Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > rocksolid.programming > #197 > unrolled thread

Re: pgp would be nice

Back to article view | Back to rocksolid.programming

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: pgp would be nice Anonymous <poster@anon.com> - 2020-12-28 05:16 -0800
    Re: pgp would be nice Retro Guy <retro_guy@retrobbs.rocksolidbbs.com> - 2020-12-30 23:08 -0700

#197 — Re: pgp would be nice

>>2ddb23cb6be90293b7
>Trying to think of good methods to make it simple for end users to want to participate.

I can see two basic ways: 
1) either the nodes offer a piece of js that does the signing (possibly using a local config file) and attaches a file with the signed message automatically when posting.
2) we write a little client to do that (could be in any lanuguage, gui or cli). Then the user would have to download that client and run it locally. To be precise, I don't mean to write a browser here, just some lines to take text and sign it, then make a POST to a predefined node.

Either way, the user would have to trust the code, which might be a showstopper for some already (those would have to do their own coding or do all the steps manually).
In the first case, js would have to be enabled in the browser which is a moot point for many. So I guess the second way is the better one.
Of course this could also be done as a plugin for the browser, but this would be sort of the same as js (from a security point of view, guess it is better to decouple this from the browser).
So the easiest way would probably be to write a shell script that acts as a wrapper for
-an editor to compose the message,
-pgp to make the signature and produce the signature files, and
-curl to make a POST stream to one of the nodes, including all necessary data like username/password, the message and the signature file.
To make it nice, we could give a qt-gui or somesuch.
This local client could be called from links on the webpage of the node, those could also transport additional information so that answering to a message does not require to manually fill the subject and reply-id.
Of course this kind of client software would have to be specific for the OS of the user (so would probably exclude IOS/Android/Windows unless somebody would write code for those - I will most probably not :-), or we use java).
But all of this sounds very doable to me. And not only would it be a supernice way to manage identities for those who want them, it would also enable various ways of flood protection (should we ever need it).
I think I will put that on the todo list.
Maybe the person posting all this stuff on /social has some kind of local solution already.

cheers

trw

-- 
Posted on def2

[toc] | [next] | [standalone]

#210

On Mon, 28 Dec 2020 05:16:29 -0800
Anonymous <poster@anon.com> wrote:

> >>2ddb23cb6be90293b7
> >Trying to think of good methods to make it simple for end users to
> >want to participate.
> 
> I can see two basic ways: 
> 1) either the nodes offer a piece of js that does the signing
> (possibly using a local config file) and attaches a file with the
> signed message automatically when posting. 2) we write a little
> client to do that (could be in any lanuguage, gui or cli). Then the
> user would have to download that client and run it locally. To be
> precise, I don't mean to write a browser here, just some lines to
> take text and sign it, then make a POST to a predefined node.

Either way and the user must trust the code of course. If it's a matter
of trust, maybe javascript is the easiest way. If you allow the js, you
can sign, if you don't it's just a feature you don't use.

Currently, rslight uses javascript for two simple things:

1. When you click 'quote' on replying to a message, it puts the quote
in the text box for you. 

2. Displaying times for posts in your local time (or UTC if js disabled)

Either one of these things is not very important, so if you don't
enable javascript they won't work, and that's not really a big deal.

I would think signing a message could be the same. The support is there
in the software, and it's up to the end user whether to use it or not.

Also, another idea:

rslight currently adds a hash to all outgoing messages built from the
the message and header, and the site key. This is sort of a
signature that shows the post is really from this site. Adding the
username is very simple to do, plus all rslight users have a key in
their config (for encrypted messages and maybe future stuff).

Then there would need to be trusted communication between nodes to
share this trust. I think we'd like to do this for other
features/reasons also, so it could be useful.

Thoughts?

[toc] | [prev] | [standalone]

Back to top | Article view | rocksolid.programming

csiph-web