Hacker News Reader

So one thing is that this by default uses a specific public relay server to setup the handshake. So there’s a little mitm by default.

magic-wormhole (which croc was inspired by) also uses a public relay server: https://magic-wormhole.readthedocs.io/en/latest/welcome.html...

Any tool that wants to reliably connect two clients P2P is going to need something like a TURN server to traverse restrictive NATs. See for instance Tailscale's use of DERP servers: https://tailscale.com/blog/how-tailscale-works/#encrypted-tc...

Yeah, ultimately you're correct

There's no MITM, transfers are end-to-end encrypted. You don't have to trust the relay.