10 ms·

Tox: A simple, distributed, free, secure Skype replacement. Now alpha with A/V

345 points by irungentoo 12y ago

Tox is now usable and has reached alpha (in other words, it is mostly working, but lacking some features, bugs might be apparent). uTox is a lightweight (minimal dependencies) Tox client for Windows, Linux and (experimentally) Android. It supports text chat, file transfers, audio and video calling, desktop sharing (both as video and as screenshots). It also supports text-only group chats (with audio/video being worked on). For more info about Tox and uTox, see the project links below. Windows updater/downloader: https://jenkins.libtoxcore.so/job/utox_update_win32/lastSuccessfulBuild/artifact/utox-updater.zip Linux nightlies: 64-bit: https://jenkins.libtoxcore.so/job/uTox_linux_amd64/lastSuccessfulBuild/artifact/utox/utox_linux_amd64.tar.xz 32-bit: https://jenkins.libtoxcore.so/job/uTox_linux_i686/lastSuccessfulBuild/artifact/utox/utox_linux_i686.tar.xz If you use an operating system other than windows or linux (OSX or android) or want to try other Tox clients, see this page: https://wiki.tox.im/Binaries Project links: Official Tox website: https://tox.im uTox Github: https://github.com/notsecure/uTox toxcore Github: https://github.com/irungentoo/toxcore Other links: qTox Github: https://github.com/tux3/qTox Antox Github: https://github.com/Astonex/Antox Note about adding friends in Tox: in the settings area of uTox you can find your Tox ID, and you give that out to your friends so that they can add you. To solve the inconvenience of sharing long IDs, Tox also supports "DNS names", for example "groupbot@toxme.se". You can register your own @toxme.se name on toxme.se Tox is alpha software, bugs are expected. Feel free to post any questions or feedback or visit us on IRC: #tox on freenode.

