- 41comments
- 12comments
- 54comments
- 63comments
- 154comments
- 55comments
- 57comments
- 806comments
- 202comments
- 14comments
- 1042comments
- 129comments
- 105comments
- 41comments
- 4comments
- 144comments
- —discuss
- 428comments
- 279comments
- 1comments
- 74comments
- 619comments
- 177comments
- 237comments
- 548comments
- 67comments
- 165comments
- 124comments
- 34comments
- 452comments
I honestly thought there would be some elaborate chain there, not "we forgot to use encryption"...
Honestly issues like this crop up pretty commonly. JWT alg:none for example. Or even older people forcing SSL to downgrade to encryption null.
In any system that provides security it should only be designed to run if the security is in use, and to fail immediately with no further action if the security is not used.
And not using authentication.
They are trying to sweet write it as much as possible. But basically there is neither encryption nor authentication. The person who made the protocol/program simply didn't care.
I find this to be very telling about what kind of people they are. If you make a mistake this big you need to own up to it. BS all you want, maybe you think that works for you.. but people see through it.
My main wish is if radicle had a way to make issues online, without installing the software. Runing a piece of software is a high barrier of entry to make a bug report, which the entire reason I use codeberg instead.
That's a downside of all decentralised software, isn't it? If there's a convenient access point, that access point is also a point of centralisation. To be distributed, you have to be running the software yourself. The big problem is that the software always ends up being inconvenient. People have no problem using bittorrent because the software is actually usable.
Like onion/ipfs/many others, I'd expect gateways to pop up if it grows relatively popular. If LLM scrapers don't destroy them immediately, at least.
announcement 3 months later is not super great, considering that the current advice is "Stop using private repositories (over the network) until the security update is released."
thankfully (for me), this is about the git forge and not the oss calendar and contact synchronization software by the same name
https://radicale.org/v3.html
it's not the same name
you're right! i can't believe i only noticed that just now, thanks!
Is there a risk that other projects that may be using the same cyphernet-labs/netservices.rs code, like Nym & Farcaster, have also been expecting authentication & encryption where it hasn't been happening?