5 ms·

The other thing is, as with almost all web-based solutions, you're being tracked by various scripts in the background (Google API/JS, etc.). So, if you're paran

The other thing is, as with almost all web-based solutions, you're being tracked by various scripts in the background (Google API/JS, etc.). So, if you're paranoid, you're better off with a client solution.

spyder 13y ago
Client side solutions can do even more tracking because there is no browser sandbox. And for example the µTorrent client has ads in it which are probably tracked.
- kimlelly 13y ago
  Yes, I suggest using open-source clients that don't include ads (such as RetroShare). µTorrent is not open-source, btw.
  - imissmyjuno 13y ago
    So if the issue is tracking regardless, why not use a non-tracking web app?
StavrosK 13y ago
Sure, but a client solution doesn't have the ease-of-use of this for the other party. I use Ghostery, incidentally, but your general point is that security on a live webpage is impossible, which I agree with. That's why I proposed that the app be made into a downloadable package as well.
- shacharz 13y ago
  It would be interesting to create a self sustained WebRTC client that can communicate with the web version.
  - StavrosK 13y ago
    It already can, the web version is just an HTML file with some JS too.
- kimlelly 13y ago
  Personally, I don't see a better platform than RetroShare. That is why I believe, we're better off if we all get behind RetroShare: Developers can extend this platform with as many plugins as they wish - as an open-source solution, it's totally open. (I believe fragmentation, more specifically increasing the number of less advanced solutions doesn't help...)
- whadar 13y ago
  Why downloadable package is necessarily more secure than a live webpage over TLS (HTTPS)? Given that you can verify that Sharefest is Sharefest (using the certificate in the future), I don't see the big difference. I do think that a live webpage can be updated with security fixes more easily. Being a live webpage also give us, as the developers, much less headaches in terms of protocol compatibility -- We maintain just one "version" of Sharefest client at the same time.
  - StavrosK 13y ago
    Because a downloadable package can't be replaced by something else the next time you use it, while Sharefest can, and nation-states can easily serve you whatever they want, even over SSL.
    - whadar 13y ago
      But nation-states can do that for downloadable packages as well, perhaps even the verifiers for those packages...
      - StavrosK 13y ago
        How?
      - whadar 13y ago
        They can spoof the package and its key. If the root of trust (CA) is tempered as you suggest and the chain of trust is broken, I don't see how you can really secure it.

spyder 13y ago

Client side solutions can do even more tracking because there is no browser sandbox. And for example the µTorrent client has ads in it which are probably tracked.

kimlelly 13y ago
Yes, I suggest using open-source clients that don't include ads (such as RetroShare). µTorrent is not open-source, btw.
- imissmyjuno 13y ago
  So if the issue is tracking regardless, why not use a non-tracking web app?

StavrosK 13y ago

Sure, but a client solution doesn't have the ease-of-use of this for the other party. I use Ghostery, incidentally, but your general point is that security on a live webpage is impossible, which I agree with. That's why I proposed that the app be made into a downloadable package as well.

shacharz 13y ago
It would be interesting to create a self sustained WebRTC client that can communicate with the web version.
- StavrosK 13y ago
  It already can, the web version is just an HTML file with some JS too.
kimlelly 13y ago
Personally, I don't see a better platform than RetroShare. That is why I believe, we're better off if we all get behind RetroShare: Developers can extend this platform with as many plugins as they wish - as an open-source solution, it's totally open. (I believe fragmentation, more specifically increasing the number of less advanced solutions doesn't help...)
whadar 13y ago
Why downloadable package is necessarily more secure than a live webpage over TLS (HTTPS)? Given that you can verify that Sharefest is Sharefest (using the certificate in the future), I don't see the big difference. I do think that a live webpage can be updated with security fixes more easily. Being a live webpage also give us, as the developers, much less headaches in terms of protocol compatibility -- We maintain just one "version" of Sharefest client at the same time.
- StavrosK 13y ago
  Because a downloadable package can't be replaced by something else the next time you use it, while Sharefest can, and nation-states can easily serve you whatever they want, even over SSL.
  - whadar 13y ago
    But nation-states can do that for downloadable packages as well, perhaps even the verifiers for those packages...
    - StavrosK 13y ago
      How?
    - whadar 13y ago
      They can spoof the package and its key. If the root of trust (CA) is tempered as you suggest and the chain of trust is broken, I don't see how you can really secure it.