7 ms·

Toxic – A distributed, secure, command-line based instant messenging client

127 points by Jfreegman 12y ago

ex-contributor 12y ago
One of the links I posted above "mysteriously" disappeared. I have an archived version though. It's one of the key-points of the situation I exposed, so it's worth a read. https://archive.today/Y6LEw https://archive.today/Y6LEw
- urras 12y ago
  Yeah, I deleted that Gist because you're using it out of context. I've talked with you one-on-one, and I've asked you to stop pasting it wherever someone mentions Tox.
- exposing 12y ago
  HIGHLIGHTS irungentoo: tox main developer, head of the Tox Foundation NikolaiToryzin (stqism): second in command, run the Tox Foundation's monetary operation The rest are other developers on the #tox-secret channel. TRACKING PROPLEX, AN EX-MEMBER OF THE TOX FOUNDATION, ONLINE ACTIVITY THROUGH HIS UA: irungentoo prolapses phone seems to have a unique user agent NikolaiToryzin If you tell me it I can make tox.im return stuff to him only irungentoo 'Mozilla/5.0 (Linux; Android 4.4.2; SM-N900V Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.69 Mobile Safari/537.36' NikolaiToryzin That'll be fun READING HIS PRIVATE EMAIL: irungentoo basically proplex did an email request change on his digital ocean account which means an email containing his ip got sent to david@tox.im which ended up in the catch all email urras irungentoo: Any interesting emails? irungentoo urras, if you want to forcefully gain access to his digital ocean account I can reset his pass [...] NikolaiToryzin But they want his personal info urras How do you guys know NikolaiToryzin Emails. irungentoo comparing himself to the NSA: irungentoo I feel like the NSA irungentoo tracking people across ips even without cookies is so easy irungentoo https://mail.tox.im/prolapse.txt https://mail.tox.im/prolapse.txt [link now unavailable, but I archived it https://archive.today/KkSWp https://archive.today/KkSWp ] irungentoo why would I want to go after terrorists? irungentoo blackmailing people with power is much more lucrative TRACKING AN EX-DEVELOPER AGAIN: irungentoo 173.52.122.131 - - [13/Jan/2015:00:33:01 -0500] "GET /User:Proplex HTTP/1.1" 404 3656 "https://github.com/Tox/Tox-Website" https://github.com/Tox/Tox-Website" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" irungentoo interesting irungentoo I like how he checked if the wiki was up: 96.250.8.105 - - [20/Dec/2014:02:12:30 -0500] "GET / HTTP/1.1" 301 5 "https://tox.im/" https://tox.im/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" irungentoo you really don't need cookies to track people online.
task_queue 12y ago
Make it worthwhile for someone to test how 'secure' this system is before touting that title. An audit or a bounty with no limitations on rendering the system insecure. An example of how not to do this would be the Telegram contest sham.
- superuser2 12y ago
  Contests/bounties are not indicative of security because it is very likely that potential profits from selling or using an exploit are greater than the bounty offered.
rasengan 12y ago
It's not really command-line since it relies on ncurses. I thought it was something different like where you're literally sitting at the command-line within some short of shell like: toxuser@toxbox:~$ tox send pg "Hi, YC looks cool!" Or maybe even crazier like that Zero project thing (I forget what it is called). That said, good stuff. :)
- Jfreegman 12y ago
  True, but I figure it's close enough. There is a true CLI client for Tox called Ratox. It's pretty neat. https://wiki.tox.im/Ratox https://wiki.tox.im/Ratox
  - SeanQ 12y ago
    raTox is a actually really fun to use, but it's less of a client and more of a command line tool in a bash script.
simlevesque 12y ago
Is Tox secure ? Compared to tinfoil chat
- Jfreegman 12y ago
  Tox is DHT/P2P based which means it does not rely on any type of centralized authority, and all traffic is encrypted using the sodium crypto library (https://github.com/jedisct1/libsodium https://github.com/jedisct1/libsodium). Full disclosure: Tox has not yet been professionally audited.
- ex-contributor 12y ago
  Tox still hasn't solved the serious metadata leakage issue. They tried to cover it up by adding onion-routing for friend requests, but ACTUAL MESSAGES are still done directly. Strong adversaries such as your ISP and agencies like the NSA, the GCHQ, etc. can still collect metadata about your conversations. The "Tox Foundation" tries to cover this up and pretend that "tox was never meant to be anonymous", but the truth is harsh. Now, this wouldn't be a problem if the Tox Foundation made this issue clear to its users. This is how P2P works, after all, direct connections, and that's fine. But the problem is that Tox doesn't make that obvious for non-tech-savvy users. When they read on the website that they are completely safe from the NSA and whatnot, they won't expect to be in any way exposed. Still, unless these non-tech-savvy users "route all incoming and outgoing traffic through Tor" they won't be completely safe and should be worried about metadata leakage and adding people they don't actually know. But such a thing isn't made clear and Tox deceives users this way, only to get more people using it. It's unethical and outright wrong, in my personal opinion.
  - urras 12y ago
    Again, don't listen to this guy. He just copies and pastes this stuff from 4chan.
    - veeti 12y ago
      So what? It's a completely valid point.
nkantar 12y ago
