majestrate
commented
6 years ago i2pd does not fully implement i2cp protocol for clients, specifically session reconfigure.
all that other stuff is vague and fear mongery so unless there are specifics not much to say.
00:44 < Iadohs> Ellenor: Heads up, mrb4mboo has been poking at I2p, and besides security flaws in both implementations, he's discovered a number of fundamental flaws in the design. Best cast is DoS attacks, worst case is router crashes or possibly deanonymizing. 00:44 < Iadohs> *case 01:31 <~Ellenor> Iadohs: Fark. 01:31 < Iadohs> Ellenor: Sums up what I said. 01:32 < Iadohs> Apparently I2CP has some issues which can cause port blocking/ddos/memory leakage. 01:32 < Iadohs> The routers don't properly free memory after the 10 minute window for tunnels. 01:33 <~Ellenor> Iadohs: Are these flaws compatibly correctible? 01:33 < Iadohs> The AES Initialization Vectors are being badly handled, and possibly the PRNGs are insecure/guessable. 01:33 < Iadohs> Ellenor: Some of the stuff may be fixable, some of the stuff may break backwards compatibility. 01:34 < Iadohs> The I2CP stuff I believe he said requires trashing it, because certain I2CP options are the cause of the DoS/DDoS capabilties 01:34 < Iadohs> IE you may be able to work it with subset of I2CP features, but it will break a lot of application compatibility. 01:35 < Iadohs> Similiar complaints about Bote as well as a variety of issues with Purple-I2P 01:37 < Iadohs> So basically you are stuck with Tor, whose majority of nodes are in 5 eyes countries, tcp only, and with a variety of other issues, but generally percieved as well written and secure, or I2P. which is now cjdns level of security/anonymity, but has a variety of features that actually make it useful for the majority of applications, but with the risk of either exploits or deanonymizing attacks on hidden services 01:40 <~Ellenor> Iadohs: the fixable stuff should be asapped 01:41 < Iadohs> Ellenor: mrb4mboo has been doing patches, but I am not sure what the status is. 01:41 < Iadohs> He's not exactly being polite with the devs. 01:43 < Iadohs> At this point I can't blame him. He was apparently building a DDoS tool for experimentation/lulz, but in the process of testing that starting running into bigger issues with the routers, like being able to trigger conditions where memory wouldn't free until the routers basically DoSed themselves before crashing due to OOM conditions. 01:45 < Iadohs> Apparently the i2pd router crashes from i2cp related issues, and the java i2p router crashes from a different buffer handling situation in the core or something.