We are happy to announce the release of (a)Smack 4.0.0-rc1. This is the first aSmack release that is in sync with Smack's codebase and therefore marks an important milestone for Smack on Android. It is also the first non-snapshot release that is going to be available on the Maven Central Repositories (SMACK-265).

Smack 4.0.0-rc1 includes some major changes and important improvements including security related fixes. While this is marked as release candidate, users are encouraged to update because some important security bugs have been fixed. Please consult the "Smack 4.0 Readme and Upgrade Guide" for further information regarding the changes between Smack 3.4 and 4.0.

Previous Smack versions suffered from a missing "Basic Constraints" check in ServerTrustManager (SMACK-410): this allowed anyone with a valid CA-signed certificate for any domain to generate a certificate for any other domain that would be accepted by Smack's ServerTrustManager. Moxie Marlinspike found the same error in IE back in 2002 and wrote a detailed summary about it: http://www.thoughtcrime.org/ie-ssl-chain.txt

We would like to thank Ryan Sleevi of the Google Chrome Security Team for reporting the issue to us.

The fix for Smack was simply removing ServerTrustManager and the related code altogether. ConnectionConfiguration now only has a setting for a custom SSLContext. We shifted the responsibility for TLS certificate validation out of the library to the user, where it belongs. A fixed version of ServerTrustManager may return as an optional module in a future Smack release. Contributions are, as always, welcome.

A second important security vulnerability often found in XMPP implementations was made public by Thijs Alkemad aka xnyhps early this year. Affected implementations did not properly verify the 'from' attribute of IQ responses and were therefore vulnerable to spoofed IQ packets. You can read more about it here: http://tools.ietf.org/html/draft-alkemade-xmpp-iq-validation-00

Thijs also reported Smack as vulnerable in SMACK-533 and SMACK-538. Thanks to Lars Noschinski, patches were quickly provided and Smack is now immune.

(a)Smack 4.0.0-rc1 is considered mature. It is marked as release candidate because we have only a small number of people who are testing the current (a)Smack development snapshot. We ask everyone using Smack in some sort of staging, development or non-critical production environment to try 4.0.0-rc1 and report any problems or feedback to the community forums.

Thanks to everyone working on Smack 4.0:

git shortlog -sn 3.4.1..4.0.0-rc1

   166  Florian Schmaus

    10  Lars Noschinski

     4  Georg Lukas

     2  Vyacheslav Blinov

     2  rcollier

     1  Daniele Ricci

     1  Jason Sipula

     1  XiaoweiYan

     1  atsykholyas

Besides the mentioned security issues, Smack 4.0 contains also many new improvments and other bugfixes. An overview of all resolved issues in Smack 4.0.0-rc1 can be found in JIRA

Smack 4.0.0-rc1 can be downloaded from maven central

aSmack 4.0.0-rc1 is avaiable as jar at http://asmack.freakempire.de/4.0.0-rc1/

Yesterday's release of Openfire 3.9.0 had some problems with packaging of the release.  Bouncycastle signed jar files were getting packed, which then caused problems when Openfire attempted to load them.  We have hopefully fixed this issue and cleaned up a few other details and are proud to announce a 3.9.1 release!

Openfire is a real time collaboration (RTC) server licensed under the Open Source Apache license. It uses the only widely adopted open protocol for instant messaging, XMPP (also called Jabber). Openfire is incredibly easy to setup and administer, but offers rock-solid security and performance.

The download page offers these files and here are their md5sums for your comparison.

Please report any issues to us in the forums.  We are always looking for developers to help improve Openfire, so please let us know if interested!

It is with a heavy heart that I am stepping down as the project lead for Smack. 

I am happy to have managed to push out 6 releases in the last 3 years, but even from the start I always had issues finding the time to dedicate to this project.  Things have never really improved on that front.  Three young children and some unexpected illnesses in my family haven't exactly made for a lot of free time over the last couple of years. 

I have been thinking about this for awhile actually, but it has only been this year that some other eager contributors have come along with a lot of ideas and motivation for the project. So that makes for a good time to step aside and let those with time and dedication move the project forward.

I still plan on contributing when and if I can, but it will probably be less code and more helping others in the forums.  It takes much shorter blocks of time.

So, I wish the best of luck to Flow, who will be taking over my role as project lead.