5 ms·

Sorry, but this argument is just so damn stupid. It's on the level of, "we don't have passwords for accounts, because people could bruteforce them anyways"...

by Tehnix 11y ago

Sorry, but this argument is just so damn stupid. It's on the level of, "we don't have passwords for accounts, because people could bruteforce them anyways"... They are basically arguing that while SSL might cover 9/10 cases, because it doesn't cover that 1 case, they will leave the other 9 open.

na85 11y ago
IRCops have a long history of being change-averse and vitriolic. This just looks like more of the same.
- Tehnix 11y ago
  I'm just so baffled, since it is almost literally just creating a certificate and you are done (I run a couple of IRC servers myself). Even a self-signed certificate is better than none at all.
  - na85 11y ago
    You're talking about people who make heavily-entrenched ideologies about minor technical distinctions into an Olympic-level contest of stubbornness and scorn.
  - toast0 11y ago
    Get a certificate, and add some scary code to your stack (openssl requires a lot of attention), and seriously restrict the number of connections per second you can handle. It's inconvenient to restart all your connections because you need to apply an openssl patch, it's when worse when all the tls handshakes increase the time to get everyone back online when you do.
Strom 11y ago
Perfect is the enemy of good. Perhaps with a bit of added rationalization to hide laziness.
draw_down 11y ago
Yeah. They're saying "bad stuff will still happen if we have SSL, so let's not do SSL". Hell of an argument.
wibbler2 11y ago
it's an IRC network aimed at gamers where 98% of channels are public and free for anyone to join without any form of authentication ever. so you'd be more accurate to say it covers 98/100 of cases, and we leave the other 2 open the main obstacle these days is that a secure PKI deployment for a network ran by 40 different companies with no legal structure is a hard problem, not the technical challenge of putting a cert in your ircd.conf
- Tehnix 11y ago
  While they are free to join the channels, I'd imagine a great deal of the users authenticate to the nickserver to avoid impersonation and to protect their nick. Without SSL, anybody on their network could potentially sniff their credentials with a lot less trouble than MITM'ing a SSL connection. So I'd say that it's just not for the 2% that are using the secure channels, but probably for the majority of the userbase that is active for more than a couple of sessions.
  - blibble 11y ago
    QuakeNet has supported challenge response auth for more than 10 years, so this isn't a problem for anyone using that.
blibble 11y ago
(redundant)
- eridius 11y ago
  The comment isn't dead (or at least, not anymore; can comments get resurrected from dead status)?
  - Tehnix 11y ago
    It would appear so. It was dead earlier, but I imagine some mod or something revived him :)
sitkack 11y ago
This a common cognitive flaw in nerds. There isn't a continuum, but a proof like step function.

by Tehnix 11y ago

na85 11y ago

IRCops have a long history of being change-averse and vitriolic. This just looks like more of the same.

Tehnix 11y ago
I'm just so baffled, since it is almost literally just creating a certificate and you are done (I run a couple of IRC servers myself). Even a self-signed certificate is better than none at all.
- na85 11y ago
  You're talking about people who make heavily-entrenched ideologies about minor technical distinctions into an Olympic-level contest of stubbornness and scorn.
- toast0 11y ago
  Get a certificate, and add some scary code to your stack (openssl requires a lot of attention), and seriously restrict the number of connections per second you can handle. It's inconvenient to restart all your connections because you need to apply an openssl patch, it's when worse when all the tls handshakes increase the time to get everyone back online when you do.

Strom 11y ago

Perfect is the enemy of good. Perhaps with a bit of added rationalization to hide laziness.

draw_down 11y ago

Yeah. They're saying "bad stuff will still happen if we have SSL, so let's not do SSL". Hell of an argument.

wibbler2 11y ago

it's an IRC network aimed at gamers where 98% of channels are public and free for anyone to join without any form of authentication ever. so you'd be more accurate to say it covers 98/100 of cases, and we leave the other 2 open the main obstacle these days is that a secure PKI deployment for a network ran by 40 different companies with no legal structure is a hard problem, not the technical challenge of putting a cert in your ircd.conf

Tehnix 11y ago
While they are free to join the channels, I'd imagine a great deal of the users authenticate to the nickserver to avoid impersonation and to protect their nick. Without SSL, anybody on their network could potentially sniff their credentials with a lot less trouble than MITM'ing a SSL connection. So I'd say that it's just not for the 2% that are using the secure channels, but probably for the majority of the userbase that is active for more than a couple of sessions.
- blibble 11y ago
  QuakeNet has supported challenge response auth for more than 10 years, so this isn't a problem for anyone using that.

blibble 11y ago

(redundant)

eridius 11y ago
The comment isn't dead (or at least, not anymore; can comments get resurrected from dead status)?
- Tehnix 11y ago
  It would appear so. It was dead earlier, but I imagine some mod or something revived him :)

sitkack 11y ago

This a common cognitive flaw in nerds. There isn't a continuum, but a proof like step function.