Hello users!

If you were online 7/21/17 you should have received an announcement via XMPP about the new domains that were being added.

As of a couple days ago I’m happy to say they’ve been setup for public use and you can register an account on any of them you’d like. If someone has taken a cool username on say, @xmpp.is you could just register it on @xmpp.co, @xmpp.cx & @xmpp.xyz vice versa. All of the domains support DNSSEC and the same security practices have been applied (no logs kept, full disk encryption, PFS supported & TLS required). All requests go to the same server specifically so communicating between these domains is even more secure. If you’re interested in grabbing an account go to the register page!

I’d also like to mention that the site and XMPP server (Prosody) now entirely use Let’s Encrypt. In the past I wasn’t able to automate the renewal of certificates because Prosody would have to be restarted every time the cert was renewed (every 3 months). To minimize downtime I found that you could just reload the Prosody TLS module when reloading the service using mod_reload_modules. This seemed to work flawlessly in tests. Along with this, a systemd service for renewals and my new script, all certs are now provided by Let’s Encrypt!

Hello users!

I’d just like to thank everyone who donated via PayPal & Bitcoin recently. We have finally hit our donation goal of $40 (PayPal) and I received a generous $20 Bitcoin donation last week. I’ll be increasing the goal every time it is hit from now on. This will help us properly keep track of the amount of PayPal donations we receive. I’m planning to use the money to buy new domains for XMPP.is, that people will be able to use primarily for XMPP accounts. If you have any ideas for a domain, let me know! I already own the domain “xmpp.co” but looking to acquire others, even buy them from others if needed.

In other news… I have since disabled the Prosody throttle_presence module because it was very buggy and generating a massive amount of error logs. I’ve also added a few more donations methods including Ethereum, Litecoin and Auroracoin which you can find at xmpp.is/donate.

Hello users!

I sent out a notification to all online users yesterday informing of an emergency Prosody restart due to an attack. Don’t worry though, it doesn’t affect the security of the server itself! It seems the goal was to exhaust resources (CPU/Memory/Storage). I’ve implemented some counter-measures to prevent this from causing the server’s load to spike as high as it did. As of yesterday mod_limits has been enabled. This should prevent any single connection whether C2S or S2S from hogging up system resources. I’ve also witnessed attacks that spam offline users with messages going up to 20GB in some cases. XMPP.is stores offline messages and there was no limit set before I noticed. I’ve setup a cron job to find and delete offline messages (every minute) above a certain file size to prevent some malicious spammer from filling up the entire disk.

This attack didn’t really do all that much though… It brought down the registration page a few times but everything else stayed up.

Full attack traffic (48 hours):

CPU usage (48 hours):

Hello users!

XEP-0352 has been implemented as of now via the following Prosody modules.

• mod_csi
• mod_throttle_presence
• mod_filter_chatstates

These will help save battery and data for mobile users. For further details please see the module’s description.

Happy chatting!

Hello users!

Support has been added to XMPP.is for the following XEPs.

• XEP-0198: Stream Management (mod_smacks)
• XEP-0280: Message Carbons (mod_carbons)
• XEP-0363: HTTP File Upload (mod_http_upload)

Other Changes During Maintenance:

• Added anti-bruteforce module (mod_limit_auth)
• Prevented MUC room info from disappearing (I think)
• Upgraded to Debian 8.8
• Updated configs on transparency page