20 ms·

Tox: Decentralized and Encrypted Instant Messaging

134 points by thepangolino 5y ago

myfartsarefoul 5y ago
Tox is a neat idea, but (at least when I tried it) it would really kill battery life. I think this is kind of inherent to the design.
aasasd 5y ago
Still no audit, right? Just “trust us, it's secure”. And afaik the authors don't have particular expertise in security. Edit: also, “it's secure, we use Nacl”: https://github.com/irungentoo/toxcore/issues/121 https://github.com/irungentoo/toxcore/issues/121
- grayhatter 5y ago
  Nope, we still can't afford the price tag on an audit. Perhaps I'm jaded or biased because I'm a former Tox dev, but Tox is the only encrypted messenger I'd actually trust. I consider myself to be pretty good a security, but that's just me and you shouldn't take anyone's word for it themselves. That said if you have an actual cause reason to be concerned, I'd be interest in hearing it?
  - tombert 5y ago
    This is not meant to be passive aggressive but it's going to sound like it is; how much would an audit actually cost? If someone set up a GoFundMe for a Tox audit, I would definitely contribute ten bucks to make that happen.
    - grayhatter 5y ago
      I don't think it's passive aggressive at all. I'm a bit embarrassed to say, but I honestly don't remember. My best guess from what I do remember the last time it was discussed, was in the 2k to 10k range. But it could expand rapidly depending on who, and what level we actually hired someone at. The primary reason we didn't set up crowdfunding ourselves was there was a few important changes we wanted to make a decision on and implement first. I still don't think they've been made, but I'm not following super close anymore.
      - tombert 5y ago
        Even if we go on the higher end of that, 10 grand doesn't seem that high for an audience of engineers (which I think is overrepresented on Hacker News). I know people have been complaining about a lack of a security audit since 2016; I think at this point it would be worth doing an audit now, and potentially another audit when new features are added. If I were in any way involved in the project I would set up the campaign myself, but sadly I don't know enough C to be useful to a project like this (unless there was a plan to rewrite it in some esoteric functional language for some reason).
        grayhatter 5y ago
        you might want to reach out to zugz (via our IRC, or github), He's also a fan of esoteric functional, so you might be able to convince him to start one. Iphy has a repo with the start of a Haskell implementation as proof of the completeness of the spec. No idea what the stat of that is, but again, might be worth reaching out :)
    - ddtaylor 5y ago
      Most of the users of Tox don't want to be identified, so it's a bit difficult to crowd fund such a thing.
  - csoghoian 5y ago
    The Open Technology Fund provides free security audits for open source projects. Apply here: https://apply.opentech.fund/red-team-lab/ https://apply.opentech.fund/red-team-lab/
- somenewaccount1 5y ago
  I mean, it's open source, so you can audit it. https://github.com/qTox/qTox https://github.com/qTox/qTox. Then you can build the client yourself and check the sha sum against any downloaded distribution.
  - RamRodification 5y ago
    > it's open source, so you can audit it Programming languages exist, so you can make your own decentralized encrypted instant messaging app. There is democracy, so you can be the president. Everyone in the family has legs, so we won't need a car.
    - dicethrowaway1 5y ago
      See also https://en.wikipedia.org/wiki/Real_freedom https://en.wikipedia.org/wiki/Real_freedom.
      - somenewaccount1 5y ago
        Onelogin was audited, and they had a security breach a year later. Intuit, also audited. Twitch? They have had audits done. So, you can continue to sit here on hacker news and bitch that it "hasn't been audited" and therefor you aren't "free", or some shit. But either way, you sound like jackass that knows nothing about technology or freedom. Freedom is not synonymous with "free", as in not having a cost.
    - somenewaccount1 5y ago
      You are not going to program anything without working for it. You are not going to be president without working for it. You are not going to have a car, without working for it. So, yes, you can audit it and then you will have an audited message platform.
- 0xdeadb00f 5y ago
  In regards to the linked issue; I wouldn't trust the security of a team that says shit like that.
VikingCoder 5y ago
Android client by "evilcorp.ltd"? Maybe not the most reassuring name.
- GoblinSlayer 5y ago
  Android users are not afraid of such things.
  - NotPractical 5y ago
    If Tox ever wishes to target normal people (like Signal), this is completely unacceptable.
- oehtXRwMkIs 5y ago
  Probably a reference to Mr. Robot
  - beebeepka 5y ago
    Who is Mr. Robot, Elliot?
