@marsik@witter.cz

· 5mo ago

One unexpected encounter on a #ham #radio #trip today. Luckily its mommy didn’t show up. #wwff OKFF-3159 #pota CZ-0200

I was just testing #aprs and #meshcore coverage of a close hill before lunch. Sadly, it is still too low for UHF to reach anywhere suitable.

witter.cz

Witter

12

1

2

0

MarSik @marsik@witter.cz

· 5mo ago

Boosted by @tchambers@indieweb.social

Replying to

@perlman@indieweb.social Ok, to show I am not just talking either, here is a #reticulum protocol analysis with focus on #privacy Including comparison to other projects. The TLDR is: #RNS is reasonably good hiding identity from services, but leaks metadata on network level. https://codeberg.org/MarSik/reticulum-audit/src/branch/main/reticulum-source-privacy-flaw.md I tried to back up all my claims and reasoning with links and sources. But feel free to call me out on any inaccuracy as the final text is rather long and I might have missed something. #tor #i2p can check me too.

codeberg.org

Cookie monster!

11

8

5

1

MarSik @marsik@witter.cz

· 2mo ago

Replying to

@tyzbit@toot.now MeshCore defaults are tailored towards infrastructure and more users. Only well placed nodes are repeaters and telemetry is limited. Meshtastic focuses on ad-hoc small groups in places without infrastructure. That is why clients repeat and send more telemetry. Use CLIENT_MUTE, limit telemetry, set faster preset and you get almost the same thing. Tech note: I like protobuf tag based packets in MT more (vs hand coded in MC). And MC author did not like GPL: https://buymeacoffee.com/ripplebiz/meshtastic-a-dead-end

Buy Me a Coffee

Meshtastic: A Dead End — Ripple Radios

Post by Ripple Radios

3

2

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@jwildeboer@social.wildeboer.net While this is sad and somewhat usual, #meshcore itself has similar roots. The author was not allowed to integrate his product with #meshtastic due to GPL and trademark issues. https://buymeacoffee.com/ripplebiz/meshtastic-a-dead-end

Buy Me a Coffee

Meshtastic: A Dead End — Ripple Radios

Post by Ripple Radios

10

2

3

0

MarSik @marsik@witter.cz

· 2mo ago

Replying to

@circfruit@fosstodon.org @everton137@social.vivaldi.net @fdlamotte@mamot.fr I would still prefer WiFi and 2.4 GHz. Reticulum can use it too (I am not a fan though) The hardware is ubiquous (every laptop and cell phone and ESP has it) and legally the band is not as limited as the 868 ISM one. And the achievable speed of even the oldest 802.11b is 11 Mbps! (LoRa is at maximum few kbps) Both LoRa and WiFi bands are line of sight (+ reflections) anyway, so there is not much disadvantage there in the 2.4G band (except water absorbtion).

1

2

1

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@Szescstopni@circumstances.run @PacoVelobs@mamot.fr There are better ways to disrupt the mesh networks than jamming. Just flood the network with unimportant messages. Neither of those projects has any bandwidth or quota management. Nor any real allow/deny list to recover from the DoS. Or simply seize the devices (and arrest operators) from the critical routing spots and the network will collapse. Neither of those mesh projects are stealthy or resistance / opposition safe.

4

2

0

MarSik @marsik@witter.cz

· 5mo ago

While we #geeks play with #meshcore , the industry and governments work on global emergency messaging (one to many alerts) using #etsi standardized #dab. See https://www.worlddab.org/dab/asa-emergency-warnings

The czech state radio just announced a pilot too https://www.lupa.cz/aktuality/cesky-rozhlas-otestuje-novy-zpusob-varovani-obyvatel-technologii-zaplati-operator/

Any tips about battery efficient DAB+ portable radio with this capability? Ideally AA powered!

