So why this when there's Hangouts?
Cause it binds you to a particular company, protocol, etc. This is open source, and does not create a single point of monitoring.
Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V
131–140 of 147 posts
Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V
#132Earlier quoted context omitted.
Ask Apple to change their policy to allow copyleft software.
It has nothing to do with Apple's policy. The GPL is what's getting in the way: it says you can't impose restrictions on the redistribution of a GPLed application, and the App Store doesn't have any means to even permit redistribution of apps once they're installed.
Google play store doesn't have that problem.
Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V
#133Earlier quoted context omitted.
When have you heard of a JavaScript dangling pointer problem? Buffer overrun? Segfault?
Comparing C to Javascript makes no sense, and Javascript is NOT a safe language. Those issues you mentioned are due to programmer incompetence. Bad programmers will make bad code no matter what language they program in. Security should not rely on a language hand-holding bad programmers.
The classes of problems that one encounters in Ada, Haskell, OCaml, Rust, D or Go are vastly different than in languages w/o memory safety.
Writing secure network code in an non-safe language is something that shouldn't be taken lightly. Given the nature of the commits it is hard to comprehend that this product will ever achieve its stated aims.
It is secure by side effect, not proof.
Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V
#134Earlier quoted context omitted.
the only thing I'm seeing from your posts is "I'm a fucking idiot who doesn't understand that C is safer than any interpreted pretend-you're-safe language"
When have you heard of a JavaScript dangling pointer problem? Buffer overrun? Segfault?
The only hope to make Tox less insecure would be to run it under emscripten or http://zerovm.org/
Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V
#135Can you explain why tox is written in C over languages?
Knowing the typical Arch/Gentoo tiling WM 8px console font anime wallpaper mindset on /g/, "bloat".
I just did an analysis of the people involved in this project. Tox even more than cryptocat, is a very dangerous product to use. Even Tor has flaws while having many very capable cryptographers behind it. Tox appears to be swiss cheese both in code and protocol.
Rather than ricers with -Ofast kernels and overclocked CPUs it would be nice if a mature team focused on security and correctness first.
Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V
#136Earlier quoted context omitted.
We don't want the guy with the most "free time" doing the work.
You're right. Make a better program. I'll be anticipating it, I really want a Skype replacement I can get behind.
So do I, but Tox isn't it.
They should have made the protocol, vetted the protocol and made a PoC implementation in a safe language.
Cryptographers and secure protocol designers can't help out if they are noodling along banging out the implementation while designing it.
Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V
#137Earlier quoted context omitted.
"Secure" is a lot of things. "Secure against bulk surveillance" is a big push in a lot of areas, it's a button Bruce Schneier and Eben Moglen have been pushing hard for the past year or so. See especially their joint lecture at Columbia Law School in December, 2013, and Schneier's presentation to Stanford Law School in April, 2014 (both are on http://FixYT.com ). Anonymized persistent IDs associated with physical / p…
Our threat model is an attacker that wants to read and record the contents of conversations between everyone, they have the ability to modify/add/remove and log any packets. We assume they do not have any access to the actual machines Tox is running on. The main goal of Tox is to make it hard for a global threat to conduct mass surveillance on everyone at the same time without sacrificing performance. If the majority…
Thanks, that's a nice and concise statement.
NB, a comment by Peter da Silva, who's been doing networking / communications / security stuff for quite a while:
"Don't like the callback model in the API, they need a version of tox_wait() that takes a select() fd mask."
https://plus.google.com/u/0/104092656004159577193/posts/MDYU...
Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V
#138Earlier quoted context omitted.
Comparing C to Javascript makes no sense, and Javascript is NOT a safe language. Those issues you mentioned are due to programmer incompetence. Bad programmers will make bad code no matter what language they program in. Security should not rely on a language hand-holding bad programmers.
The classes of problems that one encounters in Ada, Haskell, OCaml, Rust, D or Go are vastly different than in languages w/o memory safety. Writing secure network code in an non-safe language is something that shouldn't be taken lightly. Given the nature of the commits it is hard to comprehend that this product will ever achieve its stated aims. It is secure by side effect, not proof.
No one is taking this project lightly and I don't know why you would suggest otherwise. You keep vaguely alluding to "the nature of the commits" but still have yet to give a single concrete example of what you have issue with. I take it that you don't actually know any C and are just repeating what you've read somewhere else.
I have extensive C experience, and I have looked through the code. While there have been plenty of bug fixes in the commit log - as is to be expected for a project of this scope in its pre-alpha/alpha stages - I have not seen anything that resembles a security threat, much less something as serious as the heartbleed bug that you keep bringing up for some reason.
At this point I have to conclude that you're either a troll with too much time on your hands, or being paid to spread FUD.
Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V
#139I don't post often on HN, but today couldn't resist. Just tested Utox on Windows as well as Toxy, also on Windows. Both programs are totally inaccessible for people using a screenreader and I'm quite sure as well for people using things like speech recognition. Utox seems to be C++ and a GUI framework I didn't look into. Toxy is .NET+WPF... two different stacks, but two inaccessible programs. I'm quite sure the devel…
We need 1.
Re: Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V
#140Earlier quoted context omitted.
Ask Apple to change their policy to allow copyleft software.
It has nothing to do with Apple's policy. The GPL is what's getting in the way: it says you can't impose restrictions on the redistribution of a GPLed application, and the App Store doesn't have any means to even permit redistribution of apps once they're installed.
Apple sells products which they have decided to retain control over after sale.
That is Apple's choice, Apple's policy, Apple's decision. It also conflict with a lot of things, including the GPL.