Avatar
Tristan Brice Velloza Kildaire
d6149823c90c4865e4bc434a4be1a1ee8f72aabd8328dd059ba4f11f7633b0b6
Computer programmer 🧑‍💻, wine drinker 🍷, opinion haver 🗣️, Roman Catholic ✝️ I have quite a keen interest in compilers, operating systems, routing and food. XMR: 43jx2gRMRxBauz2gwKTb9VJyUqKNg7wVPVVhQd32cgUA6WGhs2haJXAHfrdTzTKdYfeGEbDT8FtkF45sKMAEyasWRSyG5Sj BTC: bc1qkvduq9rwray2ymrvkrven3m8vsp9ah55f4hnc4 SimpleX: https://simplex.chat/contact#/?v=2-7&smp=smp%3A%2F%2Fhpq7_4gGJiilmz5Rf-CswuU5kZGkm_zOIooSw6yALRg%3D%40smp5.simplex.im%2FG0HWkVbLHEAC38X3oPTL6iOLZnJ0gC32%23%2F%3Fv%3D1-3%26dh%3DMCowBQYDK2VuAyEAc_KgxEP05S0o28ZO2FoaWC-fmRPWsjRUYNGTiE9N-y8%253D%26srv%3Djjbyvoemxysm7qxap7m5d5m35jzv5qq6gnlv7s4rsn7tdwwmuqciwpid.onion
Replying to Avatar hodlbod

**Security Update**

I've got some bad news for you guys. This morning, as I was adding error handling to flotilla, I discovered that Coracle has been sending user session objects to bugsnag when reporting errors.

Who is affected: Users who triggered an error in Coracle while signed in with their private key, since December 5th 2023.

What I've done:

- I immediately released a new version of Coracle, both to web and to zap.store

- I have deleted the affected apks from my releases

- I have deleted all my error data from bugsnag

- I have deleted my bugsnag project and rotated my api key, so lingering error reports will be dropped

- I have audited my code for use of the session object to ensure nothing else like this is happening

What you should do:

- If you're logged in with your private key, log out

- Hard refresh the page to ensure you have the latest version of Coracle

The bottom line is that if you signed in to Coracle with your private key, it has been shared with me and with bugsnag. In practical terms, your keys should still be secure, since they were sent over TLS, and have been deleted. But there is no guarantee I can offer that they are in fact gone.

I take my users' privacy seriously. My error reporting implementation doesn't record user IPs, it redacts identifying data, and it allows users to opt-out. I also warn the user when they attempt to enter an nsec into a text field. In this case, I simply screwed up, and I sincerely apologize. Reply to this note if you have any questions.

Respect for the full disclosure

Yeah I don't recall it using Meshtastic?

Like I never investigated how the RNode's communicate but I never thought they would be using the Meshtastic protocol buffers?

That is what my parents tell me at least. I have never bought a television. Nor would I pay a license for one 😂😂, given the context here.

SABC is still around, yes.... 😂

The gift that keeps on giving...

If I hate any state, including Israel.

Am I an anti-semite then?

In ZA they do but I still don't agree with the mechanism. The state broadcaster here did not homestead every channel/band so they can't make a claim to it like that.

Yet, in ZA to buy a TV you must actually have a license. It is bizarre.

Not required for a radio though, I believe.

All a scam

It is filmed kinda weirdly. Maybe fake but to make a point that we all know is worth making.

"Can't pay for something you never signed up for". Merely, saying that my TV could pick it up isn't justification.