Is anyone actually using this (or something like it)? If so, I'm curious about the details like context and experience.
PhearTheCeal 12y ago
Also relevant, and containing video and audio chat support, is uTox[0] and qTox[1]. Looks like they are currently working on getting group video chat working. [0] http://utox.org/ http://utox.org/ [1] http://utoxisfinished.info/ http://utoxisfinished.info/
ssalenik 12y ago
The home page[0] seems to suggest that there are also audio and video capable clients... are they still in development, or is there something functional already? [0] - https://tox.im/ https://tox.im/
- Jfreegman 12y ago
  Toxic has 1 on 1 audio chats, and GUI clients such as uTox and qTox additionally have group audio, as well as 1 on 1 video. Both clients are usable, though I would personally recommend qTox.
benwaffle 12y ago
core C lib: https://github.com/irungentoo/toxcore https://github.com/irungentoo/toxcore Qt client: https://github.com/tux3/qTox https://github.com/tux3/qTox ncurses client: https://github.com/Tox/toxic https://github.com/Tox/toxic metro/windows client: https://github.com/Reverp/Toxy https://github.com/Reverp/Toxy plain C client (uses xlib/win32 to draw the UI): https://github.com/notsecure/uTox https://github.com/notsecure/uTox racket client: https://github.com/lehitoskin/blight https://github.com/lehitoskin/blight there's also java bindings: https://github.com/sonOfRa/tox4j https://github.com/sonOfRa/tox4j etc...
ex-contributor 12y ago
DISCLAIMER: I am one of the many Tox ex-contributors, who used to work on it in the past. I don't want to be identified due to harassment other ex-contributors suffered in the past. The following message is my point of view on the project as a whole. Proplex, a long-time member of the Tox-Foundation and in charge of both infrastructure and marketing, called out tox devs because the 2 people in charge (irungentoo and stqism) were dealing with money in a shady way and he got suspicious. This lead him to leaving the Tox Foundation Proof: https://gist.github.com/irungentoo/5af26f5edefcdb7eac72 https://gist.github.com/irungentoo/5af26f5edefcdb7eac72 After he went away and stopped to pay for the website and other servers (he hosted everything), Tox devs got angry and tracked his online activity by his browser UA, read his private email sent to his @tox.im address and considered breaking into his VPS account Proof: https://gist.github.com/urras/ba792274f5aaf662a082/5d91d2a780b38e015cd4dc331eb68038f09f5c2f https://gist.github.com/urras/ba792274f5aaf662a082/5d91d2a78... and https://archive.today/KkSWp https://archive.today/KkSWp Members of the Tox Foundation such as stqism try constantly to sneak in copyright changes in unrelated fixes: Proof: https://github.com/irungentoo/toxcore/pull/1219 https://github.com/irungentoo/toxcore/pull/1219 and https://github.com/irungentoo/toxcore/pull/1224 https://github.com/irungentoo/toxcore/pull/1224 irungentoo enforced censorship on his github repo to try to cover everything up Proof: https://github.com/irungentoo/toxcore/issues/1227 https://github.com/irungentoo/toxcore/issues/1227 After it got out of hand and too many people called out the Tox Foundation, this happened: Proof: http://a.pomf.se/kqwgsg.png http://a.pomf.se/kqwgsg.png irungentoo claims Tox is secure just because he uses a secure primitive, which is really arrogant and something only a pretentious deceiver would say. This is a crypto 101 mistake. Proof: https://github.com/irungentoo/toxcore/issues/121#issuecomment-35750212 https://github.com/irungentoo/toxcore/issues/121#issuecommen... After the points exposed above, the conclusion is obvious, at least for me. The Tox Foundation claims Tox is completely secure and nobody can break in, not even the NSA. Still, there's been no security audit and it is highly likely Tox isn't completely secure, given it's alpha software. But their website gives the idea people face no risk by using Tox right now. They are deceiving people to believe it is secure so they gain more users at the expense of putting users privacy at risk. Proof: https://tox.im https://tox.im itself. See all security claims even though it hasn't been audited. Saying it's "alpha" doesn't mean to anything to non-tech-savvy, they will think it's missing a feature or two, not that their privacy and security is possibly compromised. I believe it's my moral obligation, and of everyone's else reading this, not to use Tox. You are contributing to a shady foundation composed of menchildren that don't care about other's privacy, deals with money in a shady way and dox people who go against them. Do not trust the Tox Foundation - this is my personal message.
plutooo 12y ago
tox does not attempt to hide your ip. Every single friend you have added has your ip. This is by design.
- Jfreegman 12y ago
  That's partially true. However if you force TCP connections (in Toxic this is done with the -t flag) your IP is effectively hidden from your contacts because all your traffic gets relayed by TCP nodes in the network. The downside is that forced TCP connections are slower and less reliable. Though to be properly anonymous you would need to run it through Tor: https://wiki.tox.im/Tox_over_Tor_(ToT) https://wiki.tox.im/Tox_over_Tor_(ToT) The reason Tox doesn't have built in anonymity is because strong anonymity has a massive impact on quality (especially streaming data like audio/video). Our goal is to steal normal (non-paranoid) users from Skype and get everyone and their mother using strong encryption. In order to achieve that we need to have comparable quality rather than something that feels like you're using a 28.8k modem. And again, anyone who actually wants anonymity still has that option.
