UPDATED: XEP-0511 (Link Metadata)
Version 0.1.1 of XEP-0511 (Link Metadata) has been released. Abstract: This specification describes how to attach metadata for links to a message. Changelog: Added security consideration. Added alt text to example. (spw) URL: https://xmpp.org/extensions/xep-0511.html Note: The information in the XEP list at https://xmpp.org/extensions/ is updated by a separate automated process and may be stale at the time this email is sent. The XEP documents linked herein are up-to- date.
For File Transfers there is a similar XEP 0446 File metadata element https://xmpp.org/extensions/xep-0446.html that allows to specify file name, size but also thumbnails. The thumbnails are specified in the XEP-0264 Jingle File Transfer https://xmpp.org/extensions/xep-0264.html Maybe it can be reused somehow or at least it worth mentioning.
It would be nice to add a sample with two links and sample with two languages for the same link. A message may have multiple bodies for different languages and it probably doesn't make sense to add a metadata if there is no a body with the language. Otherwise it may be not clear for a client developer if it should be included all the translations of the metadata. Let's say there is two languages en and de but for the link we have 10 translations. For the Security Considerations it should be mentioned that this can be used for phishing: you are sending a link to a fake site but the thumbnails and metadata will say "This is your bank". Another one problem is that the image URL can be used for tracking so that when a client tries to fetch it an attacker will see IP of a receiver. Ideally the thumbnail should be sent inline, for a chat messages they anyway shouldn't be that big, The sample has a lot of images and it may be not clear which one to support: <og:image>https://link.to.example.com/image.png</og:image> <og:image>cid:sha-256+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855@bob.xmpp.org</og:image> <og:image>ni:///shai-256;47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU</og:image> <og:image>data:image/jpeg,...</og:image> <og:video>https://videos.example.com/video-embed.html</og:video> Can we have a sample of a real page? Ideally a stable one. Then a client developer can test and compare results. And last question: do we have any implementation of the XEP? I may add it to the Spark (Java+Smack) to test the specification and provide a feedback. But if this was already implemented I would rather see it in action.
It would be nice to add a sample with two links and sample with two languages for the same link.
Would be xml:lang srme as body.
For the Security Considerations it should be mentioned that this can be used for phishing: you are sending a link to a fake site but the thumbnails and metadata will say "This is your bank". Another one problem is that the image URL can be used for tracking so that when a client tries to fetch it an attacker will see IP of a receiver.
Yes. The XEP already mentions both of these.
The sample has a lot of images and it may be not clear which one to support:
Any or none. They are just examples.
And last question: do we have any implementation of the XEP? I may add it to the Spark (Java+Smack) to test the specification and provide a feedback. But if this was already implemented I would rather see it in action.
Yes, Cheogram Android, Monocles, and Cheogram WWW all have it. And Gajim in at least nightly.
participants (3)
-
Daniel Gultsch -
Stephen Paul Weber -
stokito＠gmail.com