Version 0.78.0

The recovery tool does not contact the storage addresses written inside a recovery list.

A recovery list records, inside its encrypted body, the storage addresses the browser was reading from when the list was written, and the tool used to try them after its own. Two sentences in the code said that was safe: the encrypted body was written by whoever holds the account code, and the bytes are checked against the file key anyway. The first stopped being true when the recovery kit started carrying the account code, because a kit somebody hands you was encrypted with their own code; the second answers a different question, since checking the bytes protects what arrives and says nothing about a request going out to a host the file chose, which tells that host's operator where and when you recovered. Those addresses are now printed and not contacted, --use-recorded-aggregators turns them back on, and this went out as recovery tool 0.4.0.

Storage lengths are labelled from the epoch length the network reports, not from a number built into the site.

One epoch is fourteen days on the network NMTS runs on, and the picker turned epochs into days using that figure compiled into the site. It is right today and would go wrong silently the day the network changed it — the screen would keep saying fourteen and people would be buying something else. The upload picker and the extend sheet already read the network's own epoch clock for other parts of the same screen, so the length now comes from there, at no extra request. The size calculator on the front page still uses the built-in number, and says which date it is based on: that page computes entirely on your device and makes no network request at all.

The home page's live figures now count a file only when what it names is a storage-network id.

The home page shows what is stored right now beside the cumulative totals. The cumulative pair has always counted only files whose parts carry the kind of id the storage network hands back; the live pair counted rows, so writing any string into your own list moved a published number at no cost. Both halves now apply the same row-level rule, and so does the figure for how many accounts have uploaded — whose own description said it could not be inflated because uploading costs money on the storage network. Nothing on the live service moved, and this still checks the shape of an id rather than whether the bytes are on the network.

The recovery tool no longer puts its session pass on the command line when it opens your browser.

The tool's control window is reached at an address carrying a one-run pass, and it used to hand that whole address to the desktop to open. On Linux any other user on the same machine can read a running program's command line, so the pass was readable while the browser was starting — and whoever holds it can ask the tool for your whole file index and have it write your files into a folder of their choosing. The tool now writes a small file only you can read, whose only content is a line sending the browser to that address, and opens the file instead: the path is public, what is in it is not. The tool still refuses to take an account code through that window, the window is still reachable only from this machine, and this went out as recovery tool 0.3.2.

The recovery tool's control channel refuses a caller before it holds anything the caller asked it to hold.

The channel read a request's head and body together, allocating whatever body length the caller declared and then waiting for it, and only afterwards checked the address and the session pass. Anything running on the same machine could open a socket, claim a 32 MB body, send nothing, and hold that much memory for the read timeout — on a machine somebody is rescuing a drive onto. The head is now read on its own, the caller is admitted or refused on what it says, only an admitted caller's body is read, and the declared length is no longer allocated in advance. The same release clears the account code out of memory on every path it arrives by, including the whole text of a recovery kit, and went out as recovery tool 0.5.0.