-4
Git as a messaging app (programming.dev)
submitted 1 month ago by to c/security@programming.dev
12 comments fedilink hide all child comments
 

this is following a previous post as seen here: https://programming.dev/post/51866250

apps like Whatsapp, Signal and SimpleXChat are great for secure messaging and far more mature than this project, but this approach is yet distict in the market. the core philosophy around secure messaging here is that it can work in a way that avoids installation and registration by enabling users to host their own data.

docs: https://glitr.io/

demo

note: feel free to ask for clarity on any of the details around how the project works.

FAQ:

  • but why? - git over https adds an additional capability previously oerlooked https. webrtc cannot work over TOR and similar networks. this way, you can take advantage of the "gold standard" for onion routing while being able to avoid IP leaking from webrtc.

  • when is it ready for production? - not any time soon. standby for updates.

  • audit/review? - no, niether is possible/available. its simply too expensive. this project is close-source so YOU cannot verify it either. DO NOT "trust me bro"... this demo is proided for testing and demo purposes only. use responsibly.

  • the abridged version of how its put together: https://www.reddit.com/r/VibeCodeDevs/comments/1vme48q/refactor_js_to_rust/

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 1 month ago (1 child)

If you accept messages from any incoming connection, you're bound to get spam or DOS, so how would your host/server limit that?

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] [S] 1 point 1 month ago* (last edited 1 month ago)

    It doesn't work like that. There is only the static server. Browsers can create a direct P2P connection by exchanging a few details as described here:

    https://github.com/positive-intentions/chat/issues/6

    You can reduce the complexity to exchanging 2 payloads to establish a webrtc connection without any backend (the exchange there is up to users. You can scan a qr code or share it over something like signal).

    https://positive-intentions.github.io/webrtc/demo/gui/app/webrtc-meet?fullscreen=1

    In this project I was looking for an approach for a decentralized backend and landed on git. While GitHub isn't decentralised, git can have multiple remotes and in the app, it will support multiple remotes which can act as encrypted backups.

    Git makes for a horrible real-time messaging experience, but it tries to establish the webrtc in the background where supported.

    Ultimately, there is no registration of users or messaging servers. The app stores data locally on your device. Connection details have to be shared by you through a channel you trust. You can optionally use a git provider of your choice if you want offline messaging.

  • permalink
  • fedilink
  • source
  • parent