Ricochet Changelog
What's new in Ricochet 1.1.4
Feb 8, 2018- Added translations for Albanian, Chinese (Hong Kong), Estonian, Italian (Italy), Norwegian Bokmål, and Portuguese (Portugal)
- Updated translations for Danish, German, Russian, Czech, and Turkish
- Use a software-only render to hopefully fix graphical and text issues (#367). Also resolves #365, #358, #348, #375, #331, #389, #411, #454, #409, #442, #445, #447
- Fix parsing of links containing certain sequences (#403, #372, no security impact)
- Fix 'dead keys' and other compose/ibus input methods with Linux binaries (#60)
- Fix Tor configuration with HTTP proxies (#418)
- Fix copying links with right click (#429)
- Use combined chat window by default (#355)
- Use an external tor instance when TOR_CONTROL_{HOST,PORT,PASSWD} is set
- Fix visual bugs with window resizing during network setup
- Properly display the "X is already your contact" error (#439)
- Revise language selection UI to fit all of our languages (#473)
- Store identity keys in ricochet.json when Tor is new enough (#227)
- Disable ASAN by default for release builds (#341)
- Attempt to disable use of RWX memory for improved security
- Display configuration parsing errors correctly
- Add support for OpenSSL 1.1 (#444)
- Updated builds with Qt 5.6.2, OpenSSL 1.0.2j, and Tor 0.2.8.9
- Windows builds can now be cross-compiled with MinGW
New in Ricochet 1.1.2 (Feb 25, 2016)
- Security fixes:
- By sending a nickname with some HTML tags in a contact request, an attacker could cause Ricochet to make network requests without Tor after the request is accepted, which would reveal the user's IP address. The malicious nickname is clearly displayed, and no network activity takes place unless the request is accepted. We've addressed this vulnerability by sanitizing nicknames in all cases before display, rejecting contact requests with suspicious nicknames, and blocking any network requests at that layer.
- Changes:
- Block all network requests to guard against potential deanonymization issues (#303)
- Reject contact requests with nicknames containing suspicious characters
- Sanitize nicknames before use in UI labels
- Fix a common crash when restarting an outbound connection attempt
- Fix a bug which caused connection attempts to contacts to stall until restarted (#295)
- Added translations for Hebrew, Slovenian, and Chinese
- Updated translations
- Updated to Qt 5.5.1, OpenSSL 1.0.1r, and Tor 0.2.7.6
- OS X builds now use AddressSanitizer for hardening
New in Ricochet 1.1.1 (Dec 29, 2015)
- UI:
- Optionally play sounds when messages are received or contacts come online
- Language can now be changed in preferences
- Add Polish translation
- Use a custom scrollbar to avoid buggy scrolling behavior
- Improve UI icon quality
- Update to Qt 5.5.0, including fixes for a variety of text display issues
- Translation updates and fixes for many languages
- Core:
- Use compiler hardening flags when available
- Add experimental apparmor and minijail sandboxing policies
- Accept public keys generated by vanity address tools
- Fix a case where contacts would be stuck in the 'Rejected' category until manually removed
- Treat all random number generator failures as fatal
- Update Tor to 0.2.6.10, including a fix for a hidden service reliability issue
- Update OpenSSL to 1.0.1p