__                 _ _                _
  / _| ___   ___   __| | |__   __ _ _ __| | __
 | |_ / _ \ / _ \ / _` | '_ \ / _` | '__| |/ /
 |  _| (_) | (_) | (_| | |_) | (_| | |  |   <
 |_|  \___/ \___/ \__,_|_.__/ \__,_|_|  |_|\_\

A personal BBS  ·  Missoula, Montana  ·  formerly NaClCON BBS

Connect from your terminal: telnet naclconbbs.net 23  |  ssh naclconbbs.net -p 2222

  1. Forum
  2. DOVE-Net
  3. Synchronet Programming

  • ctrl/sbbs.ini docs/v322_new.md exec/load/sbbsini.js src/sbbs3/websrvr.

    From Rob Swindell (on Debian Linux)@VERT to Git commit to main/sbbs/master on Sat Aug 1 00:24:30 2026
    https://gitlab.synchro.net/main/sbbs/-/commit/3cd05185ae71b03a3971332f
    Modified Files:
    ctrl/sbbs.ini docs/v322_new.md exec/load/sbbsini.js src/sbbs3/websrvr.cpp websrvr.h
    Log Message:
    websrvr: stop advertising TLS-PSK in the default Authentication list

    The web server cannot perform TLS-PSK: the code that would register the user/password pairs with the TLS session, and the code that would read the negotiated username back off it, are both compiled out. They have been
    disabled since dbbfabf1b1 (funky-27-foam, 2015-08-20), the commit that first added TLS support here, so the mechanism has never functioned.

    Offering it by default meant a sysop who followed the shipped list and set Authentication = TLS-PSK for a directory got a location nobody could authenticate to, with no diagnostic explaining why.

    Drop it from the default in all three places the string is spelled: the compiled-in WEB_DEFAULT_AUTH_LIST, the stock ctrl/sbbs.ini (which has carried it since 4cf1839fce, service-28-when, 2016-11-28), and the JavaScript mirror
    of the default in exec/load/sbbsini.js.

    Correcting the default does not reach an install whose own sbbs.ini already names TLS-PSK, since an explicit key always wins over the compiled default,
    so also log a warning at web server startup when the configured list still names it.

    The disabled TLS-PSK code is left in place for the day the web server gains
    an additional or alternative crypto backend; this changes what is advertised, not the dormant support.

    GitLab #1206

    Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

    ---
    þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net