- grayhatter 5y ago
  robinli would be hurt that you don't trust his corp. :P They're totally not evil... Promise :D
oehtXRwMkIs 5y ago
https://github.com/privacytools/privacytools.io/issues/566 https://github.com/privacytools/privacytools.io/issues/566
- bovermyer 5y ago
  While a mildly interesting discussion, it does not appear to have any merit with regards to Tox itself.
  - hannob 5y ago
    It links to a bug report discussion where one of the developers states that they don't understand the security properties of tox very well[1]. I find that worrying. [1] https://github.com/TokTok/c-toxcore/issues/426 https://github.com/TokTok/c-toxcore/issues/426
    - GoblinSlayer 5y ago
      Isn't it the reason why you do audits?
    - grayhatter 5y ago
      lol, I think you're probably talking about me. I remember that troll, he's what killed a lot of my motivation to work on Tox too. He likes stiring up shit on other foss projects too :/. Saying I don't understand the security properties is an interesting take. My intended comments meant I misunderstood the issue. I was only half paying attention at the time; I assumed it was another troll reposting the same issue "if someone steals your private keys they can steal your identity". Which is true, but an annoying complaint, because that's how crypto has to work. To be sure, I didn't write base the protocol itself, nor the crypto primitives. So while I don't agree with the assertion, even if it was true. It wouldn't matter because I didn't design the original system :)
      - ueueshitashita 5y ago
        >I remember that troll Made me chuckle that you're referring to Jason Donenfeld as "that troll"
BiteCode_dev 5y ago
Tox is already a very popular testing tool in python, to the name is a bit confusing.
- TonyTrapp 5y ago
  Neither of them is particularly new; The testing tool seems to be around since 2010 while the chat protocol is around since 2013.
  - BiteCode_dev 5y ago
    3 years is a lot, and tox the testing tool is much more used than tox the chat protocol.
    - GoblinSlayer 5y ago
      Just like the git name collision. If it's not a guid, chances are it's not unique.
- timbit42 5y ago
  I believe Tox is meant to sound like Talks.
  - blacksmith_tb 5y ago
    That was my assumption too - though if it was my project I'd probably have shied away from it since it also suggests "toxic"... (that could be a plus, too, depending on your tastes, I suppose).
sschueller 5y ago
I think https://jami.net/ https://jami.net/ is a better solution and has a working mobile client.
- csdvrx 5y ago
  Do either tox or jami expose the IP address by default?
  - timbit42 5y ago
    I believe Tox does but you can run it through Tor.
snvzz 5y ago
It does the job, and it isn't centralized. It "just works". Resource usage is also pretty low. I can't comprehend why this isn't widely used. I wish this was a thing _before_ crap like WhatsApp, Skype or Discord got so popular.
- jqpabc123 5y ago
  I can't comprehend why this isn't widely used. It doesn't have an iOS client. It's hard to tell your employees to standardize on Tox when a good portion of them don't have a working client to install. I'm no Apple fan but the world does not run on Android alone.
  - grayhatter 5y ago
    Yeah, this is a big problem as well. There used to be an iOS client, but it's developer moved on to other projects. So it's woefully unmaintained at this point.
  - kwhitefoot 5y ago
    If my employer wants me to use a piece of software then they have to provide the hardware on which it will run. Then it isn't a problem for the employee what hardware it runs on.
- adrusi 5y ago
  It wasn't a thing before Skype, but it predates Discord, and might predate Whatsapp, or at least predates me hearing about Whatsapp in the US. It was a hobby project originally started by a bunch of anons in 4chan, and every time it gets attention, people point out it hasn't been audited, and no one has their reputation at stake. And it doesn't have any desktop/mobile sync.
  - beebmam 5y ago
    Not being audited is key here. Would you trust closed source software to live up to its security promises without audits? I sure wouldn't!
leke 5y ago
Does anyone know if this supports code snippets? We're currently using mattermost at work and it has great code and custom command support. But for that, we need to have domains, certificates and our own servers set up. I'm not the tech guy so I don't know if this kind of chat app would be better, but I think it would be great to have something that was P2P (no server requirements, certificates etc...) while being super secure.
- grayhatter 5y ago
  None of the client do at this point, I'm working on adding markdown to uTox, and eventually syntax highlighting but I've been struggling with pretty severe apathy the past while so I can't offer a timeframe. Opening an issue requesting it on the github uTox repo, and then pestering me to actually finish it has been known to work in the past. :D
