On Sun, Mar 8, 2026 at 2:49 PM Philipp Hörist <philipp(a)hoerist.com> wrote:
On Sun, Mar 8, 2026, at 10:27, Daniel Gultsch wrote:
I was never fully sold on the pre-authenticated
roster part of the
stack. I don’t know. I guess it’s kinda neat but I don’t really need a
mutual presence subscription to get the first message out.
You share a QR code to a friend, or they scan it from your phone, and all the
subscribe/subscribed dance is done without anyone of the 2 users receiving requests that
they need to accept or acknowledge. This sounds to me like a pretty nice value.
Why do you think its about sending a first message?
I just meant if the goal is to share your JID and to send you a
message (aka make first contact) I don’t really need mutual presence
sub for that. Yes it's nice to have but personally I’m very much
*shrug emoji*.
Anyway my goal is not to take Roster Pre Auth away from someone. Out
of the two suggestions I had in my original email I'm absolutely fine
with going the "combine this all into one do it all XEP".
However 0401
doesn’t provide a guarantee that the server even supports
0445 and I have no way of knowing that before retrieving the invite
URI. Only after retrieving the invite URI and checking for the
existence of the ibr=y parameter I know that the server supports 0445.
It does guarantee that, it says
> Romeo's server MUST support at least one Pre-Authenticated In-Band Registration
mechanism.
There is also language like that:
"The ibr query component in the XMPP URI indicates that the invitee is
allowed to create an account on Romeo's server, using the 'preauth'
token. If the server does not support or allow in-band registration
for invited users, the server MUST omit the ibr query component."
and
"Register an account with Romeo's server (if the URI contains a ibr=y
parameter)." (Notice the *if*)
And I’m fairly sure that in practice not all implementation in all
configuration do that.
The 0445 stream feature is only advertised to unauthenticated users.
Which actually makes sense because the normal register stream feature
is also only advertised before authentication. So they can’t be used
for logged in users to display that button or not.