Thread

Radicle: Disclosure of Vulnerability in the Network Protocol

154 points · 58 comments · lostmsu

iamnothere · 1790188016 · focus · HN ↗
Glad to hear they are moving to iroh instead of a custom protocol. This is the problem with rolling your own stuff.
As a bonus, this should help camouflage the traffic. (Iroh is becoming more common.)
1. innocent_name · 1790203877 · focus · HN ↗
  >this should help camouflage the traffic
  How? QUIC is easy to fingerprint and flow classificate:
  <a href="https://datatracker.ietf.org/doc/html/rfc9000#section-12.1" rel="nofollow">https://datatracker.ietf.org/doc/html/rfc9000#section-12.1
  Speaking of bold claims, Iroh, just like Radicle, are overselling themselves:
  >iroh's QUIC multipath implementation automatically switches between Wi-Fi, cellular, ethernet, LAN, LoRa, HaLow, Tor, Bluetooth—or bring your own transport.
  The thing is, QUIC multipath isn't standardized.
  1. iamnothere · 1790207948 · focus · HN ↗
    It should appear as encrypted iroh traffic. Depending on how radicle handles things, this could make it difficult to identify versus other applications using iroh. If needed, they could add noise or dummy traffic in the future for further obfuscation.
    They may be overselling, but I’ve had good experiences using apps built on it.

Unofficial Hacker News client; not affiliated with Y Combinator.