TODO[edit]

Gajim might intelligently set a Tor socks user name per account already. Do we still manually specify a user/password?
- Gajim developers said they don't intelligently set a Tor socks user name per account. https://dev.gajim.org/gajim/gajim/issues/9213 ^[archive]

security
- (3) TODO: create an AppArmor profile
does it have any protocol leaks ^[archive]?
- (4) TODO: check Gajim's built-in XML console
how to pre-configure Gajim with all these settings by default as a linux distribution?
- (5) TODO: feature request for .d config folder support - https://dev.gajim.org/gajim/gajim/issues/9214 ^[archive]

Resolved[edit]

Was a blocker:

Are uploads by gajim-httpupload encrypted using gajim-omemo?
- Developer responded: "yes if you have activated OMEMO, httpupload will always encrypt the file, in fact you can not send a unencrypted file with OMEMO activated even if you wanted."

Plugin installer is only using https for verification which is weaker than gpg which is used by APT which is usually used to install software. ^[1] ^[2]
- We can nuke the plugin installer. anon-apps-config ^[archive] which is installed by default will deactivate gajim plugin installer / updater ^[archive] because it's not secure. Using config-package-dev displace.
- (2) Debian feature request to ship the gajim plugin-installer plugin in a separate Debian package.^[3]