IRC: a plaintext connection is never upgraded, because STS is not read #177

Closed
opened 2026-09-11 22:25:53 -04:00 by Salastil · 1 comment
Owner

sts is not in WANTED_CAPS (nobilis/src/backend/irc/connect.rs:438), and nothing
anywhere reads an STS policy.

STS is how a network says "come back over TLS, and keep doing so for this long". A
client that ignores it stays in plaintext on a port the network would rather it left,
and gets none of the downgrade protection the policy exists to provide - the whole point
is that the second connection cannot be talked out of TLS by an attacker who could
intercept the first.

Worth handling both halves: the upgrade itself, and persisting the duration so it is
still honoured on the next run.

`sts` is not in `WANTED_CAPS` (`nobilis/src/backend/irc/connect.rs:438`), and nothing anywhere reads an STS policy. STS is how a network says "come back over TLS, and keep doing so for this long". A client that ignores it stays in plaintext on a port the network would rather it left, and gets none of the downgrade protection the policy exists to provide - the whole point is that the second connection cannot be talked out of TLS by an attacker who could intercept the first. Worth handling both halves: the upgrade itself, and persisting the duration so it is still honoured on the next run.
Salastil added the feature label 2026-09-11 22:25:53 -04:00
Author
Owner
Finished — https://git.salastil.com/Salastil/nobilis/commit/e879e66 Bump: https://git.salastil.com/Salastil/moho/commit/0fb0d1a
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Salastil/moho#177