4 ms·
TLS is accepted, since you implicitly trust the server when using chatrooms in most cases. for everything else there are plugins in your client for OMEMO (what
by dijit 4y ago
TLS is accepted, since you implicitly trust the server when using chatrooms in most cases.
for everything else there are plugins in your client for OMEMO (what signal is based on) and OTR (which is purely session based).
Handling this as a third-party implementation for E2EE is probably the only true way to gain trust anyway. If your provider provides the infrastructure and the client then how can you really trust it?
- sdfhdhjdw3 4y agoI'm not a security expert, but my humble view is that if you need plugins for really basic functionality, that's a red flag.
- dijit 4y ago"E2EE" is not really basic functionality. I believe it is hard to get right, and only worthwhile on 1:1 communication, it doesn't work well at all on large chat rooms, which is what IRC is. Regardless, if you don't want E2EE to be handled by a plugin- it is possible to make a client with it baked in. There is no company that will stop you creating a third-party client unlike slack/discord which are extremely hostile to those endeavors by comparison. EDIT: If you downvote without replying I'm just going to assume you're ideologically opposed to open standards, because I'm not sure what else I can take from it.
- sdfhdhjdw3 4y agoI didn't downvote, and I'm very pro open standards. I just think we can do better than IRC, that's all.
- dijit 4y agoAh, I wasn't accusing you of downvoting, just the community. You can't downvote direct replies. --- Speaking about standards; have you looked at IRCv3? Is there anything specific that you feel is not being addressed? Encryption (to my mind) is better handled outside of the spec itself, just like HTTP vs TLS wrapped HTTP (HTTPS) where the "TLS" has no bearing at all on how HTTP is implemented. IRCv3 is attempting to address the persistence issues, though many people like the lack of persistence in general. I don't want to guess at what your concerns are, but more generally; have you looked at the spec?
- deleted 4y ago[deleted]
- numpad0 4y agoIt's not really a green flag when values offered by major commercial alternatives seems like then-experimental client features of existing thing(cf. Twitter, Slack, Discord)
- rdpintqogeogsaa 4y agoYet there are also large networks like QuakeNet or UnderNet with no TLS anywhere.
- dijit 4y agoAnd you can choose not to be there. My network forces TLS: https://darkscience.net https://darkscience.net Forcing people to "do what you want" is against the spirit of open standards.
- deleted 4y ago[deleted]