The #XMPP community should move away from STARTTLS.
· It's slower than direct TLS.
· It adds complexity and increases the attack surface.
· With SNI & ALPN widely deployed and encryption now mandatory, it no longer serves a purpose.
· It's slower than direct TLS.
· It adds complexity and increases the attack surface.
· With SNI & ALPN widely deployed and encryption now mandatory, it no longer serves a purpose.
𝔻𝕚𝕖𝕘𝕠 🦝🧑🏻💻🍕 likes this.
Markus Brückner
in reply to Daniel Gultsch • • •Inuit
in reply to Daniel Gultsch • • •Hello @daniel
Will all clients automatically connect to direct TLS at port 5223 if I close port 5222 on my server ?
Also for s2s will all servers establish connections at port 5270 if I close 5269 ?
Bhante Subharo
in reply to Daniel Gultsch • • •the two worst "footguns" I encountered when setting up #Prosody 0.12.3 in #Debian 12 were - you're not going to like this - enabling TLS, not STARTTLS (ruins upload.sampledomain.com capability), and trying to use SRV records (made an honest attempt, couldn't get it to fly).
These "footguns" wasted two brutally unenjoyable days of my life, until I scaled back these progressive wishes.
#XMPP