Live data from Hacker News

Toxic – A distributed, secure, command-line based instant messenging client

github.com

51–60 of 91 posts

Re: Toxic – A distributed, secure, command-line based instant messenging client

#51
post #50

Can Tox do persistent group text chats with offline message delivery to people when they sign in again? It's the one killer feature of Skype that keeps me on it. No open messaging programs ever support this it seems like.

Currently no, but there is a groupchat rewrite underway and that is one of the planned improvements.

Re: Toxic – A distributed, secure, command-line based instant messenging client

#52

My one experience with the Tox project was that I made a few (I thought) constructive suggestions. First, I suggested they use some form of static analysis or perhaps a 'safer' language to implement their core functionality - such as Rust or Go, instead of rather messy (at the time) C code. Furthermore, having spent a lot of time researching parsers and how parser differentials can affect the security of systems, I s…

Our of interest, could you share the url to the discussion?

Re: Toxic – A distributed, secure, command-line based instant messenging client

#53
If you use a secure crypto primitive, is it correct to say your program is secure?

I mean, can you be sure something is secure just because of the crypto lib?

I thought there had something to do with the implementation too?

I ask this because of Tox. The main developer claims Tox is secure because of the crypto library.

It sounds weird to me, so I decided to ask... After all, if it was this easy all programs would be secure, right? Just import a secure crypto lib and it's done? Sounds weird.

https://github.com/irungentoo/toxcore/issues/121#issuecommen...

Re: Toxic – A distributed, secure, command-line based instant messenging client

#54

If you use a secure crypto primitive, is it correct to say your program is secure? I mean, can you be sure something is secure just because of the crypto lib? I thought there had something to do with the implementation too? I ask this because of Tox. The main developer claims Tox is secure because of the crypto library. It sounds weird to me, so I decided to ask... After all, if it was this easy all programs would be…

Having a sound library removes a whole host of issues; however, it doesn't remove all of them. First and second among many are key management and concatenating values before hashing or signing.

Re: Toxic – A distributed, secure, command-line based instant messenging client

#55

If you use a secure crypto primitive, is it correct to say your program is secure? I mean, can you be sure something is secure just because of the crypto lib? I thought there had something to do with the implementation too? I ask this because of Tox. The main developer claims Tox is secure because of the crypto library. It sounds weird to me, so I decided to ask... After all, if it was this easy all programs would be…

No, you didn't decide to ask, you take a lot of redirections and bullshitting to point out your link. Which is an interesting contribution, but the way you deliver it is really bad style and annoying.

Re: Toxic – A distributed, secure, command-line based instant messenging client

#56
post #50

Can Tox do persistent group text chats with offline message delivery to people when they sign in again? It's the one killer feature of Skype that keeps me on it. No open messaging programs ever support this it seems like.

Currently no, but there is a groupchat rewrite underway and that is one of the planned improvements.

I look forward to this.

I have to echo the parent though, getting history from the period you were disconnected is a killer feature of skype that seems to get little or no attention.

It is one of the major things that keeps some of my group chats on skype.

Re: Toxic – A distributed, secure, command-line based instant messenging client

#57

My one experience with the Tox project was that I made a few (I thought) constructive suggestions. First, I suggested they use some form of static analysis or perhaps a 'safer' language to implement their core functionality - such as Rust or Go, instead of rather messy (at the time) C code. Furthermore, having spent a lot of time researching parsers and how parser differentials can affect the security of systems, I s…

There are also protocol buffers libraries for and in C code, such as the protobuf-c library: https://github.com/protobuf-c/protobuf-c

Re: Toxic – A distributed, secure, command-line based instant messenging client

#60

If you use a secure crypto primitive, is it correct to say your program is secure? I mean, can you be sure something is secure just because of the crypto lib? I thought there had something to do with the implementation too? I ask this because of Tox. The main developer claims Tox is secure because of the crypto library. It sounds weird to me, so I decided to ask... After all, if it was this easy all programs would be…

I agree, the main developer has no clue what he is doing.
Post reply on HN