Viewing profile — mpowers

I'm not being flip about it. Granted, entropy is an issue with in-browser JS, but the rest of it is really just cautionary about browser bugs, compromised browsers, and known page-…

I appreciate your concern, but you can't fault JS for browser bugs or OS bugs. It's also not clear to me why you're any more secure with a signed browser extension or native app. J…

Your logical fallacy is: putting words into my mouth (argumentum ad logicam). I didn't say "why bother making the crypto" secure. I said that you can't point to endpoint security a…

Yes, this is the kind of feedback we're looking for with regard to another comment here. This is why we haven't committed to a language for the server-side reference impl yet, beca…

Agree, wordpress is an apt comparable. Some of the KS tiers are that we're providing hosting for early backers, so we need to provide hosting for early backers. The intent is to ex…

I get where you're coming from, but I was sitting at an Eclipse game with ESR last week (where he beat me on the tiebreaker but I digress) and he thought our approach was great. KS…

A single client isn't weakened by other compromised clients. If you run a hardened trustworthy client, your own public posts are still verifiable, and private posts meant for you a…

Agree, I yield. It's gone now.

I didn't post this. But feel free to make unsubstantiated ad hominem attacks, because: the internet. :)

Well, it's kickstarter so we're deferring some decisions until it closes, and leaving room to listen to our backers. I know you probably meant to snark, but to take your question s…

If your device or browser is compromised, you have bigger problems than someone subtly modifying your js runtime. Similarly if a host is compromised to serve bad js files. We can't…

Gah, HN is rate-limiting my responses. Very familiar with the document, but it mainly just boils down to watch-out for XSS attacks. We require SSL to deliver the entire page with n…

(fyi, these replies are meant to be read in reverse order from how they're displayed, i think...)

That said, the js crypto isn't the part I'm worried about. It's all the scripting vulnerabilities to guard against in the browser. Still, if anyone has mission-critical privacy the…

If normal people are going to use it, it has to run in a browser, hence JS. There are working open source crypto libs in JS today, and kind of the nice thing about them is that the…

Well, it's a kickstarter, so it's by definition trying to get backing for a vaporware product. But fair point.

Our use cases are of Twitter too, so it makes a certain sense. We haven't designed the UX yet, but it's meant to convey the idea. That said, the architecture supports not only Twit…

It's ending up either trust or tryst. Kind of like GIF vs. JIF. That said, we'd have probably half the mainstream press coverage without that name.

JS on the client, and that's the important bit where all the crypto happens. Likely Java on the server, basically a drop-in servlet for any Tomcat, but still TBD.

Our thing is that we: (1) extend RSS to support self-signed/self-encrypted entries, (2) specify rest apis for http servers to exchange RSS entries (kind of like NNTP). We'll make a…