jmakov 5y ago
Shouldn't the first question be who is paying for all this (also who's done an audit)? Remember CryptoAG, Potonmail claiming they don't log IPs etc.?
- throwawaymanbot 5y ago
  I would throw truecrypt in to this grouping also.
- fwip 5y ago
  It's open source and distributed. The only ongoing costs are the optional bootstrap DHT nodes, which are pretty cheap.
- paulryanrogers 5y ago
  FWIW, website says "Powered by Digital Ocean".
  - aasasd 5y ago
    If my site is powered by the Nginx server, it doesn't mean Nginx the company has anything to do with it.
  - grayhatter 5y ago
    Our webservers and build/dev servers are graciously donated by DO. They're really an awesome company to FOSS projects :D
- grayhatter 5y ago
  Former Tox dev, no one is paying for it. It's home grown FOSS. I guess technically, if you're using Tox, you are paying for it. There's no servers, being exclusively P2P so your internet bandwidth and participation in the DHT is what allows it to function. Anyone who you directly connect to can know your IP, but not much else. So your friends could log your IP, and your ISP could see you're using Tox, (The traffic doesn't try to hide itself.) So there's no way we (the devs) could log your IP, we never actually see it. And, as someone else said, you can tunnel through Tor if you need to keep your IP secret.
olah_1 5y ago
I prefer the decentralized messaging protocols that are incentivized by tokens. eg. Status / VacP2P (ethereum), Session (oxen), Sylo, etc. I know that a lot of people have opposite preference, but nothing is free, and tokens allow projects to create their own value, which I think is a very cool innovation. Afterall, it seems lack of funding is a main issue with Tox (can’t afford audit etc). So how else do you avoid being beholden to investors while also having resources?
- grayhatter 5y ago
  You're in luck https://github.com/irungentoo/toxcoin https://github.com/irungentoo/toxcoin just don't pay attention to the date :P
  - olah_1 5y ago
    Amazing haha. If anything, I think this just shows the importance of people with real organization and management skills. Institutions are important for sustainability
  - verall 5y ago
    > The Toxcoin dev team currently consists entirely of ideas guys, we need actual developpers to design and implement toxcoin properly. The development team will recieve 10% of toxcoin profits while 90% will go to the ideas guys who came up with the idea. lmao
hilbert42 5y ago
Been using Jami because I thought the Tox project dead. Just loaded up six profiles from older version 1.16.3 (qtox 2019-05-08) on this new version (qtox 1.17.3) and they load OK but passwords don't work (except where they were embedded). Have good backups of them so they should. Just wondered if it's just me for some reason (no big deal as I wasn't using the program). Will reinstall older .exe and see what happens, same with earlier Android version (it uses the same old passwords).
ashton314 5y ago
How does this compare with, say, Matrix with P2P support?
- hilbert42 5y ago
  Right, I wish I knew. Trying to get a decent side-by-side comparison of Tox, Jami, etc., etc. is like trying to find hens' teeth. Surely, there must be someone out there in user-land who's actually done the legwork. The reason I want more input on this has to do with my past experience of Tox's poor connection reliability and I want to know what to do about it—or find out whether it's actually fixable or not, or whether I should settle on another P2P program such as Jami which works in a similar way, etc. For me, connection reliability is more important than security and I'd like to settle on the program with the most reliable connection service (I'd prefer the NSA didn't listen to what I've to say but it's the Googles and Facebooks of this world that I'm really trying to avoid). The last time I used Tox in a serious way was several years ago when I had relatives visiting from overseas and I refused to use Facebook, Google etc. When I really needed it, Tox didn't work or dropped out too often to the point where it was unusable much to others and my annoyance — and only to be told 'why the hell don't you use what everyone else uses, social media, Facebook etc. — then there'd be no problem?' It's hard to argue with that when one has others breathing down one's neck to organize things locally. It seems to me we need to sort this out with some decent real-world testing/runoffs. And for this we need the input of many users/many setups to get good comparative data. As I said elsewhere, I thought the Tox project was dead as updates were so few and far between, so support and the user-base size is also important. If we can't get to the bottom of the P2P problem then it seems that I may have fall back to Jitsi (so far that always seems to work but I'd prefer not to use it for obvious reasons).