deleted 12y ago
[deleted]
JellyYelly 12y ago
Any chance of an iOS client any time soon?
- notsecure 12y ago
  Not any time soon, as iOS isn't very FLOSS friendly (in fact, the GPL is not compatible with the Apple app store). There have been talks of making a licensing exception, but the iOS client with the most progress (https://github.com/Jman012/Toxicity https://github.com/Jman012/Toxicity) isn't functional at the moment.
  - volitek 12y ago
    I believe there's someone working on a completely different iOS client that looks pretty snazzy, but they haven't got any public code in their repo yet.
  - JellyYelly 12y ago
    Oh, that's a shame. Hopefully in the future there will be an iOS client.
    - davexunit 12y ago
      Ask Apple to change their policy to allow copyleft software.
      - duskwuff 12y ago
        It has nothing to do with Apple's policy. The GPL is what's getting in the way: it says you can't impose restrictions on the redistribution of a GPLed application, and the App Store doesn't have any means to even permit redistribution of apps once they're installed.
        ginko 12y ago
        Seems like the App Store's problem.
        Ridley 12y ago
        Google play store doesn't have that problem.
        belorn 12y ago
        Apple sells products which they have decided to retain control over after sale. That is Apple's choice, Apple's policy, Apple's decision. It also conflict with a lot of things, including the GPL.
  - f3llowtraveler 12y ago
    MPLv2 is compatible with both the GPL and the App Store.
dang 12y ago
Posts without URLs are penalized. You might want to repost this using the most appropriate URL, then add your text as a comment to the post. If you like, email us at hn@ycombinator.com with a link to the new post and we'll look it over for you. Edit: this one seems to be doing fine.
- TheSisb2 12y ago
  Reading HN full time as a job must be extremely enjoyable. :)
  - dang 12y ago
    It's like being paid to eat cheesecake.
    - massappeal 12y ago
      Livin the dream, Dang
gue5t 12y ago
Can you compare this to Jabber+Jingle?
- irungentoo 12y ago
  Tox is distributed meaning it doesn't rely on any central servers.
  - gue5t 12y ago
    This would be good to note in the post, since right now it's easy to decide not to click anything because there are so many links and the salient feature is never mentioned prior to visiting them!
    - irungentoo 12y ago
      Fixed. Thank you.
  - hobarrera 12y ago
    As is XMPP. Does Tox actually offer any advantages?
    - pikdum 12y ago
      From what I understand, XMPP is decentralized, whereas Tox is distributed. http://cffn.ca/img/articles/Centralized-Decentralized-And-Distributed-System.jpg http://cffn.ca/img/articles/Centralized-Decentralized-And-Di...
      - rakoo 12y ago
        Depends. Just like SMTP, XMPP can be centralized (if everyone's on the same server, say gmail.com), as much as it can be distributed (if everyone's on his own server) and anywhere in between. Tox can only be distributed.
  - Sami_Lehtinen 12y ago
phobitor 12y ago
What about its design makes it secure? Do you guys have a design document or a description of how you've implemented security? Have any security experts audited the code?
- stqism 12y ago
  An audit is currently planned when the core stabilizes.
  - aalvarado 12y ago
    FAQ says it's using the NaCl crypto library, so I guess its protocol is as strong as the encryption. The audit would be less ambiguous, because so many other factors could come into play for all parts of an app, not just the communications part.
    - stqism 12y ago
      Yeah, it's more about the implementation and the design of the network/dht itself.
- alex_duf 12y ago
  This is a good question. What makes it secure ? "encryption" is not enough. Do you have central servers or is it protocol using P2P ? how do you connect one client to another ? What kind of encryption ? How are the key generated, can we change them etc...
  - kragniz 12y ago
    The whole protocol is decentralized and peer to peer. Each person in the network has a public and private key. The NaCl library is used to do all of the encryption.
    - alex_duf 12y ago
      Cool. Is this direct connection from peer to peer or does the communication bounce from one node to another as a TOR communication would do ? (I'm guessing direct for obvious latency reasons when using audio / video)
ledo 12y ago
i've been keeping an eye on this project for a while, it looks really promising. I'm spreading the word about it where i can.
- hobarrera 12y ago
  How is it superior to existing IM protocols (eg: XMPP)? The article comapres it to skype, which is popular, but, techonologically, one of the worst protocols around.
  - irungentoo 12y ago
    Tox is distributed meaning there are no central servers. Also, encryption is mandatory.
nickysielicki 12y ago
why is it distributed in binary format?
- JellyYelly 12y ago
  they have links to their git hub repos, so it's also distributed in source format. Unless I don't understand what you're saying.
stal 12y ago
OMG, not again. We are SICK of hearing about your 'tox' junk! We only need SKYPE!
aalvarado 12y ago
Is toxcore the name of the protocol? Would it be somewhat compatible with XMPP or something like that? I like that it's between FB messenger, gchat/hangouts, viber, what's app, Skype and hosted xmpp. I think it will have a chicken and an egg problem unless there's some kind of tool that let's you talk with other older apps and protocols like gchat/hangouts, or maybe this is planned.
- Epictek 12y ago
  It will most likely not be compatible with anything but Tox itself unless someone makes a bot to bridge between the two. For example there is currently a bot in the groupchat (Syncbot) which is a bridge between Tox and IRC. Bot example here: https://github.com/aitjcize/tox-irc-sync https://github.com/aitjcize/tox-irc-sync More info on the protocol here: https://github.com/irungentoo/toxcore/blob/master/docs/updates/DHT.md https://github.com/irungentoo/toxcore/blob/master/docs/updat...
nmflkjfelkrnfl 12y ago
For those that don't already know, this project comes from 4chan's technology board. While there's a lot of inane trash, there are also some real gems if you're patient enough. I find lots of really cool stuff there that doesn't seem to be anywhere else. More technically-capable people are always welcome to help drown out the inanity. :) http://boards.4chan.org/g/catalog http://boards.4chan.org/g/catalog
- shitlord 12y ago
  Interesting development: http://boards.4chan.org/g/thread/43340418/its-official-bittorrent-bleep-is-a-tox-clone-done http://boards.4chan.org/g/thread/43340418/its-official-bitto...
  - nmflkjfelkrnfl 12y ago
    Ignore all bait threads. Sage all bait threads. Report all bait threads. Hide all bait threads. Don't take the troll bait. ;)
    - gcb0 12y ago
      those "trolls" have a very sane point about having to be an idiot to trust bittorrent, the company.
      - nkjfnbewkjfew 12y ago
        Yes they sure do. I was referring to the OP's "deprecated" meme.
Plexion 12y ago
