News for hackers. Stuff that matters.
Re:Shelter Protocol: End-to-End Encrypted, Fedederated, User... by Groxx on Saturday July 22, 2023 @04:11PM (#36829401)
Avoiding re-serialization does avoid a ton of issues, yea. Though I would suggest building in validation for e.g. no duplicate keys immediately, because unexpected duplicates are a common source of bugs and security exploits (e.g. it's a fairly common issue with http headers when requests cross multiple systems).
Re:Shelter Protocol: End-to-End Encrypted, Fedederated, User... by gslepak on Tuesday July 25, 2023 @12:24PM (#36864826)
After evaluating the various options, we seem to be settling on the idea that the protocol will specify that for duplicate keys, the handling must be the same as in browsers: meaning, the last key is the one that's used.