3 ms·

how does it know who else to talk to? it seems that by saying things are anonymous you punt on all questions of identity? so there's no way to know that you a

how does it know who else to talk to? it seems that by saying things are anonymous you punt on all questions of identity? so there's no way to know that you are joining the forum you expect? another way of saying the above - despite the encryption there's no protection against mitm, right? it uses tls so it's just direct connections? so you're identified by your ip? you say (iirc) that keys are automatically regenerated and not verified. so it's really anonymous (not pseudonymous). so there's no way to be sure two comments are by the same person? even in the same discussion? since the encryption is useless (mitm) yet you're not actually anonymous to an attacker (ip) it seems to combine the worst parts of insecure software with the worst parts of forums (no reliable identities). [edit: sorry, updated the above slightly. ok, so there's some forwarding of messages which makes people more anonymous if an attacker doesn't see all the network. pre-snowden that might have seemed worth something.]

rolleiflex 13y ago
> how does it know who else to talk to? There is a bootstrap node, which you connect to at the beginning of your first boot. Connecting to that node gets you a list of posts and a a list of nodes, like every other sync with any other node. You can opt out of connecting to boostrap node if you have a friend you know to be currently online, and putting his / her ip:port at the settings page of the onboarding. >it seems that by saying things are anonymous you punt on all questions of identity? so there's no way to know that you are joining the forum you expect? The forums only exist as names, there is no way to have two forums with the same name, they will automatically be merged. (There is two bitcoin topics currently, that's a corner case I'm fixing now) But there is no way to know who you are actually talking to, yes. I'm planning to add public key authentication in the future at the point I am reasonably confident the core stack is working reliably and there is sufficient interest. > it uses tls so it's just direct connections? so you're identified by your ip? Yes, it's only direct connections, but when you connect to someone, it also gives you posts from other people the guy you connected to have upvoted. You're identified by your node id, which can hold multiple users. It's probably more correct to say it identifies computers, rather than people. But it's easy to change, just delete the userprofile.json and you'll automatically produce a new one.

rolleiflex 13y ago

> how does it know who else to talk to? There is a bootstrap node, which you connect to at the beginning of your first boot. Connecting to that node gets you a list of posts and a a list of nodes, like every other sync with any other node. You can opt out of connecting to boostrap node if you have a friend you know to be currently online, and putting his / her ip:port at the settings page of the onboarding. >it seems that by saying things are anonymous you punt on all questions of identity? so there's no way to know that you are joining the forum you expect? The forums only exist as names, there is no way to have two forums with the same name, they will automatically be merged. (There is two bitcoin topics currently, that's a corner case I'm fixing now) But there is no way to know who you are actually talking to, yes. I'm planning to add public key authentication in the future at the point I am reasonably confident the core stack is working reliably and there is sufficient interest. > it uses tls so it's just direct connections? so you're identified by your ip? Yes, it's only direct connections, but when you connect to someone, it also gives you posts from other people the guy you connected to have upvoted. You're identified by your node id, which can hold multiple users. It's probably more correct to say it identifies computers, rather than people. But it's easy to change, just delete the userprofile.json and you'll automatically produce a new one.