-4
Git as a messaging app (programming.dev)
submitted 1 month ago by to c/security@programming.dev
12 comments fedilink hide all child comments
 

this is following a previous post as seen here: https://programming.dev/post/51866250

apps like Whatsapp, Signal and SimpleXChat are great for secure messaging and far more mature than this project, but this approach is yet distict in the market. the core philosophy around secure messaging here is that it can work in a way that avoids installation and registration by enabling users to host their own data.

docs: https://glitr.io/

demo

note: feel free to ask for clarity on any of the details around how the project works.

FAQ:

  • but why? - git over https adds an additional capability previously oerlooked https. webrtc cannot work over TOR and similar networks. this way, you can take advantage of the "gold standard" for onion routing while being able to avoid IP leaking from webrtc.

  • when is it ready for production? - not any time soon. standby for updates.

  • audit/review? - no, niether is possible/available. its simply too expensive. this project is close-source so YOU cannot verify it either. DO NOT "trust me bro"... this demo is proided for testing and demo purposes only. use responsibly.

  • the abridged version of how its put together: https://www.reddit.com/r/VibeCodeDevs/comments/1vme48q/refactor_js_to_rust/

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 1 month ago (4 children)

Funny idea but... what's the point of showing a technical demo without the source code ? The added value of this idea relies on its implementation, not on its result.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] [S] 0 points 1 month ago* (last edited 1 month ago) (3 children)

    i started on this project as open source and ive tried to be transparent about some reasonably unique features and approach for secure messaging as seen here. its reasonably documented, but feel free to reach out for clarity.

    the key changes between the open and close source versions is the closed version introduces git-as-a-backend and removes peerjs.

    im not new to open source. i simply dont see the benefit to open sourcing this particular project if unit-tests, formal-verification, documentation were so easily dismissed. cybersecurity has countless nuances and open source without an audit is simply not going to work... i've already concluded that an audit isnt going to be possible. i dont see the benefit of open soucing the project when it puts me at a competative disadvantage against any modern AI.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 1 month ago

    I find it strange to explain how everything works but keep the implementation closed. It gives a "Trust me bro !" vibe, so I understand that some people might be reluctant about your project.

    Anyway, using git as backend storage is cool. I love it when tools are repurposed for uses other than their original intent ^^.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 1 month ago (1 child)

    So, security through obscurity?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •