Ember v1.5.2

What's New

• The Ember Network has its own light on the status bar. We only showed it once Kad was up, which made the two look like the same thing. They aren't. You can now see whether the overlay is running and how many peers it is holding
• Finished downloads say when their Ember hash was checked. If we verified a completed file against the content hash published on the Ember Network and it matched, the row gets a badge. It only appears when the check actually ran, so a file recovered after a crash, or one with no Ember hash to check against, won't have it
• File properties show the Ember content hash next to the ed2k and AICH hashes, so you can see the digest your downloads are checked against
• The Ember Network page shows what you're holding for other people. Your node stores records on the network's behalf and there was no way to see how many. We count only records somebody else published, so the number is what you're actually contributing rather than your own entries coming back to you

What's Fixed

Our third audit since 1.4.2, this time seven passes reading in parallel over everything we had changed. It turned up 28 findings. 26 held up and are fixed here; two were our own false alarms.

Before you upgrade

• Nothing to do. We didn't touch the library database, so you can move between 1.5.0, 1.5.1 and 1.5.2 in either direction

Friends and the Ember Network

• Your friend code can't be used to take over your presence. An ember2: code is meant to be public, and it's enough to work out where your presence is registered. Anyone holding yours could claim that spot with their own key, so friends looking you up reached a stranger or found nothing at all. One request was enough, and it worked every time. A presence slot now belongs to the identity it was derived from and to nobody else. This one is server-side and already deployed, so 1.5.0 and 1.5.1 are covered too
• Your node can relay for friends again. We tied the relay offer to Kad being connected, and Kad is off in a default install, so a default install advertised nothing and turned away every friend that tried to use it. Relaying is the one discovery path that works for two friends who share no downloads, which is the case we built it for
• Relayed transfers survive both ends going quiet. Our 1.5.1 fix kept the second peer's side of a relay alive and missed the first, so a quiet relayed session was still being closed at thirty seconds. Also server-side, also already deployed
• A spoofed packet can't stop a peer reaching you. Someone forging a peer's address could displace that peer's half-finished handshake over and over, so when the real reply turned up there was nothing left to match it against and first contact never completed. Both halves of the handshake now survive a forged packet
• One unverified claim can't fail a download forever. A single node could assert the content hash for a file and we would enforce it at completion. If the claim was wrong the download failed, found nothing to repair, and started again from the top, indefinitely. A hash we learn from the network now needs two publishers to agree before we hold a file to it

Talking to other clients

• Obfuscated connections don't corrupt themselves after a stall. If a peer stopped reading for a minute, the next packet could put part of the previous one back on the wire. It decrypts cleanly at the far end, so nothing looks wrong until the framing has drifted and the connection is finished
• One byte can't hold an incoming connection slot. A connection that sent a single byte and then went silent was waited on with no timeout at all. Around thirty-four of those filled the listener and shut out every real peer, upload and port test
• Source swapping runs with Kad off. Moving a peer from a file it can't help with to one it can was gated on Kad, even though it only ever deals with ordinary ed2k sources. Nobody running server-only ever saw it work
• A peer can't make us hold hundreds of megabytes. We bounded the corruption-recovery buffer by bytes in one download path and by packet count in the other. The one we missed is the path a single-source download takes

Search

• The name you see is the name you get. Two different rules picked the filename for the results list and the filename written to disk, so a result could show one name and download another
• Peers send a full page of results. Our budget for how many packets one answer may use was smaller than a single page, so the 1.5.1 fix couldn't take effect and each peer still returned a slice of what it held

Kad

• One peer can't block all publishing on your node. Comments, ratings and source records shared one space with keyword records, and only keyword records could be trimmed to make room. Whichever of the other two filled it first locked the whole store and refused everything else in the meantime: five hours for sources, a full day for comments
• A refused publish can't delete somebody else's records. Our 1.5.1 fix covered new records and not updates to existing ones, so a peer could still make us drop another publisher's entries to clear space for a record its own limits were about to turn down

Your data

• An interrupted save doesn't reset your settings. Replacing a file on Windows sometimes needs the old one moved aside first. In 1.5.1 we taught the identity file to recover from that and left every other file as it was. For settings it meant a launch that looked like a fresh install: every preference back to default and every shared folder gone
• Approved folders stay approved, and stay yours. The record of which folders Ember may use failed the same way, and it failed open. An empty record looked like a first run, so whatever was sitting at each configured path got approved again without anyone asking you
• An interrupted save doesn't lock you out of chat history. The chat key could be left under the set-aside name, and we would then report the history sealed and tell you to restore a backup, with the key sitting right next to the database
• Backups are never shared, whatever you call them. Our rule for keeping a profile backup out of your shared folders matched the extension exactly, so a file saved as .EmberBackup went straight past it and got indexed and offered to peers like anything else
• Restoring an old backup can't stop Ember opening. A chat message that happened to start with the text we use to mark encrypted messages made the upgrade of a pre-1.4 database fail, and then fail again on every launch after that
• The last saves on exit aren't skipped. One save finishing at the wrong moment consumed the signal another was waiting on, and the wait that followed ate the time the reputation, source list and server list saves needed
• Two smaller ones: file permissions on Windows are applied through a handle that can't be redirected between the check and the change, and the peer credit counters saturate instead of wrapping when a stored value is out of range

Full Changelog: v1.5.1...v1.5.2