diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 33 |
1 files changed, 33 insertions, 0 deletions
@@ -29,6 +29,39 @@ go build -o n2usenet ./cmd/n2usenet go build -o n2u-check ./cmd/n2u-check ``` +## Features + +- **Proof-of-work anti-spam**: client computes a hashcash-style token before + submission; the server only verifies it (never computes it) and caches + spent tokens in memory with a TTL to reject replays. +- **Ed25519 signing**: the message is signed locally in the browser with the + self-hosted TweetNaCl (`nacl`) library. The secret key never leaves the + device; the server only verifies the signature against the submitted text. +- **VFACE identicon / `Face:` header**: the public key deterministically + generates a visual identicon (`identicons-cli` engine, same backend as + `identicons.virebent.art`), embedded as a folded `Face:` header alongside + `X-Ed25519-Pub`/`X-Ed25519-Sig` so any reader can re-verify authorship. +- **Optional persistent identity (save/load)**: after generating a keypair, + "Save Identity" downloads a JSON file with the public/secret key and + username/email. Loading that file later reuses the same keypair, so the + same identicon keeps appearing across posts and proves later messages + come from the same author. This is entirely optional: skip it for a + fresh, unlinkable throwaway identity on every post. The file contains the + secret key in clear, so it must be kept private, anyone holding it can + sign as that identity. +- **Usenet-style line wrapping**: before signing, the message body is + automatically word-wrapped to 72 columns (RFC 1855 Netiquette + convention), for compatibility with classic terminal-based newsreaders. + Blank lines and quoted lines (`>`) are left untouched. The wrap happens + client-side, before the Ed25519 signature is computed, so the signature + always covers the exact bytes that end up posted. +- **CSRF protection and per-IP rate limiting**, both server-side. +- **No access logs, ephemeral state**: identity and form data are kept only + in browser tab memory and wiped after a successful send. +- **Delivery over the Nym mixnet**, not Tor: SOCKS5 through a local + `nym-socks5-client`/`nym-network-requester` path to the Mail2News relay, + then into `news.tcpreset.net` via NNTP. + ## Required Configuration Set these in an environment file or systemd unit: |