From gdt at ir.bbn.com Tue Aug 21 10:29:30 2007 From: gdt at ir.bbn.com (Greg Troxel) Date: Tue, 21 Aug 2007 10:29:30 -0400 Subject: [Greg Troxel] [OTR-dev] finished converstations a bad UI choice! Message-ID: The scenario I described in the attached message happened again today. Any thoughts? Do people disagree with how I think things should work? Is it just a question of not enough round tuits to implement it? If I send a patch to do behavior 2 below, will it be accepted? I'm on the verge of stopping using OTR. -------------- next part -------------- An embedded message was scrubbed... From: Greg Troxel Subject: [OTR-dev] finished converstations a bad UI choice! Date: no date Size: 2734 URL: From ian at cypherpunks.ca Tue Aug 21 20:45:35 2007 From: ian at cypherpunks.ca (Ian Goldberg) Date: Tue, 21 Aug 2007 20:45:35 -0400 Subject: [Greg Troxel] [OTR-dev] finished converstations a bad UI choice! In-Reply-To: References: Message-ID: <20070822004535.GR15409@yoink.cs.uwaterloo.ca> On Tue, Aug 21, 2007 at 10:29:30AM -0400, Greg Troxel wrote: > The scenario I described in the attached message happened again today. > > Any thoughts? Do people disagree with how I think things should work? > Is it just a question of not enough round tuits to implement it? > If I send a patch to do behavior 2 below, will it be accepted? > > I'm on the verge of stopping using OTR. There's certainly always the tuit problem, and I'm sorry I haven't had a chance to reply sooner. I'm still not totally convinced your solution is strictly better, though. > There are then two cases: > > OTR is enabled, with automatic initiation, but not required) > > Here, we know that OTR recently worked with this peer. So choices > are > > 0) send in clear - dangerous, violates user expectations > 1) fail (current behavior) > 2) try to initiate, and send message if negotatiation is successful > > OTR is enabled, with automatic initiation, and further is required) > > Here, there are two choices > > 0) send in clear - against stated policy, dangerous > 1) fail > 2) try to initiate, and send message if negotatiation is successful > > > In the required case, note that these are the same options as in a "not > private" state. But in "not private", otr-gaim does option 2, which is > useful and what the user expects. In the 'not required' case, option 2 > seems preferred - a savvy user can always 'end private' if that's what > they want. > > I have no objection to "Conversation is in state finished; trying to > initiate private conversation" message. > > I realize this is work to change. But does anyone really think that the > current behavior is useful and reasonable? To me it's gratuitously > difficult when there's a better behavior without security problems. The problem occurs when your buddy ends the private conversation and then logs in again, when they're *not* set to "required". What with the limited set of clients that currently support OTR (more now than when the feature was implemented, admittedly), it's totally possible that your buddy does not in fact support OTR any more. So at best, libotr could send an automatic OTR Query message (which would annoy your buddy if that's indeed the case). If libotr stashed the plaintext in the same way as when you type something in "required" mode, it would in fact get automatically sent if your buddy does support OTR, but something mysterious would probably happen otherwise, that could probably only be detected by a super-ugly timeout or something like that. So it's not so much that there hasn't been a tuit to implement a solution to this problem, but rather that there hasn't been one to spec it, I think. Does that make sense? All that having been said, I'd be totally happy to see someone spec a solution, or better, supply both a spec and then a patch. ;-) Thanks, - Ian From gdt at ir.bbn.com Wed Aug 22 09:37:41 2007 From: gdt at ir.bbn.com (Greg Troxel) Date: Wed, 22 Aug 2007 09:37:41 -0400 Subject: [Greg Troxel] [OTR-dev] finished converstations a bad UI choice! References: <20070822004535.GR15409@yoink.cs.uwaterloo.ca> Message-ID: Ian Goldberg writes: > On Tue, Aug 21, 2007 at 10:29:30AM -0400, Greg Troxel wrote: >> Any thoughts? Do people disagree with how I think things should work? >> Is it just a question of not enough round tuits to implement it? >> If I send a patch to do behavior 2 below, will it be accepted? > > There's certainly always the tuit problem, and I'm sorry I haven't had a > chance to reply sooner. I'm still not totally convinced your solution > is strictly better, though. Thanks for replying. I certainly agree that deciding on the proper behavior is hard; my big point was the current behavior is a problem. > So it's not so much that there hasn't been a tuit to implement a > solution to this problem, but rather that there hasn't been one to spec > it, I think. For discussion, I'll assume that Alice is in state finished and Bob has reappeared. So if Alice has Bob configured to "required", do you agree that Alice's OTR implementation should auto-initiate and send if a message is entered? I don't see any downside to that. (Except for maybe getting fussy about private vs unverified and a downgrade attack there. But that's really not about finished - it's more general and I think should be addressed separately.) > The problem occurs when your buddy ends the private conversation and > then logs in again, when they're *not* set to "required". What with the > limited set of clients that currently support OTR (more now than when > the feature was implemented, admittedly), it's totally possible that > your buddy does not in fact support OTR any more. So at best, > libotr could send an automatic OTR Query message (which would annoy > your buddy if that's indeed the case). I see your point. It's a question of an OTR Query being annoying to Bob (who has just used an OTR client and is now using a non-OTR client, so he kind of deserves the poke :-), vs a baffling failure to Alice (who isn't a cryptographer, and for whom Bob had installed OTR). > If libotr stashed the plaintext in the same way as when you type > something in "required" mode, it would in fact get automatically sent if > your buddy does support OTR, but something mysterious would probably > happen otherwise, that could probably only be detected by a super-ugly > timeout or something like that. While timeouts are ugly, they seem hard to avoid in all cases, and the current behavior has led to failure to communicate in actual user testing. I won't suggest options to configure how to respond, as that seems too hairy. But, I do not understand how these two situations differ client in state not private, OTR required client in state finished, OTR required It seems to me that the issues surrounding save text, initiate, send if successful, are all the same. It seems reasonable to have a timeout of a minute or so and inform the user that negotiation failed - but even without addressing that it seems that the same behavior as not private is appropriate for finished. I wonder if a popup dialog is in order in the non-required case, with choices: try to re-initiate OTR end private conversation (warning: messages will be sent unencrypted) no change (stay in finished and discard message) This seems hard, but the fundamental underlying issues really are hard. > If libotr stashed the plaintext in the same way as when you type > something in "required" mode, it would in fact get automatically sent if > your buddy does support OTR, but something mysterious would probably > happen otherwise, that could probably only be detected by a super-ugly > timeout or something like that. For the required case, do you agree that treating it like not private (save message, initiate, send) is appropriate? That's the case that's causing me grief. > Does that make sense? All that having been said, I'd be totally happy > to see someone spec a solution, or better, supply both a spec and then a > patch. ;-) Yes, makes sense - thanks for spending the time to think about this. From michael.meier at mmsources.de Wed Aug 29 16:32:06 2007 From: michael.meier at mmsources.de (Michael Meier) Date: Wed, 29 Aug 2007 22:32:06 +0200 Subject: [OTR-dev] German translation for pidgin-otr Message-ID: <46D5D7C6.1060903@mmsources.de> Hello, i've created a translation of pidgin-otr in my native language. I hope it meets your requirements. I have also subscribed to this list and would like to continue maintaining the german translation for future releases. Regards, Michael -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: de.po URL: From ian at cypherpunks.ca Wed Aug 29 17:50:30 2007 From: ian at cypherpunks.ca (Ian Goldberg) Date: Wed, 29 Aug 2007 17:50:30 -0400 Subject: [OTR-dev] German translation for pidgin-otr In-Reply-To: <46D5D7C6.1060903@mmsources.de> References: <46D5D7C6.1060903@mmsources.de> Message-ID: <20070829215030.GV15409@yoink.cs.uwaterloo.ca> On Wed, Aug 29, 2007 at 10:32:06PM +0200, Michael Meier wrote: > Hello, > > i've created a translation of pidgin-otr in my native language. I hope > it meets your requirements. > I have also subscribed to this list and would like to continue > maintaining the german translation for future releases. Cool, thanks! I'm about to go away for the long weekend, but I'll take a closer look when I get back. - Ian From cactusthesaint at yahoo.com Wed Aug 29 18:16:18 2007 From: cactusthesaint at yahoo.com (Cactus The Saint) Date: Wed, 29 Aug 2007 15:16:18 -0700 (PDT) Subject: [OTR-dev] Slovene translation for pidgin-otr