To help users of my app, it was important to document the details around the “how it works”. the docs were easy enough using docusaurus + AI. i can then index that data (like used in the docusaurus search). i framed this as like a chatbot so that it can be intuitive for users who have questions. at this point it was really just a fancy autocomplete.

i started to investigate running a local LLM to perhaps offer a more conversational experienced (and hopefully better suggestions)? im using WebLLM on a browser and it seems to work “reasonably” well. i wired it up and set it up so users could select an LLM down download for offline use. the experience varies between devices and models used. there are models that are 19mb… they are unsable as far as i can tell. there are some ~1gb models which are better but understandable slow.

its great that the 1gb model can “show me the bubble-sort in rust”, but i want something “dumber” and smaller. something can can take advantage the data ive already indexed. something that can respond “quickly enough” for a conversational flow. perhaps better i should make a verbose set of reponse templates to perhaps add fancier autocomplete capabilities.

are there any models out there you can suggest for me to investigate and compare?

note: the project is unstable, experiemental and there will be breaking changes. its far from finished. im just trying things out and this approach with LLM’s might just be a waste of time. if you want to test it out, you can try: https://app.glitr.io/ai

I wanted to implement the Signal protocol for a series of secure messaging apps I’m working on, so I built this project to test and use in my own work. It’s still far from finished, but I think it’s at a stage where it’s worth sharing with the community.

IMPORTANT DISCLAIMER: This project is not professionally audited and is not production-ready. I do not recommend anyone use this in their own code yet. It is provided strictly for testing, experimentation, and demo purposes. I used AI as an assistant to help build this, so double-check everything before taking it seriously.

Project Links:

• GitHub: https://github.com/positive-intentions/signal-protocol
• Live Demo: https://signal.positive-intentions.com/
• Formal Verification Docs: https://glitr.io/docs/technical/formal-verification/signal-protocol
• Security Feedback (ROS): https://www.reddit.com/r/CyberSecurityAdvice/comments/1su8lir/security_audit_feedback_from_radically_open

Current Status & Development:

• Spec Alignment: The goal is to fully align with the official Signal protocol spec.
• Testing: It includes unit tests, but due to WASM testing limitations, I also added a Storybook-like UI to run and test it directly within a browser environment.

I wanted to implement the Signal protocol for a series of secure messaging apps I’m working on, so I built this project to test and use in my own work. It’s still far from finished, but I think it’s at a stage where it’s worth sharing with the community.

IMPORTANT DISCLAIMER: This project is not professionally audited and is not production-ready. I do not recommend anyone use this in their own code yet. It is provided strictly for testing, experimentation, and demo purposes. I used AI as an assistant to help build this, so double-check everything before taking it seriously.

Project Links:

• GitHub: https://github.com/positive-intentions/signal-protocol
• Live Demo: https://signal.positive-intentions.com/
• Formal Verification Docs: https://glitr.io/docs/technical/formal-verification/signal-protocol
• Security Feedback (ROS): https://www.reddit.com/r/CyberSecurityAdvice/comments/1su8lir/security_audit_feedback_from_radically_open

Current Status & Development:

• Spec Alignment: The goal is to fully align with the official Signal protocol spec.
• Testing: It includes unit tests, but due to WASM testing limitations, I also added a Storybook-like UI to run and test it directly within a browser environment.

Edit for clarity:

IMPORTANT DISCLAIMER: While this is aiming to provide a secure experience, it's far from finished. It cannot be audited or reviewed because it's close-source. I'm sharing here for testing, feedback and demo purposes only. If you are unsure, this isn't for you (you safely can move away from this post before it ruins your day). Feel free to reach out for clarity on any of the details instead of diving into the documentation. Pease use responsibly.

This project demonstates a unique approach and architecture in contrast to mainstream messaging apps.

The core philosophy around secure messaging here is that it can work in a way that avoids installation and registration by enabling users to host their own data (and user incompetence will be one of many nuanced vulnerabilities in this approach)

The project is unstable and experimental. It's far from finished, but im putting together some docs for "how it works". It's pretty outside-the-box thinking (and that shouldn't inspire confidence!), so it's worth repeating: Pease use responsibly.

