{"action":"created","issue":{"url":"https://api.github.com/repos/ircv3/ircv3-specifications/issues/207","labels_url":"https://api.github.com/repos/ircv3/ircv3-specifications/issues/207/labels{/name}","comments_url":"https://api.github.com/repos/ircv3/ircv3-specifications/issues/207/comments","events_url":"https://api.github.com/repos/ircv3/ircv3-specifications/issues/207/events","html_url":"https://github.com/ircv3/ircv3-specifications/issues/207","id":129798925,"number":207,"title":"STS considered harmful - shouldn't be in 3.3 core spec","user":{"login":"kaniini","id":1522444,"avatar_url":"https://avatars.githubusercontent.com/u/1522444?v=3","gravatar_id":"","url":"https://api.github.com/users/kaniini","html_url":"https://github.com/kaniini","followers_url":"https://api.github.com/users/kaniini/followers","following_url":"https://api.github.com/users/kaniini/following{/other_user}","gists_url":"https://api.github.com/users/kaniini/gists{/gist_id}","starred_url":"https://api.github.com/users/kaniini/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kaniini/subscriptions","organizations_url":"https://api.github.com/users/kaniini/orgs","repos_url":"https://api.github.com/users/kaniini/repos","events_url":"https://api.github.com/users/kaniini/events{/privacy}","received_events_url":"https://api.github.com/users/kaniini/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-01-29T15:31:22Z","updated_at":"2016-01-29T16:06:16Z","closed_at":null,"body":"Not to be that guy, but I question why STS should be a core component.\r\n\r\nSTS as a method to advertise 'secure-preferred' is harmful.  Security as a *preference* implies that a connection *without* security is also somehow accepted.  In practice, this means that conversations can still be compromised by an unencrypted user, because very few people use `+S` and equivalent channel modes.\r\n\r\nThe real solution for secure IRC usage, must be TLS from the first byte, as the STS implementation leaks metadata (specifically, if you `/server irc.indymedia.org` for example, an attacker doing passive sniffing now has metadata that you attempted to connect to `irc.indymedia.org`).  Using DNS SRV records would actually be an appropriate solution here.\r\n\r\nMandating STS as a solution to the IRC security problem is half-baked at best, and worse, encourages the status quo to continue (since there is a downgrade path).  STS is also ineffective in the IRC environment without dependence on CAs or fingerprinting, which should be included in the STS declaration (but the spec does not really mention this).\r\n\r\nI suspect that adding things to the core like STS will result in many vendors simply ignoring that component of the spec, thus diluting the meaning between \"core\" and \"extension\".\r\n\r\nA better solution would be to publish a \"best operational practices\" document which includes this and other advice about operating secure IRC networks.  If that is acceptable, I will be happy to contribute a draft for one."},"comment":{"url":"https://api.github.com/repos/ircv3/ircv3-specifications/issues/comments/176838600","html_url":"https://github.com/ircv3/ircv3-specifications/issues/207#issuecomment-176838600","issue_url":"https://api.github.com/repos/ircv3/ircv3-specifications/issues/207","id":176838600,"user":{"login":"kaniini","id":1522444,"avatar_url":"https://avatars.githubusercontent.com/u/1522444?v=3","gravatar_id":"","url":"https://api.github.com/users/kaniini","html_url":"https://github.com/kaniini","followers_url":"https://api.github.com/users/kaniini/followers","following_url":"https://api.github.com/users/kaniini/following{/other_user}","gists_url":"https://api.github.com/users/kaniini/gists{/gist_id}","starred_url":"https://api.github.com/users/kaniini/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kaniini/subscriptions","organizations_url":"https://api.github.com/users/kaniini/orgs","repos_url":"https://api.github.com/users/kaniini/repos","events_url":"https://api.github.com/users/kaniini/events{/privacy}","received_events_url":"https://api.github.com/users/kaniini/received_events","type":"User","site_admin":false},"created_at":"2016-01-29T16:06:16Z","updated_at":"2016-01-29T16:06:16Z","body":"Don't know, but it needs to be addressed.  I will *not* merge support for this until such time that it is addressed.\r\n\r\nAs I said earlier, \"under no circumstance is your typical IRC network ready to deploy this\"."}}