In the spirit of supporting as many individuals as possible, Tox websites are now accessible as a hidden service via Tor. The hidden service mirror has been stripped of Piwik tracking, and forms of Javascript, and soon we'll label outbound links. i2p support will also follow soon. Tox main site: http://kdzzxucnh4fyovxg.onion/ http://kdzzxucnh4fyovxg.onion/ Tox developer documentation: http://kdzzxucnh4fyovxg.onion/docs/ http://kdzzxucnh4fyovxg.onion/docs/ Tox wiki: http://kdzzxucnh4fyovxg.onion/wiki http://kdzzxucnh4fyovxg.onion/wiki
Aqueous 12y ago
I guess you've settled on a name, pretty completely, but tox evokes all sorts of bad feelings like "Toxin", "Detox" - generally feelings associated with the idea of poison or of poisoning yourself. From a marketing perspective this might not be the least sinister name you could have chosen. I realize this comes out of 4chan and we make a point of not giving a shit about marketing but...
- curun1r 12y ago
  It seems to be intentional, or at least acknowledged...the name of one of the Mac clients is 'Poison'.
- imaginenore 12y ago
  I disagree, it sounds like "talks" to me. Pretty cool name actually.
  - Byzantine 12y ago
    They intended "Talks" but most people will just associate it with toxicity or toxins. They really need to come up with a better name if they want to succeed.
  - threedaymonk 12y ago
    Whether "tox" sounds like "talks" will depend on whether or not your dialect exhibits the cot/caught merger. To those of us without, it sounds very different!
- Danieru 12y ago
  Also disagree, to me it sounds like Torx the screwdriver bit. It makes me think of a very utilitarian program.
- TallboyOne 12y ago
  The first thing I thought of was toxic.
  - 12y ago
Byzantine 12y ago
What makes the main developer, irungentoo, qualified to write the Tox core?
- laikaa 12y ago
  He has the time to do it.
  - sitkack 12y ago
    We don't want the guy with the most "free time" doing the work.
    - iopq 12y ago
      You're right. Make a better program. I'll be anticipating it, I really want a Skype replacement I can get behind.
      - sitkack 12y ago
        So do I, but Tox isn't it. They should have made the protocol, vetted the protocol and made a PoC implementation in a safe language. Cryptographers and secure protocol designers can't help out if they are noodling along banging out the implementation while designing it.
- sitkack 12y ago
  Starting a new, blue water distributed encryption system in a non-safe language is odd at this point. The protocol is being _noodled_ through and the code is in C. This is the coding style https://github.com/irungentoo/toxcore/commit/84c28337d248bad2319b5c001108b198dbd6bc5c https://github.com/irungentoo/toxcore/commit/84c28337d248bad... this is openssl all over again https://github.com/irungentoo/toxcore/commit/1d6c3934736c3694a7c9f694d818252e4159cde3 https://github.com/irungentoo/toxcore/commit/1d6c3934736c369...
  - deleted 12y ago
    [deleted]
deleted 12y ago
[deleted]
dredmorbius 12y ago
NB: the tox project website is unusable w/o JS enabled. Please fix that. https://tox.im/ https://tox.im/ While we're at it, the rest of the suggestions may be useful: http://www.reddit.com/r/dredmorbius/comments/27d5xr/please_forward_to_marketing_how_to_present_your/ http://www.reddit.com/r/dredmorbius/comments/27d5xr/please_f... From the FAQ, this I like: "The goal of this project is to create a configuration-free P2P Skype replacement. Configuration-free means that the user will simply have to open the program and without any account configuration will be capable of adding people to his or her's friends list and start conversing with them. There are many so-called Skype replacements and all of them are either hard to configure for the normal user or suffer from being way too centralized." A lot. (Emphasis added).
- notsecure 12y ago
  The website should be completely functional with JS disabled (and it is for me), what issues do you get? Note: I'm not in charge of the tox.im website, if it were up to me there would be no javascript at all.
  - dredmorbius 12y ago
    Chromium w/ ScriptSafe installed: no text until I allow the primary domain's JS: http://imgur.com/6xOfCr0 http://imgur.com/6xOfCr0 http://imgur.com/E8WK98R http://imgur.com/E8WK98R
    - dchest 12y ago
      You should probably submit a bug report to ScriptSafe.
sitkack 12y ago
Can you explain why tox is written in C over languages?
- veeti 12y ago
  Knowing the typical Arch/Gentoo tiling WM 8px console font anime wallpaper mindset on /g/, "bloat".
  - volitek 12y ago
    Also for interoperability and portability. Pretty much every language has a way to bind to C code, and pretty much all hardware can run C.
  - anon4 12y ago
    You say it like it's not a sign of a good developer who minds all the details. Though I'll admit I use a 16px font.
    - oldmanjay 12y ago
      It's not a reliable sign of a good developer at all, although you'd be hard-pressed to realize that if you're hip deep in the culture.
      - lawl 12y ago
        My experience from interviewing other devs begs to differ. But why have a discussion when you can just ad homiem people? In my experience this shows that people actually care about the tech they work with. Which is a good sign.
        scott_karana 12y ago
        Caring about tooling doesn't mean you can necessarily use them well, especially when rhetoric becomes codified.
  - 12y ago
Quequau 12y ago
Does Tox have plans to offer telephone numbers so that POTS subscribers can call Tox users? If not, I don't see how it can be a replacement for Skype.
- richardwhiuk 12y ago
  PSTN connectivity requires centralization
spiritplumber 12y ago
This is great! Is there an Android version, and if so, are you OK with me writing a telepresence bot control API for it? (It's just a couple of hooks to a control app, if you're not releaseing source, I can just give you them).
- volitek 12y ago
  Antox, the android client: https://github.com/Astonex/Antox https://github.com/Astonex/Antox Please do! It's all free and open source.
donniezazen 12y ago
Do you sync messages across various clients? So that I can start chatting on one and move to second or third client.
- notsecure 12y ago
  Not yet. This is a planned feature but the implementation has not been decided yet because this feature is not exactly compatible with how Tox works and it could cause a lot security issues.
wesley 12y ago
Are group chats also encrypted? (The problem with jabber right now)
- Ridley 12y ago
  Yes, everything is encrypted from what I can tell.
JoeAltmaier 12y ago
Warning: shameless plug. Sococo has a free replacement for Skype, including doc sharing, chat etc. Been around for years now.
- dethstar 12y ago
  Sococo doesn't seem to be open source
  - JoeAltmaier 12y ago
    Free though. And lots of features.
- dethstar 12y ago
  Sococo doesn't seem to be open source
Nux 12y ago
So, what is the difference between utox_linux_amd64.tar.xz and Venom from https://repo.tox.im/rpm/ https://repo.tox.im/rpm/ ?
bramd 12y ago
