5 ms·
I am if the opinion that IRCv3 is horrid and has taken the email route of (forgive the language) "polishing turd". You cannot have a secure irc that is backward
by _8j50 5y ago
I am if the opinion that IRCv3 is horrid and has taken the email route of (forgive the language) "polishing turd".
You cannot have a secure irc that is backwards compatible, you can have separate default ports and uri schemes like http vs https, but you can't connect to http and opportunistically redirect 301 to https and call that an improvement of securiry because it is actually worsening security by introducing false assurances of securiry.
I also believe it is possible to have a protocol that has proper E2EE and simple enough to where you can use netcant and one other tool to use IRC.
Trust-on-first-use authentication (like signal or ssh) is also terrible in practice on its own. Keep it simple. Let the servers handle public key distribution and certification so that compromise of the server/mesaaging infrastructure is required to mount identity attacks, then do the normal TOFU authentication so users won't have to trust middleware. Have a commandline tool that "connects" to the other user (like ssh or sendmail) and opens a socket/fd you can use with a proper frontend or just echo/netcat to it.