XEP-0156: Discovering Alternative XMPP Connection Methods
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Webrtc and XMPP
webRTC and XMPP Philipp Hancke, XMPP Summit 2013 What is this webRTC thing … …and why should XMPP developers care? . I assume you know what XMPP is… . … you might have heard of Jingle . the XMPP framework for establishing P2P sessions . used for VoIP, filesharing, … . … you might have also heard about this webRTC thing . doing VoIP in the browser . without plugins . „no more flash“ . Do you want to know how it relates to XMPP ? Philipp Hancke © ESTOS GmbH 2013 2 What is webRTC? . P2P sessions between browsers . no servers involved in media transfer . using open standards . Javascript API in the browser . also an BSD-licensed C++ library from Google . Want to know more? . Listen to the evangelists! . Justin Uberti http://www.youtube.com/watch?v=E8C8ouiXHHk . Jose de Castro http://vimeo.com/52510068 . Cullen Jennings http://vimeo.com/cullenfluffyjennings/rtcwebexplained Philipp Hancke © ESTOS GmbH 2013 3 Initiating P2P sessions . initiate a P2P session between two browsers . negotiate media codecs, NAT traversal, etc . media is sent P2P . you need a session initiation protocol . SIP? . JSEP? . H.323? . Jingle! . webRTC does not mandate a signalling protocol . WG decision Philipp Hancke © ESTOS GmbH 2013 4 Call Flow - JSEP Philipp Hancke © ESTOS GmbH 2013 5 Jingle . You can use Jingle as signalling protocol . together with BOSH or XMPP over websockets in the browser . Demo later . But… . webRTC uses the Session Description Protocol as an API . Jingle does not use SDP . You need a mapping SDP -> Jingle -> SDP . Complicated, but doable . Topic for breakout Philipp Hancke © ESTOS GmbH 2013 6 Call Flow - Jingle Philipp Hancke © ESTOS GmbH 2013 7 webRTC-Jingle usecases . -
SDM 7.61 Open Source and Third-Party Licenses
Structured Data Manager Software Version 7.61 Open Source and Third-party Licenses Document Release Date: February 2019 Software Release Date: February 2019 Open Source and Third-party Licenses Legal notices Copyright notice © Copyright 2017-2019 Micro Focus or one of its affiliates. The only warranties for products and services of Micro Focus and its affiliates and licensors (“Micro Focus”) are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Micro Focus shall not be liable for technical or editorial errors or omissions contained herein. The information contained herein is subject to change without notice. Adobe™ is a trademark of Adobe Systems Incorporated. Microsoft® and Windows® are U.S. registered trademarks of Microsoft Corporation. UNIX® is a registered trademark of The Open Group. This product includes an interface of the 'zlib' general purpose compression library, which is Copyright © 1995-2002 Jean-loup Gailly and Mark Adler. Documentation updates The title page of this document contains the following identifying information: l Software Version number, which indicates the software version. l Document Release Date, which changes each time the document is updated. l Software Release Date, which indicates the release date of this version of the software. You can check for more recent versions of a document through the MySupport portal. Many areas of the portal, including the one for documentation, require you to sign in with a Software Passport. If you need a Passport, you can create one when prompted to sign in. Additionally, if you subscribe to the appropriate product support service, you will receive new or updated editions of documentation. -
The Elinks Manual the Elinks Manual Table of Contents Preface
The ELinks Manual The ELinks Manual Table of Contents Preface.......................................................................................................................................................ix 1. Getting ELinks up and running...........................................................................................................1 1.1. Building and Installing ELinks...................................................................................................1 1.2. Requirements..............................................................................................................................1 1.3. Recommended Libraries and