134 points by thepangolino 5y ago

Tox is a neat idea, but (at least when I tried it) it would really kill battery life. I think this is kind of inherent to the design.

aasasd 5y ago

Still no audit, right? Just “trust us, it's secure”. And afaik the authors don't have particular expertise in security. Edit: also, “it's secure, we use Nacl”: https://github.com/irungentoo/toxcore/issues/121 https://github.com/irungentoo/toxcore/issues/121

grayhatter 5y ago
Nope, we still can't afford the price tag on an audit. Perhaps I'm jaded or biased because I'm a former Tox dev, but Tox is the only encrypted messenger I'd actually trust. I consider myself to be pretty good a security, but that's just me and you shouldn't take anyone's word for it themselves. That said if you have an actual cause reason to be concerned, I'd be interest in hearing it?
- tombert 5y ago
  This is not meant to be passive aggressive but it's going to sound like it is; how much would an audit actually cost? If someone set up a GoFundMe for a Tox audit, I would definitely contribute ten bucks to make that happen.
  - grayhatter 5y ago
    I don't think it's passive aggressive at all. I'm a bit embarrassed to say, but I honestly don't remember. My best guess from what I do remember the last time it was discussed, was in the 2k to 10k range. But it could expand rapidly depending on who, and what level we actually hired someone at. The primary reason we didn't set up crowdfunding ourselves was there was a few important changes we wanted to make a decision on and implement first. I still don't think they've been made, but I'm not following super close anymore.
    - tombert 5y ago
      Even if we go on the higher end of that, 10 grand doesn't seem that high for an audience of engineers (which I think is overrepresented on Hacker News). I know people have been complaining about a lack of a security audit since 2016; I think at this point it would be worth doing an audit now, and potentially another audit when new features are added. If I were in any way involved in the project I would set up the campaign myself, but sadly I don't know enough C to be useful to a project like this (unless there was a plan to rewrite it in some esoteric functional language for some reason).
      - grayhatter 5y ago
        you might want to reach out to zugz (via our IRC, or github), He's also a fan of esoteric functional, so you might be able to convince him to start one. Iphy has a repo with the start of a Haskell implementation as proof of the completeness of the spec. No idea what the stat of that is, but again, might be worth reaching out :)
  - ddtaylor 5y ago
    Most of the users of Tox don't want to be identified, so it's a bit difficult to crowd fund such a thing.
- csoghoian 5y ago
  The Open Technology Fund provides free security audits for open source projects. Apply here: https://apply.opentech.fund/red-team-lab/ https://apply.opentech.fund/red-team-lab/
somenewaccount1 5y ago
I mean, it's open source, so you can audit it. https://github.com/qTox/qTox https://github.com/qTox/qTox. Then you can build the client yourself and check the sha sum against any downloaded distribution.
- RamRodification 5y ago
  > it's open source, so you can audit it Programming languages exist, so you can make your own decentralized encrypted instant messaging app. There is democracy, so you can be the president. Everyone in the family has legs, so we won't need a car.
  - dicethrowaway1 5y ago
    See also https://en.wikipedia.org/wiki/Real_freedom https://en.wikipedia.org/wiki/Real_freedom.
    - somenewaccount1 5y ago
      Onelogin was audited, and they had a security breach a year later. Intuit, also audited. Twitch? They have had audits done. So, you can continue to sit here on hacker news and bitch that it "hasn't been audited" and therefor you aren't "free", or some shit. But either way, you sound like jackass that knows nothing about technology or freedom. Freedom is not synonymous with "free", as in not having a cost.
  - somenewaccount1 5y ago
    You are not going to program anything without working for it. You are not going to be president without working for it. You are not going to have a car, without working for it. So, yes, you can audit it and then you will have an audited message platform.
0xdeadb00f 5y ago
In regards to the linked issue; I wouldn't trust the security of a team that says shit like that.

VikingCoder 5y ago

Android client by "evilcorp.ltd"? Maybe not the most reassuring name.

