diff --git a/docs/api/get_started/plugins/index.html b/docs/api/get_started/plugins/index.html index 86725360f7..9a8743efa5 100644 --- a/docs/api/get_started/plugins/index.html +++ b/docs/api/get_started/plugins/index.html @@ -66,6 +66,7 @@ https://github.com/laurent22/joplin/blob/dev/readme/api/get_started/plugins.md
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
+ What's New Help Forum Joplin Cloud
-
-
- +
-
- +
-
- +
-
- +
-
- +
-
- +
-
- +
-
- +
-
- +
-
- +
-
- +
-
- +
-
- +
-
- +
-
- +
-
- +
-
- +
-
- +
-
- +
-
- +

And the winner is...πŸ”—

After much discussion and votes and new logo and icon for Joplin has finally been decided:

-

+

In the end, it is an icon relatively similar to the previous one but with a unique style for the "J", which gives it a distinctive look.

Perhaps that's the best way - evolving and cleaning up the icon rather than radically changing it. Another advantage of this icon is that it does not represent any specific object (it's not a note, or notebook), so it does not restrict the scope of the project, which as it grows, is becoming more than just a tool to take notes.

Finally, this icon scales well at different sizes, including down to 16x16 pixels which we need for tray icons. It also works well inside circles (for Android) and square shapes.

@@ -307,12 +146,9 @@ https://github.com/laurent22/joplin/blob/dev/readme/blog/20191117-183855.md

D 135

E 61

Many thanks to everyone who's contributed to the votes and discussion!

-
-

url: https://www.patreon.com/posts/and-winner-is-31636650
-published_at: 2019-11-17T18:38:55.000+00:00

diff --git a/docs/blog/20191118-072700/index.html b/docs/news/20191118-072700/index.html similarity index 60% rename from docs/blog/20191118-072700/index.html rename to docs/news/20191118-072700/index.html index bb62874bed..18d689bad8 100644 --- a/docs/blog/20191118-072700/index.html +++ b/docs/news/20191118-072700/index.html @@ -5,11 +5,11 @@ !!! WARNING !!! -This file was auto-generated from readme/blog/20191118-072700.md and any manual change +This file was auto-generated from readme/news/20191118-072700.md and any manual change made to it will be overwritten. To make a change to this file please modify the source Markdown file: -https://github.com/laurent22/joplin/blob/dev/readme/blog/20191118-072700.md +https://github.com/laurent22/joplin/blob/dev/readme/news/20191118-072700.md --> @@ -66,6 +66,7 @@ https://github.com/laurent22/joplin/blob/dev/readme/blog/20191118-072700.md
-
- +

Joplin is looking into joining Google Summer of Code in 2020πŸ”—

-

+

Joplin is looking into joining Google Summer of Code next summer. The application period as organisation is expected to happen in the second half of January 2020. Until then Joplin hopes to have multiple active discussion and may even have some easy commits in regard to the application and potential projects.

For those who don’t know, GSoC is a summer internship sponsored by Google, where open source organisations get full-time students as interns (paid by Google) to help take care of tasks. It’s a huge boon to many open source projects, allowing potentially some impressive progress to take place, and therefore many organisations try to qualify.

In order to apply, we'd need:

@@ -305,12 +144,9 @@ https://github.com/laurent22/joplin/blob/dev/readme/blog/20191118-072700.md

Fell free to make a suggestion or offer support by creating topics in the Features category of the forum and tagging them by #GSoC and #2020, if it is directly related to the upcoming coding season. More details on how to contribute will be published soon.

In general, Google wants to know that its money is put to good use, so we, as the Joplin community, need to show active involvement in this, leading to a solid schedule of desired deliverables during the coding phase.

The GSoC application is managed by @PackElend. He is an open source enthusiast with a big believe in a fair economy. He has recognised that Joplin has the potential to become one of the best note taking apps, and he sees the GSoC has a great opportunity to bring certain essential features to Joplin. PackElend mentored students in the past for another project and thus is aware of the pitfalls. He would appreciate if he could get support in giving the documentation the final touch.

