Hacker News Reader

Comment by dabeeeenster | Hacker News Reader

Two questions:

1 - What language is the wave server written in? Have google mentioned this yet?

2 - If Wave is going to disrupt and displace email, how are they going to combat spam? Messages between wave servers are encrypted which is a good start, but how are they going to ensure that we don't end up where SMTP is now?

View on HN

From http://www.waveprotocol.org/draft-protocol-spec it's clear that Wave is 100% based on XMPP, which means contact authentication prior to communication takes place, hence there's no room for spam in Wave/XMPP (at least in esteblished meaning of 'spam').

2 - They are encrypted, but more importantly, they can also be signed. That could make it so that you have to pay some cert authority $20-100 if you want to set up a Wave server that talks to the rest of the world, but... actually, that sounds pretty reasonable to me.

That's just my understanding. I could be wrong.

http://www.waveprotocol.org/draft-protocol-spec

"The connection MUST be secured using the TLS feature of XMPP."

So yes, you will need a cert to run a public wave server, but there is no sensible way to avoid this.

First, you should read on how XMPP works from http://www.xmpp.org. Second, no, you don't need an SSL certificate. You may choose how your XMPP server authenticates your own users and it's up to you do decide whether you want them to use TLS/SSL or not and no any other XMPP server have means to learn what authentication method was used on user end. The established practice is to use TLS with self-signed SSL cert. Server-to-server connectins are usually insecured, so Google may require to use SSL while connecting to their XMPP servers, yet as till now they don't.

It's right there in black and white. This isn't XMPP, it's Wave over XMPP, so there's no reason they can't impose additional constraints, and kudos to them for doing so. Optional TLS is effectively the same as no TLS and that just won't do for _the_ next gen messaging standard.

1 - if you watch the "Wave and GWT" video from Google I/O, you'll see that both client and server are written in Java. (They share some of the truly hairy communications code.) Of course, the client compiles down to Javascript (using GWT).

2 - I don't think they've addressed the spam issue yet.

The demo video had a spam folder, just like gmail, so there's something baked in.

People will be able to write robots that will flag spam.

Reply on news.ycombinator.com