Programs......................................................................................1 1.4. Further reading............................................................................................................................2 1.5. Tips to obtain a very small static elinks binary...........................................................................2 1.6. ECMAScript support?!...............................................................................................................4 1.6.1. Ok, so how to get the ECMAScript support working?...................................................4 1.6.2. The ECMAScript support is buggy! Shall I blame Mozilla people?..............................6 1.6.3. Now, I would still like NJS or a new JS engine from scratch. .....................................6 1.7. Feature configuration file (features.conf).............................................................................7 -
Cheat Sheet – Common Ports (PDF)
COMMON PORTS packetlife.net TCP/UDP Port Numbers 7 Echo 554 RTSP 2745 Bagle.H 6891-6901 Windows Live 19 Chargen 546-547 DHCPv6 2967 Symantec AV 6970 Quicktime 20-21 FTP 560 rmonitor 3050 Interbase DB 7212 GhostSurf 22 SSH/SCP 563 NNTP over SSL 3074 XBOX Live 7648-7649 CU-SeeMe 23 Telnet 587 SMTP 3124 HTTP Proxy 8000 Internet Radio 25 SMTP 591 FileMaker 3127 MyDoom 8080 HTTP Proxy 42 WINS Replication 593 Microsoft DCOM 3128 HTTP Proxy 8086-8087 Kaspersky AV 43 WHOIS 631 Internet Printing 3222 GLBP 8118 Privoxy 49 TACACS 636 LDAP over SSL 3260 iSCSI Target 8200 VMware Server 53 DNS 639 MSDP (PIM) 3306 MySQL 8500 Adobe ColdFusion 67-68 DHCP/BOOTP 646 LDP (MPLS) 3389 Terminal Server 8767 TeamSpeak 69 TFTP 691 MS Exchange 3689 iTunes 8866 Bagle.B 70 Gopher 860 iSCSI 3690 Subversion 9100 HP JetDirect 79 Finger 873 rsync 3724 World of Warcraft 9101-9103 Bacula 80 HTTP 902 VMware Server 3784-3785 Ventrilo 9119 MXit 88 Kerberos 989-990 FTP over SSL 4333 mSQL 9800 WebDAV 102 MS Exchange 993 IMAP4 over SSL 4444 Blaster 9898 Dabber 110 POP3 995 POP3 over SSL 4664 Google Desktop 9988 Rbot/Spybot 113 Ident 1025 Microsoft RPC 4672 eMule 9999 Urchin 119 NNTP (Usenet) 1026-1029 Windows Messenger 4899 Radmin 10000 Webmin 123 NTP 1080 SOCKS Proxy 5000 UPnP 10000 BackupExec 135 Microsoft RPC 1080 MyDoom 5001 Slingbox 10113-10116 NetIQ 137-139 NetBIOS 1194 OpenVPN 5001 iperf 11371 OpenPGP 143 IMAP4 1214 Kazaa 5004-5005 RTP 12035-12036 Second Life 161-162 SNMP 1241 Nessus 5050 Yahoo! Messenger 12345 NetBus 177 XDMCP 1311 Dell OpenManage 5060 SIP 13720-13721 -
XEP-0347: Internet of Things - Discovery
XEP-0347: Internet of Things - Discovery Peter Waher mailto:peterwaher@hotmail:com xmpp:peter:waher@jabber:org http://www:linkedin:com/in/peterwaher Ronny Klauck mailto:rklauck@informatik:tu-cottbus:de xmpp:TBD http://www-rnks:informatik:tu-cottbus:de/~rklauck 2018-11-03 Version 0.5.1 Status Type Short Name Deferred Standards Track iot-discovery This specification describes an architecture based on the XMPP protocol whereby Things can be in- stalled and safely discovered by their owners and connected into networks of Things. Legal Copyright This XMPP Extension Protocol is copyright © 1999 – 2020 by the XMPP Standards Foundation (XSF). Permissions Permission is hereby granted, free of charge, to any person obtaining a copy of this specification (the ”Specification”), to make use of the Specification without restriction, including without limitation the rights to implement the Specification in a software program, deploy the Specification in a network service, and copy, modify, merge, publish, translate, distribute, sublicense, or sell copies of the Specifi- cation, and to permit persons to whom the Specification is furnished to do so, subject to the condition that the foregoing copyright notice and this permission notice shall be included in all copies or sub- stantial portions of the Specification. Unless separate permission is granted, modified works that are redistributed shall not contain misleading information regarding the authors, title, number, or pub- lisher of the Specification, and shall not claim endorsement of the modified works by the authors, any organization or project to which the authors belong, or the XMPP Standards Foundation. Warranty ## NOTE WELL: This Specification is provided on an ”AS IS” BASIS, WITHOUT WARRANTIES OR CONDI- TIONS OF ANY KIND, express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. -
