temporary.chat-playbook VS c-toxcore

used as an easy platform to diffuse content via rss (works for images too)

https://github.com/ba9f11ecc3497d9993b933fdc2bd61e5/temporar...

I am building my own chat server/file upload server that you can host at home. you can also firewall it. It works without external dependencies after install, and it also works without phone number and even without dns if you want. /r/privacy mods will never let me post it for some reason, even if I try to explain it is a work in progress and a collaborative project (that's what open source is about) they talk to me about shipping, audited, etc. I'm just one guy who wrote this as a side project for a few months now. Live demo is here https://temporary.chat/ and code is here https://github.com/ba9f11ecc3497d9993b933fdc2bd61e5/temporary.chat-playbook

I mean, it is great to see people get into security stuff and build chat stuff. But I have some points on your "philisophy".

You hate big billion dollar Companies? Well, your domain is hosted on AWS so are the servers. To prrof your point, you should've got the domain somewhere else and host the serveres somewhere else. Additionally, how is the weather in Middlesex, GB?

Now to the software side. Man is that repo a mess. I mean, you put a lot of work into the documents which is great, but until you find the damn source code of the actual important shit it takes years. (if anyone interested it is this billion character long mess: https://github.com/ba9f11ecc3497d9993b933fdc2bd61e5/temporar...).

What am I trying to say here? Great to see people starting coding. But split the project up or at least order it. The source of the server should be on click on `src` and done. Maybe extract the client to another repo. Hide the whole deployment stuff in another folder. We people who click the link to github want to see code. Not configuration stuff. First look matters.

And, if you want to be so "security hacker like nobody knows", create fancy profile picture with no face. Get a decent username no hash gabage. Hide your WhoIs Information from the domain. If you care about security and "not being dependent on multi billion dollar companies that collect all our data", don't use AWS. Go to a decent server hosting n your country (or where privacy matters).

Did this wake my interest? Yes.

https://github.com/ba9f11ecc3497d9993b933fdc2bd61e5/temporary.chat-playbook/blob/master/CONTRIBUTING.md

how to deploy is here :

See also this somewhat infamous thread on Tox's cryptographic design[1].

[1]: https://github.com/TokTok/c-toxcore/issues/426

In case with Tox you have to trust in homebrew crypto that was never properly audited (how about that security issue reported by Donenfeld in 2017, which is being tackled only now, sort of?) -- and outdated and outright abandoned clients which were never above, let's say, "beta quality".

it has the new group chat feature (https://github.com/TokTok/c-toxcore/pull/2269)

"If Tox already does onion routing, why use Tox over Tor?"

What an arbitrary criteria to judge a project by. There have been 5 releases in the past year, including a major feature release.

https://github.com/TokTok/c-toxcore/releases

Signal isn't falling behind and Tox is an old service that has had issues with messages being spoofable since day 1

tox https://github.com/TokTok/c-toxcore/issues/426

You could use a Tox front end like qTox or Toxic. It is a fully encrypted end-to-end communication protocol that allows text, voice, and video chat. The github page for the Tox protocol has some useful caveats about the its security.

It links to a bug report discussion where one of the developers states that they don't understand the security properties of tox very well[1].

I find that worrying.

[1] https://github.com/TokTok/c-toxcore/issues/426