I don't post often on HN, but today couldn't resist. Just tested Utox on Windows as well as Toxy, also on Windows. Both programs are totally inaccessible for people using a screenreader and I'm quite sure as well for people using things like speech recognition. Utox seems to be C++ and a GUI framework I didn't look into. Toxy is .NET+WPF... two different stacks, but two inaccessible programs. I'm quite sure the developers didn't write inaccessible software deliberately, but this makes me wonder if we need either: 1. Inform developers better about accessibility 2. Fix tooling: warn/error if you don't label your elements etc 3. All of the above... To give this post some more context, earlier this week I looked at Stellar... their web client is inaccessible. Earlier this week Wunderlist released a version 3... iOS app is nearly inaccessible. Earlier this week I finally wanted to give Foursquare's new Swarm app a shot... inaccessible. Do you see the pattern? I'm sorry for ranting about this, but imagine some random app update did stop the app from working and only displayed a black screen, you would be annoyed at least.
- biomechanica 12y ago
  As far as I can tell, uTox is written in C and uses XLib (on GNU/Linux, at least).
- kohanz 12y ago
  Seems like these would be useful suggestions to add to the respective github pages of those projects. Also, they are open-source, so there's an opportunity there if you have expertise in making UI's accessible.
- mahkoh 12y ago
  >Utox seems to be C++ and a GUI framework I didn't look into. utox is written in C and uses its own toolkit so that it looks the same everywhere. For that reason it will probably never give you the level of accessibility provided by more mature toolkits.
- mind-blight 12y ago
  The software is in alpha, so I imagine screen reader accessibility is lower on their priority list. Once it becomes late stage beta, then accessibility complaints are more reasonable. Until then, core features should take precedence.
mpnordland 12y ago
So, This is pretty cool, however, one thing that I noticed: Addresses are per device. Skype lets you have one name and messages and calls come to all your devices, but as far as I see, Tox is one address per device.
- biomechanica 12y ago
  I remember reading discussion how to address this problem. I can't for the life of me find it, though.
  - x1798DE 12y ago
    This is where the original (fairly old) idea is on the wiki: https://wiki.tox.im/Multiple_Devices https://wiki.tox.im/Multiple_Devices Here is a breakdown of the different ways they are considering on how to implement it: https://github.com/Quoturnix/ProjectTox-Core/wiki/Multiple-devices https://github.com/Quoturnix/ProjectTox-Core/wiki/Multiple-d...
throwaway-27677 12y ago
This project has largely disappointed me in many ways. I know HN doesn't care much about software licensing and that kind of stuff, but there are many legal issues behind the project that remain unsolved and have remained unsolved for majority of the project's lifetime. 1. The people behind Tox don't seem to be the copyright holders of their logo as admitted by one of the main developers[1]. The logo is the one also used on their website. 2. Tox project is now attempting to (falsely) claim to be the copyright holders of the logo.[2] Wikimedia Commons deleted the project logo for legal concerns, and to date it remains deleted.[3] There is no concrete proof for Tox's copyright claims on the logos, while there's pretty concrete proof that the project indeed does not hold the copyright on the logos. For those unaware of how our legal system works, "works without license" are considered copyrighted work of the author (e.g. anonymous user on linked /gd/ board). 3. Creative Commons licenses are also incompatible with their choice of software licensing, GPLv3+,[4] which means they cannot legally redistribute current logos under the current licenses with Tox software even if they were copyright holders to those logos.[5] As far as I know, the logos are already being redistributed with the software. 4. The documentation also cannot be legally redistributed with the software, and in theory nobody outside the project has practical freedoms to modify the documentation.[6] "I'm le troll! :-)" was most likely added by the developers. 5. Because of the above mentioned issues, Tox cannot be accepted to Debian GNU/Linux repositories because of DSFG guidelines. 6. The above mentioned issues also create false advertising; "Tox is both free for you to use, and free for you to change. You are completely free to both use and modify Tox."[7] 7. A developer quit the project because of other serious issues in the project.[8][9] The developer criticized the design of DHT (distributed hash table) used to find users, which leaked a lot of data about users. There's a large reddit thread about these DHT issues somewhere too, but I seem to be unable to find it myself right now. Fortunately, the leak was patched a long time ago. Unfortunately, the patch was a large hack which the Tox developers solved by reinventing the wheel and reimplementing Tor onion routing. 8. I haven't verified this (so don't count on me), but the Tox core (or core + clients?) is now ~100k lines of code. It's not entirely lightweight per se, which was one of the initial goals as far as I remember. 9. Another minor thing that upset me was that during Tox's conference talk (forgot which conference, but it was related to YouBrokeTheInternet), the speaker forgot to introduce himself and what he was doing. This probably led to some confusion. 10. Possibly controversial too, but the first radio talk show Tox was introduced in was... could I say, maybe slightly cringeworthy. Or something. See it for yourself.[10] Sorry if I went a little bit too political, knowing the rules. I wanted to point out these issues to let you know how everyone involved in the project can be a help. [1]: https://rbt.asia/g/thread/40445107#p40449131 https://rbt.asia/g/thread/40445107#p40449131 - you can scroll down and read the replies too [2]: https://commons.wikimedia.org/wiki/Commons:Deletion_requests/File:Tox_logo.svg https://commons.wikimedia.org/wiki/Commons:Deletion_requests... [3]: https://commons.wikimedia.org/wiki/Commons:Undeletion_requests/Archive/2014-03#File:Tox_logo.svg https://commons.wikimedia.org/wiki/Commons:Undeletion_reques... [4]: https://github.com/irungentoo/toxcore/blob/master/COPYING https://github.com/irungentoo/toxcore/blob/master/COPYING [5]: https://www.gnu.org/licenses/license-list.html#ccbysa https://www.gnu.org/licenses/license-list.html#ccbysa [6]: https://github.com/Tox/Docs/issues/7 https://github.com/Tox/Docs/issues/7 [7]: https://tox.im/ https://tox.im/ [8]: http://www.tox-chat.com/2013/08/tox-developer-fed-up-quits.html http://www.tox-chat.com/2013/08/tox-developer-fed-up-quits.h... [9]: https://github.com/irungentoo/toxcore/issues/493 https://github.com/irungentoo/toxcore/issues/493 [10]: https://www.youtube.com/watch?v=IdR3SVcBbq0 https://www.youtube.com/watch?v=IdR3SVcBbq0 Disclaimer: I'm not the author of any of the links above. It's what I have gathered from numerous discussion threads Tox has had on 4chan.
aagha 12y ago
So why this when there's Hangouts?
- kazagistar 12y ago
  Cause it binds you to a particular company, protocol, etc. This is open source, and does not create a single point of monitoring.
notsobrightkid 12y ago
can someone please explain in easy to understand how alice and bob find each other with temporary public keys in the DHT? I read this (https://github.com/irungentoo/toxcore/blob/master/docs/Prevent_Tracking.txt https://github.com/irungentoo/toxcore/blob/master/docs/Preve...) but I still can't picture it (the wording isn't the greatest either). Thanks!!
lwh 12y ago
How does it differ from Retroshare? http://retroshare.sourceforge.net/ http://retroshare.sourceforge.net/

