Post #1848884

2026-03-03 03:16 UTC

@danieltufvesson @kalleboo - AirConfig could use some kind of rudimentary cipher to encode/decode the data. Either something known only to the developer, or a secret password given to people who register their devices on the list.

Replies (3)

@danieltufvesson@mastodon.social 2026-03-03 03:24

@theirongiant @kalleboo Last year I actually wrote a web service for this that used preauthenticated URLs, so I have the framework. Problem I had was finding a suitable secret to use that is unique and known to each user/node to bootstrap the whole thing so I put it on hold.

Open ##1848885
@kalleboo@bitbang.social 2026-03-03 04:35

@theirongiant @danieltufvesson When I added the URL feature it was never the plan that I would become the default bootstrap for every new member joining the network, but nobody complained so I just kept it updated. If we're going to decide "this is the default method how people join” we could do better with a hard-coded URL in AIRConfig and a password screen instead

Open ##1848886
@kalleboo@bitbang.social 2026-03-03 04:59

@theirongiant @danieltufvesson I don't think encryption makes any difference, nobody is going to MITM a list of GlobalTalk IP addresses, this list doesn't contain any of the personal info from the sheet. But instead of a secret URL it should be behind a password that gets rotated between seasons.

Open ##1848887