Hacker News Reader

Comment by aasasd | Hacker News Reader

Still no audit, right? Just “trust us, it's secure”. And afaik the authors don't have particular expertise in security.

Edit: also, “it's secure, we use Nacl”: https://github.com/irungentoo/toxcore/issues/121

Nope, we still can't afford the price tag on an audit. Perhaps I'm jaded or biased because I'm a former Tox dev, but Tox is the only encrypted messenger I'd actually trust. I consider myself to be pretty good a security, but that's just me and you shouldn't take anyone's word for it themselves. That said if you have an actual cause reason to be concerned, I'd be interest in hearing it?

This is not meant to be passive aggressive but it's going to sound like it is; how much would an audit actually cost? If someone set up a GoFundMe for a Tox audit, I would definitely contribute ten bucks to make that happen.

I don't think it's passive aggressive at all. I'm a bit embarrassed to say, but I honestly don't remember. My best guess from what I do remember the last time it was discussed, was in the 2k to 10k range. But it could expand rapidly depending on who, and what level we actually hired someone at. The primary reason we didn't set up crowdfunding ourselves was there was a few important changes we wanted to make a decision on and implement first. I still don't think they've been made, but I'm not following super close anymore.

Even if we go on the higher end of that, 10 grand doesn't seem that high for an audience of engineers (which I think is overrepresented on Hacker News). I know people have been complaining about a lack of a security audit since 2016; I think at this point it would be worth doing an audit now, and potentially another audit when new features are added.

If I were in any way involved in the project I would set up the campaign myself, but sadly I don't know enough C to be useful to a project like this (unless there was a plan to rewrite it in some esoteric functional language for some reason).

you might want to reach out to zugz (via our IRC, or github), He's also a fan of esoteric functional, so you might be able to convince him to start one. Iphy has a repo with the start of a Haskell implementation as proof of the completeness of the spec. No idea what the stat of that is, but again, might be worth reaching out :)

Most of the users of Tox don't want to be identified, so it's a bit difficult to crowd fund such a thing.

The Open Technology Fund provides free security audits for open source projects.

Apply here: https://apply.opentech.fund/red-team-lab/

In regards to the linked issue; I wouldn't trust the security of a team that says shit like that.

I mean, it's open source, so you can audit it. https://github.com/qTox/qTox.

Then you can build the client yourself and check the sha sum against any downloaded distribution.

> it's open source, so you can audit it

Programming languages exist, so you can make your own decentralized encrypted instant messaging app.

There is democracy, so you can be the president.

Everyone in the family has legs, so we won't need a car.

Onelogin was audited, and they had a security breach a year later.

Intuit, also audited.

Twitch? They have had audits done.

So, you can continue to sit here on hacker news and bitch that it "hasn't been audited" and therefor you aren't "free", or some shit. But either way, you sound like jackass that knows nothing about technology or freedom.

Freedom is not synonymous with "free", as in not having a cost.

You are not going to program anything without working for it. You are not going to be president without working for it. You are not going to have a car, without working for it.

So, yes, you can audit it and then you will have an audited message platform.

Reply on news.ycombinator.com