TLS certificate verification policy?

Hi all, I'm the current maintainer of GNU social (formerly StatusNet).

I figured I'll try to install Diaspora to work out some kinks that are
making it hard for Diaspora and GNU social to federate, despite very
similar protocols in use.

During my installation I found that Diaspora by default requires CA
validation on HTTPS connections. This requires everyone running Diaspora
to purchase (or trust StartSSL not to start charging) a TLS certificate
- and I guess we all know what a fishy and awful business that is. Sites
are not able to use self-signed certificates or even CAs like CAcert.org.

Relatedly, the XMPP community has recently decided to use a baseline of
required TLS encryption but _not_ required CA verification. (sidenote:
this leaves out the already doomed Google Talk from wide XMPP federation
since Google won't enable server-to-server TLS).

Diaspora has a reason not to immediately change their default
configuration, since they _hotlink_ a lot of data such as remote users'
avatars etc. This would cause many problems for today's web browsers
since they are following their own CA root certificate databases, giving
out errors for anything "unverified". (GNU social caches everything
locally and publishes from the user's already trusted server)


Either way, this got me thinking on whether TLS enforcement of any kind
is within the scope of this working group when working out a protocol
and deciding on security models.

Unfortunately, WebFinger (RFC7033) was standardised with enforced HTTPS
+ CA verification (without referencing a list of trusted CAs, thus
ensuring total chaos in which trust chains to use). That's something to
be consider if WebFinger becomes part of a Social Web protocol.

Also I have no idea how (or whether at all) the linked data web folks -
which might be relevant if we're using some LD interface) have any idea
how to address HTTP vs. HTTPS, given there's no good migration policy.


If the discussion on TLS/HTTPS is within the scope of the working group,
I suggest we set it as a requirement - but leave out CA verification,
just like the XMPP community has done and for the same reasons.

--
Mikael Nordfeldth
XMPP/mail: mmn@hethane.se