  - platz 12y ago
    If broad adoption is truly your goal you have a branding problem. Normal people will not use a tool called 'toxic' which prints crazy ASCII letters in the command line. You might as well ask soccer moms to hold the line at occupy wall street.
    - lappa 12y ago
      Are you aware that there are a myriad of clients available?
    - Jfreegman 12y ago
      Toxic is just one of many clients that are built ontop of Tox. Some clients fill a niche, others (like qTox) are meant for widespread adoption.
plutooo 12y ago
tox does not attempt to hide your ip. Every single friend you have added has your ip. This is by design. So make sure you trust your friends..
synchronise 12y ago
So how does this differ to Retroshare or Ricochet?
jbangert 12y ago
My one experience with the Tox project was that I made a few (I thought) constructive suggestions. First, I suggested they use some form of static analysis or perhaps a 'safer' language to implement their core functionality - such as Rust or Go, instead of rather messy (at the time) C code. Furthermore, having spent a lot of time researching parsers and how parser differentials can affect the security of systems, I suggested they use some tools, such as protocol buffers, to eliminate handwritten parsing code. The response I got was rather disheartening and downright hostile - it boiled down to the fact that protocol buffers involves C++ code which they are a priori against, without actually engaging in a factual argument (I wrote an article in the current USENIX login/ last years OSDI about parsers for binary protocols for anyone interested in background: https://www.usenix.org/system/files/conference/osdi14/osdi14-paper-bangert.pdf https://www.usenix.org/system/files/conference/osdi14/osdi14... and github.com/jbangert/nail)
- dethstar 12y ago
  There was a tox-core rewrite in Rust[1], but it's been abandoned. According to the author until Tox gets proper doc. https://github.com/mahkoh/Xot https://github.com/mahkoh/Xot
- stingraycharles 12y ago
  Our of interest, could you share the url to the discussion?
  - jbangert 12y ago
    https://github.com/irungentoo/toxcore/issues/137 https://github.com/irungentoo/toxcore/issues/137
    - mplewis 12y ago
      They wrote their own parser and think it's more secure than Google-backed protobufs? That's unbelievable.
    - kevan 12y ago
AgentME 12y ago
Can Tox do persistent group text chats with offline message delivery to people when they sign in again? It's the one killer feature of Skype that keeps me on it. No open messaging programs ever support this it seems like.
- Jfreegman 12y ago
  Currently no, but there is a groupchat rewrite underway and that is one of the planned improvements.
  - hammerandtongs 12y ago
    I look forward to this. I have to echo the parent though, getting history from the period you were disconnected is a killer feature of skype that seems to get little or no attention. It is one of the major things that keeps some of my group chats on skype.
    - colechristensen 12y ago
      You might be interested in trying Slack, then.
exposing 12y ago
If you use a secure crypto primitive, is it correct to say your program is secure? I mean, can you be sure something is secure just because of the crypto lib? I thought there had something to do with the implementation too? I ask this because of Tox. The main developer claims Tox is secure because of the crypto library. It sounds weird to me, so I decided to ask... After all, if it was this easy all programs would be secure, right? Just import a secure crypto lib and it's done? Sounds weird. https://github.com/irungentoo/toxcore/issues/121#issuecomment-35750212 https://github.com/irungentoo/toxcore/issues/121#issuecommen...
- jimktrains2 12y ago
  Having a sound library removes a whole host of issues; however, it doesn't remove all of them. First and second among many are key management and concatenating values before hashing or signing.
- detaro 12y ago
  No, you didn't decide to ask, you take a lot of redirections and bullshitting to point out your link. Which is an interesting contribution, but the way you deliver it is really bad style and annoying.
- tox-exposed 12y ago
  I agree, the main developer has no clue what he is doing.
EGreg 12y ago
Why'd they call it by such a negative moniker?
tox-exposed 12y ago
Tox is made by pedophiles. Why would the Top Foundation spend so much time making Tox? A secure, encrypted messenger. There is only one reason!!!
Pxtl 12y ago
Is this at all related to Nullsoft Waste? That was quite a scandal when it launched with a "whoops we didn't mean to open-source that" thing. It was a crypto-IM too.
dang 12y ago
We've closed this thread to noob accounts (except the submitter) because of troll activity.
- zaroth 12y ago
  Not a moment too soon. :-/ Looking at some of these [flagkilled] comments... all I can say is... it sure makes me happy to be a part of the HN community and that we have a place which is largely free of that "nonsense" (a much too overly nice way to describe it)
juliangoldsmith 12y ago
I hadn't looked much into Tox, but after seeing a few mentions on cyberpunk boards, and seeing how hard people are shilling against it, I think I'm going to take a closer look.

