this is following a previous post as seen here: https://programming.dev/post/51866250

apps like Whatsapp, Signal and SimpleXChat are great for secure messaging and far more mature than this project, but this approach is yet distict in the market. the core philosophy around secure messaging here is that it can work in a way that avoids installation and registration by enabling users to host their own data.

docs: https://glitr.io/

demo

note: feel free to ask for clarity on any of the details around how the project works.

FAQ:

  • but why? - git over https adds an additional capability previously oerlooked https. webrtc cannot work over TOR and similar networks. this way, you can take advantage of the “gold standard” for onion routing while being able to avoid IP leaking from webrtc.

  • when is it ready for production? - not any time soon. standby for updates.

  • audit/review? - no, niether is possible/available. its simply too expensive. this project is close-source so YOU cannot verify it either. DO NOT “trust me bro”… this demo is proided for testing and demo purposes only. use responsibly.

  • the abridged version of how its put together: https://www.reddit.com/r/VibeCodeDevs/comments/1vme48q/refactor_js_to_rust/

  • eksb@programming.devEnglish
    91·
    2 months ago

    Allegedly secure, but no independent audit and closed source. Nobody should use this.

    • xoron@programming.devOPEnglish
      22·
      2 months ago

      it says it right there in the FAQ. im not alleging its secure at all; “this demo is provided for testing and demo purposes only. use responsibly.”

      • eksb@programming.devEnglish
        6·
        2 months ago

        It says “private” and “encrypted”, both of which we just have to take your word for.

        • eksb@programming.devEnglish
          61·
          2 months ago

          “Just give my vibe-coded closed-source app write access to your git repo. You can trust me bro!”

  • KissYagni@programming.devEnglish
    3·
    1 month ago

    Funny idea but… what’s the point of showing a technical demo without the source code ? The added value of this idea relies on its implementation, not on its result.

    • xoron@programming.devOPEnglish
      12·
      1 month ago

      i started on this project as open source and ive tried to be transparent about some reasonably unique features and approach for secure messaging as seen here. its reasonably documented, but feel free to reach out for clarity.

      the key changes between the open and close source versions is the closed version introduces git-as-a-backend and removes peerjs.

      im not new to open source. i simply dont see the benefit to open sourcing this particular project if unit-tests, formal-verification, documentation were so easily dismissed. cybersecurity has countless nuances and open source without an audit is simply not going to work… i’ve already concluded that an audit isnt going to be possible. i dont see the benefit of open soucing the project when it puts me at a competative disadvantage against any modern AI.

      • KissYagni@programming.devEnglish
        2·
        1 month ago

        I find it strange to explain how everything works but keep the implementation closed. It gives a “Trust me bro !” vibe, so I understand that some people might be reluctant about your project.

        Anyway, using git as backend storage is cool. I love it when tools are repurposed for uses other than their original intent ^^.

        • xoron@programming.devOPEnglish
          11·
          1 month ago

          I hope the documentation helps to understand how it works, but as a work in progress, there are countless details to consider before it can be comparable to the mainstream messaging apps.

          For similar open source projects, you can take a look at: https://positive-intentions.com/

  • I Cast Fist@programming.devEnglish
    2·
    2 months ago

    If you accept messages from any incoming connection, you’re bound to get spam or DOS, so how would your host/server limit that?

    • xoron@programming.devOPEnglish
      1·
      2 months ago

      It doesn’t work like that. There is only the static server. Browsers can create a direct P2P connection by exchanging a few details as described here:

      https://github.com/positive-intentions/chat/issues/6

      You can reduce the complexity to exchanging 2 payloads to establish a webrtc connection without any backend (the exchange there is up to users. You can scan a qr code or share it over something like signal).

      https://positive-intentions.github.io/webrtc/demo/gui/app/webrtc-meet?fullscreen=1

      In this project I was looking for an approach for a decentralized backend and landed on git. While GitHub isn’t decentralised, git can have multiple remotes and in the app, it will support multiple remotes which can act as encrypted backups.

      Git makes for a horrible real-time messaging experience, but it tries to establish the webrtc in the background where supported.

      Ultimately, there is no registration of users or messaging servers. The app stores data locally on your device. Connection details have to be shared by you through a channel you trust. You can optionally use a git provider of your choice if you want offline messaging.