<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
On 09/10/2013 08:02 PM, Jurre van Bergen wrote:<br>
<span style="white-space: pre;">><br>
> On 09/10/2013 07:46 PM, Jacob Appelbaum wrote:<br>
> > Heya,<br>
><br>
> > There exists an information leak in Pidgin/Pidgin-OTR
where Pidgin<br>
> > doesn't allow Pidgin-OTR to encrypt a specific message
before it is sent<br>
> > to the network. Specifically on IRC networks, users who
emote through<br>
> > the use of a message such as `/me thinks this is a bug`
- will leak the<br>
> > full text of their /me command.<br>
><br>
> > This is annoying and it would be nice if Pidgin didn't
treat /me<br>
> > messages in this way. It appears that around the same
time as learning<br>
> > about this bug, I found a bug report with a fix for
Pidgin itself.<br>
><br>
> > If there are any Pidgin/Pidgin-OTR users on this list
who also use IRC<br>
> > with Pidgin, it would be great to see if the following
patch fixes the<br>
> > behavior of /me on irc:<br>
><br>
> > <a class="moz-txt-link-freetext" href="https://developer.pidgin.im/ticket/15750">https://developer.pidgin.im/ticket/15750</a><br>
><br>
> > This could also be fixed inside of Pidgin-otr - though I
think the right<br>
> > place is inside of Pidgin itself. It would be useful if
IRC using<br>
> > Pidgin-OTR developers could test the patch attached to
ticket 15750 on<br>
> > the Pidgin bug tracker.<br>
><br>
> > Useful questions to answer:<br>
><br>
> > Does it solve the /me info leak for you? Does it cause
any adverse<br>
> > issues? Does it make sense to put this into Pidgin-OTR?<br>
><br>
> > All the best,<br>
> > Jake<br>
><br>
><br>
> I tested this patch a few weeks ago and it doesn't fix the
current issue<br>
> in IRC while being in an OTR conversation.<br>
><br>
> Jurre<br>
></span><br>
A rectification is in place here, I reviewed a patch from Thijs back
in July, the patch has changed now which I haven't reviewed yet.<br>
<br>
Jurre<br>
<br>
<br>
- -- <br>
Give a man a fish and you feed him for a day; teach a man to fish
and you feed him for life.<br>
<br>
Jabber: <a class="moz-txt-link-abbreviated" href="mailto:drwhax@jabber.ccc.de">drwhax@jabber.ccc.de</a><br>
Fingerprint: 79C9BECD 4841247F 7318BD12 8CFD6413 5476FE92<br>
<br>
<br>
I like my email encrypted, please consider using my GPG key.<br>
<a class="moz-txt-link-freetext" href="http://jurrevanbergen.nl/jurre.asc">http://jurrevanbergen.nl/jurre.asc</a><br>
My fingerprint is: 2976 FD1A 2ABE FB14 3907 58CE B739 2967 EA80 1D02<br>
<a class="moz-txt-link-freetext" href="http://jurrevanbergen.nl/">http://jurrevanbergen.nl/</a><br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.12 (GNU/Linux)<br>
<br>
iQEcBAEBAgAGBQJSL6r0AAoJELc5KWfqgB0CQbgH/ie6cFlWAyoxqGHFYa4L0e7N<br>
MnEqsV5KsLYSqIn8LUfBYVwl9zCJ7KEfLkV4MwAkDrPOYQH4CA9DiWqo5N/ykXfO<br>
wzenk2vwiRNP6SgSyG2NBmompg0OOwFDhGzuvvVwhOOBgW4gKZTIHBeGlV72jIvY<br>
2Hj4J8UNoUVCqwfv1jgPOT5u/yHzedNYxPyieG8nJOyIoU1A8ShqDFTCz/sjSiNu<br>
+/yADolm8j7CsXEzDXetuqDQ3GABXsrtVhSpRYYWUu3BGT3tM/7dPHP4NcG23PLz<br>
XkISS2ekALbk1u1XvTzTAUUPgLUbc8knHiRMdZoaZXEMvhYOyw2pbopYh1rPip4=<br>
=iLNL<br>
-----END PGP SIGNATURE-----<br>
<br>
</body>
</html>