75f3a0ed04
- Added a new test suite for attack vectors targeting the /discover federation routes, ensuring (known) vulnerabilities are addressed. - Implemented a proxy function to check for blacklisted servers, enhancing security measures. - Introduced URL validation to prevent SSRF attacks by blocking internal addresses. - Updated package.json with a new test command for the attack tests. - Refactored server and route handling to improve type safety and error handling. - Added new middleware for blacklist checks and URL validation to prevent unauthorized access. |
||
|---|---|---|
| .vscode | ||
| drizzle | ||
| public/logo | ||
| src | ||
| tests | ||
| .env.local.example | ||
| .gitignore | ||
| bun.lock | ||
| components.json | ||
| drizzle.config.ts | ||
| LICENSE | ||
| next.config.ts | ||
| package-lock.json | ||
| package.json | ||
| playwright.config.ts | ||
| postcss.config.mjs | ||
| README.md | ||
| tsconfig.json | ||
SiPher
Silent Whisper — A federated social network built for the modern age.
SiPher is a federated social network. Each server is independent — no central authority, no single point of failure.
Your identity is you@yourserver.com. Your server, your data, your rules.
Roadmap
- Phase 1 — Core federation. Two servers can follow each other, post, and see each other's posts.
-
- — Two servers can follow each other, trust their keys and rotate them.
-
- — One server can create posts, have users following each other and dms (unencrypted for now) works.
-
- — Two servers can fetch posts, follows and other data from their users, including DMs.
- Phase 2 — Server trust scoring and a public vouch ledger.
- Phase 3 — Opt-in relay network for censorship resistance.
- Phase 4 — End-to-end encryption via TBD.
Author
Marcello Brito (Tocka) — tockanest.com
Security
SiPher implements custom federation and cryptographic protocols. I am not a professional cryptographer or security researcher — this system has not been audited and almost certainly contains multiple vulnerabilities I am not aware of.
If you find one, please open an issue or contact me directly at tocka@tockanest.com. Responsible disclosure is appreciated.
Contributions from people with security or cryptography experience are especially welcome, even if just pure criticism.
Do not use SiPher in any context where your physical safety depends on it — not yet.