usrsctp

Today, an issue was raised in one project I use, because their build system rejected an invalid sha256sum while downloading a dependency from a GitHub zip file. The offending dependency is usrsctp (https://github.com/sctplab/usrsctp) at commit 9d6b99b: https://github.com/sctplab/usrsctp/archive/9d6b99b10a70f7a63d21cd80d03c353da9ac19d… This file's sha256sum has always been d9b7b3350ea0be2a3d1437e404d4852df741c4984b734729c5edc337ff4b7611 but suddenly today it changed to e86fe0b8aabef0eae207a94a5525da303e90477c37fce272c84e2d87d7ac169b This lasted a couple hours, and it is now back to the original hash. Does this mean that the project might have been compromised somehow? Or are there any other less alarming explanations for what has happened?

I am sure there are even more implementations that I am not aware of. * https://github.com/pion/sctp * https://github.com/aiortc/aiortc/blob/main/src/aiortc/rtcsct... * https://source.chromium.org/chromium/chromium/src/+/main:thi... * https://github.com/sctplab/usrsctp People don't make these decisions for technical reasons only. Career wise it is a bad choice to spend your time working on pre-existing technologies. You don't become a distinguished engineer by iterating on existing technologies. You become one by being the creator of something new. I think QUIC is great and does a good job solving the problems it was designed to solve. It is disingenuous to pretend these decisions were made only for technical reasons.

SCTP can't go through NAT (there is ietf draft in works for that). But SCTP already exist in your favorite browser Chrome, Firefox both use usrsctplib (https://github.com/sctplab/usrsctp) to provide sctp over udp for webrtc signaling. But there also need to be sctp over udp over dtls (or just sctp over dtls) happen as you can't use TLS with SCTP unordered mode or multihoming. SCTP slowly gain traction in userspace besides being only in mobile operator networks (lte)