Hacker News Reader

Comment by astonex | Hacker News Reader

I would use Tox and any of its clients with caution. At one point in time, your friends would be able to execute arbitrary shell commands on your PC if you were running utox and accepted a file download. Even with large security concerns like this, the lead developer believes Tox and uTox is secure because he reads the code he wrote himself (none the less git history is filled with bug fixes he clearly missed in his reading). This isn't exactly reassuring, especially coming from someone who doesn't have provable past experience in security software.

Edit: I just got banned from their IRC for stating this opinion here.

View on HN

uTox was not originally written by the main toxcore dev. However he and a few other brave volunteers have made a big effort to clean up uTox's code over the past few months. That's why this thread was created now and not 6 months ago.

>I would use Tox and any of its clients with caution.

It's hard to argue with that given that Tox is still in alpha, and this is generally a good idea for any software you use if you have reasons to believe that an adversary is trying to exploit your computer.

And your opinion is based on what? What you just said is true for any software. Any reason why you pick out tox in particular?

The comment you replied to seems to be a fairly specific and verifiable criticism of uTox, which, like all security software, deserves to have its claims approached with skepticism.

That last part is enough to ditch them unless you were fighting with them in IRC. Were you?

Your claims ring true for vast majority of new, COMSEC schemes. Far as Tox, this is what I found on their GitHub page: "Current build status: build failing." I'll add that NSA and malware authors have 0-days on the platforms the tool will likely run on. It will be bypassed like all others on such platforms.

I was just idling on their channel when irungentoo got me banned for my post here.

Yeah, that's quite questionable. They need to be able to handle and defend criticism better if they want to make it in INFOSEC. Especially if they ever get press like Cryptocat or Diaspora did.

Astonex was never banned from any of the public tox IRC channels. He was banned from an invite-only channel for off-topic discussion because he was trolling. The ban did not last very long either, because most of us still like him despite his attempts to create drama. Everyone has their off days.

Always good to hear both sides. I reserve judgment until I do. In this case, I'm just going to say "Ok" and be neutral. I like the line you added at the end: quite fair.

Not saying your lying or anything. But if you make accusations like that you should probably back them up with a chat log.

Chat logs of which bit are you after?

Preferably a few hours from the last time you said something or 24 hours back.

Reply on news.ycombinator.com