Status Update 2022/9/11 | Poal: Say what you want.

1.3K

•

Status Update 2022/9/11

From now on I'm going to post status updates there as well as here, in order to increase visibility for the extension and hopefully get other people that want to help to notice.

Went through some more of the svelte tutorial. I think I'll wait until tomorrow or even later before I try to start working on a design/implementing the prototype proper.

I was thinking about the design some more. By default all urls that are sent from the extension should be securely hashed, without the original url ever being known by the server. This will again help user privacy, since even if you have access to the server, you can only tell the website users were commenting on if you happen to guess the url, or brute force it. In addition, I can even use the url with a salt appended to encrypt the comments. In this way, in addition to not knowing what the url is, you couldn't even read the comments unless you knew the url beforehand.

The extension will also always remove all the data after the '?' in a url before hashing it and sending it to a server. Anything after the '?' is where all the personal info is supposed to go. But incase a website developer is stupid enough to design their urls like http://foo.com/<userid>/<account>/<password>/<ssn>/<... other personal details, etc. ...>/, then because of the above, regardless if the user comments on it, the url won't be visible to anyone else including the server owner.

The above is something the original gab dissenter plugin didn't do, BTW. Anytime a user commented the original dissenter sent everything before the '?' in the url to the gab owned server. I guess they did that so they could maintain a list of 'hot' urls where everyone was commenting to show everyone, like the "trending" data on twitter. I could probably do something like that by having a threshold where if, for example, over 50 users commented on a url, then the next time a user commented on it, it would be released in plaintext to the server. But it'd be kind of messy to implement, and there is a security hole because the server could just lie and tell the extension that 50 users commented on it, so they would release the plain text.

I thought of other idea to help prevent spam by a great deal but I'm too tired today so I think wouldn't be able to explain it well, so I will wait until tomorrow.

Thanks for reading.

Didn't get much sleep last night. Felt a little off because of it I so did some grunt work. I came up with an initial logo, pretty basic, but it'll do for now. I also setup gpg for email and initial github repository and updated the README. Here it is: https://github.com/captaindirgo/captaindirgo-browser-ext From now on I'm going to post status updates there as well as here, in order to increase visibility for the extension and hopefully get other people that want to help to notice. Went through some more of the svelte tutorial. I think I'll wait until tomorrow or even later before I try to start working on a design/implementing the prototype proper. I was thinking about the design some more. By default all urls that are sent from the extension should be securely hashed, without the original url ever being known by the server. This will again help user privacy, since even if you have access to the server, you can only tell the website users were commenting on if you happen to guess the url, or brute force it. In addition, I can even use the url with a salt appended to encrypt the comments. In this way, in addition to not knowing what the url is, you couldn't even read the comments unless you knew the url beforehand. The extension will also always remove all the data after the '?' in a url before hashing it and sending it to a server. Anything after the '?' is where all the personal info is supposed to go. But incase a website developer is stupid enough to design their urls like http://foo.com/<userid>/<account>/<password>/<ssn>/<... other personal details, etc. ...>/, then because of the above, regardless if the user comments on it, the url won't be visible to anyone else including the server owner. The above is something the original gab dissenter plugin didn't do, BTW. Anytime a user commented the original dissenter sent everything before the '?' in the url to the gab owned server. I guess they did that so they could maintain a list of 'hot' urls where everyone was commenting to show everyone, like the "trending" data on twitter. I could probably do something like that by having a threshold where if, for example, over 50 users commented on a url, then the next time a user commented on it, it would be released in plaintext to the server. But it'd be kind of messy to implement, and there is a security hole because the server could just lie and tell the extension that 50 users commented on it, so they would release the plain text. I thought of other idea to help prevent spam by a great deal but I'm too tired today so I think wouldn't be able to explain it well, so I will wait until tomorrow. Thanks for reading.

(post is archived)