I'm seeing AI reverse engineering games from compiled code. All very cool.
following a previous post, I'm assuming minifying and obfuscated code would be relatively easy for an AI to chew up.
Taking that obfuscation idea further, if I create a a rust native app, how secure it that relatively?
TLDR; The title of this post. I have read the rules. When working in cybersecurity, there are countless nuances to consider and the subject matter is too dense to compress it into one post. The roadmap is more comprehensive.
Roadmap: https://glitr.io/docs/technical/roadmap
IMPORTANT DISCLAIMER: While this is aiming to provide a secure experience, it's far from finished. It cannot be audited or reviewed because it's close-source. I'm sharing here for testing, feedback and demo purposes only. If you are unsure, this probably isn't for you. Feel free to reach out for clarity on any of the details instead of diving into the documentation. Pease use responsibly.
This project demonstates a unique approach and architecture in contrast to the traditional approach with mainstream messaging apps. To put it briefly, its a Dioxus PWA with a Git-server backend which can be used to establish a webrtc connection between browsers.
The core philosophy around secure messaging here is that it can work in a way that avoids installation and registration by enabling users to host their own data (user incompetence will be one of many nuanced vulnerabilities in this approach).
Using git for encrypted messaging seems like it would be breaking TOS for things like Github (and could get you banned?), so like with any secure messaging app, its best when selhosted. The ability for it to work with multiple generic git-hosts is helpful for users to get started.
Following investigation around onion-routing for webrtc (here), i wanted to consider something like a double-turn-hop routing. To explain it simply, peers should agree "through some secure means" to use different turn servers. Its hardly onion-routing, but perhaps there could be a benefit to the additional ip mask. following another question around webrtc ip leaking, a VPN could help, but there are details to consider as describe in the post. You can also do something similar with the git-based approach by using different git providers. (The app will allow for multiple git remotes, which are automatically kept in sync from the app as a kind-of decentraliazed database.)
Im putting together some docs for "how it works". It's pretty outside-the-box thinking (and that shouldn't inspire confidence!), so it's worth repeating: Pease use responsibly.
Features:
Some of the core concepts:
FAQ:
The future/TODO:
IMPORTANT DISCLAIMER: While this is aiming to provide a secure experience, it's far from finished. It cannot be audited or reviewed because it's close-source. I'm sharing here for testing, feedback and demo purposes only. If you are unsure, this isn't for you (you safely can move away from this post before it ruins your day). Feel free to reach out for clarity on any of the details instead of diving into the documentation. Pease use responsibly.
This project demonstates a unique approach and architecture in contrast to mainstream messaging apps.
The core philosophy around secure messaging here is that it can work in a way that avoids installation and registration by enabling users to host their own data (and user incompetence will be one of many nuanced vulnerabilities in this approach)
The project is unstable and experimental. It's far from finished, but im putting together some docs for "how it works". It's pretty outside-the-box thinking (and that shouldn't inspire confidence!), so it's worth repeating: Pease use responsibly.
Website/Docs: glitr.io
Roadmap: https://glitr.io/docs/technical/roadmap (work-in-progress)
Features:
Some of the core concepts:
FAQ:
I hope my wording here isn't too negative. When working in cybersecurity, there are countless nuances to consider and I would rather be discouraging than inspire undue confidence in my project.
This project demonstates a unique approach to secure messaging. The approach is different enough that it can't be easily compared to Signal or SimpleX.
The core philosophy around secure messaging here is that it can work in a way that avoids installation and registration by enabling users to host their own data.
The project is far from finished, but im putting together some docs for the "how it works". It's pretty outside-the-box thinking (and that doesnt make it a good idea), so it would be great if you could share your thoughts on the approach.
Website: glitr.io
Features:
Some of the core concepts:
FAQ:
Im clearly missing several details like a security audit, but if i dont sell anything there isnt any funding for an audit (and they arent cheap).
My project is further described here. The technical approach is quite unique.
I have loads of documentation and open source code. Im sure much more can also be done, but I think I've reached the point of diminishing returns in offering transparency.
Help me understand my options for going forward on my project. I suspect im going to have to go close-source like Whatsapp because i cant secure open source funding.
Feel free to ask for clarity on the details about my project instead of diving into the docs.
Apps like Whatsapp, Signal and SimpleXChat are great for secure messaging and far more mature than this project, but this demonstates a unique approach.
