look; I like delta chat. a lot.
but I work in cybersecurity.
I can tell you went from zero to a perfect ten on unreasonably defensive so... maybe it's good for you to take a breather, regroup...
basics (free advice):
- webxdc should include a link to the source code in each zip file (not just a minified zip) (this is part of how fdroid's repository works)
- webxdc should link to an author's website, and prove they control it (supply chain provenance)
- should check for updates vs the latest zip file
- it's a very, very (very) bad security smell to immediately dismiss a trivially obvious security concern
Risotto Bias
npub1g5…28tcf
2025-03-28 15:41:59 UTC
in reply to nevent1q…vpnc
Author Public Key
npub1g5c0qqgqkegm8fmhq9pqr7gw0803dww6mmj0gpxkc6gsqwk4dqgqz28tcfSeen on
wss://relay.momostr.pinkPublished at
2025-03-28 15:41:59 UTCEvent JSON
{
"id": "d5f59fdaf0c62b9d18f9416ad3ecb089d6c68d7cbb34182aa58ea83189bb4dee",
"pubkey": "4530f00100b651b3a777014201f90e79df16b9dadee4f404d6c691003ad56810",
"created_at": 1743176519,
"kind": 1,
"tags": [
[
"p",
"cfa4990670e555c3bbe1e0bbe5119e0025e9be1c369fd99951cb343d5ee52149"
],
[
"proxy",
"https://tech.lgbt/@risottobias/114240816375249515",
"web"
],
[
"e",
"35644d82a6bc04bf7d24ec2e9f3334ab20f5b9dd1eafccc7b176663f261ee051",
"",
"reply",
"f202d7a843c41d717dddf6cb013d6ef689f44f12214c6ed421b484020aec2208"
],
[
"p",
"4530f00100b651b3a777014201f90e79df16b9dadee4f404d6c691003ad56810"
],
[
"p",
"f202d7a843c41d717dddf6cb013d6ef689f44f12214c6ed421b484020aec2208"
],
[
"e",
"75b72e07f47e744a845e726698769c3ec73d9ef3d89bd782614e1a410e3facba",
"",
"root",
"f202d7a843c41d717dddf6cb013d6ef689f44f12214c6ed421b484020aec2208"
],
[
"proxy",
"https://tech.lgbt/users/risottobias/statuses/114240816375249515",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://tech.lgbt/users/risottobias/statuses/114240816375249515",
"pink.momostr"
],
[
"-"
]
],
"content": "look; I like delta chat. a lot.\n\nbut I work in cybersecurity.\n\nI can tell you went from zero to a perfect ten on unreasonably defensive so... maybe it's good for you to take a breather, regroup...\n\nbasics (free advice):\n\n- webxdc should include a link to the source code in each zip file (not just a minified zip) (this is part of how fdroid's repository works)\n- webxdc should link to an author's website, and prove they control it (supply chain provenance) \n- should check for updates vs the latest zip file\n- it's a very, very (very) bad security smell to immediately dismiss a trivially obvious security concern",
"sig": "8bea17d6da7888858d8b09a97b96f54d076cf3b9fa6ae2c7d1f0ab55de04ab86bb7cd08e28c659a7802985984fc9657eda125a8524638373e3adf76e2bd6c713"
}