Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TOX – A New Kind of Instant Messaging

tox.chat

Post reply on HN
Print view View original

41–50 of 110 posts

Re: TOX – A New Kind of Instant Messaging

#41

Post by iphy »

Jaruzel wrote: post #6

Please forgive my ignorance, but it talks a lot about peer-to-peer conversations - how would that work if the peers are behind NATs or Proxies?

That works with UDP hole punching (https://en.wikipedia.org/wiki/UDP_hole_punching), and there is a branch with uPNP (https://en.wikipedia.org/wiki/Universal_Plug_and_Play) support. We still need to review that code carefully before accepting it into master.

Re: TOX – A New Kind of Instant Messaging

#45

Post by iphy »

eeZah7Ux wrote: post #19

Be warned, Tox claims to protect users from "governments", which is a huge claim. Yet, it's written in C, it hasn't had a security audit, it does not publish a list of security risks and mitigations, and, regarding its roots in 4chan, see for yourself: https://github.com/irungentoo/toxcore/issues/1186

Regarding security audit: my day job is developing high security software. I could do a formal audit, and it would take about 2-3 person-weeks, and be completely useless, because it would result in a huge number of trivial issues that need to be resolved before it could identify real problems. So instead of wasting time and money on that, I've decided to go and fix those trivial issues one by one, and once I'm a bit happier with the code, I'll have two other people do the formal audit.

Re: TOX – A New Kind of Instant Messaging

#46

Post by iphy »

Dowwie wrote: post #11

I tried an earlier version of a tox client. At that time, there were at least two competing clients that looked the same and did the same things. Is the tox civil war over yet?

The preliminary plan is to deliver a high quality implementation of the Tox protocol and then deliver a high quality client. I personally don't have time to do both, and the team has very limited resources. The most actively developed client is currently qTox.

Re: TOX – A New Kind of Instant Messaging

#47

Post by iphy »

zerognowl wrote: post #34
okket wrote: post #3

FYI: https://en.wikipedia.org/wiki/Tox_(protocol)

It seems robust, but I do worry about the client. Has the client been audited properly? I hope the track record's not like Pidgin's https://pidgin.im/news/security/

qTox is currently undergoing major rewrites, so I'm not getting myself involved with that. Once the rewrites are done, I can see about reviewing it. Just like with toxcore, if I started reviewing it now, I'd come up with lots of trivial issues that need resolving before I can do a serious audit.

Re: TOX – A New Kind of Instant Messaging

#48

Post by oakwhiz »

gregn610 wrote: post #10

from the FAQ: "How do I add someone to my contacts list? Look in the profile or settings panel of your client to get your Tox ID which should look something like: 56A1ADE4B65B86BCD51CC73E2CD4E542179F47959FE3E0E21B4B0ACDADE51855D34D34D37CB5" Yuk! I see this flaw so many products like this, just about anything p2p, blockchain addresses, commit ids, etc. I think there is zero chance of getting anyone who is not technolo…

This isn't a flaw, it's a feature. Whoever controls the phone book controls the keys to the kingdom. If the names are numbers generated by some cryptographic system, it is harder to subvert the system.

Re: TOX – A New Kind of Instant Messaging

#50

Post by nvk »

iphy wrote: post #46
Dowwie wrote: post #11

I tried an earlier version of a tox client. At that time, there were at least two competing clients that looked the same and did the same things. Is the tox civil war over yet?

The preliminary plan is to deliver a high quality implementation of the Tox protocol and then deliver a high quality client. I personally don't have time to do both, and the team has very limited resources. The most actively developed client is currently qTox.

You did an incredible job, ignore all this trashing.
Post reply on HN