31–40 of 44 posts
Earlier quoted context omitted.
It would be perfect if only they open-sourced it.
There's Syncthing, but I'm not a big fan of the whole "server"-like interface. They've improved it recently, but it still seems quite non-consumer-friendly. http://syncthing.net/
So if I understand this right, there's probably a backdoor in it? Honestly though, I doubt that you can keep the NSA and FBI out of your system. If they want in, they'll get in, and there's nothing* you can do about it. Having said that, we do need these kinds of solutions without the back doors. Why aren't any software developers from countries where mandatory backdoors aren't a thing building stuff like BTSync? And…
Yeah, but you don't have to make it _easy_ for them, like using closed-source software that's capitalizing on the name recognition of "BitTorrent" to pretend to be open.
(I expect that even if you lived in McLean, Virginia and never locked your doors, if you were writing open-source software, nobody would make you put a backdoor in. The intelligence agencies have shown a great bias towards doing things that people won't notice.)
Also, even assuming you can't keep the NSA and FBI out if they really care (which I somewhat agree with), it's definitely worth it to keep everyone else out. Like BitTorrent the company, or anyone MITMing any of those HTTP URLs.
Something to keep BT on its edge, but this is hardly a "security analysis" in an established conventional sense. It's a semi-random collection of surface observations from half-a-day of poking around. Sure, some of these may be indicative of serious underlying issues, but they may also be not. E.g. - > [MEDIUM] Attack vector potentiel : mise à jour automatique (silent update) du client en HTTP sur http://update.utorr…
There are ways to mitigate this, but not well given the design constraints of closed-source software.
So if I understand this right, there's probably a backdoor in it? Honestly though, I doubt that you can keep the NSA and FBI out of your system. If they want in, they'll get in, and there's nothing* you can do about it. Having said that, we do need these kinds of solutions without the back doors. Why aren't any software developers from countries where mandatory backdoors aren't a thing building stuff like BTSync? And…
"Having said that, we do need these kinds of solutions without the back doors." You do have that. Further, you've had it since 2006. Point duplicity[1] to rsync.net[2]. Cheers! [1] http://duplicity.nongnu.org/ [2] http://www.rsync.net/resources/notices/canary.txt
What's wrong with using http instead of https on the localhost web server?
I assume you refer to this: > [LOW] confirmed: When registering, http traffic for creating new user on loopback http://127.0.0.1:8888 And I wonder the same. Didn't really get that one, but yeah you may be right that they mean it should be https. I guess the risk is when an application can monitor loopback traffic, but you can only do that with special permissions or if you're root. The former case is exceptional, in…
From the "Conclusions" section: > Change of sharing paradigm that introduced this vulnerability happened after the first releases. This may be the result of NSL (National Security Letters, from US Government to businesses to pressure them in giving out the keys or introducing vulnerabilities to compromise previously secure systems) that could have been received by BitTorrent Inc and/or developers. IF that's true, the…
There's a lot of people saying "don't use btsync for sensitive data" and rightfully so. What are some alternatives that are considered more secure?
What's wrong with using http instead of https on the localhost web server?
So if I understand this right, there's probably a backdoor in it? Honestly though, I doubt that you can keep the NSA and FBI out of your system. If they want in, they'll get in, and there's nothing* you can do about it. Having said that, we do need these kinds of solutions without the back doors. Why aren't any software developers from countries where mandatory backdoors aren't a thing building stuff like BTSync? And…