witter.cz

Witter

4

2

5

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@maexchen1@nrw.social @voyagermesh@dresden.network @blackforestmesh@freiburg.social @adingbatponder@fosstodon.org @oscillator@chaos.social @h4kor@chaos.social (sorry for english) Personal safety lies in stealth. Reticulum use will flag you to the government and the strong cryptography gives zero protection - https://xkcd.com/538/ IP was designed for routing around a nuked city and can be built on top of everything too https://en.wikipedia.org/wiki/IP_over_Avian_Carriers#Real-life_implementation and all hardware and sw support it natively. LoRa is prone to https://en.wikipedia.org/wiki/Direction_finding + slow and proprietary. Hide in the crowd.

xkcd

Security

3

0

1

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@ratcatcher@beige.party @kimschulz@social.data.coop I believe it switches to different frequency for local group use. It intentionally does not enable the Meshtastic behavior. See here https://blog.meshcore.io/2026/02/13/off-grid-client-repeat-mode or here https://nodakmesh.org/blog/meshcore-off-grid-repeat-guide/

Off-grid (client repeat) Mode - MeshCore Blog

blog.meshcore.io

Off-grid (client repeat) Mode - MeshCore Blog

The next version of the Ripple MeshCore firmware will (finally) support off-grid mode, also known as 'client repeat' mode.

3

2

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@prometheuspetrosss@mas.to @perlman@indieweb.social I have nothing against the project per-se. It is an impressive piece of work. But I get upset about some of the “marketing” of it as the “new internet”. Such claims are denigrating the accumulated experience and achievements of all the thousands engineers and researchers that has worked on the real standards over the past decades. Hobby projects are just that until they follow the proper scientific methods to prove the value.

3

16

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@perlman@indieweb.social folks seriously. What are the benefits of “new” unproven #reticulum over proven alternatives?

Nomad network vs. https://www.torproject.org/ and onion services
LXMF over BP https://www.rfc-editor.org/rfc/rfc9171.html
LXST over RTP, WebRTC. With https://en.wikipedia.org/wiki/M17_(amateur_radio) for voice.
Micron over Asciidoc, Markdown…
Sideband vs https://jami.net/

Reticulum link protocols over slip, ppp, Ethernet or https://en.wikipedia.org/wiki/IEEE_802.15.4

Please compare Reticulum with standards, not with toys.

torproject.org

The Tor Project | Privacy & Freedom Online

Defend yourself against tracking and surveillance. Circumvent censorship.

3

32

1

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@PacoVelobs@mamot.fr @Szescstopni@circumstances.run Finding nodes is trivial. Radio direction finding and Time of arrival methods have been known for decades and the modern AI tech made them even more powerful. SIGINT is militarized and governments have cool toys. Read https://cdn.rohde-schwarz.com/am/us/campaigns_2/a_d/Intro-to-direction-finding-methodologies.pdf to get a glimpse. The cheap chinese mesh nodes leak radio signal even when not transmitting. The internal direct conversion oscilators are usually not shielded at all either and so even receiving devices can be found.

cdn.rohde-schwarz.com

2

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@oz1lqo@techhub.social @g7vkq@mastodon.radio You could call it a single point of failure too. Also it does not allow regional differentiation. 50 kW is actually quite lot of power (just the cost of electricity for the 24/7 broadcast adds up). Our transmitters in CZ are long (2021) gone as well :/

2

4

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@fredy_pferdi @perlman Btw, mentioning simplex.chat - add #Briar (https://briarproject.org/how-it-works/) to the list. And I already mentioned #Jami couple of times.

briarproject.org

How it works - Briar

Briar is a messaging app designed for activists, journalists, and anyone else who needs a safe, easy and robust way to communicate. Unlike traditional messaging apps, Briar doesn’t rely on a central server – messages are synchronized directly between the users’ devices. If the Internet’s down, Briar can sync via Bluetooth, Wi-Fi or memory cards, keeping the information flowing in a crisis. If the Internet’s up, Briar can sync via the Tor network, protecting users and their relationships from sur

2

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@danslerush @nodestar is on Fediverse too :) https://mastodon.social/@nodestar/116395995229664057

mastodon.social

Node Star: "100% FREE RESOURCE A practical #security guide f…" - Mastodon

2

1

0

MarSik @marsik@witter.cz

· 4mo ago

Replying to

@fribbledom@mastodon.social @maaslalani@mastodon.social I am a huge fan of https://www.visidata.org/ It can use Python functions in columns!

