8 ms·
Ring, officially a GNU package
- reitanqild 10y agoOfficial web page seems to be https://ring.cx/ https://ring.cx/
- 0xmohit 10y agoAnd https://ring.cx/en/about/practical https://ring.cx/en/about/practical contains more details about the project. Source repositories located at https://gerrit-ring.savoirfairelinux.com/#/admin/projects/ https://gerrit-ring.savoirfairelinux.com/#/admin/projects/ (Uses gerrit!)
- metilda 10y agoHas ring improved much? I remember a few months back it used 28gb of background data over LTE (which was fine since I'm uncapped) on my phone, and was less stable than sflphone, which would randomly stop registering occasionally. I can recommend pjsip though, very reliable so long as you read its docs before writing a script to leverage it.
- irl_ 10y agoFor voice I've found it to be quite stable, the video features a little flaky though. Sometimes it would work, sometimes it just wouldn't.
- joecool1029 10y agoHow was your battery life with that? And most mobile clients use pjsip, at least non-commercial ones (aside from popular sipdroid). I don't know what Bria uses but if I lose signal it slams my battery. Unfortunately it also works best for my commercial line. Csipsimple is an android implementation of the pjsip library. Taki is another for BB10. They are both fairly reliable. I don't know any on iOS (sry).
- Ruud-v-A 10y agoThis appears to be something phone-related, not the Ring cryptography library written in Rust based on Boringssl. (https://github.com/briansmith/ring https://github.com/briansmith/ring)
- Rovanion 10y agoNeither is it the Clojure web server library https://github.com/ring-clojure/ring https://github.com/ring-clojure/ring.
- frumiousirc 10y agoWhat stops attackers from poisoning the DHT? Could one publish false name <--> IP address associations?
- ycmbntrthrwaway 10y agoCryptography. Identity is not simply a name. You don't choose it but generate.
- magila 10y agoThe crypto would stop you from actually impersonating the target, but you could easily DOS someone by flooding the DHT with bogus data for their id. Edit: You could also get the IPs of all the people trying to contact the target.
- fulafel 10y agoThere seems to be no browseable source code around, what are the implementation language(s)? I want to know whether the protocol implementations are written in a memory-safe language.
- coolguy132435 10y agocheck Contribute > Build instructions
- aban 10y agolibring (or ring-daemon) is written in C++. P.S. I couldn't find any browseable source either, so I cloned their repo.
- irl_ 10y agoThe DHT system for identities is cool, but the thing that gets me is that they don't have support for SRTP with ZRTP, only SRTP with SDES. There's no perfect forward secrecy, and a bunch of other features that ZRTP has. https://www.silentcircle.com/products-and-solutions/technology/zrtp/#why-is-the-zrtp-protocol-better https://www.silentcircle.com/products-and-solutions/technolo...
- nextos 10y agoYes, that's true. A more comparable thing to Signal is Matrix [1] and it's client Riot [2]. Theoretically, it has perfect forward secrecy. It's not as distributed as Ring is, but there is no centralized server as in Signal either. Riot is also in F-Droid. So while not a GNU member, I find it sufficiently open and free. A totally distributed approach with forward secrecy is Tox [3]. It needs a good code audit, though. And as in Ring, P2P causes data consumption issues in mobile. [1] https://matrix.org/ https://matrix.org/ [2] https://riot.im/ https://riot.im/ [3] https://tox.chat/ https://tox.chat/
- akermu 10y agoI think you meant "but there is no centralized server as in _Signal_ either"
- nextos 10y agoFixed, thanks.
- drdaeman 10y agoAFAIK, Matrix identity servers system isn't really decentralized yet. They're working on this, but it's not there yet. Just saying.
- qwertyuiop924 10y ago...No, not unless you're converting from an external ID. Matrix IDs are decentralized, last I checked.
- geofft 10y agoWhat's the advantage of being a GNU project these days? It seems like it ties you very strongly to the FSF's political opinions and in particular Richard Stallman's political opinions (e.g., eugenics) and restricts your technical decision-making options (e.g., limited plugin architecture, limited support for non-free OSes, mandatory support for things like GNUTLS), while not giving you very much in return - with the existence of GitHub and a wide variety of competitors, it's pretty easy to attract a healthy development community independent of GNU. What am I missing?
- davexunit 10y ago>seems like it ties you very strongly to the FSF's political opinions Some are happy to be associated with the opinion that all software should be free. >in particular Richard Stallman's political opinions (e.g., eugenics) Richard Stallman's opinions, outside of the realm of free software, are irrelevant in the context of the GNU project. Throwing out eugenics like that feels manipulative to me. >restricts your technical decision-making options The next few paragraphs will explain why what you see as restrictions aren't seen the same way from the perspective of GNU developers. >limited plugin architecture You are of course referring to exposing the AST of GCC to other (possibly proprietary) programs, which was a GCC-specific issue. It doesn't broadly apply to everything. I help maintain GNU Guix, a project designed from the ground up to be as extensible as possible, and there has been no such issue. Nor does GNU Emacs have an issue with extensibility. >limited support for non-free OSes I think this is distorting the truth a bit. The point is that the focus of the GNU project is to develop a fully free operating system, and maintainers should focus their efforts accordingly. That doesn't mean that GNU software shouldn't work well on other, proprietary operating systems, and maintainers shouldn't reject patches from contributors that add or improve such support unless it adds a significant burden. Bottom line is: GNU software should work the best on the GNU system, which seems sensible to me. The GNU maintainer guidelines go into more detail about this topic. >mandatory support for things like GNUTLS Software in the GNU project should work well with or use other software in the GNU system. Again, those that participate in the GNU project think this is positive, because GNU should form a cohesive whole, just like MacOS or Windows should. >while not giving you very much in return GNU and the FSF give Guix a place to host many Git repos, space for a website, several mailing lists, a bug tracker, they colocate our hardware in their datacenter, give us virtual machines on their own servers, handle donations, and promote our releases. I think it's a pretty great deal given the project is philosophically aligned with the free software movement. >With the existence of GitHub and a wide variety of competitors I wouldn't call GitHub a competitor. GitHub is just a code hosting site, GNU is a unified project with a political mission. >What am I missing? Hopefully I've helped answer this question.