GoblinSlayer 5y ago
Android users are not afraid of such things.
- NotPractical 5y ago
  If Tox ever wishes to target normal people (like Signal), this is completely unacceptable.
oehtXRwMkIs 5y ago
Probably a reference to Mr. Robot
- beebeepka 5y ago
  Who is Mr. Robot, Elliot?
grayhatter 5y ago
robinli would be hurt that you don't trust his corp. :P They're totally not evil... Promise :D

oehtXRwMkIs 5y ago

https://github.com/privacytools/privacytools.io/issues/566 https://github.com/privacytools/privacytools.io/issues/566

bovermyer 5y ago
While a mildly interesting discussion, it does not appear to have any merit with regards to Tox itself.
- hannob 5y ago
  It links to a bug report discussion where one of the developers states that they don't understand the security properties of tox very well[1]. I find that worrying. [1] https://github.com/TokTok/c-toxcore/issues/426 https://github.com/TokTok/c-toxcore/issues/426
  - GoblinSlayer 5y ago
    Isn't it the reason why you do audits?
  - grayhatter 5y ago
    lol, I think you're probably talking about me. I remember that troll, he's what killed a lot of my motivation to work on Tox too. He likes stiring up shit on other foss projects too :/. Saying I don't understand the security properties is an interesting take. My intended comments meant I misunderstood the issue. I was only half paying attention at the time; I assumed it was another troll reposting the same issue "if someone steals your private keys they can steal your identity". Which is true, but an annoying complaint, because that's how crypto has to work. To be sure, I didn't write base the protocol itself, nor the crypto primitives. So while I don't agree with the assertion, even if it was true. It wouldn't matter because I didn't design the original system :)
    - ueueshitashita 5y ago
      >I remember that troll Made me chuckle that you're referring to Jason Donenfeld as "that troll"

BiteCode_dev 5y ago

Tox is already a very popular testing tool in python, to the name is a bit confusing.

TonyTrapp 5y ago
Neither of them is particularly new; The testing tool seems to be around since 2010 while the chat protocol is around since 2013.
- BiteCode_dev 5y ago
  3 years is a lot, and tox the testing tool is much more used than tox the chat protocol.
  - GoblinSlayer 5y ago
    Just like the git name collision. If it's not a guid, chances are it's not unique.
timbit42 5y ago
I believe Tox is meant to sound like Talks.
- blacksmith_tb 5y ago
  That was my assumption too - though if it was my project I'd probably have shied away from it since it also suggests "toxic"... (that could be a plus, too, depending on your tastes, I suppose).

sschueller 5y ago

I think https://jami.net/ https://jami.net/ is a better solution and has a working mobile client.

csdvrx 5y ago
Do either tox or jami expose the IP address by default?
- timbit42 5y ago
  I believe Tox does but you can run it through Tor.

snvzz 5y ago

It does the job, and it isn't centralized. It "just works". Resource usage is also pretty low. I can't comprehend why this isn't widely used. I wish this was a thing _before_ crap like WhatsApp, Skype or Discord got so popular.

jqpabc123 5y ago
I can't comprehend why this isn't widely used. It doesn't have an iOS client. It's hard to tell your employees to standardize on Tox when a good portion of them don't have a working client to install. I'm no Apple fan but the world does not run on Android alone.
- grayhatter 5y ago
  Yeah, this is a big problem as well. There used to be an iOS client, but it's developer moved on to other projects. So it's woefully unmaintained at this point.
- kwhitefoot 5y ago
  If my employer wants me to use a piece of software then they have to provide the hardware on which it will run. Then it isn't a problem for the employee what hardware it runs on.
adrusi 5y ago
It wasn't a thing before Skype, but it predates Discord, and might predate Whatsapp, or at least predates me hearing about Whatsapp in the US. It was a hobby project originally started by a bunch of anons in 4chan, and every time it gets attention, people point out it hasn't been audited, and no one has their reputation at stake. And it doesn't have any desktop/mobile sync.
- beebmam 5y ago
  Not being audited is key here. Would you trust closed source software to live up to its security promises without audits? I sure wouldn't!

leke 5y ago

Does anyone know if this supports code snippets? We're currently using mattermost at work and it has great code and custom command support. But for that, we need to have domains, certificates and our own servers set up. I'm not the tech guy so I don't know if this kind of chat app would be better, but I think it would be great to have something that was P2P (no server requirements, certificates etc...) while being super secure.

