Mně se povedlo dostat skoro celou rodinu na MXChat (Matrix) a WhatsApp mám už jen kvůli práci – máme ho přemostěný do Matrixu, takže mi všechny zprávy chodí tam.

Volání přes most nejde, ale aspoň mi přijde notifikace, že někdo volal → pak buď otevřu WhatsApp a zavolám zpět, nebo zavolám normálně.

Jediná nevýhoda: WhatsApp stejně musí být v telefonu. Most totiž používá webové rozhraní (WhatsApp Web / linked device), takže telefon musí být připojený k internetu, aby to fungovalo. WhatsApp appka nemusí být pořád otevřená – stačí ji jen občas spustit.

We don't really know what it is, but there's something *besides* guns that causes it.

There has been an extremely significant uptick in mass schootings in the US in recent years, which isn't supported by a significant enough liberalisation of gun rights in that period. There has to be something else going on.

With that said, guns are a *necessary first step* that makes mass shootings possible, but there's more to them than just access to guns.

Whatever the trend is, even Europe isn't fully immune from it either, see e.g. the attacks in Berlin a few years ago where a person drove a truck into a large crowd of pedestrians. The tool is different, the effect is similar.

many servers will reject by default urls above 8k. But there are probably special setups out there.

Other things start to break when urls go beyond 64k. h2 may have a problem with its header handling (although headers are outside the stream's window size).

h3 will have problems with initial congestion windows where headers count for the window.

I think 64k would therefore be a limit that should not by itself pose problems.

Un touriste occidental, sûr de sa supériorité, à un citoyen russe : « Nous en Occident, nous avons le droit de critiquer notre gouvernement. »
Le Russe, surveillant du coin de l’œil le mouchard de service : « Et alors ? Nous aussi, nous avons le droit de critiquer votre gouvernement ! »

#pfffitt

replied here fosstodon.org/@arcanechat/1157…

ArcaneChat

2025-12-14 10:17:43

@david_chisnall by saying "requires phone numbers" I was implying that you can discover people by phone numbers since that is the case in 99% if not 100% of all apps that offer phone number registration, that you can disable this feature is meaningless if it is opt-out and most people will leave it like that, by saying ArcaneChat is immune to this I meant because you can't discover people like that, people must get in contact directly via QR or invite link

@arcanechat @ david_chisnall@infosec.exchange

It's obvious David doubled down on missing the point --thanks for the heads up

When you post something about a vulnerability in another messenger and completely misrepresent it, in a way that implies that you don’t understand the cause of it at all, it gives me no confidence in your system.

The root cause is nothing to do with phone numbers. It depends on two things:

• Being able to send messages to someone from some public identifier. Any messenger that doesn’t require an interactive flow for pairing devices (as some military systems do) has this feature.
• Receiving read receipts from messages. Signal allows you to turn off read receipts if you are concerned about information leaks from them.

If you actually wanted to convince people your system was better you would:

• Show that you don’t issue read receipts (which will put some people off because they are useful).
• Show how you mitigate this kind of attack, by rate limiting this kind of message, adding jitter to responses, and so on.

Email-based flows tend to not be vulnerable to this kind of attack because they do most of the processing on the server, so you’d only be able to probe the server. But you wouldn’t bother because email has so little metadata protection that you don’t need to bother with an attack like this. From what I know of DeltaChat’s group chat protocol, I suspect there is a way of triggering a similar attack by sending broadcast invalid messages and timing the error response. If you really wanted to convince people that your system is better, you’d show a security analysis that explains why I’m wrong, rather than just say ‘I don’t understand this attacks but the researchers who published it didn’t bother trying to attack the protocol I use and so I’m sure it is secure!’ That is exactly the attitude to security that makes me distrust DeltaChat.

Oh and before anyone jumps in with anything about XMPP: this attack is completely trivial on XMPP. Send an invalid iq stanza to the client’s bare JID and time the response. And this is impossible to fix without redesigning the protocol because unknown iq stanzas must be forwarded to the client to enable future extension and clients must respond with errors.