Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toxic – A distributed, secure, command-line based instant messenging client

github.com

Post reply on HN
Print view View original

81–90 of 91 posts

Re: Toxic – A distributed, secure, command-line based instant messenging client

#81

Post by Jfreegman »

sillysaurus3 wrote: post #80
Jfreegman wrote: post #79

Earlier quoted context omitted.

I should point out that silentbits is not a Tox dev. He was only expressing his personal opinion on that matter.

My mistake, sorry. (And apparently everyone else is making the same mistake too...) I've edited my comment for clarity. Did Tox devs express anything on the matter? It's very hard to substantiate all of this without someone who knows the Tox project. For example, the last reply was "The Tox protocol is very easy to parse in C which means little chance of issues." Is that from a Tox dev?

That last comment was by irungentoo, who is the lead Tox dev and the one who wrote the parsing code.

Re: Toxic – A distributed, secure, command-line based instant messenging client

#82

Post by superuser2 »

task_queue wrote: post #20

Make it worthwhile for someone to test how 'secure' this system is before touting that title. An audit or a bounty with no limitations on rendering the system insecure. An example of how not to do this would be the Telegram contest sham.

Contests/bounties are not indicative of security because it is very likely that potential profits from selling or using an exploit are greater than the bounty offered.

Re: Toxic – A distributed, secure, command-line based instant messenging client

#83

Post by [deleted] »

impossibru wrote: post #28
ex-contributor wrote: post #27

Earlier quoted context omitted.

Or maybe the Tox Foundation is covering it up? Hopefully I archive most for good measure. https://archive.today/Y6LEw https://archive.today/MajJV https://archive.today/KkSWp https://archive.today/CWBUp http://a.pomf.se/kqwgsg.png

Yeah I read all that and it's really the main dev trying to track down the guy who maintained all the servers because he dropped everything. Maybe he acted awkwardly, I don't know, I don't care; the point is, there isn't some sort of "Tox Foundation conspiracy" trying to deceive everyone (as if the tox community was large enough to be worth deceiving) and given your tendency to shitpost on 4chan I would be more incli…

[deleted]

Re: Toxic – A distributed, secure, command-line based instant messenging client

#84

Post by zaroth »

dang wrote: post #73

We've closed this thread to noob accounts (except the submitter) because of troll activity.

Not a moment too soon. :-/

Looking at some of these [flagkilled] comments... all I can say is... it sure makes me happy to be a part of the HN community and that we have a place which is largely free of that "nonsense" (a much too overly nice way to describe it)

Re: Toxic – A distributed, secure, command-line based instant messenging client

#85

Post by irungentoo »

kevan wrote: post #76
jbangert wrote: post #65

Earlier quoted context omitted.

https://github.com/irungentoo/toxcore/issues/137

The last reply to the issue: "The Tox protocol is very easy to parse in C which means little chance of issues." Building a homegrown parser and simultaneously expecting not to have security issues, that's true confidence.

If you actually read the code you will see that it's true.

The parsing is dead simple and written in a way that mistakes are very unlikely.

Re: Toxic – A distributed, secure, command-line based instant messenging client

#86

Post by irungentoo »

jbangert wrote: post #40

My one experience with the Tox project was that I made a few (I thought) constructive suggestions. First, I suggested they use some form of static analysis or perhaps a 'safer' language to implement their core functionality - such as Rust or Go, instead of rather messy (at the time) C code. Furthermore, having spent a lot of time researching parsers and how parser differentials can affect the security of systems, I s…

First of all the choice of C is because it was the language I was the most confidant writing secure code in. I'm not going to learn a new language and then right away start try to write secure code with it.

Clang has some great tools I use like the various sanitizers. Static analysis sucks and almost never finds any real issues but we still use it.

If you think toxcore should use protocol buffers, feel free to port it. This is an open source project and contributions are welcome. If you do a better job than me then I will merge your contribution. We are at #tox-dev on freenode.

Re: Toxic – A distributed, secure, command-line based instant messenging client

#87

Post by irungentoo »

ex-contributor wrote: post #12

DISCLAIMER: I am one of the many Tox ex-contributors, who used to work on it in the past. I don't want to be identified due to harassment other ex-contributors suffered in the past. The following message is my point of view on the project as a whole. Proplex, a long-time member of the Tox-Foundation and in charge of both infrastructure and marketing, called out tox devs because the 2 people in charge (irungentoo and…

>Proplex, a long-time member of the Tox-Foundation and in charge of both infrastructure and marketing, called out tox devs because the 2 people in charge (irungentoo and stqism) were dealing with money in a shady way and he got suspicious

We barely get any donations. We barely have money and we are very transparent about it, look at our donations page.

>After he went away and stopped to pay for the website and other servers (he hosted everything)

He disappeared one day, didn't warn us or anything and took everything (including backups) with him.

>Tox devs got angry and tracked his online activity by his browser UA, read his private email sent to his @tox.im address and considered breaking into his VPS account

Yes because I wanted to know if he had done anything weird on the site. We never considered breaking into his account. His tox.im mail was never remade on the new tox.im mail server so all emails sent to it ended up in our catch all email.

>Members of the Tox Foundation such as stqism try constantly to sneak in copyright changes

I'm a member of the Tox foundation and I don't sneak in copyright changes in my repo. He also didn't try to sneak it in. I never merge pull requests before reading everything first.

>After it got out of hand and too many people called out the Tox Foundation, this happened

Yes and I explained exactly what happened. What is the issue?

>irungentoo enforced censorship on his github repo to try to cover everything up

Because kicking trolls is censorship?

>irungentoo claims Tox is secure just because he uses a secure primitive

Scroll down to my next comment in that thread.

Sorry for my previous comment. This one should be better.

Re: Toxic – A distributed, secure, command-line based instant messenging client

#89

Post by nfkd »

irungentoo wrote: post #86
jbangert wrote: post #40

My one experience with the Tox project was that I made a few (I thought) constructive suggestions. First, I suggested they use some form of static analysis or perhaps a 'safer' language to implement their core functionality - such as Rust or Go, instead of rather messy (at the time) C code. Furthermore, having spent a lot of time researching parsers and how parser differentials can affect the security of systems, I s…

First of all the choice of C is because it was the language I was the most confidant writing secure code in. I'm not going to learn a new language and then right away start try to write secure code with it. Clang has some great tools I use like the various sanitizers. Static analysis sucks and almost never finds any real issues but we still use it. If you think toxcore should use protocol buffers, feel free to port i…

But why create your own parser instead of using proven-secure ones? Sounds like NIH Syndrome to me.

Re: Toxic – A distributed, secure, command-line based instant messenging client

#90

Post by nfkd »

irungentoo wrote: post #85
kevan wrote: post #76

Earlier quoted context omitted.

The last reply to the issue: "The Tox protocol is very easy to parse in C which means little chance of issues." Building a homegrown parser and simultaneously expecting not to have security issues, that's true confidence.

If you actually read the code you will see that it's true. The parsing is dead simple and written in a way that mistakes are very unlikely.

That's a really bold statement to make. And why not use a proven secure parser in the first place?
Post reply on HN