mirrors/git-annex
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Added a comment

Browse source
This commit is contained in:
https://john-millikin.com/ 2013-07-22 01:52:41 +00:00 • committed by admin
parent d4f387ccf6
commit efaba23640
1 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
doc/bugs/cannot_connect_to_xmpp_server/comment_11_dabd74bba1f38b326a2d0c86d3027cd9._comment Normal file
View file

@ -0,0 +1,17 @@
[[!comment format=mdwn
username="https://john-millikin.com/"
nickname="John Millikin"
subject="comment 11"
date="2013-07-22T01:52:41Z"
content="""
(I'm the author of the XMPP library git-annex uses)
The biggest issue I can think of with continuing in the absence of a <features> element is authentication. Without <features> the client library is not able to know which SASL mechanisms are supported, so it can't authenticate.
It is possible to modify the XMPP library such that it can work around the problems exibited by this server software (adding a timeout to receipt, hardcoding a fallback SASL list), but I very much do not want to do that because it would almost certainly cause unexpected behavior when used with properly working servers.
According to <a href=\"http://www.mail-archive.com/jdev@jabber.org/msg10598.html\">http://www.mail-archive.com/jdev@jabber.org/msg10598.html</a> , jabberd-1.4.3 was released in 2003. Since its release, there have been multiple severe security issues discovered, including a remote crash (see <a href=\"http://mail.jabber.org/pipermail/jabberd/2004-September/002004.html\">http://mail.jabber.org/pipermail/jabberd/2004-September/002004.html</a> and <a href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1378\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1378</a>).
In my opinion, the best course of action is for Daniel to switch to a different Jabber server software, preferably one that is still actively maintained.
"""]]