[Wocky] JabberApplet findings

[Greg Hudson]

I experimentally set up JabberApplet on wocky.mit.edu (thanks to Mark
for installing the web server there).  Unfortunately, I quickly
discovered that JabberApplet does not support SSL or SASL
authentication, only old-style iq digest auth, which our server won't
do.  As a side note, our server may not be responding to such attempts
properly; tcpdump did not show anything besides TCP acks from the
server in response to the iq stanzas from the client, and the Java
applet hung waiting for a reply.

JabberApplet has not been touched in at least three years, so hopes
for a new release with SSL support from upstream are faint.  I looked
into other Jabber Java applets:

  * GreenThumb appears to be moribund; all their information was in an
    unmaintained wiki which has been overrun by spammers.

  * e4applet appears to be a couple of years old and also only
    supports iq auth.

  * Jeti appears to be maintained and supports SSL, but it doesn't
    appear to run fully within the applet sandbox; it asks the user to
    trust it, presumably so that it can connect to servers other than
    the web server it was downloaded from.  I also couldn't get it to
    work with wocky.mit.edu; tcpdump showed the server returning a
    "not well-formed (invalid token)" error to the client during the
    login sequence.

I'm guessing we could get Jeti to work with some effort, and might be
able to modify it to work without requesting trust from the user.  It
might be a few weeks of developer effort or more, though (at least if
I were doing it; I'd need to learn more about tools for debugging Java
applets, and my Java programming experience is limited), so I think we
were right in designating this a post-pilot goal.

(There is still the JWChat option.  It looked more complicated to set
up, and it appeared to be using dodgier technologies, and I suspect
we'd have more issues getting authentication to work reasonably.)