ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network
Has the code quality improved since I was told to screw off for bringing up security?<p>* 2 years out of date gevent-websocket<p>* Year old Python-RSA, which included some worrying security bugs in that time. [0](Vulnerable to side-channel attacks on decryption and signing.)<p>* PyElliptic is both out of date, and actually an unmaintained library. But it's okay, it's just the OpenSSL library!<p>* 2 years out of date Pybitcointools, with just a few bug fixes around confirmation things are actually signed correctly.<p>* A year out of date pyasn1, which is the type library. Not as big a deal, but covers some constraint verification bugs. [1]<p>* opensslVerify is actually up to date! That's new! And exciting!<p>* CoffeeScript is a few versions out of date. 1.10 vs the current 1.12, which includes moving away from methods deprecated in NodeJS, problems with managing paths under Windows and compiler enhancements. Not as big a deal, but something that shouldn't be happening.<p>Then of course, we have the open issues that should be high on the security scope, but don't get a lot of attention.<p>Like:<p>* Disable insecure SSL cryptos [3]<p>* Signing fail if Thumbs.db exist [4]<p>* ZeroNet fails to notice broken Tor hidden services connection [5]<p>* ZeroNet returns 500 server error when received truncated referrer [6] (XSS issues)<p>*  port TorManager.py to python-stem [7] i.e. Stop using out of date, unsupported libraries.<p>I gave up investigating at this point. Doubtless there's more to find.<p>As long as:<p>a) The author/s continues to use out-dated, unsupported libraries by directly copying them into the git repository, rather than using any sort of package management.<p>b) The author/s continue to simply pass security problems on to the end user<p>... ZeroNet is unfit for use.<p>As simple as that.<p>People have tried to help. I tried to help before the project got as expansive as it is.<p>But then, and now, there is little or no interest in actually fixing the problems.<p>ZeroNet is an interesting idea, implemented poorly.<p>[0] <a href="https://github.com/sybrenstuvel/python-rsa/issues/19" rel="nofollow">https://github.com/sybrenstuvel/python-rsa/issues/19</a><p>[1] <a href="https://github.com/etingof/pyasn1/issues/20" rel="nofollow">https://github.com/etingof/pyasn1/issues/20</a><p>[3] <a href="https://github.com/HelloZeroNet/ZeroNet/issues/830" rel="nofollow">https://github.com/HelloZeroNet/ZeroNet/issues/830</a><p>[4] <a href="https://github.com/HelloZeroNet/ZeroNet/issues/796" rel="nofollow">https://github.com/HelloZeroNet/ZeroNet/issues/796</a><p>[5] <a href="https://github.com/HelloZeroNet/ZeroNet/issues/794" rel="nofollow">https://github.com/HelloZeroNet/ZeroNet/issues/794</a><p>[6] <a href="https://github.com/HelloZeroNet/ZeroNet/issues/777" rel="nofollow">https://github.com/HelloZeroNet/ZeroNet/issues/777</a><p>[7] <a href="https://github.com/HelloZeroNet/ZeroNet/issues/758" rel="nofollow">https://github.com/HelloZeroNet/ZeroNet/issues/758</a>