• poVoq@slrpnk.net
    link
    fedilink
    English
    arrow-up
    0
    ·
    23 hours ago

    Significant improvements to certificate pinning and validation have been added to all major XMPP clients as a result of this incident, but it should also be clear that hosting a server on infrastructure under control by an antagonist government (see also Signal) is a very bad idea and hard to mitigate against.

    • rottingleaf@lemmy.world
      link
      fedilink
      English
      arrow-up
      0
      ·
      21 hours ago

      Signal doesn’t suffer anything worse than DoS if a hostile party controls the central service. That’s its point and role. It’s based on the assumption that such hostile parties as governments don’t like DoS’ing central services, they prefer to be invisible.

      For other points and roles other solutions exist. One can’t make an application covering them all, that never happens.

      Briar again (I’ve finally read on it and installed it, and I love how it works and also the authors’ plans on the future possibilities based on the same protocols, but not for IM, say, there’s an article discussing possibility of RPC over those, which, for example, can give us something like the Web ; I mean, those plans are ambitious and if I want them to succeed so much, I should look for ways to defeat my executive dysfunction and distractions and learn Java). Except it would be cool if it allowed to toss data over untrusted parties, say, now if two Briar users in the same group are not in each other’s range, but there’s a third Briar user not in that group between them, their group won’t synchronize (provided they don’t have Internet connectivity). If one could allow allocating some space for such piggybacked data, or create some mesh routing functionality, then it would become a bit cooler.

      • poVoq@slrpnk.net
        link
        fedilink
        English
        arrow-up
        0
        ·
        21 hours ago

        You are very naive if you think that is all the US government can do in regards to Signal, but suit yourself 🤷

          • poVoq@slrpnk.net
            link
            fedilink
            English
            arrow-up
            0
            ·
            21 hours ago

            A lot, but please educate yourself, this topic has been extensively discussed here and in other places.

            • rottingleaf@lemmy.world
              link
              fedilink
              English
              arrow-up
              0
              ·
              21 hours ago

              A lot, but please educate yourself,

              Thanks for the advice.

              this topic has been extensively discussed here and in other places.

              This is noise, not an argument.

              I dunno what’s the purpose of this comment. I asked for specific things, not for noise.

              • jet@hackertalks.com
                link
                fedilink
                English
                arrow-up
                0
                ·
                edit-2
                9 hours ago

                Whenever anybody on the internet tells you to educate yourself, but refuses to provide the information they allude to, they’re lying. They know they’re lying.

                Signal has issues, like SVR… which are worth discussing on their own without this weird vague eliteism

                • rottingleaf@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  0
                  ·
                  6 hours ago

                  Yes, I know that.

                  Especially the “this has been discussed before” thing, I dunno about other countries and cultures, but in Russia this is the most common obnoxious shit people without arguments and thinking they have authority use.

                  • jet@hackertalks.com
                    link
                    fedilink
                    English
                    arrow-up
                    0
                    ·
                    5 hours ago

                    Yeah it’s like appealing to authority and social pressure all in one. We already discussed it. Bah.

    • eleitl@lemmy.zip
      link
      fedilink
      English
      arrow-up
      0
      ·
      22 hours ago

      End to end encryption between clients (also for groups) seems to partly address the issue of a bad server. As for self-hosting, any rented or cloud sevices are very vulnerable to an evil maid. So either in-house hosting or locked cages with tamper-proof hardware remain an option.