Add IRC and SSL/TLS guide. #106
Conversation
content/guides/irc_and_ssl.mkd
Outdated
| datetime: 2017-05-01 00:00:00 | ||
| --- | ||
| Although IRC is useful, the default IRC protocol is *unencrypted*, which means | ||
| that anyone listening in on the network, such as a black hat sniffing WiFi |
There was a problem hiding this comment.
I'd get rid of "such as a black hat sniffing wifi packets in the same coffee shop as us" and instead link to something like the pinapple in your statement listening to your network traffic.
There was a problem hiding this comment.
I'd like to leave "black hat in a coffee shop" as I imagine more people are familiar with that term and scenario than the pineapple, but I'll also link to the WiFi pineapple.
content/guides/irc_and_ssl.mkd
Outdated
| that anyone listening in on the network, such as a black hat sniffing WiFi | ||
| packets in the same coffee shop as us, or perhaps an unscrupulous Three-Letter | ||
| Agency or Internet Service Provider, is able to read, and possibly modify, the | ||
| contents of our messages. In order to defend against this, we can use |
There was a problem hiding this comment.
This sentence is a run-on. Consider breaking it into two separate sentences.
There was a problem hiding this comment.
Don't say "us" or "our" just say "you" or "your". This is for flow, not accuracy.
There was a problem hiding this comment.
Run-on sentences are fine. Academics don't teach you how to write long, complex sentences in order to keep you from thinking complex thoughts[citation needed]. Good catch on the "we".
content/guides/irc_and_ssl.mkd
Outdated
|
|
||
| Background | ||
| ---------- | ||
| SSL/TLS is poorly-named; the short story is that SSL (Secure Sockets Layer) |
There was a problem hiding this comment.
SSL/TLS is poorly-named; the short story is that
There was a problem hiding this comment.
The first thing that anyone will notice when trying to figure out SSL/TLS is why the heck there are two separate names for basically the same thing, and I'd like to provide them a little validation since it's a bit of a headache.
content/guides/irc_and_ssl.mkd
Outdated
| ---------- | ||
| SSL/TLS is poorly-named; the short story is that SSL (Secure Sockets Layer) | ||
| refers to a now-obsolete version of the encryption protocol while TLS | ||
| (Transport Layer Security) refers to a new version of the protocol. However, |
There was a problem hiding this comment.
... of the protocol, these separate protocols are sometimes called one name, SSL/TLS.
There was a problem hiding this comment.
I've rarely heard it called "SSL/TLS", usually people just lazily say "SSL", then someone may nitpick whether that person means "TLS" or not. Real headache.
content/guides/irc_and_ssl.mkd
Outdated
| because of the naming kerfuffle, libraries that implement the newer TLS | ||
| protocol still use the old SSL in their name, such as in the case of the | ||
| OpenSSL library, which is often used for TLS. The encryption protocol will | ||
| be referred to in this document as TLS for brevity's sake. |
There was a problem hiding this comment.
Nitpicky, but granted.
content/guides/irc_and_ssl.mkd
Outdated
| The `-ssl_verify` tells `irssi` to verify the server's certificate against the | ||
| PKI. Note also that the command uses port 66*9*7 rather than 66*6*7, because | ||
| the TLS version of the protocol usually runs on a different port. You should | ||
| now be able to connect to Freenode securely! |
There was a problem hiding this comment.
Link to an additional external doc which covers connecting to irssi and/or weechat securely. Diversity of docs and technical info is a good thing.
There was a problem hiding this comment.
connecting to irssi and/or weechat securely
You mean using irssi and/or weechat to connect to Freenode securely, right? I think I found the docs for this.
content/guides/irc_and_ssl.mkd
Outdated
| key pair and tell `irssi` where they are. The most obvious place to store these | ||
| is in your `irssi` configuration directory, run: | ||
|
|
||
| mkdir ~/.irssi/freenode |
There was a problem hiding this comment.
Please fence off commands with ``` and pre-pend $ to CLI commands.
content/guides/irc_and_ssl.mkd
Outdated
| Next, generate the *private* key: | ||
|
|
||
| umask 0077 | ||
| openssl genrsa -out key.pem 4096 |
There was a problem hiding this comment.
Add a note about this generating a file key.pem and how people can verify it worked (the file exists for instance).
There was a problem hiding this comment.
I noted that the file exists -- I'm not going to mention how to use 'stat' and 'ls' to find the file, though.
content/guides/irc_and_ssl.mkd
Outdated
| This command will prompt you for metadata about yourself: he only field worth | ||
| filling out is the "Common Name" field, for which you should put your IRC | ||
| nickname. Now, you can tell `irssi` to use this cert and key when you | ||
| connect by running: |
There was a problem hiding this comment.
Clarify which commands are run in the terminal (shell) and which commands are run in the irssi client. This is a common point of confusion for even intermediate newbies.
There was a problem hiding this comment.
I'll add some notes, but it should be more clear now that shell commands are prefixed with a '$'.
content/guides/irc_and_ssl.mkd
Outdated
| ---------- | ||
| This has been an extremely brief introduction to using TLS with Freenode IRC. | ||
| You should now be able to connect securely to Freenode over TLS, and be able | ||
| to identify yourself to NickServ without providing your account password. |
There was a problem hiding this comment.
Add some other external 'connecting to irssi / weechat securely' guides / our own guide for connecting to irc in a 'further reading' section.
There was a problem hiding this comment.
I added info on TLS/SSL, X.509, and OpenSSL. SSL/TLS is basically just wrapped around the IRC protocol, and thus most issues occur in the SSL/TLS protocol and have little to do with IRC. I'll add a link to this guide in the "Further Reading" section of the other IRC guide, since this would come after connecting to IRC.
| @@ -146,3 +146,4 @@ Now that you know how to get weechat up and running we have another | |||
| [irssi]: http://www.irssi.org | |||
| [weechat]: http://www.weechat.org | |||
| [guide]: http://lug.oregonstate.edu/blog/weechat-intro/ | |||
| [ssl]: http://lug.oregonstate.edu/blog/irc-and-ssl/ | |||
There was a problem hiding this comment.
You have to reference this somewhere in the text, like If you want to set up secure IRC chat, see our [Securing IRC with SSL/TLS guide][ssl]`.
There was a problem hiding this comment.
@clinew Add a reference to the link and I'll merge this.
Thanks again for the contribution! It's a good guide. 😄
There was a problem hiding this comment.
Whoops, should be fixed now.
Please review and let me know whether this is sane or not. I tried to keep it brief, but there's a lot that can go wrong and/or must be omitted for simplicity. #43