VisiData

Open-source data multitool | VisiData

Command-line interactive multitool for tabular data.

1

0

MarSik @marsik@witter.cz

· 4mo ago

Replying to

@sean@scoat.es I guess people do not like Poe that much and did not get the association.

1

0

MarSik @marsik@witter.cz

· 4mo ago

Replying to

@occult@vox.ominous.net Check the charging, remote management and over the air update work first :) Climbing that again to do an update.. uhuh. I do not fear heights, I just avoid them :D Btw, I wonder if a grounded enclosure would make sense. This tower must see a lot of lightning strikes.

1

2

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@albi@f.cz @ruza@witter.cz Jenže jaké? Ten protokol je fajn, ale ta DAB rádia na trhu žerou energii ve velkém. Takže při výpadku proudu to na baterie neudržíte moc dlouho. Ani ve standby.

1

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@bms48 @ariarhythmic @maxleibman I agree with you, but algorithms are special. They are between the creative (code) and discovery (math and science) boundaries. Quite commonly copyright protects the expression (code or code structure at least) and not the idea itself (that is why sw patents are a thing). Nobody attributes quicksort. Even though it would probably still be protected according typical copyright laws (1961 +70 yrs).

1

2

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@bms48 @ariarhythmic @maxleibman Learning from opensource projects and books is legal. As a human I have seen a lot of projects over past decades and probably have learned some tricks from those too. Just using the learned tricks would be fine as well as reproducing a well known algorithm conceptually. There are limited ways to express those efficiently and according to the state of the art. However the reproduction of identical code (incl. variable names and comments) IS an issue indeed.

1

19

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@nodestar @VeroniqueB99 I think the point was to get #disconnected for a while. No annoying calls or messages demanding immediate response. #digitaldetox

1

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@perlman Any weak link in crypto or the protocol is exploitable. A similar list exists for TOR https://github.com/Attacks-on-Tor/Attacks-on-Tor#categories-of-de-anonymizing-techniques-and-attacks The de-anonymization attacks are very real https://nusenu.medium.com/tracking-one-year-of-malicious-tor-exit-relay-activities-part-ii-85c80875c5df or https://blog.torproject.org/tor-security-advisory-relay-early-traffic-confirmation-attack/ Imagine a state with "unlimited resources" hunting whistleblowers, spys, opposition or you. Overlooking something or a small bug can be outright dangerous in this field and I found more gaps than this one (first hop, link correlation, path breadcrumbs, proof source signature).

GitHub

GitHub - Attacks-on-Tor/Attacks-on-Tor: Thirteen Years of Tor Attacks

Thirteen Years of Tor Attacks. Contribute to Attacks-on-Tor/Attacks-on-Tor development by creating an account on GitHub.

1

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@perlman yes, there are lot of things that work just fine. And then few things that were missed. For example the link proof can be linked with the sender via the signature done using the publicly known destination identity key. Or the path discovery breadcrumbs. And the statistical analysis of interface traffic that can link the various identities together. Network privacy is simply hard.

1

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@perlman@indieweb.social I am an engineer and HAM and I am doing radio and telco (and real time cloud that powers that). I am also an open source advocate and used to tough questions and code reviews. And I am indeed a bit sensitive to hyperinflated claims and project marketing that ignores history lessons and existing projects. Show me data, comparisons, measurements. Show me the benefit of the new approach. Hobby is fine too, just do not call it “the new internet” without proving it.

1

13

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@perlman And btw, I am guilty of reimplementing radio protocols too. And I know how time consuming and futile it is.... but I learned a lot. So experimenting with simpler solutions is something I absolutely recommend and support. However production and safety related deployments need a bit more than experiments.