127 points by Jfreegman 12y ago

One of the links I posted above "mysteriously" disappeared. I have an archived version though. It's one of the key-points of the situation I exposed, so it's worth a read. https://archive.today/Y6LEw https://archive.today/Y6LEw

urras 12y ago
Yeah, I deleted that Gist because you're using it out of context. I've talked with you one-on-one, and I've asked you to stop pasting it wherever someone mentions Tox.
exposing 12y ago
HIGHLIGHTS irungentoo: tox main developer, head of the Tox Foundation NikolaiToryzin (stqism): second in command, run the Tox Foundation's monetary operation The rest are other developers on the #tox-secret channel. TRACKING PROPLEX, AN EX-MEMBER OF THE TOX FOUNDATION, ONLINE ACTIVITY THROUGH HIS UA: irungentoo prolapses phone seems to have a unique user agent NikolaiToryzin If you tell me it I can make tox.im return stuff to him only irungentoo 'Mozilla/5.0 (Linux; Android 4.4.2; SM-N900V Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.69 Mobile Safari/537.36' NikolaiToryzin That'll be fun READING HIS PRIVATE EMAIL: irungentoo basically proplex did an email request change on his digital ocean account which means an email containing his ip got sent to david@tox.im which ended up in the catch all email urras irungentoo: Any interesting emails? irungentoo urras, if you want to forcefully gain access to his digital ocean account I can reset his pass [...] NikolaiToryzin But they want his personal info urras How do you guys know NikolaiToryzin Emails. irungentoo comparing himself to the NSA: irungentoo I feel like the NSA irungentoo tracking people across ips even without cookies is so easy irungentoo https://mail.tox.im/prolapse.txt https://mail.tox.im/prolapse.txt [link now unavailable, but I archived it https://archive.today/KkSWp https://archive.today/KkSWp ] irungentoo why would I want to go after terrorists? irungentoo blackmailing people with power is much more lucrative TRACKING AN EX-DEVELOPER AGAIN: irungentoo 173.52.122.131 - - [13/Jan/2015:00:33:01 -0500] "GET /User:Proplex HTTP/1.1" 404 3656 "https://github.com/Tox/Tox-Website" https://github.com/Tox/Tox-Website" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" irungentoo interesting irungentoo I like how he checked if the wiki was up: 96.250.8.105 - - [20/Dec/2014:02:12:30 -0500] "GET / HTTP/1.1" 301 5 "https://tox.im/" https://tox.im/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" irungentoo you really don't need cookies to track people online.