- themihai 10y agoIs there a well-known discovery document or any other way to create shortcuts for the ringID? (i.e. mapping it somehow to web or email address) I doubt many fancy spelling ringIDs.
- qwertyuiop924 10y agoWhy this over Tox, Psyc, or Matrix? There doesn't seem to be much benefit...
- snvzz 10y agoI hear tox has been approached before, but they were uninterested. Remember GNU requires transferring rights to the FSF, which many aren't comfortable with. I personally favor tox, because ec25519 and full forward secrecy. Also, not fond of SIP.
- qwertyuiop924 10y agoWell, that explains some of it. I heard tox needs a code review. Has its security been verified in any way?
- paroneayea 10y agoGNU developer here (MediaGoblin lead developer). GNU projects get to decide whether or not to do copyright assignment to the FSF. As an example, MediaGoblin and Guix don't require copyright assignment, while Guile does.
- sitkack 10y agoI have interacted with Tox core devs, the exchange was not pleasant. The overlap between professional and mature (both in social and engineering aspects) seems to very slim in the security space.
- qwertyuiop924 10y agoWhat did you expect? You know where they come from, right? If you don't, they come from 4chan. So yeah... But they got accepted into GSoC as a mentor project, so they can't all be bad.
- Mindless2112 10y agoSeems like it's not possible to change your password after you use it to create a Ring ID...
- chatterbeak 10y agoLooks interesting, but there's nobody to try it with. Here's my ring id: ring:c4a328573fe93e6a7b797ea9b52d26361f7b754c
- GirlsCanCode 10y agoI was happy to see they have a native Windows version that actually looks like a Windows application and not some 80s era SunOS application. However, every time I tell it to grab my camera, it crashes. (This is on a very standard Windows Surface Book)
- alpb 10y agoLittle bit off-topic but: > respects freedoms and privacy of its users It downloads the binary over http on http://ring.cx http://ring.cx, makes it susceptible to tampering. Is serving binaries over HTTP a GNU thing because the expectation is that you would check the signature?
- brute 10y agoCare to elaborate? http://ring.cx http://ring.cx has a 301 forward to https://ring.cx https://ring.cx, and all the downloads seem to use https as well. Where is it using plain http? Or was the forward added in the last hour?
- teraflop 10y agoThe links on the "Downloads" page are HTTPS, but the download button on the home page points to http://gpl.savoirfairelinux.net/ring-download/windows/ring-windows-nightly-x64.exe http://gpl.savoirfairelinux.net/ring-download/windows/ring-w... with no security.
- brute 10y agoThank you, that explains it. For me, the same button links to https://ring.cx/en/download/gnu-linux https://ring.cx/en/download/gnu-linux but under windows you are right.
- alphapapa 10y agoCouldn't a MitM attack skip the redirect?
- strcat 10y agoSure, although not in mainstream browsers if there's HSTS + HSTS preloading, which can be easily adopted by any site. Outside browsers, HSTS is usually not supported. It was actually implemented by wget, but without preloading, so it only works after first use which is much less useful.
- snvzz 10y agoWhile I'm sure it's well-intended, it does have a couple of fatal flaws. * Lack of full forward secrecy means logged network logs can be decrypted in the future if an endpoint key is ever compromised. * e2e encryption is optional, due to legacy SIP support. This is extremely dangerous as it will no doubt lead to false sense of security, with users assuming they're safe just because Ring is the program they're talking through. Due to these two I cannot actually recommend it to anyone. Note that Tox got these two right, and is a pretty active project which gets commits semi-daily, regardless of the nonsense about it being dead that some party seems to be spreading.
- synchronise 10y agoe2e could be enforced for the DHT clients if the user states they aren't going to be using SIP though, right? Either way, I don't use SIP so that feature isn't a dealbreaker for me.
- snvzz 10y ago> e2e could be enforced for the DHT clients if the user states they aren't going to be using SIP though, right? That needs user intervention, which implies his understanding of why it is necessary. Here's a better idea, remove backwards compatibility. Perhaps they could release a separate SIP client under a different name. Just keep it away from Ring itself. Let Ring be actually secure.
- davexunit 10y agoThe Tox community is absolutely toxic, no pun intended. I have abandoned that ship.
- davidcollantes 10y agoI could not find this anywhere; do Ring uses a server (NAT traversal, or similar)? Thanks!
- davidbanham 10y agoAccording to the docs, it gives you the option deep in the settings to add your own STUN and TURN servers. It seems like it doesn't ship with any preconfigured. That makes it a non starter for me.