345 points by irungentoo 12y ago

deleted 12y ago

[deleted]

JellyYelly 12y ago

Any chance of an iOS client any time soon?

notsecure 12y ago
Not any time soon, as iOS isn't very FLOSS friendly (in fact, the GPL is not compatible with the Apple app store). There have been talks of making a licensing exception, but the iOS client with the most progress (https://github.com/Jman012/Toxicity https://github.com/Jman012/Toxicity) isn't functional at the moment.
- volitek 12y ago
  I believe there's someone working on a completely different iOS client that looks pretty snazzy, but they haven't got any public code in their repo yet.
- JellyYelly 12y ago
  Oh, that's a shame. Hopefully in the future there will be an iOS client.
  - davexunit 12y ago
    Ask Apple to change their policy to allow copyleft software.
    - duskwuff 12y ago
      It has nothing to do with Apple's policy. The GPL is what's getting in the way: it says you can't impose restrictions on the redistribution of a GPLed application, and the App Store doesn't have any means to even permit redistribution of apps once they're installed.
      - ginko 12y ago
        Seems like the App Store's problem.
      - Ridley 12y ago
        Google play store doesn't have that problem.
      - belorn 12y ago
        Apple sells products which they have decided to retain control over after sale. That is Apple's choice, Apple's policy, Apple's decision. It also conflict with a lot of things, including the GPL.
- f3llowtraveler 12y ago
  MPLv2 is compatible with both the GPL and the App Store.

dang 12y ago

Posts without URLs are penalized. You might want to repost this using the most appropriate URL, then add your text as a comment to the post. If you like, email us at hn@ycombinator.com with a link to the new post and we'll look it over for you. Edit: this one seems to be doing fine.

TheSisb2 12y ago
Reading HN full time as a job must be extremely enjoyable. :)
- dang 12y ago
  It's like being paid to eat cheesecake.
  - massappeal 12y ago
    Livin the dream, Dang

gue5t 12y ago

Can you compare this to Jabber+Jingle?

irungentoo 12y ago
Tox is distributed meaning it doesn't rely on any central servers.
- gue5t 12y ago
  This would be good to note in the post, since right now it's easy to decide not to click anything because there are so many links and the salient feature is never mentioned prior to visiting them!
  - irungentoo 12y ago
    Fixed. Thank you.
- hobarrera 12y ago
  As is XMPP. Does Tox actually offer any advantages?
  - pikdum 12y ago
    From what I understand, XMPP is decentralized, whereas Tox is distributed. http://cffn.ca/img/articles/Centralized-Decentralized-And-Distributed-System.jpg http://cffn.ca/img/articles/Centralized-Decentralized-And-Di...
    - rakoo 12y ago
      Depends. Just like SMTP, XMPP can be centralized (if everyone's on the same server, say gmail.com), as much as it can be distributed (if everyone's on his own server) and anywhere in between. Tox can only be distributed.
- Sami_Lehtinen 12y ago

phobitor 12y ago

What about its design makes it secure? Do you guys have a design document or a description of how you've implemented security? Have any security experts audited the code?

stqism 12y ago
An audit is currently planned when the core stabilizes.
- aalvarado 12y ago
  FAQ says it's using the NaCl crypto library, so I guess its protocol is as strong as the encryption. The audit would be less ambiguous, because so many other factors could come into play for all parts of an app, not just the communications part.
  - stqism 12y ago
    Yeah, it's more about the implementation and the design of the network/dht itself.
alex_duf 12y ago
This is a good question. What makes it secure ? "encryption" is not enough. Do you have central servers or is it protocol using P2P ? how do you connect one client to another ? What kind of encryption ? How are the key generated, can we change them etc...
- kragniz 12y ago
  The whole protocol is decentralized and peer to peer. Each person in the network has a public and private key. The NaCl library is used to do all of the encryption.
  - alex_duf 12y ago
    Cool. Is this direct connection from peer to peer or does the communication bounce from one node to another as a TOR communication would do ? (I'm guessing direct for obvious latency reasons when using audio / video)

ledo 12y ago

i've been keeping an eye on this project for a while, it looks really promising. I'm spreading the word about it where i can.

hobarrera 12y ago
How is it superior to existing IM protocols (eg: XMPP)? The article comapres it to skype, which is popular, but, techonologically, one of the worst protocols around.
- irungentoo 12y ago
  Tox is distributed meaning there are no central servers. Also, encryption is mandatory.

nickysielicki 12y ago

why is it distributed in binary format?