The core philosophy around secure messaging here is that it can work in a way that avoids installation and registration by enabling users to host their own data.
The project is far from finished, but im putting together some docs for the "how it works". It's pretty outside-the-box thinking (and that doesnt make it a good idea), so it would be great if you could share your thoughts on the approach.
Docs: glitr.io
Features:
Some older versions of the core concepts.
Feel free to reach out for clarity instead of diving into the docs.
IMPORTANT: While this is aiming to provide a secure experience, it cannot be audited or reviewed. Shared for testing, feedback and demo purposes only. Please use responsibly.
Apps like Whatsapp, Signal and SimpleXChat are great for secure messaging and far more mature than this project, but this approach is yet a unique approach.
The core philosophy around secure messaging here is that it can work in a way that avoids installation and registration by enabling users to host their own data.
The project is far from finished, but im putting together some docs for the "how it works". It's pretty outside-the-box thinking (and that doesnt make it a good idea), so it would be great if you could share your thoughts on the approach.
Docs: glitr.io
I hope the docs are clear. Feel free to ask for clarity on the details around how the project works.
By creating it as a webapp that works with local-only storage a browser-based functionality, we can avoid installation and registration entirely.
Browsers can create a direct webrtc connection by exchanging a few details as described here:
https://github.com/positive-intentions/chat/issues/6
https://github.com/positive-intentions/chat/blob/staging/src/components/pages/webrtc/WebRTC.jsx
You can reduce the complexity to exchanging 2 payloads to establish a connection. avoiding any fixed backend (the exchange is up to users. You can scan a qr code or share it over something like signal).
https://positive-intentions.github.io/webrtc/demo/gui/app/webrtc-meet?fullscreen=1
Im just sharing a demo here. The project is far from finished and much more needs to be considered before the experience is comparable to mainstream messaging apps.
Is there anything out there like this?
Like whatsapp and signal it should have an intuitive UI for messaging, but under the hood it uses git read/write to publish encrypted messages and push them to a git provider.
It wouldn't be "instant messaging" because the git repos would have to be polled.
The git storage could get big so we can do thing like truncate the history to make the data more flat.
Messages can be encrypted with the signal protocol. It should be fine to publish if implemented properly.
Like whatsapp and signal it should have an intuitive UI for messaging, but under the hood it uses git read/write to publish encrypted messages and push them to a git provider.
The git storage could get big so we can do thing like truncate the history to make the data more flat.
Messages can be encrypted with the signal protocol. It should be fine to publish if implemented properly.
Im sure im not the first consider this approach, but i would like to share a demo for clarity and transparancy. No need to debug, its far from finished and there is much to do.
Im working on a P2P messaging app and generally up until recently i thought in such a system, if a peer is offline, you cant send a message... It wouldnt be "decentralized" if there was some central queue of messages.
It took embarassingly long, but then it hit me... git... just regular git is a decentralized database. Github isnt decentralized, but git can have multiple remotes that can act as redundencies.
In my setup i need the ability for others to be abe to read and only i should be able to write to it. That functionality is out-of-the-box in git.
Git is also pretty standardized so there are many providers if users want to move away from Github.
The storage requirements for my project are fairly small. Typically small text messages. The data itself thats publicly readable would be encrypted (aiming to keep aligned to Kerkhoffs principles).
There is much more to improve and consider there for things like encrypting the data at rest.
I have concerns around if providers like GitHub, Codeberg and Gitlab might see the way my app works as fundamentally violating their terms-of-service.
IMPORTANT DISCLAIMER: This is open source for transparency, testing and demo purposes only. it is still a work in progress and far from finished. you should not use it on any sensitive repositories. There WILL BE breaking changes. Use responsibly.
Hey, I'm a webdev. I previously approached my project with JavaScript. I'm familiar with the js ecosystem.
I put a fair bit of consideration and in contrast to my JavaScript-approach, I'd like to investigate Dioxus.
I'm not completely new. I've dabbled in Rust before. I have read a lot of the docs and I'm sure there is much more to learn and practice.
What advice would you give to getting started with the Rust ecosystem approach?
Similar to a lot of languages there are considerations for things like tests. So it would be helpful to compare the options. As well as any other best-practices and nuances.
In relation to my project, I'm particularly interested in the tooling available in Rust for formal verification.