task_queue 12y ago

Make it worthwhile for someone to test how 'secure' this system is before touting that title. An audit or a bounty with no limitations on rendering the system insecure. An example of how not to do this would be the Telegram contest sham.

superuser2 12y ago
Contests/bounties are not indicative of security because it is very likely that potential profits from selling or using an exploit are greater than the bounty offered.

rasengan 12y ago

It's not really command-line since it relies on ncurses. I thought it was something different like where you're literally sitting at the command-line within some short of shell like: toxuser@toxbox:~$ tox send pg "Hi, YC looks cool!" Or maybe even crazier like that Zero project thing (I forget what it is called). That said, good stuff. :)

Jfreegman 12y ago
True, but I figure it's close enough. There is a true CLI client for Tox called Ratox. It's pretty neat. https://wiki.tox.im/Ratox https://wiki.tox.im/Ratox
- SeanQ 12y ago
  raTox is a actually really fun to use, but it's less of a client and more of a command line tool in a bash script.

simlevesque 12y ago

Is Tox secure ? Compared to tinfoil chat

Jfreegman 12y ago
Tox is DHT/P2P based which means it does not rely on any type of centralized authority, and all traffic is encrypted using the sodium crypto library (https://github.com/jedisct1/libsodium https://github.com/jedisct1/libsodium). Full disclosure: Tox has not yet been professionally audited.
ex-contributor 12y ago
Tox still hasn't solved the serious metadata leakage issue. They tried to cover it up by adding onion-routing for friend requests, but ACTUAL MESSAGES are still done directly. Strong adversaries such as your ISP and agencies like the NSA, the GCHQ, etc. can still collect metadata about your conversations. The "Tox Foundation" tries to cover this up and pretend that "tox was never meant to be anonymous", but the truth is harsh. Now, this wouldn't be a problem if the Tox Foundation made this issue clear to its users. This is how P2P works, after all, direct connections, and that's fine. But the problem is that Tox doesn't make that obvious for non-tech-savvy users. When they read on the website that they are completely safe from the NSA and whatnot, they won't expect to be in any way exposed. Still, unless these non-tech-savvy users "route all incoming and outgoing traffic through Tor" they won't be completely safe and should be worried about metadata leakage and adding people they don't actually know. But such a thing isn't made clear and Tox deceives users this way, only to get more people using it. It's unethical and outright wrong, in my personal opinion.
- urras 12y ago
  Again, don't listen to this guy. He just copies and pastes this stuff from 4chan.
  - veeti 12y ago
    So what? It's a completely valid point.

nkantar 12y ago

Is anyone actually using this (or something like it)? If so, I'm curious about the details like context and experience.

PhearTheCeal 12y ago

Also relevant, and containing video and audio chat support, is uTox[0] and qTox[1]. Looks like they are currently working on getting group video chat working. [0] http://utox.org/ http://utox.org/ [1] http://utoxisfinished.info/ http://utoxisfinished.info/

ssalenik 12y ago

The home page[0] seems to suggest that there are also audio and video capable clients... are they still in development, or is there something functional already? [0] - https://tox.im/ https://tox.im/

Jfreegman 12y ago
Toxic has 1 on 1 audio chats, and GUI clients such as uTox and qTox additionally have group audio, as well as 1 on 1 video. Both clients are usable, though I would personally recommend qTox.

benwaffle 12y ago

core C lib: https://github.com/irungentoo/toxcore https://github.com/irungentoo/toxcore Qt client: https://github.com/tux3/qTox https://github.com/tux3/qTox ncurses client: https://github.com/Tox/toxic https://github.com/Tox/toxic metro/windows client: https://github.com/Reverp/Toxy https://github.com/Reverp/Toxy plain C client (uses xlib/win32 to draw the UI): https://github.com/notsecure/uTox https://github.com/notsecure/uTox racket client: https://github.com/lehitoskin/blight https://github.com/lehitoskin/blight there's also java bindings: https://github.com/sonOfRa/tox4j https://github.com/sonOfRa/tox4j etc...

