different bodies that
"steer" the internet work t ranging from UN committees and ICANN down
to mere mortals such as us. The XMPP Standards Foundation (XSF) was
not called out specifically, but our colleagues at the IETF and W3C
were mentioned.
In her talk, she criticized the lack of participation from "civil
society" in standardization work. She attributed this partially to
high barriers to entry at IETF events (high costs, fancy hotels) and
said (I’m paraphrasing) that it’s basically just rich FAANG employees.
Some of that doesn’t exactly match my own experience at the IETF, but
I don’t think any of what she said was in bad faith. I hope to meet
her in Vienna (IETF126) to discuss some of these things in person. And
who knows, maybe she is right.
Anyway, long story short, this got me thinking about our processes
here at the XSF (which, again, she didn’t mention at all):
I think the XMPP Standards Foundation is in a unique position where
many of our members can be described as "civil society" - people who
might describe themselves as activists or promoters of XMPP rather
than developers. (And/or people who do software development for a
living, but whose jobs are unrelated to XMPP and who joined the XSF
more in the capacity of a user.)
At the same time, I’m observing that a lot of our Last Calls (and
standards work in general) have few participants, at least relative to
our overall membership numbers. Furthermore, I've heard criticism that
the XSF doesn’t take the concerns of some minority groups seriously
enough. (Which may or may not be true; I don’t want to take sides on
that at this point.)
This leads me to a question: Can we kill two or three birds with one
stone here? Can we either rephrase some of the questions in the Last
Call or add new ones that explicitly invite feedback from "civil
society" (for lack of a better word)?
I just want to get the discussion started, so I don’t have a final
list, but the questions could go in a direction like this:
* Would you use this feature if it were implemented in the XMPP client
you currently use?
* Do you think an implementation of this feature could negatively
impact your community?
* Does this improve (make easier) the work you do in your community?
Cheers,
Daniel
Version 1.1.0 of XEP-0386 (Bind 2) has been released.
Abstract:
This specification provides a single-request replacement for several
activities an XMPP client needs to do at startup.
Changelog:
It's authorization-identifier not authorization-identity (dg)
URL: https://xmpp.org/extensions/xep-0386.html
Note: The information in the XEP list at https://xmpp.org/extensions/
is updated by a separate automated process and may be stale at the
time this email is sent. The XEP documents linked herein are up-to-
date.
This message constitutes notice of a Last Call for comments on
XEP-0377.
Title: Spam Reporting
Abstract:
This document specifies a mechanism by which users can report spam and
other abuse to a server operator or other spam service.
URL: https://xmpp.org/extensions/xep-0377.html
This Last Call begins today and shall end at the close of business on
2026-01-05.
Please consider the following questions during this Last Call and send
your feedback to the standards(a)xmpp.org discussion list:
1. Is this specification needed to fill gaps in the XMPP protocol
stack or to clarify an existing protocol?
2. Does the specification solve the problem stated in the introduction
and requirements?
3. Do you plan to implement this specification in your code? If not,
why not?
4. Do you have any security concerns related to this specification?
5. Is the specification accurate and clearly written?
Your feedback is appreciated!