-6
Git as the backend for a messaging app (programming.dev)
submitted 6 days ago* (last edited 6 days ago) by xoron@programming.dev to c/git@programming.dev
17 comments fedilink hide all child comments

this is following a previous post as seen here: https://programming.dev/post/51866250

apps like Whatsapp, Signal and SimpleXChat are great for secure messaging and far more mature than this project, but this approach is yet distict in the market. the core philosophy around secure messaging here is that it can work in a way that avoids installation and registration by enabling users to host their own data.

docs: https://glitr.io/

demo

note: feel free to ask for clarity on any of the details around how the project works.

FAQ:

  • but why? - git over https adds an additional capability i had previously oerlooked https. webrtc cannot work over TOR and similar networks. this way, you can take advantage of the "gold standard" for onion routing while being able to avoid IP leaking from webrtc.

  • when is it ready for production? - not any time soon. standby for updates.

  • audit/review? - no, niether is possible/available. its simply too expensive. this project is close-source so you cannot verify it either. DO NOT "trust me bro"... this demo is proided for testing and demo purposes only. use responsibly.

  • the abridged version of how its put together: https://www.reddit.com/r/VibeCodeDevs/comments/1vme48q/refactor_js_to_rust/

you are viewing a single comment's thread
view the rest of the comments
[-] moonpiedumplings@programming.dev 1 points 3 days ago
  1. Okay, but it sounds like you haven't yet investigated any of the sponsored security audit solutions. These aren't quite the same as a grant.

https://ostif.org/get-an-audit/

But by making yourself closed source, you kill any chances of getting access.

It's not enough for the cryptography to secure. An unverified, unsigned, unhashed index.html that the user still has the same issues outlined in the article above. The supply chain has to be secure as well.

[-] xoron@programming.dev 1 points 3 days ago* (last edited 3 days ago)

I've approached OSTIF.

"Sadly at this time, OSTIF is unable to provide you with security work. We wish you and your project the best of luck and much success to come."

They suggested to take a look at opentech.fund ... Similarly rejected.

"We very much appreciate your submission to the Open Technology Fund (OTF) for consideration. Upon evaluation, we have decided that OTF is not able to provide financial support for your project at this time."

Going close source is a fairly recent change in direction for my project. I hope it's more clear why Im not going to bet on support by open sourcing my project.

It certainly isn't enough for the cryptography alone to be secure. Cybersecurity is full of nuances when it comes to the supply chain. Concerns around apps like mine running on untrusted browsers sits in contrast to something like the Signal app running on untrusted hardware/OS/networks.

When talking about the supply chain vulnerabilities, security can be easily undermined if you have screen sharing malware on your device. Neither browser or native app can protect against that. As a browser app, you have more flexibility in choice of browser and OS compared to something like Signal.

The rust approach is intended to further break out of that limitation (albeit close-source, unaudited, etc).

this post was submitted on 10 Sep 2026
-6 points (28.6% liked)

Git

4758 readers
1 users here now

Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.

Resources

Rules

  1. Follow programming.dev rules
  2. Be excellent to each other, no hostility towards users for any reason
  3. No spam of tools/companies/advertisements. It’s OK to post your own stuff part of the time, but the primary use of the community should not be self-promotion.

Git Logo by Jason Long is licensed under the Creative Commons Attribution 3.0 Unported License.

founded 3 years ago
MODERATORS
Ategon@programming.dev
jnovinger@programming.dev
canpolat@programming.dev