ex-contributor 12y ago

DISCLAIMER: I am one of the many Tox ex-contributors, who used to work on it in the past. I don't want to be identified due to harassment other ex-contributors suffered in the past. The following message is my point of view on the project as a whole. Proplex, a long-time member of the Tox-Foundation and in charge of both infrastructure and marketing, called out tox devs because the 2 people in charge (irungentoo and stqism) were dealing with money in a shady way and he got suspicious. This lead him to leaving the Tox Foundation Proof: https://gist.github.com/irungentoo/5af26f5edefcdb7eac72 https://gist.github.com/irungentoo/5af26f5edefcdb7eac72 After he went away and stopped to pay for the website and other servers (he hosted everything), Tox devs got angry and tracked his online activity by his browser UA, read his private email sent to his @tox.im address and considered breaking into his VPS account Proof: https://gist.github.com/urras/ba792274f5aaf662a082/5d91d2a780b38e015cd4dc331eb68038f09f5c2f https://gist.github.com/urras/ba792274f5aaf662a082/5d91d2a78... and https://archive.today/KkSWp https://archive.today/KkSWp Members of the Tox Foundation such as stqism try constantly to sneak in copyright changes in unrelated fixes: Proof: https://github.com/irungentoo/toxcore/pull/1219 https://github.com/irungentoo/toxcore/pull/1219 and https://github.com/irungentoo/toxcore/pull/1224 https://github.com/irungentoo/toxcore/pull/1224 irungentoo enforced censorship on his github repo to try to cover everything up Proof: https://github.com/irungentoo/toxcore/issues/1227 https://github.com/irungentoo/toxcore/issues/1227 After it got out of hand and too many people called out the Tox Foundation, this happened: Proof: http://a.pomf.se/kqwgsg.png http://a.pomf.se/kqwgsg.png irungentoo claims Tox is secure just because he uses a secure primitive, which is really arrogant and something only a pretentious deceiver would say. This is a crypto 101 mistake. Proof: https://github.com/irungentoo/toxcore/issues/121#issuecomment-35750212 https://github.com/irungentoo/toxcore/issues/121#issuecommen... After the points exposed above, the conclusion is obvious, at least for me. The Tox Foundation claims Tox is completely secure and nobody can break in, not even the NSA. Still, there's been no security audit and it is highly likely Tox isn't completely secure, given it's alpha software. But their website gives the idea people face no risk by using Tox right now. They are deceiving people to believe it is secure so they gain more users at the expense of putting users privacy at risk. Proof: https://tox.im https://tox.im itself. See all security claims even though it hasn't been audited. Saying it's "alpha" doesn't mean to anything to non-tech-savvy, they will think it's missing a feature or two, not that their privacy and security is possibly compromised. I believe it's my moral obligation, and of everyone's else reading this, not to use Tox. You are contributing to a shady foundation composed of menchildren that don't care about other's privacy, deals with money in a shady way and dox people who go against them. Do not trust the Tox Foundation - this is my personal message.

plutooo 12y ago

tox does not attempt to hide your ip. Every single friend you have added has your ip. This is by design.

Jfreegman 12y ago
That's partially true. However if you force TCP connections (in Toxic this is done with the -t flag) your IP is effectively hidden from your contacts because all your traffic gets relayed by TCP nodes in the network. The downside is that forced TCP connections are slower and less reliable. Though to be properly anonymous you would need to run it through Tor: https://wiki.tox.im/Tox_over_Tor_(ToT) https://wiki.tox.im/Tox_over_Tor_(ToT) The reason Tox doesn't have built in anonymity is because strong anonymity has a massive impact on quality (especially streaming data like audio/video). Our goal is to steal normal (non-paranoid) users from Skype and get everyone and their mother using strong encryption. In order to achieve that we need to have comparable quality rather than something that feels like you're using a 28.8k modem. And again, anyone who actually wants anonymity still has that option.
- platz 12y ago
  If broad adoption is truly your goal you have a branding problem. Normal people will not use a tool called 'toxic' which prints crazy ASCII letters in the command line. You might as well ask soccer moms to hold the line at occupy wall street.
  - lappa 12y ago
    Are you aware that there are a myriad of clients available?
  - Jfreegman 12y ago
    Toxic is just one of many clients that are built ontop of Tox. Some clients fill a niche, others (like qTox) are meant for widespread adoption.

