{"action":"created","issue":{"url":"https://api.github.com/repos/agl/pond/issues/161","labels_url":"https://api.github.com/repos/agl/pond/issues/161/labels{/name}","comments_url":"https://api.github.com/repos/agl/pond/issues/161/comments","events_url":"https://api.github.com/repos/agl/pond/issues/161/events","html_url":"https://github.com/agl/pond/pull/161","id":55304483,"number":161,"title":"Send messages to multiple recipients, optionally introducing some of them to all the others","user":{"login":"burdges","id":680126,"avatar_url":"https://avatars.githubusercontent.com/u/680126?v=3","gravatar_id":"","url":"https://api.github.com/users/burdges","html_url":"https://github.com/burdges","followers_url":"https://api.github.com/users/burdges/followers","following_url":"https://api.github.com/users/burdges/following{/other_user}","gists_url":"https://api.github.com/users/burdges/gists{/gist_id}","starred_url":"https://api.github.com/users/burdges/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/burdges/subscriptions","organizations_url":"https://api.github.com/users/burdges/orgs","repos_url":"https://api.github.com/users/burdges/repos","events_url":"https://api.github.com/users/burdges/events{/privacy}","received_events_url":"https://api.github.com/users/burdges/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-01-23T16:52:40Z","updated_at":"2015-01-30T04:20:17Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/agl/pond/pulls/161","html_url":"https://github.com/agl/pond/pull/161","diff_url":"https://github.com/agl/pond/pull/161.diff","patch_url":"https://github.com/agl/pond/pull/161.patch"},"body":"This pull supersedes https://github.com/agl/pond/pull/144 incorporating suggestions by @agl  Check https://github.com/agl/pond/pull/144 for further earlier comments on the development. \r\n\r\nMessages can be sent to multiple recipients.  By default, recipient not told other recipients exist, like BCC in email.  Optionally, recipients may be marked as to \"introduce\", which tells other recipients about them and tells them about all the other recipients.  In particular, an introduced recipient and any other recipient see a \"greet\" button which allows them to initiate a PANDA key exchange.\r\n\r\nAs noted in https://github.com/agl/pond/pull/144 introduction functionality creates a vector to socially engineer an MITM attack.  We therefore provide three new records introducedBy, verifiedBy, and introducedTo to record your local social graph, as visible from messages containing introductions.  In theory, these would help contacts discover such socially engineering attacks.  Users may disable collecting these records.\r\n\r\nOur short-term TODO list : \r\n- Add sending to multiple recipients to the CLI and make introductions in the CLI use it. @rvedam \r\n- Expose GTK's information dialog boxes in client/gtk.go @emptyset\r\n- Make dialog boxes that explain anything that needs explaining, like the risks of keeping the social graph data, what to do if an introduction creates a second contact with a similar name, etc.\r\n- Allow CLI users to disable collecting social graph information for the GUI\r\n- Rename verifiedBy to corroboratedBy.\r\n\r\nOur longer-term TODO list : \r\n- A new outbox message is created for every recipient in this patch.  Ideally, we should replace queuedMessage.to with toNormal and toIntroduce fields as well, but this requires allowing a message to live in both client.queue and client.outbox simultaneously.  We can make this happen by using the same queuedMessage.id field and leaving the queuedMessage.message pointer nil in one of them, but it's another huge commit. \r\n- A reply all function would begin to make sense once we've done all that, but again we should settle on how to encode introductions before doing it.  Reply all require more thought about to whom we send more introductions. \r\n- Allow users to edit a contact's name when doing an introduction.  Reply all should presumably preserve such names through a message thread, i.e. if I receive a message introducing @ioerror as ioerror who I already know as Jake then if I reply all I should reintroduce him as ioerror, not Jake.  There is a slight downside here that if the original message was an MITM attempt that I didn't catch then I'd create an MITMed ioerror in addition to my real Jake, which I'd continue to propagate.  And nobody else would notice \"Hey Jeff always calls ioerror Jake\". "},"comment":{"url":"https://api.github.com/repos/agl/pond/issues/comments/72152154","html_url":"https://github.com/agl/pond/pull/161#issuecomment-72152154","issue_url":"https://api.github.com/repos/agl/pond/issues/161","id":72152154,"user":{"login":"bnagy","id":453996,"avatar_url":"https://avatars.githubusercontent.com/u/453996?v=3","gravatar_id":"","url":"https://api.github.com/users/bnagy","html_url":"https://github.com/bnagy","followers_url":"https://api.github.com/users/bnagy/followers","following_url":"https://api.github.com/users/bnagy/following{/other_user}","gists_url":"https://api.github.com/users/bnagy/gists{/gist_id}","starred_url":"https://api.github.com/users/bnagy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bnagy/subscriptions","organizations_url":"https://api.github.com/users/bnagy/orgs","repos_url":"https://api.github.com/users/bnagy/repos","events_url":"https://api.github.com/users/bnagy/events{/privacy}","received_events_url":"https://api.github.com/users/bnagy/received_events","type":"User","site_admin":false},"created_at":"2015-01-30T04:20:17Z","updated_at":"2015-01-30T04:20:17Z","body":"For the record, I can't support this. It's needlessly leaking metadata and I can't see any upside whatsoever."}}