JellyYelly 12y ago
they have links to their git hub repos, so it's also distributed in source format. Unless I don't understand what you're saying.

stal 12y ago

OMG, not again. We are SICK of hearing about your 'tox' junk! We only need SKYPE!

aalvarado 12y ago

Is toxcore the name of the protocol? Would it be somewhat compatible with XMPP or something like that? I like that it's between FB messenger, gchat/hangouts, viber, what's app, Skype and hosted xmpp. I think it will have a chicken and an egg problem unless there's some kind of tool that let's you talk with other older apps and protocols like gchat/hangouts, or maybe this is planned.

Epictek 12y ago
It will most likely not be compatible with anything but Tox itself unless someone makes a bot to bridge between the two. For example there is currently a bot in the groupchat (Syncbot) which is a bridge between Tox and IRC. Bot example here: https://github.com/aitjcize/tox-irc-sync https://github.com/aitjcize/tox-irc-sync More info on the protocol here: https://github.com/irungentoo/toxcore/blob/master/docs/updates/DHT.md https://github.com/irungentoo/toxcore/blob/master/docs/updat...

nmflkjfelkrnfl 12y ago

For those that don't already know, this project comes from 4chan's technology board. While there's a lot of inane trash, there are also some real gems if you're patient enough. I find lots of really cool stuff there that doesn't seem to be anywhere else. More technically-capable people are always welcome to help drown out the inanity. :) http://boards.4chan.org/g/catalog http://boards.4chan.org/g/catalog

shitlord 12y ago
Interesting development: http://boards.4chan.org/g/thread/43340418/its-official-bittorrent-bleep-is-a-tox-clone-done http://boards.4chan.org/g/thread/43340418/its-official-bitto...
- nmflkjfelkrnfl 12y ago
  Ignore all bait threads. Sage all bait threads. Report all bait threads. Hide all bait threads. Don't take the troll bait. ;)
  - gcb0 12y ago
    those "trolls" have a very sane point about having to be an idiot to trust bittorrent, the company.
    - nkjfnbewkjfew 12y ago
      Yes they sure do. I was referring to the OP's "deprecated" meme.

Plexion 12y ago

In the spirit of supporting as many individuals as possible, Tox websites are now accessible as a hidden service via Tor. The hidden service mirror has been stripped of Piwik tracking, and forms of Javascript, and soon we'll label outbound links. i2p support will also follow soon. Tox main site: http://kdzzxucnh4fyovxg.onion/ http://kdzzxucnh4fyovxg.onion/ Tox developer documentation: http://kdzzxucnh4fyovxg.onion/docs/ http://kdzzxucnh4fyovxg.onion/docs/ Tox wiki: http://kdzzxucnh4fyovxg.onion/wiki http://kdzzxucnh4fyovxg.onion/wiki

Aqueous 12y ago

I guess you've settled on a name, pretty completely, but tox evokes all sorts of bad feelings like "Toxin", "Detox" - generally feelings associated with the idea of poison or of poisoning yourself. From a marketing perspective this might not be the least sinister name you could have chosen. I realize this comes out of 4chan and we make a point of not giving a shit about marketing but...

curun1r 12y ago
It seems to be intentional, or at least acknowledged...the name of one of the Mac clients is 'Poison'.
imaginenore 12y ago
I disagree, it sounds like "talks" to me. Pretty cool name actually.
- Byzantine 12y ago
  They intended "Talks" but most people will just associate it with toxicity or toxins. They really need to come up with a better name if they want to succeed.
- threedaymonk 12y ago
  Whether "tox" sounds like "talks" will depend on whether or not your dialect exhibits the cot/caught merger. To those of us without, it sounds very different!
Danieru 12y ago
Also disagree, to me it sounds like Torx the screwdriver bit. It makes me think of a very utilitarian program.
TallboyOne 12y ago
The first thing I thought of was toxic.
- 12y ago

Byzantine 12y ago

What makes the main developer, irungentoo, qualified to write the Tox core?

laikaa 12y ago
He has the time to do it.
- sitkack 12y ago
  We don't want the guy with the most "free time" doing the work.
  - iopq 12y ago
    You're right. Make a better program. I'll be anticipating it, I really want a Skype replacement I can get behind.
    - sitkack 12y ago
      So do I, but Tox isn't it. They should have made the protocol, vetted the protocol and made a PoC implementation in a safe language. Cryptographers and secure protocol designers can't help out if they are noodling along banging out the implementation while designing it.
sitkack 12y ago
Starting a new, blue water distributed encryption system in a non-safe language is odd at this point. The protocol is being _noodled_ through and the code is in C. This is the coding style https://github.com/irungentoo/toxcore/commit/84c28337d248bad2319b5c001108b198dbd6bc5c https://github.com/irungentoo/toxcore/commit/84c28337d248bad... this is openssl all over again https://github.com/irungentoo/toxcore/commit/1d6c3934736c3694a7c9f694d818252e4159cde3 https://github.com/irungentoo/toxcore/commit/1d6c3934736c369...
- deleted 12y ago
  [deleted]

deleted 12y ago

[deleted]

dredmorbius 12y ago

NB: the tox project website is unusable w/o JS enabled. Please fix that. https://tox.im/ https://tox.im/ While we're at it, the rest of the suggestions may be useful: http://www.reddit.com/r/dredmorbius/comments/27d5xr/please_forward_to_marketing_how_to_present_your/ http://www.reddit.com/r/dredmorbius/comments/27d5xr/please_f... From the FAQ, this I like: "The goal of this project is to create a configuration-free P2P Skype replacement. Configuration-free means that the user will simply have to open the program and without any account configuration will be capable of adding people to his or her's friends list and start conversing with them. There are many so-called Skype replacements and all of them are either hard to configure for the normal user or suffer from being way too centralized." A lot. (Emphasis added).

