[OTR-dev] Irssi and OTR

[Alexander Færøy]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hello,

TL;DR: We would like to move Irssi-OTR into Irssi itself, this is a call for
testers of a very early version of Irssi that ships with OTR.

Last year, we began talking about integrating the external OTR plug-in for
Irssi into Irssi itself, such that it will be part of our ordinary release
cycle, bugs will be tracked in Irssi's official bug tracker and it would be
considered a first class citizen when it comes to developer support.

This email is a slightly chaotic initial call for testers. I've uploaded a
tarball containing Irssi with OTR support included (and my TLS patches)
applied. A signed, compressed, tarball can be downloaded from here:

http://hapy.0x90.dk/~ahf/irssi/otr%2btls/

I have written some notes below about what I have changed from the Irssi-OTR
plug-in and which issues that I am fully aware of already - there should be no
doubt that this is a very early release, but testing is much needed for the
plot to get OTR into Irssi itself to succeed.

The tarball is signed using my personal PGP key (0xF9BC2FE22B08CE8F) and not
the official Irssi staff key.

# Changes to the Original Irssi-OTR Plug-in

* Instead of generating the key with the identifier `$nickname@$server` it is
  now `$nickname@$network` (`ahf at efnet.port80.se` vs. `ahf at EFnet`). This should
  cause less trouble for people using multiple servers with round-robin.

  I am still not fully convinced that I am happy with this. At FOSDEM we
  shortly discussed changing this so you that you would have an OTR key per
  client instance, but this would be troublesome for people using Irssi for
  both IRC, XMPP and Bitlbee and want to continue having just one client
  running at the same time. We need a way to specify a default key and a way of
  allowing you to override the default key per network.

* Use `fork()` for key generation rather than a pthread and communicate with
  the child using the Irssi's event loop.

* Use the command line API from Irssi. This means that tab completion of the
  `/otr` command now works.

* Use Irssi's theme API for all UI strings. This will allow theme authors to
  change the colors and text strings used for various UI notifications within
  the OTR component of the client.

* Support "static compilation" of the plug-in. This means that we do not create
  a shared object in your Irssi module directory, but instead the OTR plug-in
  will be embedded in your `irssi` binary (like a lot of people does with the
  Perl plug-in).

The patches included in the tarball is a merge of [1] and [2]. I have included
the TLS branch because I believe that it might have interest for the same kind
of people that is willing to test out an experimental merge of Irssi OTR. The
TLS branch includes more verbose TLS information upon `/connect` and `/server`
and x509 SHA-256 certificate pinning (public key pinning will be included in a
later version of the branch as well).

# Building Irssi with OTR enabled

1. Download the compressed tarball from the above URL.
2. Verify the signature with GnuPG.
3. Uncompress the tarball.
4. Run: `./configure --with-otr=yes` (and all the other options that you enjoy).
5. Run: `make` followed by `make install`.
6. Run: `irssi` and check that the `/otr` command is available.

You can enable OTR debug messages in your status window using `/otr debug`.

# Known Issues

Known issues that needs to be fixed before this can enter an Irssi release
includes:

* When someone initiates an OTR conversation with you, Irssi will not
  automatically create a new chat window with the person and thus output OTR
  session information in the status window

* We are still not locking the input bar while the OTR session is being
  established - any messages written between an `/otr init` and the "Session
  secured" line will be send as an ordinary cleartext IRC message.

* We have not resurrected the policy system that many people have requested
  from an older release of irssi-otr.

* The various UI strings for OTR could be more colorful and fancy - if people
  come up with better theme strings, please let me know.

# Reporting Issues

If you discover any issues, please let me know. I can be contacted via IRC,
where I go by the nickname ahf (in #otr), on email at ahf at 0x90.dk (PGP:
0xF9BC2FE22B08CE8F) or Jabber at ahfaeroey at jabber.ccc.de (OTR: C84CA45A
9DB54679 7849A0D1 699D5412 912EF652).

Please help me testing this if you want OTR to become part of Irssi itself and
not as an external plug-in :-)

Hopefully our combined efforts will make OTR more available on IRC.

Cheers,
Alex.

[1]: https://github.com/irssi/irssi/tree/ahf/otr
[2]: https://github.com/irssi/irssi/tree/ahf/tls

-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJXHq7DAAoJEPm8L+IrCM6Pas0P/1Y0JQivJikIDDQ03faKHnqI
Nii3KGLKd03KPOL4qVwFDLo7BK8Ee7d9kc7P+5lHndsxVt7N/b7YteXMaVwm4Pv8
gCpIewvMXdfX4fbGvVjf+Ee4aWTktTb4VXL0urElqSCjpGV4mrdpacSdZee/jAx9
LVS4dJV/eAvD9VM4Xfhls/QYWqEh7MLJYjRXGSHxEKJgyPEJO2+zCjkl0UTgUBJy
MTH+YwEDNLPiaApNThtTykiV8A28Q8h+e6NZI5cS+jFrC1ez4e1JTzhOFtMy+Iww
c9CFgCfPCJXCp7l71wStL8TOykeug1FZ4Ccypg+02TmlcE6/OwZCI1qedefICX98
8mtTKudoV+rK1aTt0p8UUkUAsiVghM6PMlYgHb4dkGG9BRzoaEhHw5T7LDvj5FG8
ac2REZ1dA4e9Is7g/m0DQ6qVT7iijS4Trllsn1w2+gssJ5rv6zbJCnwXrUsSjvwu
9zdXw1SfXc1UG+JKqmcTAfe2LQHDT2FwgqdzpcC5MD9HcjM+0Ju/hkI9u9o1Chuw
BVHoMKfr0rtieHZQzicBKca3KGmMbA4sm50jdlSwm5wLLlddp00wlyOxpbEqg/CD
5xrV9F3/21yFIl8E7MBpO4luTnHtzVS49iNBbgCP/A5mubjySZUWmWxZnKqAPSJk
JNAgzc2IEeQf7IacSX0X
=XSVK
-----END PGP SIGNATURE-----

-- 
Alexander Færøy