-
-

url: https://www.patreon.com/posts/joplin-is-into-31650911
-published_at: 2019-11-18T07:27:00.000+00:00

diff --git a/docs/blog/20200220-190804/index.html b/docs/news/20200220-190804/index.html similarity index 54% rename from docs/blog/20200220-190804/index.html rename to docs/news/20200220-190804/index.html index 18c2510279..92f36d7c3d 100644 --- a/docs/blog/20200220-190804/index.html +++ b/docs/news/20200220-190804/index.html @@ -5,11 +5,11 @@ !!! WARNING !!! -This file was auto-generated from readme/blog/20200220-190804.md and any manual change +This file was auto-generated from readme/news/20200220-190804.md and any manual change made to it will be overwritten. To make a change to this file please modify the source Markdown file: -https://github.com/laurent22/joplin/blob/dev/readme/blog/20200220-190804.md +https://github.com/laurent22/joplin/blob/dev/readme/news/20200220-190804.md --> @@ -66,6 +66,7 @@ https://github.com/laurent22/joplin/blob/dev/readme/blog/20200220-190804.md
-
- +
-
- +
-
- +

Experimental WYSIWYG editor in JoplinπŸ”—

The latest pre-release of Joplin (v1.0.194) includes a new WYSIWYG editor, a prototype for now, but a first step towards integrating this feature into Joplin.

-

+

WYSIWYG is probably the most requested feature in Joplin - it's the second most up-voted on GitHub, and one of the most viewed and commented on post in the forum.

Please note however that this feature is experimental at this stage - don't use it for important notes as you may lose the content of the note, or it might get corrupted.

If you are interested in this editor though it might make sense to use it for less important notes, so as to evaluate it and report bugs and issues you might find.

@@ -306,13 +145,10 @@ https://github.com/laurent22/joplin/blob/dev/readme/blog/20200314-001555.md

Some features are missing, most notably the ability to insert plugin blocks such as Katex or Mermaid, so you would have to create them first in the split view. Once created, they can however be edited.

One issue to be aware of, one that cannot be easily fixed, is that some Markdown plugins are not supported by the editor. This is because once the Markdown is converted to HTML, and displayed in the WYSIWYG editor, it cannot be converted back to the original Markdown. Some plugins are supported, such as Katex, Fountain or Mermaid. But others are not, like the multi-md table. So if you open a note that contains a multi-md table in the WYSIWYG editor and save, the original multi-md Markdown will be lost, and you'll get back a plain Markdown table.

Again if you find any issue, please report it on GitHub: https://github.com/laurent22/joplin/issues/176

-

-
-

url: https://www.patreon.com/posts/experimental-in-34246624
-published_at: 2020-03-14T00:15:55.000+00:00

+

diff --git a/docs/news/20200406-214254/index.html b/docs/news/20200406-214254/index.html new file mode 100644 index 0000000000..985f77d6a8 --- /dev/null +++ b/docs/news/20200406-214254/index.html @@ -0,0 +1,219 @@ + + + + + + + + + + + + + + + + + + Joplin informal encryption and security audit results | Joplin + + + + +
+ + +
+
+
+ + +
+ + +

Joplin informal encryption and security audit resultsπŸ”—

+

Joplin encryption, and in particular the E2EE system used during synchronisation, was recently audited by Isaac Potoczny-Jones, CEO of Tozny and this is what he had to say:

+
+

I was looking through your encryption implementation for Joplin and I have a few comments and concerns. I don't see anything that I *know* is a critical issue, but there are a number of choices and weaknesses that I'd like to lend you some advice about.