Instant Messaging
Instant Messaging Internet Technologies and Applications Contents • Instant Messaging and Presence • Comparing popular IM systems – Microsoft MSN – AOL Instant Messenger – Yahoo! Messenger • Jabber, XMPP and Google Talk ITS 413 - Instant Messaging 2 Internet Messaging •Email – Asynchronous communication: user does not have to be online for message to be delivered (not instant messaging) • Newsgroups • Instant Messaging and Presence – UNIX included finger and talk • Finger: determine the presence (or status) of other users • Talk: text based instant chatting application – Internet Relay Chat (IRC) • Introduced in 1988 as group based, instant chatting service • Users join a chat room • Networks consist of servers connected together, and clients connect via a single server – ICQ (“I Seek You”) • Introduced in 1996, allowing chatting between users without joining chat room • In 1998 America Online (AOL) acquired ICQ and became most popular instant messaging application/network – AIM, Microsoft MSN, Yahoo! Messenger, Jabber, … • Initially, Microsoft and Yahoo! Created clients to connect with AIM servers • But restricted by AOL, and most IM networks were limited to specific clients • Only recently (1-2 years) have some IM networks opened to different clients ITS 413 - Instant Messaging 3 Instant Messaging and Presence • Instant Messaging – Synchronous communications: message is only sent to destination if recipient is willing to receive it at time it is sent •Presence – Provides information about the current status/presence of a user to other -
URI Use and Abuse Contributing Authors
URI Use and Abuse Contributing Authors • Nathan McFeters – Senior Security Analyst – Ernst & Young Advanced Security Center, Chicago • Billy Kim Rios – Senior Researcher – Microsoft, Seattle • Rob Carter – Security Analyst – Ernst & Young Advanced Security Center, Houston URIs – An Overview • Generic – http://, ftp://, telnet://, etc. • What else is registered? – aim://, firefoxurl://, picasa://, itms://, etc. URIs – Interaction With Browsers • Developers create URI hooks in the registry for their applications • Once registered they can be accessed and interacted with through the browser • XSS can play too! URI Discovery – Where and What? • RFC 4395 defines an IANA-maintained registry of URI Schemes • W3C maintains *retired* schemes • AHA! The registry! Enter DUH! DUH Tool – Sample Output Attacking URIs – Attack Scope • URIs link to applications • Applications are vulnerable to code flaws and functionality abuse • URIs can be accessed by XSS exposures Stack Overflow in Trillian’s aim.dll Through the aim:// URI • The aim:// URI is associated with the command ‘Rundll32.exe “C:\Program Files\Trillian\plugins\aim.dll”, aim_util_urlHandler url=”%1” ini="c:\program files\trillian\users \default\cache\pending_aim.ini”’. Stack Overflow in Trillian’s aim.dll Through the aim:// URI • Attacker controls the value that is put into aim_util_urlHandler through the URI, such as aim://MyURL. • Value is copied without bounds checking leading to a stack overflow Stack Overflow in Trillian’s aim.dll Through the aim:// URI Example: • aim:///#1111111/11111111111111111111111111111111111 -
A Survey of DNSSEC Deployment in the US R&E Community
A survey of DNSSEC deployment in the U.S. R&E community Shumon Huque; University of Pennsylvania Bill Owens; NySERNET Joint Techs Conference, Stanford University, July 16th 2012 http://events.internet2.edu/2012/jt-stanford/ 1 Abstract: DNSSEC (DNS Security Extensions) is a system to verify the authenticity of DNS data using public key signatures. Although a small number of institutions in the R&E community have been at the forefront of DNSSEC deployment, the adoption rate in the larger community is still quite low. This talk will present some results of an ongoing project to survey the status of DNSSEC deployment in the US Research & Education and a few other communities. It also surveys the status of several other DNS capabilities, such as availability of the service over IPv6 transport, TCP transport, EDNS0 support, etc. [Joint Techs, Stanford University, Jul 2012] 2 Agenda • DNSSEC deployment monitoring project overview • Live demo of the website • New uses of DNSSEC by applications (DANE/TLSA etc) • (time permitting) [Joint Techs, Stanford University, Jul 2012] 3 DNSSEC at a glance • “DNS Security Extensions” • A system to verify the authenticity of DNS “data” using public key signatures • Specs: RFC 4033, 4034, 4035, 5155 (and more) • Helps detect DNS spoofing, misdirection, cache poisoning .. • Additional benefits: • Ability to store and use cryptographic keying material in the DNS, eg. SSHFP, IPSECKEY, CERT, DKIM, TLSA, etc .. [Joint Techs, Stanford University, Jul 2012] 4 Other surveys • SecSpider • http://secspider.cs.ucla.edu/ -
