Ha. At the bottom in the related articles list: "Your AI agent fixed the bug, but what else did it change?"

Is as much time saved as is likely claimed, if hundreds of generated backports are actually subjected to the review scrutuny they really deserve?

LOL Get rekt lmao...

*remembers he's been experimenting with local AI using vs code plaugins*

OH SHI-

*@installed claude : nothing*
*@installed cursor : nothing*

I hope your whole infrastructure collapses so you have to hire a billion devs you fucking cunts.

You're talking about sandbox type container-based app packaging, like flatpak, appimage, or snaps I think. Containers in the libcontainer/docker sense were always supposed to be "lightweight self-contained runtime environments." It simplified deployment and operations by decoupling infrastructure from code. If it were made with security applications in mind from the start, rootless would have been supported properly

Application kernels are a thing, need to get using then

Sydbox or gvisor

Yeah, but Nix and every other solution you mentioned has their own tradeoff and ease of use friction between developer and devops. Containers have good ergonomics for both that it reduces friction to achieve ci/cd

You definitely don't need containers to "run something that needs a different dependency", it's a massive waste of time and resources and just not what containers were made for. There are/were a thousand other solutions for this, from Nix to chroot to building from source to LD_LIBRARY_PATH to AppImage.

Containers were initially sold as a "security boundary" of sorts. The ability to run some software with the peace of mind that it won't ruin your OS or leak all your data if it's vulnerable. It's the entire point, but it turns out to be extremely difficult to get right. We managed to make a boundary against accidentally messing something up, not against targeted attacks.

Oh hey, it's a vulnerability that wouldn't happen in Rust. What a surprise.

Exactly, it never has been. Moderately decent boundaries are just a side-effect if the runtime platform is configured adequately.

... Containers were a security boundary?
No no no.
It means I can run something that needs a different dependency version than another service .... Without and clash.
That's the isolation. That's what the isolation means.
Maybe it's the wrong word to use, hence the confusion.

Just cause it's "awkward to get into a container" so it looks like a sealed box, doesn't mean it's actually a secure sealed box.
That box has different dependencies than this other box.
Oh, and these boxes? Yeh, they just run on any host set up to run boxes.
But there is no security

Nah, there's a wide selection of curves you can choose from.
Curve 25519 is a very popular one with much less suspicious properties.

Doesn't it use elliptic curve that might be compromised by the NSA?

ECDSA has already pretty much replaced RSA anyway.
This'll help convince the last stragglers though, at least until a PQ solution gets widely adopted.

Soooo, alternatives? Age?

The practical risk is limited, but still significant. Applying the attack against the deprecated use of 1024-bit keys took a handful of months on an academic CPU cluster, significantly less than the current estimates for 1024-bit factoring that would require resources that only nations or companies with massive resources could achieve. Widely used RSA implementations are also safe.

Nonetheless, the research has taken cryptographers by surprise because it introduces signature forgery, a new way to break RSA keys without factoring. Equally important, this novel method reduces the required computing resources by orders of magnitude.

The article is paywalled for me.

Sounds to me like google owns a hacker group and should be punished for their crimes.

What does it mean if google has a mole inside? Google is not the police. So their just colleques till it gets to hot. I bet they copied all the stolen data to train gemini also.

so Google is still working with Australian LE

I find it strange to explain how everything works but keep the implementation closed. It gives a "Trust me bro !" vibe, so I understand that some people might be reluctant about your project.

Anyway, using git as backend storage is cool. I love it when tools are repurposed for uses other than their original intent ^^.

I hope the documentation helps to understand how it works, but as a work in progress, there are countless details to consider before it can be comparable to the mainstream messaging apps.

For similar open source projects, you can take a look at: https://positive-intentions.com/

So, security through obscurity?

i started on this project as open source and ive tried to be transparent about some reasonably unique features and approach for secure messaging as seen here. its reasonably documented, but feel free to reach out for clarity.

the key changes between the open and close source versions is the closed version introduces git-as-a-backend and removes peerjs.

im not new to open source. i simply dont see the benefit to open sourcing this particular project if unit-tests, formal-verification, documentation were so easily dismissed. cybersecurity has countless nuances and open source without an audit is simply not going to work... i've already concluded that an audit isnt going to be possible. i dont see the benefit of open soucing the project when it puts me at a competative disadvantage against any modern AI.

Funny idea but... what's the point of showing a technical demo without the source code ? The added value of this idea relies on its implementation, not on its result.

It doesn't work like that. There is only the static server. Browsers can create a direct P2P connection by exchanging a few details as described here:

https://github.com/positive-intentions/chat/issues/6

You can reduce the complexity to exchanging 2 payloads to establish a webrtc connection without any backend (the exchange there is up to users. You can scan a qr code or share it over something like signal).

https://positive-intentions.github.io/webrtc/demo/gui/app/webrtc-meet?fullscreen=1

In this project I was looking for an approach for a decentralized backend and landed on git. While GitHub isn't decentralised, git can have multiple remotes and in the app, it will support multiple remotes which can act as encrypted backups.

Git makes for a horrible real-time messaging experience, but it tries to establish the webrtc in the background where supported.

Ultimately, there is no registration of users or messaging servers. The app stores data locally on your device. Connection details have to be shared by you through a channel you trust. You can optionally use a git provider of your choice if you want offline messaging.

If you accept messages from any incoming connection, you're bound to get spam or DOS, so how would your host/server limit that?

feel free to reach out for clarity on the details and i can share how it works. while the app isnt open source, a lot my my work is and i can shared more examples with code demos. a good place to start might by the projects subreddit.

https://www.reddit.com/r/positive_intentions/comments/1tq1u62/introducing_enkrypted_chat

regarding connecting a git repo... its important to connect it to a blank repo. with scoped permissions to just that repo. DO NOT use an existing repo of a project you care about.

"Just give my vibe-coded closed-source app write access to your git repo. You can trust me bro!"