Unhandled Expression

Yes, let's see

* Not end-to-end encrypted by default

* No end-to-end encrypted groups

* No end-to-end encryption on any desktop client by the vendor, forcing cross-platform users to drop secret chats. This includes 81% of working age people who sit on their computer during work day, and 100% of college students and IT workers.

* No post-quantum key exchange

* No future secrecy

* No per-message forward secrecy

* Bullshit claims about distributed keys https://security.stackexchange.com/questions/238562/how-does-telegrams-secret-splitting-scheme-work/243172#243172

* Lacks ALL metadata protection from server like phone number, IP-address and thus geolocation, contact list, group memberships, quantity and schedule of communication, data types. In fact --

* Secret chats leak additional metadata about intent to hide content from TG as the vendor.

Also,

History of poor encryption implementation

* 2013: A cracking contest https://news.ycombinator.com/item?id=6932648

* 2013: Telegram, AKA "Stand back, we have Math PhDs!" http://unhandledexpression.com:8081/crypto/general/security/2013/12/17/telegram-stand-back-we-know-maths.html

* 2015: IND-CCA issues https://eprint.iacr.org/2015/1177.pdf,

* 2015 64-bit complexity MITM attack https://web.archive.org/web/20160425091011/http://www.alexrad.me/discourse/a-264-attack-on-telegram-and-why-a-super-villain-doesnt-need-it-to-read-your-telegram-chats.html

* 2021 Valsorda "The Most Backdoor-Looking Bug I've Ever Seen"…

> I'd really like Telegram to implement something that _is_ considered secure by many experts, but trusting _one_ experts word without any proof seems wrong to me.

Please read the link I provided before[0], it features links to a bunch of people saying Telegram is not secure[1][2][3][4]. It's not just Moxie. I actually have not seen any expert saying that Telegram is secure, but I'm interested in such thing. As the Telegram protocol is open, everybody is able to see how flawed it is. We know that. With a closed client that allegedly implements a secure encryption method (we also know it's good because it's open as well) there's a chance it doesn't work the way it's supposed to work, but there's also the chance it's working as intended. I'd rather take one percent chance over zero.

[0] https://security.stackexchange.com/questions/49782/is-telegram-secure

[1] https://eprint.iacr.org/2015/1177.pdf

[2] https://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/

[3] http://www.alexrad.me/discourse/a-264-attack-on-telegram-and-why-a-super-villain-doesnt-need-it-to-read-your-telegram-chats.html

[4] http://thoughtcrime.org/blog/telegram-crypto-challenge/

> For self-referential datastructures (your first point above), using an Rc or Arc shouldn't have any overhead. I agree that it would be nice to be able to express this, but it's not really that big of a problem.

I don't see how that could be true. It means using a separate heap allocation for each referenced piece (although the owning_ref thing steveklabnik mentioned might minimize that), a bit of extra RAM for the counter, and a bit of bookkeeping. I'm not saying the overhead is huge, but how could it be zero?

fwiw, I finished this section of my code, and the context approach I mentioned worked out well for me. It was just a bit of a puzzle to find a way Rust would like.

I'm pretty happy with Rust so far even though I've had to restructure parts of an apparently-working program to fit its model. My program is now more obviously correct, benchmarks are pretty good so far (though I wish profile-driven optimization were supported/mature: https://unhandledexpression.com/2016/04/14/using-llvm-pgo-in-rust/), and the open source library situation seems better than C/C++ for what I'm doing and actively improving where C/C++ is stagnant.

I still don't really understand this all discussion around Telegram. MTProto is used just with the regular chats and they decided to use a custom protocol "In order to achieve reliability on weak mobile connections as well as speed when dealing with large files (such as photos, large videos and files up to 1,5 GB)" (from the FAQ). There is also a pretty long discussion here http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/ between Telegram developers and another "security expert", where the practical reasons for their choices are explained (might be outdated, but it's still interesting to see why certain more secure algorithms might not be always the best solution). Providing cloud services, robustness and reliability can come at a cost unfortunately.

If you care about having a really private conversation, just instantiate the Secret Chat. It's state of the art in terms of security. Just one of the many benchmarks https://www.eff.org/secure-messaging-scorecard.

Windows suffers some famous dain bramage wrt to DLL loading paths: http://unhandledexpression.com/2010/08/23/fixing-the-dll-loading-vulnerability/ Basically, even when "safe" DLL loading is turned on, the search path still includes the current directory. I'm guessing that Notepad and friends all look for some (legacy?) DLL that isn't always installed, so if an attacker puts a malicious DLL by its same name in the same path as the file being opened, it'll be loaded and executed. The part about network drives is probably just an assumption about trust boundaries: Microsoft assumes that attacker can't ordinarily put a malicious file in the same local folder that you're opening a text file in, but on a network drive anything goes.

This is all just speculation. I don't code for Windows, and I don't know anything more about this vulnerability than what's stated in the advisory.

This is called profile-guided optimization.[0] Slightly off-topic, but even Rust has it, courtesy of LLVM.[1]

It doesn't seem very popular unfortunately. Most web/tech companies are obsessive about capturing user interaction data for UX purposes, but it would be nice if that data could be fed back into a profile-guided optimizer.

In theory the compiled WebAssembly output would always be optimized for the latest usage trends, provided there were frequent builds. Depending on the product, it may even be possible to classify users into various high-level categories based on their behavior, and serve them a binary that's optimized for their specific use case. The latter's level of specificity probably wouldn't be worth it though.

[0] https://en.wikipedia.org/wiki/Profile-guided_optimization

[1] https://unhandledexpression.com/2016/04/14/using-llvm-pgo-in-rust/