Security

Ferryman moves your project’s assets between machines, so it treats every connection as untrusted until you decide otherwise.

Machine keys

Every machine has its own key pair, made the first time Ferryman runs. It is stored in the user’s settings folder (on Windows %LOCALAPPDATA%\tridiART\Ferryman), together with the list of machines it paired with. All editors on that machine share it.

Encrypted transfers

Every network connection between two editors is encrypted: the editors agree on a key with X25519 and encrypt everything with ChaCha20-Poly1305, which also detects any change on the way. This applies to sends, pastes, live links, tickets and connection codes.

Pairing with check words

The first parcel from another machine shows four check words on both editors. They are derived from the keys the two editors agreed on for this connection, so they only match when nobody sits in between.

1. Ask the sender which words their editor shows (in person, by phone, in a chat).
2. Land only if they are exactly the words your review shows.
3. Tick Trust this machine from now on to pair with it.

A paired machine is remembered by its id and its key. If the same machine name shows up with a different key, it is treated as a new, unpaired machine again.

Only you decide whether to trust a machine. Parcels from unpaired machines always wait for your review, whatever the Review Arrivals setting says. To forget a paired machine, use forget_device from Python.

Connection codes

A connection code carries the receiver’s address, its port and an 80-bit secret. The secret is mixed into the connection’s keys, so only someone with the code can send with it. Codes are valid for an hour. Parcels sent with your code are treated like parcels from a paired machine.

Locked dock parcels

A parcel put on the dock with Lock with a code is encrypted with a key derived from its six-word code (PBKDF2, then ChaCha20-Poly1305). The dock lists it as Locked parcel, without names; only the code opens it. Unlocked parcels are plain files that anyone with access to the shared folder can read.

What is shared on your network

To be found, each editor announces itself on your local network: its project name, its machine name and id, its engine version, its port and its public key. No assets and no file names. Turn off Announce On LAN in the settings to stop announcing; editors on the same machine still see each other. Turn off Enable Network to stop all network use.

There is no tridiART server: nothing goes through us, and Ferryman doesn’t send anything anywhere else. The one exception is Find public address on the Code page, which asks a public STUN server for this machine’s internet address when you press it.

Your project stays safe

Even from a trusted machine, nothing is written without the rules of the review: replaced assets are backed up first, and a parcel that fails halfway is undone completely.

Caution

Only accept parcels from people you trust. Assets can reference code and plugins; the review lists what they need, but it can’t judge what a Blueprint does.