notsecure 12y ago
The website should be completely functional with JS disabled (and it is for me), what issues do you get? Note: I'm not in charge of the tox.im website, if it were up to me there would be no javascript at all.
- dredmorbius 12y ago
  Chromium w/ ScriptSafe installed: no text until I allow the primary domain's JS: http://imgur.com/6xOfCr0 http://imgur.com/6xOfCr0 http://imgur.com/E8WK98R http://imgur.com/E8WK98R
  - dchest 12y ago
    You should probably submit a bug report to ScriptSafe.

sitkack 12y ago

Can you explain why tox is written in C over languages?

veeti 12y ago
Knowing the typical Arch/Gentoo tiling WM 8px console font anime wallpaper mindset on /g/, "bloat".
- volitek 12y ago
  Also for interoperability and portability. Pretty much every language has a way to bind to C code, and pretty much all hardware can run C.
- anon4 12y ago
  You say it like it's not a sign of a good developer who minds all the details. Though I'll admit I use a 16px font.
  - oldmanjay 12y ago
    It's not a reliable sign of a good developer at all, although you'd be hard-pressed to realize that if you're hip deep in the culture.
    - lawl 12y ago
      My experience from interviewing other devs begs to differ. But why have a discussion when you can just ad homiem people? In my experience this shows that people actually care about the tech they work with. Which is a good sign.
      - scott_karana 12y ago
        Caring about tooling doesn't mean you can necessarily use them well, especially when rhetoric becomes codified.
- 12y ago

Quequau 12y ago

Does Tox have plans to offer telephone numbers so that POTS subscribers can call Tox users? If not, I don't see how it can be a replacement for Skype.

richardwhiuk 12y ago
PSTN connectivity requires centralization

spiritplumber 12y ago

This is great! Is there an Android version, and if so, are you OK with me writing a telepresence bot control API for it? (It's just a couple of hooks to a control app, if you're not releaseing source, I can just give you them).

volitek 12y ago
Antox, the android client: https://github.com/Astonex/Antox https://github.com/Astonex/Antox Please do! It's all free and open source.

donniezazen 12y ago

Do you sync messages across various clients? So that I can start chatting on one and move to second or third client.

notsecure 12y ago
Not yet. This is a planned feature but the implementation has not been decided yet because this feature is not exactly compatible with how Tox works and it could cause a lot security issues.

wesley 12y ago

Are group chats also encrypted? (The problem with jabber right now)

Ridley 12y ago
Yes, everything is encrypted from what I can tell.

JoeAltmaier 12y ago

Warning: shameless plug. Sococo has a free replacement for Skype, including doc sharing, chat etc. Been around for years now.

dethstar 12y ago
Sococo doesn't seem to be open source
- JoeAltmaier 12y ago
  Free though. And lots of features.
dethstar 12y ago
Sococo doesn't seem to be open source

Nux 12y ago

So, what is the difference between utox_linux_amd64.tar.xz and Venom from https://repo.tox.im/rpm/ https://repo.tox.im/rpm/ ?

bramd 12y ago

I don't post often on HN, but today couldn't resist. Just tested Utox on Windows as well as Toxy, also on Windows. Both programs are totally inaccessible for people using a screenreader and I'm quite sure as well for people using things like speech recognition. Utox seems to be C++ and a GUI framework I didn't look into. Toxy is .NET+WPF... two different stacks, but two inaccessible programs. I'm quite sure the developers didn't write inaccessible software deliberately, but this makes me wonder if we need either: 1. Inform developers better about accessibility 2. Fix tooling: warn/error if you don't label your elements etc 3. All of the above... To give this post some more context, earlier this week I looked at Stellar... their web client is inaccessible. Earlier this week Wunderlist released a version 3... iOS app is nearly inaccessible. Earlier this week I finally wanted to give Foursquare's new Swarm app a shot... inaccessible. Do you see the pattern? I'm sorry for ranting about this, but imagine some random app update did stop the app from working and only displayed a black screen, you would be annoyed at least.

biomechanica 12y ago
As far as I can tell, uTox is written in C and uses XLib (on GNU/Linux, at least).
kohanz 12y ago
Seems like these would be useful suggestions to add to the respective github pages of those projects. Also, they are open-source, so there's an opportunity there if you have expertise in making UI's accessible.
mahkoh 12y ago
>Utox seems to be C++ and a GUI framework I didn't look into. utox is written in C and uses its own toolkit so that it looks the same everywhere. For that reason it will probably never give you the level of accessibility provided by more mature toolkits.
mind-blight 12y ago
The software is in alpha, so I imagine screen reader accessibility is lower on their priority list. Once it becomes late stage beta, then accessibility complaints are more reasonable. Until then, core features should take precedence.

mpnordland 12y ago

So, This is pretty cool, however, one thing that I noticed: Addresses are per device. Skype lets you have one name and messages and calls come to all your devices, but as far as I see, Tox is one address per device.

