@Whysmerhill No, there is not.

There might be some kind of mitigation for that CVE without that update. Anyway I would strongly recommend you do not forgo the MDS patch. It is very important.

pff forest, 2fast4me while answering that POST over TLS question :-)

Also, it doesn't really reduce performance much unless you also disable SMT (not to be confused with SMP), and even that isn't a huge problem.

@Luc Well it was an easy question at least. :P

(+1'd you for the client cert recommendation, which I agree people often forget)

Wow this chat system is so bad. It almost made me double post.

imo the SE chat is pretty alright. Better than some real chat services...

it could be worse, it could be Electron!

I'm used to IRC so if I find something unreliable, it must be really bad. :P

irc is also pretty good for just chat though (if you don't want inline images or file transfers), I don't know anything that can beat that in terms of versatility and moderateability. Everyone and their moms have written an irc client at some point, enough to choose from :P

And you can even use netcat if you don't have a client!

PRIVMSG #the-dmz :and just send messages directly as text!

yeah, compare that to Telegram's protocol, what a pain in the ass that is to implement

I tried to implement the Tox protocol a few years ago and gave up.

so we want a chat protocol that support lots of features, uses end to end encryption, and is simple to implement. How hard could that be!

Well e2e is easy enough with libotr.

if it were that simple, why doesn't everyone use it? Matrix, signal, telegram, wire, whatsapp, etc. all use their own protocol instead of just plugging in libotr. (I never looked into libotr myself, only ever used it in pidgin on top of gtalk and msn, so I don't know much about it)

Mostly because OTR is meant to be a plug-in for protocols that don't natively support end-to-end encryption, like IRC and XMPP. That's why it uses only ASCII.

Also, it doesn't support group chat currently, only one-on-one.

Also OTRv3 at least doesn't have the best cryptography. 1535-bit DH, 1024-bit DSA...

OTRv4 upgraded a fair bit and now uses x25519 (or maybe even x448?) and ed25519, and Salsa20/20 in Poly1305 mode. Kind of silly that they used Salsa20/20 instead of ChaCha20 though, since the latter has better diffusion.

(back, had a meeting) right, OTR was meant as a layer on top of non-e2ee protocols, but you mentioned it earlier as if it works great as a layer, as if you can just plug it in like tls. Sounds quite perfect for anyone who wants to implement e2ee, yet nobody does

Because too few people care about e2e.

The few that do can afford to write their own protocol (e.g. Signal).

Also, Signal has some specific properties that it needs which OTR lacks.

That's why they came up with the DH Double Ratchet protocol.

Which, amusingly, OTRv4 (the newest version) has adopted. :P

so now we have two competing standards :P

googleprojectzero.blogspot.com/p/0day.html

djhworld.github.io/post/2019/05/21/…

I'm not sure what the term is for what I'm looking for, but it would be related to a password manager. What do you call a piece of software that is like a password manager but doesn't store the "password", it just visualizes a big list of stuff (dice ware word list) where the user can click through, then based on the user's choices pastes the corresponding 256 bit base64 index for the selection into a password box?