1

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@ozeng @perlman Nope, IP does not require any authority. It is just a protocol. Publicly reachable Internet nodes do, but that is not the same. You can build a totally independent IP based network. Or just point to point links using random local addresses. See for example: https://archive.fosdem.org/2025/schedule/event/fosdem-2025-6523-hamnet-status-update/ (uses an ancient allocated IP block now, but worked without it in the past). or https://en.wikipedia.org/wiki/Unique_local_address Routing is then done via standard BGP and private ASs: https://www.rfc-editor.org/rfc/rfc6996

archive.fosdem.org

FOSDEM 2025 - HAMNET - Status Update

1

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@perlman The design goal to avoid IP is exactly where I do not agree. I see the benefits of exploring non-connected networks (https://en.wikipedia.org/wiki/Delay-tolerant_networking) like LXMF could do and Bundle Protocol does. Or in research of plausible deniability and steganography in connected networks (where Reticulum partially competes with TOR or Jammi). But the lower level networking and routing methods are so widely studied using https://en.wikipedia.org/wiki/Request_for_Comments that doing your own is waste of time.

en.wikipedia.org

1

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@fredy_pferdi @perlman Agreed. But it is not specific to IP as it applies to any medium where the adversary can listen and perform traffic analysis. That includes landline (govts know who called whom and can tap the line), LoRa as everybody can listen to the radio or the intermediate Internet nodes. On the other hand, you can also build a private IP and wire based network and avoid surveillance that way.

1

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@perlman I agree the solutions for connected environments and delayed / disrupted environments differ significantly. But the bundle protocol (BPv7) is specifically meant as protocol for complicated environments. NASA uses it for interplanetary communication. So actually no, I did not assume working Internet.

1

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@perlman Alternatives without wide hardware support and tools tend to be short lived. Micron is the prime example. Show me any IDE, editor or renderer (https://pandoc.org/MANUAL.html#option--from ) with support for it. TOR has had many security audits. Reticulum got 0. The standards mean much wider audience, research and dev pool with more varied experience. Eg. a network engineer is not necessarily a security expert. Reimplementing all in a single repo is limiting. Collaboration is better.

Pandoc

Pandoc - Pandoc User’s Guide

A universal document converter

1

0

MarSik @marsik@witter.cz

· 6mo ago

Replying to

@perlman btw in case you haven’t heard about it yet. The amateur radio operators in Germany and around actually built a high speed private network HAMNET - https://archive.fosdem.org/2025/schedule/event/fosdem-2025-6523-hamnet-status-update/ It is not privacy oriented though, HAM traffic cannot be encrypted. That is the legal price we pay for having access to extra frequencies.

archive.fosdem.org

FOSDEM 2025 - HAMNET - Status Update

1

0

MarSik @marsik@witter.cz

· 6mo ago

Replying to

@perlman The last case is complex - political danger. When comms work fine you need secrecy, privacy and plausible deniability. That is why VPNs and steganography exist and TOR was invented as an overlay network. When comms are down, like in war, it’s the worst combination. Even a possession of special tools can put you in danger. Radio is banned, jammed, triangulated or targeted. Key distribution and identity validation is impossible.

1

0

MarSik @marsik@witter.cz

· 6mo ago

Replying to

@perlman Reinventing *everything* from scratch is wrong. The prime example: the Micron markup. Why? Markdown, Asciidoc and even vt100 are more byte efficient (HTML compresses nicely). You can build your own infra and be your own ISP even using IP. Then use .onion and TOR browser. Btw, LoRa is ~100kbps max on shared airwaves. Meshtastic in CZ collapsed with low traffic (flood). Meshcore is hitting routing issues (prefix length). Imagine what happens to the mesh when thousands join at once.

1

4

0

MarSik @marsik@witter.cz

· 4mo ago

Replying to

@oz1lqo@techhub.social @g7vkq@mastodon.radio One of the last ones here was https://en.wikipedia.org/wiki/Topoln%C3%A1_transmitter Max 1.5 MW in 80s. 650 kW at the end.

en.wikipedia.org

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@engideer @bms48 @ariarhythmic @maxleibman Look at a typical politician. Are they too different? I have encountered such overconfident people indeed. From computational perspective we are similar (just much more complex). Especially the verbal thinkers that talk to themselves during reasoning.

