Is this at all related to Nullsoft Waste? That was quite a scandal when it launched with a "whoops we didn't mean to open-source that" thing. It was a crypto-IM too.
Toxic – A distributed, secure, command-line based instant messenging client
71–80 of 91 posts
Re: Toxic – A distributed, secure, command-line based instant messenging client
#72Earlier quoted context omitted.
He isn't a troll, all his statements are real. I confirm them. I'm a good friend of Proplex.. I mean I was a good friend of Proplex. Proplex finally killed himself because the Tox Foundation harrased him. HE TOOK HIS OWN LIFE. RIP Proplex, I miss you.
His last activity on github was 5 hours ago...
He killed himself 3 hours ago. I was devastated. I'm crying. I can't take it anymore. When will the Tox foundation stop. The only way you can redeem yourselves is if you stop the development of Tox.
Re: Toxic – A distributed, secure, command-line based instant messenging client
#73We've closed this thread to noob accounts (except the submitter) because of troll activity.
Re: Toxic – A distributed, secure, command-line based instant messenging client
#74My one experience with the Tox project was that I made a few (I thought) constructive suggestions. First, I suggested they use some form of static analysis or perhaps a 'safer' language to implement their core functionality - such as Rust or Go, instead of rather messy (at the time) C code. Furthermore, having spent a lot of time researching parsers and how parser differentials can affect the security of systems, I s…
[deleted]
Re: Toxic – A distributed, secure, command-line based instant messenging client
#75Re: Toxic – A distributed, secure, command-line based instant messenging client
#76Earlier quoted context omitted.
Our of interest, could you share the url to the discussion?
https://github.com/irungentoo/toxcore/issues/137
The last reply to the issue:
"The Tox protocol is very easy to parse in C which means little chance of issues."
Building a homegrown parser and simultaneously expecting not to have security issues, that's true confidence.
Re: Toxic – A distributed, secure, command-line based instant messenging client
#77Earlier quoted context omitted.
The response I got was rather disheartening and downright hostile - it boiled down to the fact that protocol buffers involves C++ code which they are a priori against Being against C++ isn't inherently a bad thing. For example, Tarsnap probably won't ever use C++ code. I can't read your PDF because of an SSL certificate error.
Weird, it works here. I put a copy on my webpage at http://csail.mit.edu/~julian/papers/login_nail.pdf As has been pointed out below, there are many C bindings for Protobuf (and my argument was that using something like protobuf allows reimplementing the protocol).
[deleted]
Re: Toxic – A distributed, secure, command-line based instant messenging client
#78Earlier quoted context omitted.
Our of interest, could you share the url to the discussion?
https://github.com/irungentoo/toxcore/issues/137
(EDIT: Note that everyone was proceeding under the assumption that silentbits was a Tox dev, but that's apparently not true, as was corrected below. I wonder it that calls into question the original comment...)
From the github conversation:
silentbits said: "Nobody is going to risk using an external parser in such critical code."
jbangert replied: "What do you mean? not invented here? Google's core engineers are better (and their code gets more review, attention, etc). than anything we can produce."
silentbits said: "You have few exchange protocols: ITCH, OUTCH (NASDAQ), UTP MD, XDP (NYSE), PITCH (BATS). These protocols are in binary form and very easy to convert from/to C/C++ struct. If you produce critical software you want to have a code that you can be verified and tested. You can of course find external parsers for this, but all serious players do their own parsers. The only exception might be FPGAs implementation where whole is written in HDL (VHDL, verilog)."
Am I correct in assessing that the reason this is troubling is because the tox devs are saying "Everyone else is writing their own parsers, so we should write our own parsers too"?
I don't know. If you want to criticize a software project for writing their own parser, you'll also need to criticize Tarsnap, since they write their own too. Yet Tarsnap is basically the gold standard in native security software. So either Tarsnap is being equally crazy, or it's not so crazy after all. I wonder which one is the case?
Re: Toxic – A distributed, secure, command-line based instant messenging client
#79Earlier quoted context omitted.
https://github.com/irungentoo/toxcore/issues/137
(EDIT: Note that everyone was proceeding under the assumption that silentbits was a Tox dev, but that's apparently not true, as was corrected below. I wonder it that calls into question the original comment...) From the github conversation: silentbits said: "Nobody is going to risk using an external parser in such critical code." jbangert replied: "What do you mean? not invented here? Google's core engineers are bett…
I should point out that silentbits is not a Tox dev. He was only expressing his personal opinion on that matter.
Re: Toxic – A distributed, secure, command-line based instant messenging client
#80Earlier quoted context omitted.
(EDIT: Note that everyone was proceeding under the assumption that silentbits was a Tox dev, but that's apparently not true, as was corrected below. I wonder it that calls into question the original comment...) From the github conversation: silentbits said: "Nobody is going to risk using an external parser in such critical code." jbangert replied: "What do you mean? not invented here? Google's core engineers are bett…
I should point out that silentbits is not a Tox dev. He was only expressing his personal opinion on that matter.
My mistake, sorry. (And apparently everyone else is making the same mistake too...) I've edited my comment for clarity.
Did Tox devs express anything on the matter? It's very hard to substantiate all of this without someone who knows the Tox project.
For example, the last reply was "The Tox protocol is very easy to parse in C which means little chance of issues." Is that from a Tox dev?