-
Mastodon: https://infosec.exchange/@xoron
How it works: https://positive-intentions.com/docs/projects/chat
TLDR: im working on a p2p messaging webapp. webapps are generally not considered secure because of the nature of serving satics over the internet. this is correct, but not a limitation of this project. (selfhosting options: https://positive-intentions.com/blog/docker-ios-android-desktop).
as a webapp, i can provide the app with zero-installation and no-registration. the storage is local-only from your browser/device. so “the cloud”, but the cloud storage capacity is made up of your devices. this allows for things like p2p authentication: https://positive-intentions.com/blog/security-privacy-authentication.
Future: im aiming to create the most secure messaging app out there... (more than signal, simplex, etc). i know i have a have a long way to go to get there. the UI is fairly ugly for the average user, but i think the mechanics are working as expected. i think javascript is underrated in what you can do with it. i actively investigting improving the encryption approach further to align to how the signal protocol works (currently using the classic diffie-helman key-exchange).
Support: i would like to keep this project open source, but open-source funding is not working for me. i dont want your donations because it isnt sustainable for a long-term project. i have so far only experienced grant-funding rejections. i have no idea what im doing in trying to get funding for this project, so any support/advice is appriciated. in recognition of the project in its current state not able to get funding... (sorry) i will have to go close-source (which id like to avoid because it undemines several cybersecurity claims id like to make.)
First, I don't want to denigrate your project. I think it's great, so good luck to you.
But... As an end user of this kind of software, what I would like to see personally is for developers to work together more, in the spirit of FOSS. To pool their limited resources, instead of working in isolation on personal passion projects which (let's face it) will probably go nowhere. Encrypted messaging in particular is a massively hard nut to crack: it's technically difficult, and you're up against the almost prohibitive barrier of network effects (nobody will use new software until everyone uses it). To make all this extremely plain, what I personally would prefer you do with your talent and energy is to devote it to an existing project with an existing codebase and genuine prospects of succeeding at this almost impossible challenge. For example, Matrix.
That said, I'm sure you couldn't care less what I personally think, and if you insist on going it alone, then good luck to you all the same.
Thanks for your thoughts. I'm sure many others share your opinions.
I'm no expert on that matter, but I assume many people work on open source for various reason. For me, This is something I hope will lead to supporting me.
I find myself recently unemployed (it happens). And so I have to figure out my next steps in life. I'd like to work on this project full-time, yet without funding, I can only continue part-time. I'm motivated to work on the project because I see its still fairly unique, but without any way for it to support me, it's future on shaky grounds... Especially when faced with issues I can't ignore like unemployment.
It's also why I'm reluctant to invite collaborators at this unstable stage because then going close-source becomes immoral.