8519a24ba6
This changes the TLS and certificate handling in a few ways: - We always use TLS 1.2, both for sync connections (as previously) and the GUI/REST/discovery stuff. This is a tightening of the requirements on the GUI. AS far as I can tell from caniusethis.com every browser from 2013 and forward supports TLS 1.2, so I think we should be fine. - We always greate ECDSA certificates. Previously we'd create ECDSA-with-RSA certificates for sync connections and pure RSA certificates for the web stuff. The new default is more modern and the same everywhere. These certificates are OK in TLS 1.2. - We use the Go CPU detection stuff to choose the cipher suites to use, indirectly. The TLS package uses CPU capabilities probing to select either AES-GCM (fast if we have AES-NI) or ChaCha20 (faster if we don't). These CPU detection things aren't exported though, so the tlsutil package now does a quick TLS handshake with itself as part of init(). If the chosen cipher suite was AES-GCM we prioritize that, otherwise we prefer ChaCha20. Some might call this ugly. I think it's awesome. |
||
|---|---|---|
| .github | ||
| assets | ||
| cmd | ||
| etc | ||
| gui | ||
| lib | ||
| man | ||
| meta | ||
| script | ||
| test | ||
| vendor | ||
| .gitattributes | ||
| .gitignore | ||
| AUTHORS | ||
| build.go | ||
| build.sh | ||
| CONDUCT.md | ||
| CONTRIBUTING.md | ||
| Dockerfile | ||
| GOALS.md | ||
| LICENSE | ||
| README-Docker.md | ||
| README.md | ||
| snapcraft.yaml.template | ||
Goals
Syncthing is a continuous file synchronization program. It synchronizes files between two or more computers. We strive to fulfill the goals below. The goals are listed in order of importance, the most important one being the first. This is the summary version of the goal list - for more commentary, see the full Goals document.
Syncthing should be:
-
Safe From Data Loss
Protecting the user's data is paramount. We take every reasonable precaution to avoid corrupting the user's files.
-
Secure Against Attackers
Again, protecting the user's data is paramount. Regardless of our other goals we must never allow the user's data to be susceptible to eavesdropping or modification by unauthorized parties.
-
Easy to Use
Syncthing should be approachable, understandable and inclusive.
-
Automatic
User interaction should be required only when absolutely necessary.
-
Universally Available
Syncthing should run on every common computer. We are mindful that the latest technology is not always available to any given individual.
-
For Individuals
Syncthing is primarily about empowering the individual user with safe, secure and easy to use file synchronization.
-
Everything Else
There are many things we care about that don't make it on to the list. It is fine to optimize for these values, as long as they are not in conflict with the stated goals above.
Getting Started
Take a look at the getting started guide.
There are a few examples for keeping Syncthing running in the background on your system in the etc directory. There are also several GUI implementations for Windows, Mac and Linux.
Vote on features/bugs
We'd like to encourage you to vote on issues that matter to you. This helps the team understand what are the biggest pain points for our users, and could potentially influence what is being worked on next.
Getting in Touch
The first and best point of contact is the Forum. There is also an IRC
channel, #syncthing on freenode (with a web client), for talking
directly to developers and users. If you've found something that is clearly a
bug, feel free to report it in the GitHub issue tracker.
Building
Building Syncthing from source is easy, and there's a guide that describes it for both Unix and Windows systems.
Signed Releases
As of v0.10.15 and onwards release binaries are GPG signed with the key D26E6ED000654A3E, available from https://syncthing.net/security.html and most key servers.
There is also a built in automatic upgrade mechanism (disabled in some distribution channels) which uses a compiled in ECDSA signature. macOS binaries are also properly code signed.
Documentation
Please see the Syncthing documentation site.
All code is licensed under the MPLv2 License.