grayhatter 5y ago
None of the client do at this point, I'm working on adding markdown to uTox, and eventually syntax highlighting but I've been struggling with pretty severe apathy the past while so I can't offer a timeframe. Opening an issue requesting it on the github uTox repo, and then pestering me to actually finish it has been known to work in the past. :D

jmakov 5y ago

Shouldn't the first question be who is paying for all this (also who's done an audit)? Remember CryptoAG, Potonmail claiming they don't log IPs etc.?

throwawaymanbot 5y ago
I would throw truecrypt in to this grouping also.
fwip 5y ago
It's open source and distributed. The only ongoing costs are the optional bootstrap DHT nodes, which are pretty cheap.
paulryanrogers 5y ago
FWIW, website says "Powered by Digital Ocean".
- aasasd 5y ago
  If my site is powered by the Nginx server, it doesn't mean Nginx the company has anything to do with it.
- grayhatter 5y ago
  Our webservers and build/dev servers are graciously donated by DO. They're really an awesome company to FOSS projects :D
grayhatter 5y ago
Former Tox dev, no one is paying for it. It's home grown FOSS. I guess technically, if you're using Tox, you are paying for it. There's no servers, being exclusively P2P so your internet bandwidth and participation in the DHT is what allows it to function. Anyone who you directly connect to can know your IP, but not much else. So your friends could log your IP, and your ISP could see you're using Tox, (The traffic doesn't try to hide itself.) So there's no way we (the devs) could log your IP, we never actually see it. And, as someone else said, you can tunnel through Tor if you need to keep your IP secret.

olah_1 5y ago

I prefer the decentralized messaging protocols that are incentivized by tokens. eg. Status / VacP2P (ethereum), Session (oxen), Sylo, etc. I know that a lot of people have opposite preference, but nothing is free, and tokens allow projects to create their own value, which I think is a very cool innovation. Afterall, it seems lack of funding is a main issue with Tox (can’t afford audit etc). So how else do you avoid being beholden to investors while also having resources?

grayhatter 5y ago
You're in luck https://github.com/irungentoo/toxcoin https://github.com/irungentoo/toxcoin just don't pay attention to the date :P
- olah_1 5y ago
  Amazing haha. If anything, I think this just shows the importance of people with real organization and management skills. Institutions are important for sustainability
- verall 5y ago
  > The Toxcoin dev team currently consists entirely of ideas guys, we need actual developpers to design and implement toxcoin properly. The development team will recieve 10% of toxcoin profits while 90% will go to the ideas guys who came up with the idea. lmao

hilbert42 5y ago

Been using Jami because I thought the Tox project dead. Just loaded up six profiles from older version 1.16.3 (qtox 2019-05-08) on this new version (qtox 1.17.3) and they load OK but passwords don't work (except where they were embedded). Have good backups of them so they should. Just wondered if it's just me for some reason (no big deal as I wasn't using the program). Will reinstall older .exe and see what happens, same with earlier Android version (it uses the same old passwords).

ashton314 5y ago

How does this compare with, say, Matrix with P2P support?

hilbert42 5y ago
Right, I wish I knew. Trying to get a decent side-by-side comparison of Tox, Jami, etc., etc. is like trying to find hens' teeth. Surely, there must be someone out there in user-land who's actually done the legwork. The reason I want more input on this has to do with my past experience of Tox's poor connection reliability and I want to know what to do about it—or find out whether it's actually fixable or not, or whether I should settle on another P2P program such as Jami which works in a similar way, etc. For me, connection reliability is more important than security and I'd like to settle on the program with the most reliable connection service (I'd prefer the NSA didn't listen to what I've to say but it's the Googles and Facebooks of this world that I'm really trying to avoid). The last time I used Tox in a serious way was several years ago when I had relatives visiting from overseas and I refused to use Facebook, Google etc. When I really needed it, Tox didn't work or dropped out too often to the point where it was unusable much to others and my annoyance — and only to be told 'why the hell don't you use what everyone else uses, social media, Facebook etc. — then there'd be no problem?' It's hard to argue with that when one has others breathing down one's neck to organize things locally. It seems to me we need to sort this out with some decent real-world testing/runoffs. And for this we need the input of many users/many setups to get good comparative data. As I said elsewhere, I thought the Tox project was dead as updates were so few and far between, so support and the user-base size is also important. If we can't get to the bottom of the P2P problem then it seems that I may have fall back to Jitsi (so far that always seems to work but I'd prefer not to use it for obvious reasons).