nextcloud / nextcloud/server

http warnings should acknowledge usage of yggdrasil

Open
#41,988 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage enhancement
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

There is a networking project that has been around for quite some years and the goal of it is the adding actual encryption in the base layer of the Internet. In the TCP layer, as it were.

This is relevant to nextcloud because deploying an instance on an yggdrasil-connected server has far reaching advantages:

  1. there is end-to-end encryption of the data below the application layer.
    No need for self-signed certificates when deploying on a home-machine!
  2. a home installation can be reached from anywhere in the world due to the mesh-networking setup going over NAT with ease.
  3. the IP of the server is bound to a private-key and thus provides mostly the same identity guarantees as https certificates do, just much simpler and without need to be connected from the Internet.

The project can be found on https://yggdrasil-network.github.io/

There is very little need for nextcloud to do anything here at all. It is afterall just an upgrade to the underlying transport layer.

But what I think would be very useful is if nextcloud's security warnings (both in the server and in passman/password-manager) about using 'http' add an extra check if the client isn't connecting over the special yggdrail IP range.
Because if it is, then the warning should reflect that.

Specifically I'm thinking that if the server listens somewhere on the 0200::/7 (ipv6) range (a range deprecated by the IETF), it means that the incoming connections are in actual fact end-to-end encrypted and thus it would be really nice if the warning in the 'security' tab has wording stating that "Connection is end-to-end encrypted via Yggdrasil".

This helps people trying out an alternative way to bring encryption to the web by not making the admins and users scared of the http (not ssl) aspect that your excellent software now warns about.

Additionally it helps me double check that my browser actually properly connected over yggdrasil instead of over regular IP, which is useful information too.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the server security warning and the corresponding passman/password-manager warning mentioned in the issue. Verify how connections using the 0200::/7 range are identified, then define wording that acknowledges Yggdrasil encryption without misclassifying regular HTTP connections.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
networking, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.