4 ms·
I mean, it is great to see people get into security stuff and build chat stuff. But I have some points on your "philisophy". You hate big billion dollar Compan
by i_found_you 6y ago
I mean, it is great to see people get into security stuff and build chat stuff. But I have some points on your "philisophy".
You hate big billion dollar Companies? Well, your domain is hosted on AWS so are the servers. To prrof your point, you should've got the domain somewhere else and host the serveres somewhere else. Additionally, how is the weather in Middlesex, GB?
Now to the software side. Man is that repo a mess. I mean, you put a lot of work into the documents which is great, but until you find the damn source code of the actual important shit it takes years. (if anyone interested it is this billion character long mess: https://github.com/ba9f11ecc3497d9993b933fdc2bd61e5/temporary.chat-playbook/tree/master/roles/chat_server/files/app https://github.com/ba9f11ecc3497d9993b933fdc2bd61e5/temporar...).
What am I trying to say here? Great to see people starting coding. But split the project up or at least order it. The source of the server should be on click on `src` and done. Maybe extract the client to another repo. Hide the whole deployment stuff in another folder. We people who click the link to github want to see code. Not configuration stuff. First look matters.
And, if you want to be so "security hacker like nobody knows", create fancy profile picture with no face. Get a decent username no hash gabage. Hide your WhoIs Information from the domain. If you care about security and "not being dependent on multi billion dollar companies that collect all our data", don't use AWS. Go to a decent server hosting n your country (or where privacy matters).
Did this wake my interest? Yes.
Got I disapointed? Yeah.
Did I got disappointed way more than I thought? Definitely.
Would I trust this app even if the source code would be readable in any way? No because security is expert stuff. That's why we have Matrix, Signal, Threema (which is open-source now too).
Is this a little harsh? Yes, but this is the Internet.
Do I want you to re-make the project in a more professional way? Yes, because that is the best pratice to become a better developer.
Sorry for the hard comment. I hope you take it as an motivation. Always fall to learn, always come back stronger.
- peppermint_tea 6y agothanks for your comment, about my temporary choice for aws: the reason is explained here : https://temporary.chat/qa.html https://temporary.chat/qa.html "I dont like your dns, registrar etc : took amazon for the ease of use and because I am familiar with it, but it is not my final choice, my goal is to make this as portable as possible so it can be deployed in virtual machines, on personal computers etc. I will not start using amazon services even if they are dirt cheap and I know how to leverage them. I do not want this project to be locked on a specific cloud platform. " Middlesex, GB??? - > i'm in montreal canada about the source code: ansible playbooks have a structure, src folder is not gonna fly here. "split the client" -> there is no client but I can probably improve the repository structure, yes. And, if you want to be so "security hacker like nobody knows" > I have no such ambitions. create fancy profile picture with no face > I don't see how if I choose to put my face online or not is relevant here. Get a decent username no hash gabage > the hash garbage is a md5sum for the word "git", I don't have imagination. Hide your WhoIs Information from the domain > On 17 May 2018 the ICANN Board adopted a Temporary Specification for gTLD Registration Data. https://www.icann.org/resources/board-material/resolutions-2018-05-17-en https://www.icann.org/resources/board-material/resolutions-2... Got I disapointed? Yeah > It is okay, I know the project is not quite secure it it's actual form (even if a put a bit of effort on the security side) it is a work in progress. Would I trust this app even if the source code would be readable in any way > if you cannot read my source code, I highly doubt you'll be able to read the signal source code (which I looked at) thanks for your comment.