Just to be clear, im not here to waste your time on my slop, but if you want to see what I've got so far (practically nothing):
im a software developer and so far when promoting my project on reddit, it is "not well recieved" because im framing it as a product. people hate being advertised to.
the reponse is completely understandable, but that framing seemed nessesary in order to encourage people to take a look. if i hint at it being "research and development", people simply wont take a look. completely understandable given that cryptography isnt particularly inviting from the onset.
reddit is not the place for feedback on a project like mine. the space for "cybersecurity" is understandably competative. i think my project demonstrates a unique approach, but its clearly not a reason to waste someones time if the documentation isnt clear enough.
... so where/how should i share my project for it to be scritinised. i certainly dont want to waste anyones time so id like to also ask what details would be important to share.
ultimately it could just be that my project is bad and i should feel bad. perhaps i need a reality-check that the system is designed to keep bums like me out.
ive heard of things like arxiv, but that seems it might demand a higher calibre of documentation and so id like more advice there so if i post, it isnt flagged as trolling.
i have loads of documentation on my project, i suspect i just havent figured out the correct way to assemble it so that its comprehensive.
i appriciate any tips/adive you can offer.
Decentralized browser-based P2P E2EE messaging.
The key detail that sets this apart from other messaging apps is the browser-based client-side cryptography philosophy.
No need to install anything. Your ID is crypto-random and so the app doesnt need to rely on any central registration system like phone numbers. Your ID is unguessable and to connect to someone, you have to explicitly share it.
WebRTC has other nuances like being to route through a shared network for secure/faster transfer.
This app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. In an evolving field like cybersecurity, it's impossible to claim any system is the "world's most secure". It ultimately depends on your threat model. By reducing the architecture's attack surface, the aim is to consolidate complexity to client-side.
... but wait. Im only getting started. That version works as an MVP, but i see the flaws of my approach and am going to do it better. Im going to proceed on the project and create "version-2".
I hope the latest version of project has reached a level i can share the following details. I've made a genuine effort towards documentation and transparancy. I dont think it'll ever be enough and so im still concerned it isnt ready to share. While im using AI throughout... This is not a vibecoded project. There is attention throughout for unit tests and formal-verification. With your feedback, id like to make improvements for clarity throughout.
I know it's impossible for any system to be the "world's most secure", but that isnt a reason to not try. I listened to feedback and proceeded. By rigorously implementing an exhaustive list of security features and practices, the aim is to get as close as possible.
This is intended to demonstrate client-side managed secure cryptography.
I know ive tried to compress a lot of my journey into one post. The project above is going to be tricky to understand. Feel free to reach out for clarity on any of the details.
IMPORTANT: While this is aiming to provide a secure experience, It is not audited or reviewed. Shared for testing, feedback and demo purposes only. Please use responsibly.
The key detail that sets this apart from all other apps is the browser based client-side philosophy.
No need to install anything. Your ID is crypto-random and so the app doesnt need to rely on any central registration system like phone numbers. Your ID is unguessable and to connect to someone, you have to explicitly share it.
WebRTC has other nuances like being to route through a shared network for secure/faster transfer.
This app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. In an evolving field like cybersecurity, it's impossible to claim any system is the "world's most secure". It ultimately depends on your threat model. By reducing the architecture's attack surface, the aim is to consolidate complexity to client-side.
... but wait. Im only getting started. That version works as an MVP, but i see the flaws of my approach and am going to do it better. Im going to proceed on the project and create "version-2".
I hope the latest version of project has reached a level i can share the following details. I've made a genuine effort towards documentation and transparancy. I dont think it'll ever be enough and so im still concerned it isnt ready to share. While im using AI throughout... This is not a vibecoded project. There is attention throughout for unit tests and formal-verification. With your feedback, id like to make improvements for clarity throughout.
This version of the app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. I know it's impossible for any system to be the "world's most secure", but that isnt a reason to not try. By rigorously implementing an exhaustive list of security features and practices, the aim is to get as close as possibl
This is intended to demonstrate client-side managed secure cryptography.
I know ive tried to compress a lot of my journey into one post. The project above is going to be tricky to understand. Feel free to reach out for clarity on any of the details.
IMPORTANT: While this is aiming to provide a secure experience, it cannot be audited or reviewed. Shared for testing, feedback and demo purposes only. Please use responsibly.
The main pushback I get it that I'm using AI.
In practice, I'm doing things like creating unit tests and documenting things like formal verification. I don't need AI to do this work. It's only my time I'm wasting to write every line. It's all quite some effort.
I'm fairly proud of my work. Various details are open source. It's understandably too complicated for anyone in their spare time, but it's an option.
Are others facing similar "merit-less" pushback?
The key detail that sets this apart is the browser based approach.
No need to install anything. your ID is crypto-random and so the app doesnt need to rely on any central registration system like phone numbers. your ID is unguessable and to connect to someone, you have to explicitly share it.
webrtc has other nuances like being to route through a shared network for secure/faster transfer.
I hope this project has reached a level i can share the following details. I've made a genuine effort towards documentation and transparancy. I dont think it'll ever be enough and so im still concerned it isnt ready to share. While im using AI throughout. This is not a vibecoded project. There is attention throughout for unit tests and formal-verification. With your feedback, id like to make improvements for clarity throughout.
This version of the app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. I know it's impossible for any system to be the "world's most secure", but that isnt a reason to not try. By rigorously implementing an exhaustive list of security features and practices, the aim is to get as close as possible.
This is intended to demonstrate client-side managed secure cryptography.
I know the project above is going to be tricky to understand. It might help to understand with an open-source version of the concept, but have since deprecated it in favour of the version linked above.
https://www.reddit.com/r/CorpFree/comments/1uytump/decentralized_p2p_chat
Feel free to reach out for clarity on any details.
Im trying to innovate in the age-of-AI. So i often find myself defending the project from being called AI slop. i have been working on imrovements throughout the code as well as the docs.
I hope this project has reached a level i can share the following details. I've made a genuine effort towards documentation and transparancy. I dont think it'll ever be enough and so im still concerned it isnt ready to share. While im using AI throughout. This is not a vibecoded project. There is attention throughout for unit tests and formal-verification. With your feedback, id like to make improvements for clarity throughout.
This version of the app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. I know it's impossible for any system to be the "world's most secure", but that isnt a reason to not try. By rigorously implementing an exhaustive list of security features and practices, the aim is to get as close as possible.
This is intended to demonstrate client-side managed secure cryptography.
I know the project above is going to be tricky to understand. It might help to understand with an open-source version of the concept for educational purposes. Its's important to note, i have since deprecated it in favour of the version linked above.
PS. Im calling it a "Signal Messenger Clone"... that just a matter of how to frame it for users. It doesnt work in a way thats comparable to the signal architecture. This project is fairly complicated and the links above are likely not going to be enough, so feel free to reach out for clarity on the details.
The key detail that sets this apart is the browser based approach.
No need to install anything. your ID is crypto-random and so the app doesnt need to rely on any central registration system like phone numbers. your ID is unguessable and to connect to someone, you have to explicitly share it.
Webrtc has other nuances like being to route through a shared network for secure/faster transfer.
I hope this project has reached a level i can share the following details. I've made a genuine effort towards documentation and transparancy. I dont think it'll ever be enough and so im still concerned it isnt ready to share. While im using AI throughout. This is not a vibecoded project. There is attention throughout for unit tests and formal-verification. With your feedback, id like to make improvements for clarity throughout.
This version of the app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. I know it's impossible for any system to be the "world's most secure", but that isnt a reason to not try. By rigorously implementing an exhaustive list of security features and practices, the aim is to get as close as possible.
This is intended to demonstrate client-side managed secure cryptography.
I know the project above is going to be tricky to understand. It might help to understand with an open-source version of the concept, but have since deprecated it in favour of the version linked above.
https://www.reddit.com/r/CorpFree/comments/1uytump/decentralized_p2p_chat
I hope this project has reached a level i can share the following details. I've made a genuine effort towards documentation and transparancy. I dont think it'll never be enough and so im still concerned it isnt ready to share. While im using AI throughout. This is not a vibecoded project. There is attention throughout for unit tests and formal-verification. With your feedback, id like to make improvements for clarity throughout.
This version of the app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. I know it's impossible for any system to be the "world's most secure", but that isnt a reason to not try. By rigorously implementing an exhaustive list of security features and practices, the aim is to get as close as possible.
This is intended to demonstrate client-side managed secure cryptography.
p.s. I know people love open-source and the project above is going to be tricky to understand. it might help to understand with an open-source version of the concept, but have since deprecated it in favour of the version linked above.
https://www.reddit.com/r/CorpFree/comments/1uytump/decentralized_p2p_chat
