Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal's TLS Proxy Failed to Be Probing Resistant

github.com

Post reply on HN
Print view View original

31–40 of 46 posts

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#31

Post by blueplanet200 »

realducksoft wrote: post #30
godelski wrote: post #12

Earlier quoted context omitted.

It got approved fairly quickly. It was a false positive (see my link in main thread) with their spam detection (DuckSoft copy pasted the post so flagged as "type too fast").

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I am DuckSoft on GitHub and I prove my identity by GPG signing this message. I am not typing too fast, nor pasting all my stuffs into the comment area. I just put a link to the GitHub issue. The discussion board even automatically extracted title and abstract for me, where I thought, 'pretty cool huh'. Then I got banned. -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEE2H0…

It sounds like a mistake, the robots incorrectly tagged you. I wouldn't interpret any ill will because of it. Also sounds like they approved your account shortly after so it's hard to see anything that negative here...

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#32

Post by chacha2 »

iforgotpassword wrote: post #27
nix23 wrote: post #23

Earlier quoted context omitted.

From pure interpretation of your answer, i would say you are the snowflake human here.

I guess not wanting to sign up with my email adress on servers administered by god knows who with unknown security practices just to help you makes me a special snowflake then.

Some people go without food. Being too afraid to sign up to a forum has past the point of first world problem.

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#33

Post by realducksoft »

blueplanet200 wrote: post #31
realducksoft wrote: post #30

Earlier quoted context omitted.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I am DuckSoft on GitHub and I prove my identity by GPG signing this message. I am not typing too fast, nor pasting all my stuffs into the comment area. I just put a link to the GitHub issue. The discussion board even automatically extracted title and abstract for me, where I thought, 'pretty cool huh'. Then I got banned. -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEE2H0…

It sounds like a mistake, the robots incorrectly tagged you. I wouldn't interpret any ill will because of it. Also sounds like they approved your account shortly after so it's hard to see anything that negative here...

So guys I've been blocked. See: https://web.archive.org/web/20210206065553/https://community...

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#34

Post by iforgotpassword »

chacha2 wrote: post #32
iforgotpassword wrote: post #27

Earlier quoted context omitted.

I guess not wanting to sign up with my email adress on servers administered by god knows who with unknown security practices just to help you makes me a special snowflake then.

Some people go without food. Being too afraid to sign up to a forum has past the point of first world problem.

Obviously; I'm living in the first world, so it shouldn't come as a surprise. It's like saying "Why don't you sell everything you have and dedicate your life to helping those that go without food?" And I'm actually one of those few people who do donate to a charity on a monthly basis. Do you do that? I'm doing that because it costs me money, not time, since I do have enough of the former, not the latter. Which brings me back to the original issue: I just don't want to bother with all the overhead of a sign up, waiting for some email confirmation that doesn't arrive because you self host mail and your mails get swallowed by Gmail, etcpp. Just no. Maybe you just don't want bug reports and patches since you also don't have enough time to handle them anyways, but if you do, just try make it frictionless. You don't need to sell your soul to github or anything, but it's still the number one OSS hosting platform of today, so just go with it. At least for the issue tracker, you can still just use it as a mirror otherwise.

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#35

Post by erikbye »

kelnos wrote: post #8
godelski wrote: post #6

For people curious, it looks like they are discussing it in the community but only the mod is involved and I don't think they (Herohtar) are an employee. While the block was unintentional this doesn't seem like the right way to handle the situation and Moxie should have been clearer and that would have avoided the issue. It is easy to interpret the response given as being brushed off. TLDR: DuckSoft got autobanned be…

> Also, honestly, why not use GitHub issues. I find issues useful. Some people would prefer to use their own issue tracker or discussion forum. I don't see that as strange at all, given that with GH issues you don't have full control over the data or experience.

You could mirror, making your project accessible while not risking data loss.

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#36

Post by erikbye »

bawolff wrote: post #9
godelski wrote: post #6

For people curious, it looks like they are discussing it in the community but only the mod is involved and I don't think they (Herohtar) are an employee. While the block was unintentional this doesn't seem like the right way to handle the situation and Moxie should have been clearer and that would have avoided the issue. It is easy to interpret the response given as being brushed off. TLDR: DuckSoft got autobanned be…

People who run the project get to pick the bug tracker. Its really next level entitlement to not let maintainers choose the place they track bugs.

It is their choice, but everyone knows a project not on GH gets less visibility and fewer reports and contributors because of that decision. I know some projects do it to minimize public interaction, they feel raising the barrier improves the quality ratio of issues.

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#37

Post by erikbye »

meibo wrote: post #24

My experience with the Signal team in issues and their community has been about the same. They're generally dismissive, especially so about design problems that cause a big amount of bugs that are strewn throughout Signal, like their handling of message timestamps/sync and dismissal of the IME concerns.

Agreed, it is why I prefer Matrix. World of difference.

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#39

Post by tinus_hn »

chacha2 wrote: post #32
iforgotpassword wrote: post #27

Earlier quoted context omitted.

I guess not wanting to sign up with my email adress on servers administered by god knows who with unknown security practices just to help you makes me a special snowflake then.

Some people go without food. Being too afraid to sign up to a forum has past the point of first world problem.

Some people have no food, therefore other people should be obliged to do security research for free, while conforming to the whims of any project they encounter.

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#40

Post by inshadows »

What is that PoC in the issue doing? They check e which is not set after first line in the function:

    func send(addr, server, sni string) int {
     c0, e := net.Dial("tcp", addr)
     if e != nil {
      log.Fatal(e)
     }
    
     c1 := tls.Client(c0, &tls.Config{
      ServerName:         server,
      InsecureSkipVerify: true,
     })
    
     c2 := tls.Client(c1, &tls.Config{
      ServerName:         sni,
      InsecureSkipVerify: true,
     })
     c2.SetDeadline(time.Now().Add(2 * time.Minute))
     s := fmt.Sprintf("GET / HTTP/1.1\r\nHost: %s\r\nUser-Agent: curl/7.68.0\r\n\r\n", sni)
     //b := make([]byte, 4096)
     l, _ := c2.Write([]byte(s))
     log.Println(l)
     if e != nil {
      return 0
     }
     log.Printf("%s->%s->%s\n", addr, server, sni)
     return l
    }
Post reply on HN