5 ms·
I would use Tox and any of its clients with caution. At one point in time, your friends would be able to execute arbitrary shell commands on your PC if you were
by astonex 11y ago
I would use Tox and any of its clients with caution. At one point in time, your friends would be able to execute arbitrary shell commands on your PC if you were running utox and accepted a file download. Even with large security concerns like this, the lead developer believes Tox and uTox is secure because he reads the code he wrote himself (none the less git history is filled with bug fixes he clearly missed in his reading). This isn't exactly reassuring, especially coming from someone who doesn't have provable past experience in security software.
Edit: I just got banned from their IRC for stating this opinion here.
- stal 11y agoStill sour you got rejected for Summer of Code?
- RottenHuman 11y agoAnd your opinion is based on what? What you just said is true for any software. Any reason why you pick out tox in particular?
- rgovostes 11y agoThe comment you replied to seems to be a fairly specific and verifiable criticism of uTox, which, like all security software, deserves to have its claims approached with skepticism.
- tux3 11y ago>I would use Tox and any of its clients with caution. It's hard to argue with that given that Tox is still in alpha, and this is generally a good idea for any software you use if you have reasons to believe that an adversary is trying to exploit your computer.
- Jfreegman 11y agouTox was not originally written by the main toxcore dev. However he and a few other brave volunteers have made a big effort to clean up uTox's code over the past few months. That's why this thread was created now and not 6 months ago.
- nickpsecurity 11y agoThat last part is enough to ditch them unless you were fighting with them in IRC. Were you? Your claims ring true for vast majority of new, COMSEC schemes. Far as Tox, this is what I found on their GitHub page: "Current build status: build failing." I'll add that NSA and malware authors have 0-days on the platforms the tool will likely run on. It will be bypassed like all others on such platforms.
- astonex 11y agoI was just idling on their channel when irungentoo got me banned for my post here.
- nickpsecurity 11y agoYeah, that's quite questionable. They need to be able to handle and defend criticism better if they want to make it in INFOSEC. Especially if they ever get press like Cryptocat or Diaspora did.
- deleted 11y ago[deleted]
- Jfreegman 11y agoAstonex was never banned from any of the public tox IRC channels. He was banned from an invite-only channel for off-topic discussion because he was trolling. The ban did not last very long either, because most of us still like him despite his attempts to create drama. Everyone has their off days.
- nickpsecurity 11y agoAlways good to hear both sides. I reserve judgment until I do. In this case, I'm just going to say "Ok" and be neutral. I like the line you added at the end: quite fair.
- lawl 11y agoNot saying your lying or anything. But if you make accusations like that you should probably back them up with a chat log.