DMARC Jesse Thompson, Technical Architect University of Wisconsin-Madison [email protected] Motivation → Authenticity
Email Authenticity with DMARC Jesse Thompson, Technical Architect University of Wisconsin-Madison [email protected] Motivation → Authenticity ● Mail your institution sends isn’t accounted for ● Mail claiming to be your domain may be fraud ● Instead of filtering the bad...we start authenticating the good? Functional Motivators for Email Authenticity 1. Deliverability: Google/MS/etc starting to require 2. Policies: DHS Binding Operational Directive 18-01 3. Security: Stop abuse Build on SPF SPF = Sender Policy Framework Publish in DNS a list of servers authorized for MAIL FROM (SMTP envelope return path). Receivers consult list. https://tools.wordtothewise.com/spf/check/wisc.edu wisc.edu. 3600 IN TXT "v=spf1 ip4:144.92.197.128/25 ?all" Build on DKIM DKIM = Domain Keys Identified Mail Attach signatures to email. Public key in DNS. Receivers verify signature. https://tools.wordtothewise.com/dkim/check/wisc.edu/selector1 DKIM-Signature: v=1; a=rsa-sha256; d=wisc.edu; s=selector1; c=relaxed/relaxed; q=dns/txt; t=1126524832; x=1149015927; h=from:to:subject:date:keywords:keywords; bh=MHIzKDU2Nzf3MDEyNzR1Njc5OTAyMjM0MUY3ODlqBLP=; b=hyjCnOfAKDdLZdKIc9G1q7LoDWlEniSbzc+yuU2zGrtruF00ldcF VoG4WTHNiYwG Build on SPF and DKIM SPF Problems: ○ Users can’t see MAIL FROM / no alignment to Header From domain ○ Forwarding / mailing lists ○ DNS lookup limit of 10 ○ Inconsistent enforcement by receivers DKIM Problems: ○ Users can’t see key selector / no alignment to Header From domain ○ Message modification in transit / mailing lists ○ Key management / vendor support Protagonist → Header From domain Need to create a link between the domain and the message. dmarc.org What is DMARC? Domain-based Message Authentication Reporting and Conformance 1. -
Difference Between Url and Uri with Example
Difference Between Url And Uri With Example lixiviatesUnchronicled that gobo.Wyndham Tiptop taints pluvious, her marmalades Amery gallop so man-hourpenetratingly and that redresses Angel laggedMiletus. very scrutinizingly. Richie still yeast supply while pinacoidal Gabriel This url with urls and examples would there any. Tells you with. Perfect examples of such acronyms are URIs and URLs In this article will'll try that look at how subtle differences between URIs and URLs. Uri with urls and stands for a difference between a virtualized url provides their street address or conceptual and additional time, and sets the differences. Uri is a symbolic name for boys born on Hanukkah. Uri examples would need to difference between url shows example. URI The prison of certain system Top. Personalisierungsfirma Ezoic verwendet, um Weiterleitungen zu verfolgen. How to copy a web page link or URL. URLs and fragment identifiers. Universal Resource Identifiers are specified in the Internet Engineering Task. As urls and examples and paste text has confirmed. Urn and uris to differences between a resource is an example of the prime minister offers us. If html does not have either class, do not show lazy loaded images. Resources are between url uri and with example. It different uris? It different uris and urls below to difference between them, but a uri? Resolves to an url from cbt nuggets uses cookies de votre consentement soumis ne peut être un esempio di questo trattamento dei nostri partner possono trattare i this. Base Domain URL vs Full Path URL What's the Difference. Uris differ by the url is the web servers what is a web utiliza cookies sind cookies de tracker le temps que vous recevez une expérience. -
Is Bob Sending Mixed Signals?
