Misfin: a smallnet messaging protocol
Misfin is a lightweight messaging protocol, similar to SMTP or WhatsApp. It uses mandatory TLS and the Gemini text format.
The active version of Misfin is called Misfin(C). The best place to talk about implementing misfin is the ##misfin channel on libera.chat
I (satch) am committed to keeping this page up-to-date, accurate and comprehensive. Please contact me at mail@satch.xyz with any corrections. This page was copied in large part from mk270's page.
Misfin(A), Misfin(B), Proposed Misfin(C)
Misfin(A) and Misfin(B) are two version of Misfin, created by Lem, the originator of Misfin, who is currently absent.
There is a community proposal for Misfin(C), negotiated between implementers via IRC. This is still in draft form. Misfin(C) is deliberately incompatible with Misfin(B). This means that conformant Misfin(B) servers will continue to enforce Misfin(B)'s stricter message length limits.
Misfin(C) is in no sense endorsed by Lem, the Misfin maintainer.
Links
Misfin(C)
Misfin(B)
Misfin in general
Implementations
Clients
Generally, clients allow one to send and sometimes read or store misfin messages.
Skylab uses a Gemini frontend. It is a CGI program in Go.
Lagrange is a smallweb browser which handles misin:// links and allows sending messages but not reading them.
This is a Gemini frontend for cipres' server written in Python.
No Active development (contact me if my categorization here is wrong):
Servers
No Active development:
Libraries
No Active development:
Issues
(This list isn't necessarily up-to-date)
- messages aren't encrypted at rest / intermediaries can intercept the messages, even though sender likely has the public key for the recipient
- mailing lists: only the last hop can be verified
- implicit ambiguity re CRLF/LF in the lines part of the misfin(B) spec
- TLS libraries are a bit shaky on self-signed certificates, the proffering of non-mandatory certificates, etc
- TLS libraries use different ASN1 data types for representing mandatory fields (like subject alt name) required by misfin
- the misfin(B) spec could be portrayed as trying to extend Gemtext format
- in principle the misfin(B) metadata lines could appear anywhere in the body of the message
- there is no obvious way that the holder of a mailbox can attest that the server is authorised to receive messages to that mailbox over misfin
- it should be explicit in Misfin(C) that the receiving servers adds the sender and timestamp, not the sender
- what support should there be for null-body verification messages
What Misfin is not
- Misfin is *not* a protocol for retrieving or manipulating messages stored on a remote server, on behalf of one or multiple clients
- Misfin is *not* end-to-end encrypted in the accepted sense of that term, but it *is* mandatorily encrypted and thus protected against middleboxes
There are related protocols for dealing with these two issues: