umurmur with mumble 1.2.8 engine ?

[Michal Kuzak]

Hi, 

Want to ask if you guys are planning to upgrade umurmur to reflect the latest 1.2.8 mumble engine, or are you wanting for mumble to release 1.3.0 ? 

Thanks

[Felix Morgner]

Hi Michal

I am not sure what you mean by upgrading to 'reflect the latest 1.2.8 mumble engine'. As far as i can tell there have been no significant (as in code/behavior changing) changes to the protocol since June 2013. could you please clarify what you mean?

Thanks in advance,

Felix

--
Det här meddelandet skickas till dig eftersom du prenumererar på gruppen "umurmur-general" i Google Grupper.
Om du vill sluta prenumerera på den här gruppen och inte längre få någon e-post från den skickar du ett e-postmeddelande till umurmur-gener...@googlegroups.com.
Om du vill göra inlägg i den här gruppen skickar du ett e-postmeddelande till umurmur...@googlegroups.com.
Besök gruppen på http://groups.google.com/group/umurmur-general.
Fler alternativ finns på https://groups.google.com/d/optout.

[Michal Kuzak]

Hi Felix,

Well looks like from version 1.2.4 - 1.2.8 there where some security fixes and other bug fixes addressed 

http://wiki.mumble.info/wiki/1.2.8

[Felix Morgner]

Hi Michal

Thanks for your response! I think the issue here is some sort of ambiguity in the versioning scheme of the Mumble project. Somewhere in docs (can't exactly remember where) of umurmur, we state that we support the Mumble protocol version 1.2.4. This is absolutely correct, but you have to take the following into account: We support the PROTOCOL version 1.2.4 which is more or less unrelated to the version of MUMBLE itself. As far as i remember, they (the Mumble project) are currently working on the specification for the protocol version 1.2.5. You need to think of the PROTOCOL version and the MUMBLE version being unrelated (even though they might just bump the PROTOCOL version to be the same as the MUMBLE version). I hope that clarifies that part :)

Now as far as security and bugfixes are concerned, those fixes are only related to mumble (the client). Our code-base is (except for the .proto file) completely disjoint from the original Mumble/Murmur code-base. Although umurmur started as a port of the original Murmur code it has since developed away from being a "pure" port.

That being said, as far i see it the changes mainly focus on the client (Mumble) and the TLS backend they use (OpenSSL). First of all umurmur is only a server an secondly uses/supports three different TLS backends (namely OpenSSL/LibreSSL, PolarSSL/mbedTLS and GnuTLS). Most often mbed is chosen by our users/maintainers, since it is a very compact and efficient TLS implementation that is very well-suited for embedded systems (read RaspberryPi, Cubieboard and the like).

This however does NOT mean, that we are not concerned with security, stability and user satisfaction. I would like to encourage you to:

- Add your RaspberryPi build instructions into the new umurmur wiki at http://github.com/umurmur/umurmur/wiki

- File bugreports on the umurmur project page over at http://github.com/umurmur/umurmur

- Keep on asking questions

- Just ask over and over again, if I don't react in time

I would like to assure you, that the whole umurmur team takes software quality and security very seriously and that we rely on every single user reporting issues/bugs/concerns/feature-requests.

I hope to have been able to address your concerns.

Best regards

Felix

[Michal Kuzak]

Hi Felix,

Thanks for the explanation, now it's start making sense. I was under the impression umurmur was a 1-1 port with cut down functionality. Also, looks like the version numbers on mumble don't reflect the protocol version, and don't suggest to be incremental fixes like 1.2.4.1 ... I guess that was the confusion.

Thumbs up for your clarification.
Cheers

Michal