1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
|
# Aegis Usenet client feature audit
This audit separates a complete NNTP reader/poster from optional features that
would conflict with Aegis privacy and VFace goals. It is based on RFC 3977,
RFC 4642, RFC 4643, RFC 5536, RFC 5537, RFC 6048 and RFC 8054.
## Current state
| Area | Status | Notes |
| --- | --- | --- |
| Implicit TLS | Present | TLS 1.2 and 1.3, certificate validation by default. |
| STARTTLS | Present | Explicit TLS upgrade is available on servers exposing port 119. |
| AUTHINFO USER/PASS | Present | Password remains in memory and requires TLS. |
| AUTHINFO SASL | Present | PLAIN is used only after capability negotiation and TLS. |
| CAPABILITIES | Partial | Parsed, but capability-specific behavior is limited. |
| Group discovery | Present | LIST NEWSGROUPS, OVERVIEW.FMT, NEWGROUPS and NEWNEWS are available. |
| Overview | Present | `OVER` with `XOVER` fallback. |
| Article retrieval | Present | ARTICLE, HEAD, BODY, STAT, LISTGROUP and HDR are available. |
| Posting | Present | Direct NNTP posting with MIME, VFace and optional Ed25519 signing metadata. |
| Threading | Partial | Local thread trees and References-aware replies are available; tree UI remains. |
| Search | Partial | Basic overview filtering only; no indexed local full-text search. |
| Offline cache | Present | Local article metadata/raw cache and drafts use atomic 0600 JSON state. |
| Filters and scoring | Present | Generic deterministic local rules support classic headers, body, VFace and tags. |
| MIME and attachments | Partial | Text MIME works; attachment file selection/presentation remains. |
| Identity | Present | VFace profile, deterministic PNG, SHA-256 metadata and public verification link. |
| Identity verification | Present | Reader verifies VFace hashes, Face and Ed25519 body signatures locally. |
| Message encryption | Deferred | Deliberately excluded from the classic Usenet client; revisit in a mixnet context. |
| SURB | Deferred | Kept separate from classic Usenet and body encryption. |
## Complete client scope
### 1. NNTP transport and account handling
- server profiles with separate credentials, proxy and TLS policies;
- implicit TLS and STARTTLS with capability checks;
- AUTHINFO USER/PASS and capability-negotiated SASL;
- IPv4/IPv6, reconnect with bounded backoff and cancellation;
- capability cache scoped to a server profile;
- `COMPRESS DEFLATE` when advertised, with a user-visible opt-in only on
cleartext NNTP; it is rejected on every TLS connection;
- exact response-code handling and a diagnostic transcript that redacts
credentials and article bodies.
### 2. Group and article navigation
- `LIST ACTIVE`, `LIST NEWSGROUPS`, `LIST OVERVIEW.FMT`, moderation metadata and
RFC 6048 list additions;
- `NEWGROUPS` and `NEWNEWS` for incremental discovery;
- `GROUP`, `LISTGROUP`, `OVER`, `HDR`, `ARTICLE`, `HEAD`, `BODY` and `STAT`;
- paging, first/last/next navigation, column sorting and cross-post awareness;
- thread trees from `References`, `In-Reply-To` and `Message-ID`;
- local read/unread state, bookmarks, tags, mute and collapse controls;
- raw article view plus normalized text view, always retaining original headers.
### 3. Composer and posting
- reply and follow-up generation with quoted text and correct references;
- draft storage and a recoverable outbox, never automatic duplicate reposting;
- explicit cross-post confirmation and `Followup-To` support;
- moderated-group detection and an `Approved` workflow only when the server
or moderator policy authorizes it;
- MIME multipart text and attachments, with strict size and line limits;
- plaintext as the classic posting format; Ed25519 signing is optional and
YubiKey support is limited to signing and verification;
- post result showing the server response and assigned article information.
### 4. Local filters and scoring
Filters should be local-only and deterministic. They should match headers,
VFace identity hash, public-key fingerprint, newsgroups, dates and optionally
body text. Actions should be hide, mark read, highlight, tag, mute thread and
save locally. They must never silently delete server articles, send network
requests, or rewrite a user's identity.
Use RE2 regular expressions, bounded body reads and an explicit rule order.
Filter files should be portable JSON or TOML, with a schema version and a
dry-run preview. A filter that references a stable VFace key is intentionally
linkable and must be shown as such in the UI.
### 5. Pseudonymity and privacy invariants
- VFace is the only profile image mechanism: no upload, replacement or
alternate image format;
- private keys never enter settings, drafts, logs or crash
reports;
- `Path`, `Injection-Info` and `Xref` remain server-controlled trace fields;
- no local hostname, IP address, proxy address or real name is added to posts;
- `Message-ID` uses the neutral Aegis domain, not the From address domain;
- the configured SOCKS/Nym route is visible as a transport policy, not embedded
in article metadata;
- URL verification is opt-in metadata and is never fetched automatically;
- local caches and filter databases need an explicit location and retention
policy, with an option to purge them;
- optional features remain inside the audited main binary so their access to
network, files, article bodies and identity material is explicit.
## Priority order
### P0, remaining for a usable complete text client
1. Add a visible thread-tree view and cache purge controls.
2. Add offline browsing of cached articles and drafts.
### P1, interoperability and daily usability
1. Add attachment file selection and reader presentation.
2. Add moderated-posting warnings and cross-post confirmation.
### P2, advanced features
1. Moderated posting workflows and control-message handling with explicit
warnings.
2. Multiple server profiles, synchronization policies and import/export.
3. SURB adapters, only after a concrete target protocol is selected.
## References
- [RFC 3977, NNTP](https://www.rfc-editor.org/rfc/rfc3977.html)
- [RFC 4642, NNTP STARTTLS](https://www.rfc-editor.org/rfc/rfc4642.html)
- [RFC 4643, NNTP authentication](https://www.rfc-editor.org/rfc/rfc4643.html)
- [RFC 5536, Netnews article format](https://www.rfc-editor.org/rfc/rfc5536.html)
- [RFC 5537, Netnews architecture and protocols](https://www.rfc-editor.org/rfc/rfc5537.html)
- [RFC 6048, NNTP LIST additions](https://www.rfc-editor.org/rfc/rfc6048.html)
- [RFC 8054, NNTP compression](https://www.rfc-editor.org/rfc/rfc8054.html)
|
