51–60 of 123 posts
Uh, for something touting e2e encryption and security it would be better if the site did not serve over plain http by default
https adds nothing to a page when the only trafic is server -> client
Scuttlebutt is a neat concept, burdened by a bad protocol. Signing a message involves serializing a json object, signing it, adding the signature as a field on that json object, and then serializing it again. To verify, you deserialize the message into an object, remove the signature field, and then reserialize it, and verify the signature against that new serialization. This means that all the clients have to have a…
Huge fan of Scuttlebutt and think it could (should) be the future of the social internet. I recently quit my job to write about and work on decentralized tech full time with scuttlebutt being my primary focus. I've written about why I think it's so important here: https://adecentralizedworld.com/2020/03/what-is-scuttlebutt/
> Decentralized social networks have been tried before, the two most well known are Diaspora and Mastadon. With these services there [is still moderation]... Scuttlebutt is how I believe the social web should function in the future. Even the Hackernews community which lean towards decentralization more so than the general public would still argue there is value in moderation.
Scuttlebutt is a neat concept, burdened by a bad protocol. Signing a message involves serializing a json object, signing it, adding the signature as a field on that json object, and then serializing it again. To verify, you deserialize the message into an object, remove the signature field, and then reserialize it, and verify the signature against that new serialization. This means that all the clients have to have a…
Any signing done over structured data has this problem. You always need a canonical representation.
Scuttlebutt is a neat concept, burdened by a bad protocol. Signing a message involves serializing a json object, signing it, adding the signature as a field on that json object, and then serializing it again. To verify, you deserialize the message into an object, remove the signature field, and then reserialize it, and verify the signature against that new serialization. This means that all the clients have to have a…
When I was faced with this (signing a structure), I serialized the json into base64, then put that base64 string as a value (along with the MAC) into a new json document. It of course increases deserialization overhead (json, verify, unbase64, inner json) but sidesteps this issue. I thought about sorting keys and other things like that, and the dozen edge cases and potential malleability issues dissuaded me for the c…
Scuttlebutt is a neat concept, burdened by a bad protocol. Signing a message involves serializing a json object, signing it, adding the signature as a field on that json object, and then serializing it again. To verify, you deserialize the message into an object, remove the signature field, and then reserialize it, and verify the signature against that new serialization. This means that all the clients have to have a…
Earlier quoted context omitted.
Any signing done over structured data has this problem. You always need a canonical representation.
could it use a HTTPHeader style system instead to avoid the json serializing back and forth?
Earlier quoted context omitted.
https adds nothing to a page when the only trafic is server -> client
Of course it does, HTTP is never only server -> client - from preventing a passive eavesdropper from seeing what pages are being browsed on the server, cookies, UA fingerprinting etc. to active content modification in transit.
I've used patchwork before, but can someone comment on the other applications of the scuttlebut network and where this scuttlebot fits in?
A decentralized book review system and a decentralized chess.
Earlier quoted context omitted.
Of course it does, HTTP is never only server -> client - from preventing a passive eavesdropper from seeing what pages are being browsed on the server, cookies, UA fingerprinting etc. to active content modification in transit.
Pages are still visable in the tls handshake, no coockies on this page (that would be client-> server traffic). But yeah, good point about the fingerprinting and content modification