biomechanica 12y ago
I remember reading discussion how to address this problem. I can't for the life of me find it, though.
- x1798DE 12y ago
  This is where the original (fairly old) idea is on the wiki: https://wiki.tox.im/Multiple_Devices https://wiki.tox.im/Multiple_Devices Here is a breakdown of the different ways they are considering on how to implement it: https://github.com/Quoturnix/ProjectTox-Core/wiki/Multiple-devices https://github.com/Quoturnix/ProjectTox-Core/wiki/Multiple-d...

throwaway-27677 12y ago

This project has largely disappointed me in many ways. I know HN doesn't care much about software licensing and that kind of stuff, but there are many legal issues behind the project that remain unsolved and have remained unsolved for majority of the project's lifetime. 1. The people behind Tox don't seem to be the copyright holders of their logo as admitted by one of the main developers[1]. The logo is the one also used on their website. 2. Tox project is now attempting to (falsely) claim to be the copyright holders of the logo.[2] Wikimedia Commons deleted the project logo for legal concerns, and to date it remains deleted.[3] There is no concrete proof for Tox's copyright claims on the logos, while there's pretty concrete proof that the project indeed does not hold the copyright on the logos. For those unaware of how our legal system works, "works without license" are considered copyrighted work of the author (e.g. anonymous user on linked /gd/ board). 3. Creative Commons licenses are also incompatible with their choice of software licensing, GPLv3+,[4] which means they cannot legally redistribute current logos under the current licenses with Tox software even if they were copyright holders to those logos.[5] As far as I know, the logos are already being redistributed with the software. 4. The documentation also cannot be legally redistributed with the software, and in theory nobody outside the project has practical freedoms to modify the documentation.[6] "I'm le troll! :-)" was most likely added by the developers. 5. Because of the above mentioned issues, Tox cannot be accepted to Debian GNU/Linux repositories because of DSFG guidelines. 6. The above mentioned issues also create false advertising; "Tox is both free for you to use, and free for you to change. You are completely free to both use and modify Tox."[7] 7. A developer quit the project because of other serious issues in the project.[8][9] The developer criticized the design of DHT (distributed hash table) used to find users, which leaked a lot of data about users. There's a large reddit thread about these DHT issues somewhere too, but I seem to be unable to find it myself right now. Fortunately, the leak was patched a long time ago. Unfortunately, the patch was a large hack which the Tox developers solved by reinventing the wheel and reimplementing Tor onion routing. 8. I haven't verified this (so don't count on me), but the Tox core (or core + clients?) is now ~100k lines of code. It's not entirely lightweight per se, which was one of the initial goals as far as I remember. 9. Another minor thing that upset me was that during Tox's conference talk (forgot which conference, but it was related to YouBrokeTheInternet), the speaker forgot to introduce himself and what he was doing. This probably led to some confusion. 10. Possibly controversial too, but the first radio talk show Tox was introduced in was... could I say, maybe slightly cringeworthy. Or something. See it for yourself.[10] Sorry if I went a little bit too political, knowing the rules. I wanted to point out these issues to let you know how everyone involved in the project can be a help. [1]: https://rbt.asia/g/thread/40445107#p40449131 https://rbt.asia/g/thread/40445107#p40449131 - you can scroll down and read the replies too [2]: https://commons.wikimedia.org/wiki/Commons:Deletion_requests/File:Tox_logo.svg https://commons.wikimedia.org/wiki/Commons:Deletion_requests... [3]: https://commons.wikimedia.org/wiki/Commons:Undeletion_requests/Archive/2014-03#File:Tox_logo.svg https://commons.wikimedia.org/wiki/Commons:Undeletion_reques... [4]: https://github.com/irungentoo/toxcore/blob/master/COPYING https://github.com/irungentoo/toxcore/blob/master/COPYING [5]: https://www.gnu.org/licenses/license-list.html#ccbysa https://www.gnu.org/licenses/license-list.html#ccbysa [6]: https://github.com/Tox/Docs/issues/7 https://github.com/Tox/Docs/issues/7 [7]: https://tox.im/ https://tox.im/ [8]: http://www.tox-chat.com/2013/08/tox-developer-fed-up-quits.html http://www.tox-chat.com/2013/08/tox-developer-fed-up-quits.h... [9]: https://github.com/irungentoo/toxcore/issues/493 https://github.com/irungentoo/toxcore/issues/493 [10]: https://www.youtube.com/watch?v=IdR3SVcBbq0 https://www.youtube.com/watch?v=IdR3SVcBbq0 Disclaimer: I'm not the author of any of the links above. It's what I have gathered from numerous discussion threads Tox has had on 4chan.

aagha 12y ago

So why this when there's Hangouts?

kazagistar 12y ago
Cause it binds you to a particular company, protocol, etc. This is open source, and does not create a single point of monitoring.

notsobrightkid 12y ago

can someone please explain in easy to understand how alice and bob find each other with temporary public keys in the DHT? I read this (https://github.com/irungentoo/toxcore/blob/master/docs/Prevent_Tracking.txt https://github.com/irungentoo/toxcore/blob/master/docs/Preve...) but I still can't picture it (the wording isn't the greatest either). Thanks!!

lwh 12y ago

How does it differ from Retroshare? http://retroshare.sourceforge.net/ http://retroshare.sourceforge.net/