Hi! I just wanted to say thank you very much for making BentoPDF - I'm a big fan! It's a tool I use regularly and I'm always very happy that it's so intuitive and easy to use. I learnt about it from lemmy here (your post 8 months ago), btw!
The problem it's trying to solve is mostly straightforward. I'll provide a high-level overview so as to not complicate things (a lot of this is simplified):
When you create an account on signal, you create a private key and a public key. When you DM someone, you're communicating with your public keys (simplified). Your private keys remain with you. However, this creates a very big problem that's not new to signal, but has existed since TLS (previously SSL):
If you are trying to communicate with Bob over the internet, he's supposed to give you his public key over the internet.
But, how do you know that the person who replies to you with their public key is actually Bob? What if someone else gives you their public key and says they're Bob? The easiest way would be to physically meet Bob, and check whether the public key you received over the internet matches. However, this is impractical (live in different countries?).
TLS solved this with certificates. How do you know that the byte stream of data you're receiving from lemmy.world is really coming from Lemmy.world, and not malicious-lemmy.world? Because of certificates: someone you trust cryptographically said that the byte stream is really from lemmy.world. Your device with which you use to access the internet (phone, laptop, browser) comes with pre-installed certificates. Here's the list Mozilla ships with Firefox: https://ccadb.my.salesforce-sites.com/mozilla/IncludedRootCertificateReport
Solving this with signal isn't that easy. There's problems (users may change numbers / usernames), and general certification is... just not that simple. That's why, when you DM someone on signal, you can "mark safety number as verified" if you can verify that you both see the same number (you do this over a medium that isn't signal).
Signal is now introducing a solution called Key transparency (defined by the IETF: https://datatracker.ietf.org/doc/draft-ietf-keytrans-protocol/), which in essence says that your device periodically checks your own entry on a ledger that signal now hosts, and you can initiate a check of your contact's entry too.
If you notice your key on the ledger is wrong, something bad happened (malicious). If the other person's key on the ledger changed, then you should verify that it was indeed meant to change (new phone? New number? New username?). Because the server that provides the ledger could theoretically show different people different versions of the ledger, independent auditors attest the ledger, making conflicting views detectable (you might pull the wrong ledger from a malicious person, or signal may give you wrong ledgers maliciously). They're entrusting external parties to attest that the data that both parties of a DM get the correct view of the ledger.
This is what I understood after a cursory reading, and I may be wrong. It is also simplified. But I hope that this is mostly correct.
It's solving a very old problem of public-key cryptography: how do you ensure that the person who is talking to you claims who they are? Are you sure you're really talking to Bob, and instead not Mallory who's pretending to be Bob?
Just purchased a server license (for life). Not only is this update jam packed full of nice features, but a lot of their updates are. I've been self-hosting it (on a VPS) for the past year and it's about time I supported them
As long as caches have existed, very similar styles of side channels have been demonstrated since the late 90s. A lot of the terminology we use (flush+reload, flush+flush...) are attack techniques that have been already demonstrated on CPU caches, and these demonstrations are at least a decade old.
The one really big difference between the page-cache side channel and other side channels is the "monitor" primitive. There are methods that the OS provides which directly report the presence of a page in cache. These are syscalls like mincore (mitigated in 2019), preadv2 + rwf_nowait (unmitigated), and cachestat (mitigated in 2025).
With these syscalls, we don't even have to rely on timing information (is page access fast -> cached; is it slow -> not cached). These syscalls really set the page-cache side channel apart because you can nondestructively figure out whether a page is in cache.
I haven't seen anyone here mention Psyllium husk. I bought 450 capsules on Amazon (ew I know) and it's been a game changer for me. Seriously. I take two a day and that's been enough for me to be comfortable throughout the day, especially while traveling.
You can implement a counting-thread that's even more precise than the CPU's timer (TSC on x86) platforms. This was shown in attacks on Intel SGX, where the rdtsc instruction to access the time-stamp counter is unavailable.
I need a recognisable domain name website that google or duckduckgo has picked as the product.
This doesn't always work. For example, I used to (and still do) see a lot of fake websites when I l type revanced (https://revanced.app/) on duckduckgo, and I've nearly fallen for two of the fake ones before (I think two of .com / .org / .to...?)
Thankfully ublock origin warns users of this:
Otherwise, I'd have 100% downloaded some malware-loaded crap.
Not exactly what you asked, but do you know about ufw-blocklist?
I've been using this on my multiple VPSes for some time now and the number of fail2ban failed/banned has gone down like crazy. Previously, I had 20k failed attempts after a few months and 30-50 currently-banned IPs at all times; now it's less than 1k failed after a year and maybe 3-ish banned at any time.
There was also that paid service where users share their spammy IP address attempts with a centralized network, which does some dynamic intelligence monitoring. I forgot the name and search these days isn't great. Something to do with "Sense"? It was paid, but well recommended as far as I remember.
Edit: seems like the keyword is " threat intelligence platform"
Hi! I just wanted to say thank you very much for making BentoPDF - I'm a big fan! It's a tool I use regularly and I'm always very happy that it's so intuitive and easy to use. I learnt about it from lemmy here (your post 8 months ago), btw!