[Ach] Config for Prosody XMPP server

[Matthew Wild]

Hi Chris,

On 27 April 2014 12:44,  <chris at debilux.org> wrote:
> Hi,
>
> I'm using prosody for serving xmpp and now have a working config that I want to be discussed, tested and included in the guide.

I'm a Prosody developer, and I've been following the ACH project for
some time. I think it's an excellent initiative.

However I have so far refrained from contributing a section for
Prosody. As a software project, I see it as our responsibility to
deliver software with secure defaults out of the box. I see cases all
the time where people have blindly copied settings from online forums
and tutorials, and have no idea what they mean - often they can end up
less secure than the defaults.

Therefore our approach is to provide the most secure defaults we can
without affecting interoperability too much. Then we provide clear
documentation on which settings users might want to tweak themselves.

One big issue for us is that when people set their own cipher strings
they are permanently overriding, not complementing, our
carefully-chosen defaults. This means that if we provide a new release
with updated defaults, they will not benefit from this. Server admins
are busy people. 95% of them are going to follow some guide once, set
their cipher string, and then forget all about it. This is actually
harmful in the long run - as we all know security is an ever-changing
field.

Most importantly, if there are problems with our defaults or our
documentation, we'd like knowledgeable people to report bugs and let
us know, instead of telling people to override them.

Obviously some people do know what they are doing, and do want or need
to specify their own settings. I fully support this, make no mistake.
I simply think that if the majority of people need to do extra work to
have a secure setup, we are doing something very very wrong.

My 2p :)

Regards,
Matthew