diff options
Diffstat (limited to 'docs/client-feature-audit.md')
| -rw-r--r-- | docs/client-feature-audit.md | 123 |
1 files changed, 123 insertions, 0 deletions
diff --git a/docs/client-feature-audit.md b/docs/client-feature-audit.md new file mode 100644 index 0000000..38d710e --- /dev/null +++ b/docs/client-feature-audit.md @@ -0,0 +1,123 @@ +# Aegis Usenet client feature audit + +This audit separates a complete NNTP reader/poster from optional features that +would conflict with Aegis privacy and VFace goals. It is based on RFC 3977, +RFC 4642, RFC 4643, RFC 5536, RFC 5537, RFC 6048 and RFC 8054. + +## Current state + +| Area | Status | Notes | +| --- | --- | --- | +| Implicit TLS | Present | TLS 1.2 and 1.3, certificate validation by default. | +| STARTTLS | Present | Explicit TLS upgrade is available on servers exposing port 119. | +| AUTHINFO USER/PASS | Present | Password remains in memory and requires TLS. | +| AUTHINFO SASL | Present | PLAIN is used only after capability negotiation and TLS. | +| CAPABILITIES | Partial | Parsed, but capability-specific behavior is limited. | +| Group discovery | Present | LIST NEWSGROUPS, OVERVIEW.FMT, NEWGROUPS and NEWNEWS are available. | +| Overview | Present | `OVER` with `XOVER` fallback. | +| Article retrieval | Present | ARTICLE, HEAD, BODY, STAT, LISTGROUP and HDR are available. | +| Posting | Present | Direct NNTP posting with MIME, VFace and optional age/Ed25519 metadata. | +| Threading | Partial | Local thread trees and References-aware replies are available; tree UI remains. | +| Search | Partial | Basic overview filtering only; no indexed local full-text search. | +| Offline cache | Present | Local article metadata/raw cache and drafts use atomic 0600 JSON state. | +| Filters and scoring | Present | Generic deterministic local rules support classic headers, body, VFace and tags. | +| MIME and attachments | Partial | Text MIME works; attachment file selection/presentation remains. | +| Identity | Present | VFace profile, deterministic PNG, SHA-256 metadata and public verification link. | +| Identity verification | Present | Reader verifies VFace hashes, Face and Ed25519 body signatures locally. | +| OpenPGP/MIME posting | Deferred | OpenPGP is reserved for the YubiKey integration, not a standalone composer format. | +| SURB | Deferred | Kept separate from classic Usenet and body encryption. | + +## Complete client scope + +### 1. NNTP transport and account handling + +- server profiles with separate credentials, proxy and TLS policies; +- implicit TLS and STARTTLS with capability checks; +- AUTHINFO USER/PASS and capability-negotiated SASL; +- IPv4/IPv6, reconnect with bounded backoff and cancellation; +- capability cache scoped to a server profile; +- `COMPRESS DEFLATE` when advertised, with a user-visible opt-in only on + cleartext NNTP; it is rejected on every TLS connection; +- exact response-code handling and a diagnostic transcript that redacts + credentials, public-key URLs and article bodies. + +### 2. Group and article navigation + +- `LIST ACTIVE`, `LIST NEWSGROUPS`, `LIST OVERVIEW.FMT`, moderation metadata and + RFC 6048 list additions; +- `NEWGROUPS` and `NEWNEWS` for incremental discovery; +- `GROUP`, `LISTGROUP`, `OVER`, `HDR`, `ARTICLE`, `HEAD`, `BODY` and `STAT`; +- paging, first/last/next navigation, column sorting and cross-post awareness; +- thread trees from `References`, `In-Reply-To` and `Message-ID`; +- local read/unread state, bookmarks, tags, mute and collapse controls; +- raw article view plus normalized text view, always retaining original headers. + +### 3. Composer and posting + +- reply and follow-up generation with quoted text and correct references; +- draft storage and a recoverable outbox, never automatic duplicate reposting; +- explicit cross-post confirmation and `Followup-To` support; +- moderated-group detection and an `Approved` workflow only when the server + or moderator policy authorizes it; +- MIME multipart text and attachments, with strict size and line limits; +- age as the software encryption format; OpenPGP only through YubiKey; +- post result showing the server response and assigned article information. + +### 4. Local filters and scoring + +Filters should be local-only and deterministic. They should match headers, +VFace identity hash, public-key fingerprint, newsgroups, dates and optionally +body text. Actions should be hide, mark read, highlight, tag, mute thread and +save locally. They must never silently delete server articles, send network +requests, or rewrite a user's identity. + +Use RE2 regular expressions, bounded body reads and an explicit rule order. +Filter files should be portable JSON or TOML, with a schema version and a +dry-run preview. A filter that references a stable VFace key is intentionally +linkable and must be shown as such in the UI. + +### 5. Pseudonymity and privacy invariants + +- VFace is the only profile image mechanism: no upload, replacement or + alternate image format; +- private keys never enter settings, drafts, logs or crash + reports; +- `Path`, `Injection-Info` and `Xref` remain server-controlled trace fields; +- no local hostname, IP address, proxy address or real name is added to posts; +- `Message-ID` uses the neutral Aegis domain, not the From address domain; +- the configured SOCKS/Nym route is visible as a transport policy, not embedded + in article metadata; +- URL verification is opt-in metadata and is never fetched automatically; +- local caches and filter databases need an explicit location and retention + policy, with an option to purge them; +- optional features remain inside the audited main binary so their access to + network, files, article bodies and identity material is explicit. + +## Priority order + +### P0, remaining for a usable complete text client + +1. Add a visible thread-tree view and cache purge controls. +2. Add offline browsing of cached articles and drafts. + +### P1, interoperability and daily usability + +1. Add attachment file selection and reader presentation. +2. Add moderated-posting warnings and cross-post confirmation. + +### P2, advanced features + +1. Moderated posting workflows and control-message handling with explicit + warnings. +2. Multiple server profiles, synchronization policies and import/export. +3. SURB adapters, only after a concrete target protocol is selected. + +## References + +- [RFC 3977, NNTP](https://www.rfc-editor.org/rfc/rfc3977.html) +- [RFC 4642, NNTP STARTTLS](https://www.rfc-editor.org/rfc/rfc4642.html) +- [RFC 4643, NNTP authentication](https://www.rfc-editor.org/rfc/rfc4643.html) +- [RFC 5536, Netnews article format](https://www.rfc-editor.org/rfc/rfc5536.html) +- [RFC 5537, Netnews architecture and protocols](https://www.rfc-editor.org/rfc/rfc5537.html) +- [RFC 6048, NNTP LIST additions](https://www.rfc-editor.org/rfc/rfc6048.html) +- [RFC 8054, NNTP compression](https://www.rfc-editor.org/rfc/rfc8054.html) |