+
+

OBC2πŸ”—

+
+

OCB2, the chosen multi-block cipher mode has had some weaknesses identified in the last few years. I don't know this mode well since it's not a NIST-approved mode, but here's a paper on the topic. I get the impression it's not considered a good choice anymore. Source

+
+

We indeed had been notified about this issue by another cryptographer and had been preparing migration to the more secure CCM mode. Migration for this is now complete in all the Joplin clients and a migration tool has been added to the Encryption config screen of the desktop application. In particular you can perform two operations:

+
    +
  • Upgrade the master key: This will convert the master key encryption to CCM
  • +
  • Re-encryption: With this tool, you can re-encrypt all your data using the new encryption method based on CCM. Please follow the instructions on this screen and note that this process can take quite a bit of time so it's better to plan for it and run it over night. It is not entirely clear how the OBC2 flaw can be exploited but it is best to upgrade your data as soon as possible.
  • +
+

Unnecessary key expansionsπŸ”—

+
+

Running key expansion on a random key: Your encrypt function uses either 1k or 10k roundsΒ of key derivation. The goal of this is to reduce brute-force attacks against user-chosen passwords. This function appears to me to be used for both password-based key derivation (at 10k rounds) *and* bulk encryption of data from a randomly-generated "master key" (at 1k rounds). The bulk encryption does not need the password expansion since the key is randomly generated (presumably with a cryptographically strong generator). I suspect this could be a major performance issue on the bulk encryption of raw data, so if you're finding encryption slow, this is maybe why.

+
+

This is more a performance than a security issue. Indeed, the previous encryption method was using 1,000 key expansion iterations every time a note was encrypted, which is unnecessary since the master key is already secured with 10,000 iterations. As a result the encryption algorithm has been changed to perform only 100 iterations when encrypting notes, which should result in faster encryption and decryption on the desktop, mobile and CLI applications.

+

Unnecessary and potentially insecure master key checksumπŸ”—

+
+

You make and store a checksum of the master password with SHA256 in addition to encrypting it. I expect this is because you need a way to tell if the user's password is correct. I've never seen this done before, and it has me concerned, but I don't know for sure that it's an issue. Thought I'd mention it anyway. Source. At least with CCM mode (and I think with OCB2) it shouldn't successfully decrypt if you have the wrong password.

+
+

A checksum was previously stored with the master key to verify that it is valid. This could potentially weaken the security of the mater key since, as mentioned in Cryptography StackExchange link, "in the standard model of hash functions there isn't a requirement that hash outputs not have properties that leak information about the input". It was also unnecessary since the decryption algorithm in use would fail if the key is invalid, so the additional checksum was not needed.
+This has also been addressed by the new master key upgrading tool. If you have performed the upgrade, the checksum will be gone from your master key.

+

Encrypting local secrets with a keychain serviceπŸ”—

+
+

Now I did notice that you cache the plain text password in the database, which is a bit concerning, but I guess the security model of your encryption approach is that it happens during sync, not locally. The generally accepted approach [to store secrets] is to use a keychain service, which is available pretty much on all modern platforms.

+
+

Passwords are indeed cached locally, so that you don't have to input it again every time a note needs to be encrypted or decrypted for synchronisation. It is assumed that your local device is secure, which is why for now passwords were cached locally.
+To improve security however, future versions of Joplin will use the system keychain whenever it is available. A pull request is in progress to add this feature.
+To conclude I'd like to thank Isaac Potoczny-Jones for conducting this audit and revealing these potential security issues. Joplin is now much safer as a result.

+ + +
+
+
+
+ + +
+
+
+ +
+ + +
+
+ + + + + diff --git a/docs/blog/20200406-224254/index.html b/docs/news/20200406-224254/index.html similarity index 69% rename from docs/blog/20200406-224254/index.html rename to docs/news/20200406-224254/index.html index 8a892e24ab..2771e1ee6d 100644 --- a/docs/blog/20200406-224254/index.html +++ b/docs/news/20200406-224254/index.html @@ -5,11 +5,11 @@ !!! WARNING !!! -This file was auto-generated from readme/blog/20200406-224254.md and any manual change +This file was auto-generated from readme/news/20200406-224254.md and any manual change made to it will be overwritten. To make a change to this file please modify the source Markdown file: -https://github.com/laurent22/joplin/blob/dev/readme/blog/20200406-224254.md +https://github.com/laurent22/joplin/blob/dev/readme/news/20200406-224254.md --> @@ -66,6 +66,7 @@ https://github.com/laurent22/joplin/blob/dev/readme/blog/20200406-224254.md
-
- +
+ What's New Help Forum {{#showJoplinCloudLinks}} @@ -42,8 +43,9 @@