Bjarni |grep -i tech / is on Nostr

Full time FOSS developer! Mailpile. Pagekite. Passcrow. Duppy. Also an Icelandic dad.

Last Notes

2024-01-27 18:06:39

- reply

@npub18kf…npv5 NoisySquare was great!

2024-01-27 17:41:27

$NewJob and $NewLife in $NewCity are all taking up so much of my headspace that I've had very little time to work on #moggie or any other passion projects lately.
In particular, this has impacted my @npub18kf…npv5 grant work - I am still finding time to make progress on the code, but I just can't seem to bring myself to writing blog posts and pushing things over the line required to achieve the milestones.
I should push to github more often tho. Code *is* getting written...

2023-07-28 16:29:54

- reply

That's this code: https://github.com/mailpile/Mailpile/blob/master/mailpile/conn_brokers.py
The connection broker uses with-block to selectively monkey patch the socket library, so third party code would make outgoing #TLS and/or #Tor connections according to a configurable security policy.
Pretty cool! I have yet to port this to #moggie, but I will for sure.
The security researcher just grepped and skimmed, they missed the fact that not only did I solve the problem, I knocked that one out of the park.
I politely told them so. ;-) (3/3)

2023-07-28 16:23:38

- reply

In #Mailpile v1, I one of the bits of code I spent the most time on, was exactly that - the TLS validation system.
At the time (it has improved since), Python's standard libraries made it almost impossible to make secure outgoing connections.
And TLS issues were hard to troubleshot. And because we had Opinions(tm), we wanted to sometimes use a TOFU policy for certs, and CA-based security at others. And sometimes we wanted to connect over Tor. But not always.
Thus: the Connection Broker. (2/n)

2023-07-28 16:18:36

Got another one of those "your project has a vulnerability!" e-mails, about the old Mailpile code-base.
Sometimes I ignore these (especially if they are fishing for bounties), sometimes I engage... it depends. In my experience they are almost always wrong and it can be a bit tiresome to keep explaining why their heuristics are wrong.
In this case they were claiming we were making insecure, unverified TLS connections.
So I kinda had to respond! (1/n)

2023-07-21 15:52:40

Reflecting a bit more on the fact that I should probably be promoting my work a bit more...
Do any of y'all know of any podcasts or Youtube channels or the equivalent, which might be interested in chatting with me about:
1. moggie - the Mailpile reboot
2. upagekite - public webservers on ESP32 microcontrollers
3. passcrow - password/key recovery for local encryption
Any suggestions?

2023-04-28 21:46:14

Current status: Experimenting with beer fueled documentation-driven development.
What is documentation-driven development? DDD is obviously when you write some docs first, to flesh out what the software is supposed to do, and then do whatever it takes to keep your promises later on.
I know how to Friday night!