Message-ID: <910558.26176.qm@web55209.mail.re4.yahoo.com> Hello, I made, er, begged my wife to make a Slovene translation of pidgin-otr; it's her native language. She worked off the Slovak translation from not too long ago. Hopefully it meets the requirements. I have also attached the translation as a utf-8 formatted file, as I have no confidence that yahoo mail won't butcher this email. In other news, there's a kopete otr plugin at http://kopete-otr.follefuder.org/, but I don't see that url on http://www.cypherpunks.ca/otr/ I have no affiliation with that plugin, but I asked a friend who uses Ubuntu to install it and it seems to work, so perhaps it deserves consideration for inclusion on the OTR page. Regards, Derek ----- #: ../gtk-dialog.c:913 ../gtk-dialog.c:2095 msgid "_What's this?" msgstr "_Kaj je to?" #: ../gtk-dialog.c:924 msgid "_More..." msgstr "_Ve?..." #. Create the Advanced... button, and left-justify it. This #. * involves adding the button, and a blank label as a spacer, and #. * reordering them so that they're at the beginning. #: ../gtk-dialog.c:980 msgid "Advanced..." msgstr "Podrobno..." #: ../gtk-dialog.c:1025 msgid "Enter secret here" msgstr "Vnesi geslo tukaj" #: ../gtk-dialog.c:1030 msgid "This buddy is already authenticated." msgstr "Ta kolega je ?e potrjen." #: ../gtk-dialog.c:1049 msgid "" "To authenticate, pick a secret known only to you and your buddy. Enter this " "secret, then wait for your buddy to enter it too. If the secrets don't " "match, then you may be talking to an imposter." msgstr "" "Za potrditev izberite geslo, ki ga poznate le vi in vas kolega. Vnesite to " "geslo, nato po?akajte, da ga vnese tudi vas kolega. ?e se geslo ne " "ujema, morda govorite z vsiljivcem." #: ../gtk-dialog.c:1053 msgid "" "If your buddy uses multiple IM accounts or multiple computers, you may have " "to authenticate multiple times. However, as long as they use an account and " "computer that you've seen before, you don't need to authenticate each " "individual conversation." msgstr "" "?e vas kolega uporablja razli?ne racunalnike, boste morda morali " "potrditi ve?krat. ?e uporablja predal in " "ra?unalnik, ki ga ?e poznate, ni potrebno potrjevati vsakega" "posameznega klepeta." #: ../gtk-dialog.c:1058 ../gtk-dialog.c:1322 ../gtk-dialog.c:1326 #: ../gtk-dialog.c:1423 ../gtk-dialog.c:1590 ../gtk-dialog.c:1750 #: ../gtk-dialog.c:1850 ../gtk-dialog.c:1935 msgid "?lang=en" msgstr "?lang=slo" #: ../gtk-dialog.c:1059 msgid "Click here for more information about authentication in OTR." msgstr "Kliknite tukaj za ve? podatkov o potrditvi v OTR." #: ../gtk-dialog.c:1063 msgid "" "Authenticating a buddy helps ensure that the person you are talking to is " "who they claim to be." msgstr "" "Potrditev kolega zagotavlja, da je oseba, s katero govorite, resni?no ta, " "za katero se izdaja." #: ../gtk-dialog.c:1113 msgid "Authenticating Buddy" msgstr "Potrjujem kolega." #: ../gtk-dialog.c:1140 msgid "Authenticating" msgstr "Potrjujem" #: ../gtk-dialog.c:1201 msgid "Generating private key" msgstr "Izdelujem osebni klju?" #: ../gtk-dialog.c:1202 msgid "Please wait" msgstr "Prosim po?akajte" #: ../gtk-dialog.c:1210 ../gtk-dialog.c:1627 ../gtk-dialog.c:1664 #: ../gtk-ui.c:175 ../otr-plugin.c:115 ../otr-plugin.c:212 ../ui.c:110 msgid "Unknown" msgstr "Neznan" #. Create the Please Wait... dialog #: ../gtk-dialog.c:1213 #, c-format msgid "Generating private key for %s (%s)..." msgstr "Izdelujem osebni klju? za %s (%s)..." #: ../gtk-dialog.c:1258 #, c-format msgid "%s Done." msgstr "%s Kon?ano." #: ../gtk-dialog.c:1320 #, c-format msgid "" "%s is contacting you from an unrecognized computer. You should > I have also attached the translation as a utf-8 formatted file Derek's a big fat liar, news at 11. ____________________________________________________________________________________ Choose the right car based on your needs. Check out Yahoo! Autos new Car Finder tool. http://autos.yahoo.com/carfinder/ -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: pidgin-slovene-utf8.txt URL: From tommy.b at gmx.net Fri Aug 31 15:50:23 2007 From: tommy.b at gmx.net (Thomas B.) Date: Fri, 31 Aug 2007 21:50:23 +0200 Subject: [OTR-dev] German translation for pidgin-otr In-Reply-To: <46D5D7C6.1060903@mmsources.de> References: <46D5D7C6.1060903@mmsources.de> Message-ID: <20070831195023.GA23975@tommy> On Wed, Aug 29, 2007 at 10:32:06PM +0200, Michael Meier wrote: > Hello, > > i've created a translation of pidgin-otr in my native language. I hope > it meets your requirements. > I have also subscribed to this list and would like to continue > maintaining the german translation for future releases. Cool! I can confirm that the language file works and that the translations make sense to me as a German ;-) Regards, Thomas