Is Bob Sending Mixed Signals? Michael Schliep Ian Kariniemi Nicholas Hopper University of Minnesota University of Minnesota University of Minnesota [email protected] [email protected] [email protected] ABSTRACT Demand for end-to-end secure messaging has been growing rapidly and companies have responded by releasing applications that imple- ment end-to-end secure messaging protocols. Signal and protocols based on Signal dominate the secure messaging applications. In this work we analyze conversational security properties provided by the Signal Android application against a variety of real world ad- versaries. We identify vulnerabilities that allow the Signal server to learn the contents of attachments, undetectably re-order and drop messages, and add and drop participants from group conversations. We then perform proof-of-concept attacks against the application to demonstrate the practicality of these vulnerabilities, and suggest mitigations that can detect our attacks. The main conclusion of our work is that we need to consider more than confidentiality and integrity of messages when designing future protocols. We also stress that protocols must protect against compromised servers and at a minimum implement a trust but verify model. 1 INTRODUCTION (a) Alice’s view of the conversa-(b) Bob’s view of the conversa- Recently many software developers and companies have been inte- tion. tion. grating end-to-end encrypted messaging protocols into their chat applications. Some applications implement a proprietary protocol, Figure 1: Speaker inconsistency in a conversation. such as Apple iMessage [1]; others, such as Cryptocat [7], imple- ment XMPP OMEMO [17]; but most implement the Signal protocol or a protocol based on Signal, including Open Whisper Systems’ caching. -
How the Internet Works: DNS Activity Unit 3
(http://csmatters.org) 3 - 5 0b11 - 0b101 How the Internet Works: DNS Activity Unit 3. Information and the Internet Revision Date: Jan 04, 2020 Duration: 2 50-minute sessions Lesson Summary Pre-lesson Preparation This lesson will require some room setup or prep for best delivery of instruction. Some of the setup should have been done in the previous lesson. Summary In this lesson, students will expand their knowledge of how the Domain Name System (DNS) works by acting as a class to simulate the use of DNS to retrieve web pages. Once the simulation is functioning students enhance its efficiency through the use of caching. Poison the DNS cache by adding false DNS replies (DNS poisoning). Students discuss with their groups how DNS works and how it supports Internet growth. Then they explain in their journals how: DNS works Caching is both a benefit and a security risk. DNS supports Internet growth. In this lesson, students will expand their knowledge of how DNS works by acting out a simulation of DNS in action and using it to retrieve web pages. This is a two-session lesson. The first session is for students to get the simulation functioning, with the teacher serving as director. As students realize they need to "fix" their implementation of the simulation (modify their scripts), they record the insights in their journals. In Session Two, students take on different roles and conduct a dress rehearsal that is entirely student-led. Teachers then introduce DNS caching and DNS poisoning. Once the simulation is functioning, students will address both increased efficiency due to DNS caching, and cybersecurity concerns associated with DNS.