plutooo 12y ago

tox does not attempt to hide your ip. Every single friend you have added has your ip. This is by design. So make sure you trust your friends..

synchronise 12y ago

So how does this differ to Retroshare or Ricochet?

jbangert 12y ago

My one experience with the Tox project was that I made a few (I thought) constructive suggestions. First, I suggested they use some form of static analysis or perhaps a 'safer' language to implement their core functionality - such as Rust or Go, instead of rather messy (at the time) C code. Furthermore, having spent a lot of time researching parsers and how parser differentials can affect the security of systems, I suggested they use some tools, such as protocol buffers, to eliminate handwritten parsing code. The response I got was rather disheartening and downright hostile - it boiled down to the fact that protocol buffers involves C++ code which they are a priori against, without actually engaging in a factual argument (I wrote an article in the current USENIX login/ last years OSDI about parsers for binary protocols for anyone interested in background: https://www.usenix.org/system/files/conference/osdi14/osdi14-paper-bangert.pdf https://www.usenix.org/system/files/conference/osdi14/osdi14... and github.com/jbangert/nail)

dethstar 12y ago
There was a tox-core rewrite in Rust[1], but it's been abandoned. According to the author until Tox gets proper doc. https://github.com/mahkoh/Xot https://github.com/mahkoh/Xot
stingraycharles 12y ago
Our of interest, could you share the url to the discussion?
- jbangert 12y ago
  https://github.com/irungentoo/toxcore/issues/137 https://github.com/irungentoo/toxcore/issues/137
  - mplewis 12y ago
    They wrote their own parser and think it's more secure than Google-backed protobufs? That's unbelievable.
  - kevan 12y ago

AgentME 12y ago

Can Tox do persistent group text chats with offline message delivery to people when they sign in again? It's the one killer feature of Skype that keeps me on it. No open messaging programs ever support this it seems like.

Jfreegman 12y ago
Currently no, but there is a groupchat rewrite underway and that is one of the planned improvements.
- hammerandtongs 12y ago
  I look forward to this. I have to echo the parent though, getting history from the period you were disconnected is a killer feature of skype that seems to get little or no attention. It is one of the major things that keeps some of my group chats on skype.
  - colechristensen 12y ago
    You might be interested in trying Slack, then.

exposing 12y ago

If you use a secure crypto primitive, is it correct to say your program is secure? I mean, can you be sure something is secure just because of the crypto lib? I thought there had something to do with the implementation too? I ask this because of Tox. The main developer claims Tox is secure because of the crypto library. It sounds weird to me, so I decided to ask... After all, if it was this easy all programs would be secure, right? Just import a secure crypto lib and it's done? Sounds weird. https://github.com/irungentoo/toxcore/issues/121#issuecomment-35750212 https://github.com/irungentoo/toxcore/issues/121#issuecommen...

jimktrains2 12y ago
Having a sound library removes a whole host of issues; however, it doesn't remove all of them. First and second among many are key management and concatenating values before hashing or signing.
detaro 12y ago
No, you didn't decide to ask, you take a lot of redirections and bullshitting to point out your link. Which is an interesting contribution, but the way you deliver it is really bad style and annoying.
tox-exposed 12y ago
I agree, the main developer has no clue what he is doing.

EGreg 12y ago

Why'd they call it by such a negative moniker?

tox-exposed 12y ago

Tox is made by pedophiles. Why would the Top Foundation spend so much time making Tox? A secure, encrypted messenger. There is only one reason!!!

Pxtl 12y ago

Is this at all related to Nullsoft Waste? That was quite a scandal when it launched with a "whoops we didn't mean to open-source that" thing. It was a crypto-IM too.

dang 12y ago

We've closed this thread to noob accounts (except the submitter) because of troll activity.

zaroth 12y ago
Not a moment too soon. :-/ Looking at some of these [flagkilled] comments... all I can say is... it sure makes me happy to be a part of the HN community and that we have a place which is largely free of that "nonsense" (a much too overly nice way to describe it)

juliangoldsmith 12y ago

I hadn't looked much into Tox, but after seeing a few mentions on cyberpunk boards, and seeing how hard people are shilling against it, I think I'm going to take a closer look.