Patch shipped: v1.6.683 — Hearth 0.4.8 security release
Posted by Chris
These SparkBox updates are now available: v1.6.683 — Hearth 0.4.8 security release - Hearth moves to 0.4.8, a security release from a full audit of the chat server and its apps. Sealed (end-to-end encrypted) Hearths now remember on each device that they are sealed, so a server can never quietly switch encryption off; call setup is encrypted between the devices on the call; messages and files are bound to their place in the chat so they cannot be moved or truncated unnoticed; a signed-out or revoked device is disconnected immediately instead of lingering on an open connection; and the link-preview fetcher can no longer be pointed at addresses inside your own network. - The Hearth container now runs as an unprivileged user. On the first start after this update it hands its existing data folder over once, automatically, so nothing changes for you. - Removing a member from a sealed Hearth changes the join code but not the encryption key; the ban and invite screens now say so plainly. A key reset is coming. Update from the SparkBox dashboard, or run sudo sparkbox upgrade on your SparkBox host. If a problem remains after updating, submit a private support ticket or reply here. Include your SparkBox version and what you see; leave passwords and licence keys out.