0

10

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@seachaint@masto.hackers.town @jwildeboer@social.wildeboer.net Yes.

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@perlman@indieweb.social Then you will compete in the marketing space with the blockchain folks (https://thenewinternet.org/) with the VPN folks (https://tailscale.com/blog/new-internet) and with the AI folks too. I was trained to write user stories (= clear goals), measure them and compare to alternatives. And do a realistic demo. I had a question: Why is RNS better than others? So I did ask for comparison and provided my examples and data. The only answer was BP is complex... I like the RNode TNC mode and tncattach, btw.

thenewinternet.org

theNewInternet

0

10

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@kimschulz@social.data.coop Reticulum is not perfect either. It encrypts everything and uses pre-negotiated links. So far so good. Sadly there are possible de-anonymization attack vectors I found when digging around in the code and protocol: https://witter.cz/@marsik/116458707129395348 The Meshcore model is semi-commercial indeed and the lack of a clear protocol description prevents alternative open firmwares from being implemented reliably. As a HAM I prefer open plaintext APRS and Winlink for the off grid emergency messaging.

witter.cz

MarSik: „@perlman@indieweb.social Ok, to show I am not jus…“ - Witter

0

2

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@bms48 @engideer @ariarhythmic @maxleibman I am not trying to model or describe all of it. We are a lot more complex. But engineering is heavy on applying best practices (design patterns). And the mundane day to day programmer’s work is close to what LLMs can do. LLMs are not really creative, the input and context space is too small for that. However they are good in pattern recognition and repetition. That’s why we discuss copyright.

0

8

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@dj3ei@mastodon.radio Thanks, this is about the same I found when browsing the available devices. It seems the time of long running AA powered FM and short wave radios are gone now :/

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@meshtastic @jp_bennett Interesting, any plans to allow generic UART KISS protocol boards too?

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@bytex64 @occult @pixie #Meshtastic has different design goals from #Meshcore. And did a lot of very good work on simulation and planning tools. All opensource. Including the mobile app! #Meshcore started because of a license and trademark dispute as well. The primary author wanted to incorporate Meshtastic to a closed source commercial product and hit GPL conditions of the protobuf files. Meshtastic was also too early and had no CLIENT_MUTE.

0

1

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@kimschulz@social.data.coop I tend to separate two use-cases:

emergency comms - setting up off-grid infrastructure (possibly encrypted)
and privacy (on any existing infra).

MC, MT, RNS all try to do bit of both.

Issues:

Heavy cryptography is not ensuring privacy unless you also validate identity keys somehow (this is hard!). Otherwise man in the middle situations are possible.

You want a simple foolproof device and many people to quickly notice you when in distress (hurt and tired). No privacy wanted.

0

MarSik @marsik@witter.cz

· 4mo ago

Replying to

@juhele@cztwitter.cz @chiptronCZ@mastodonczech.cz Mně se ty barevný e-inky taky líbí, propojit to s home assistantem, kalendářem a školním seznamem akcí by bylo super. Ale není to ekonomické a nemám vhodné místo s napájením. I když to chvíli na baterku vydrží, nějak ty Li-Pol nemám poslední dobou moc rád.

0

MarSik @marsik@witter.cz

· 5mo ago

Replying to

@bms48 @engideer @ariarhythmic @maxleibman Ok, so I actually agree that purely conversational AI tools are unpredictable, hallucinate and have outdated knowledge. However when the AI models are trained in problem solving (as opposed to knowledge only) this changes. The connection to the real world via tools appears. Then the AI can replicate the problem solving and tool usage patterns (still not smart, but predictable) - prof. Wooldridge actually says so too in the QA https://youtu.be/CyyL0yDhr7I?t=3237

This is not the AI we were promised | The Royal Society

0