Website/Docs: glitr.io

Demo

Features:

• WebApp
• P2P / WebRTC
• Local-first / Local-only
• No installation
• TURN server
• Encrypted-at-rest
• Signal protocol
• Post Quantum cryptography
• Video calls
• TOR / anonymous via Git
• Serverless over WebRTC

Some of the core concepts:

• Chat - deprecared in favour of Enkrypted Chat
  • Code: https://github.com/positive-intentions/chat
  • Demo: https://chat.positive-intentions.com/
• Enkrypted Chat - deprecated in favour of Glitr
  • Intro: https://positive-intentions.com/blog/introducing-enkrypted-chat
  • Demo: https://enkrypted.chat/
• File
  • Code: https://github.com/positive-intentions/dim/blob/staging/src/stories/05-Hooks-useFS.stories.js
  • Demo: https://dim.positive-intentions.com/?path=%2Fdocs%2Fusefs--docs
• Crypto
  • Code: https://github.com/positive-intentions/cryptography
  • Demo: https://cryptography.positive-intentions.com/
• Signal Protocol
  • Code: https://github.com/positive-intentions/signal-protocol
  • Demo: https://signal.positive-intentions.com/

FAQ:

• Why git?
  • When it comes to secure messaging, self-hosting is generally encouraged. While not quite nessesarily self hosted, it would make it easier for the majority of users to get started. Users can choose a git storage provider of their choice (GitHub, Gitlab, etc), or host their own git server.
• Serverless WebRTC?
  • A connection can be achieved without a backend as described here: https://github.com/positive-intentions/chat/issues/6
  • demo: https://positive-intentions.github.io/webrtc/demo/gui/app/webrtc-meet?fullscreen=1
• Ready for production?
  • No. While this is aiming to provide a secure experience, it cannot be audited or reviewed. Shared for testing, feedback and demo purposes only.
• EU Chat Control?
  • There is no registration, no central server and it uses client-side cryptography. While the following post refers to the older version of this project, the mechanics remain very similar: https://www.reddit.com/r/europrivacy/comments/1ndbkxn/help/_me/_understand/_if/_chatcontrol/_could/_affect/_my
• Threat model?
  • It's a work in progress. There are many details still to be implemented before I can share the initial draft.
  • It's close source and unaudited so the best I can offer is "trust me bro"... And you shouldn't need to. The app doesn't require sensitive details, so don't use any when testing it out.
• Open source?
  • Open source from the onset is not something I can support at this stage. Hopefully I can work towards that goal. I'm aware this goes against the cybersecurity rhetoric. There are open source versions of various ideas linked above, but it's important to be clear, that glitr.io is close source in contrast to my other work.
• Where can I find out more?
  • https://positive-intentions.com/
  • https://www.reddit.com/r/positive/_intentions
  • Feel free to reach out for clarity instead of diving into the docs.

I hope my wording here wasn't too negative. When working in cybersecurity, there are countless nuances to consider and I would prefer to be discouraging than inspire undue confidence in the project.

Original post:

This might become the worlds most secure messaging app.

This project demonstates a unique approach to secure messaging. The approach is different enough that it can't be easily compared to Signal or SimpleX.

The core philosophy around secure messaging here is that it can work in a way that avoids installation and registration by enabling users to host their own data.

The project is far from finished, but im putting together some docs for the "how it works". It's pretty outside-the-box thinking (and that doesnt make it a good idea), so it would be great if you could share your thoughts on the approach.

Website: Glitr.io

Demo

Features:

• WebApp
• P2P / WebRTC
• Local-first / Local-only
• No installation
• TURN server
• Encrypted-at-rest
• Signal protocol
• Post Quantum cryptography
• Video calls
• TOR / anonymous via Git
• Serverless over WebRTC

Some of the core concepts:

• Chat - deprecared in favour of Enkrypted Chat
  • Code: https://github.com/positive-intentions/chat
  • Demo: https://chat.positive-intentions.com/
• Enkrypted Chat - deprecated in favour of Glitr
  • Intro: https://positive-intentions.com/blog/introducing-enkrypted-chat
  • Demo: https://enkrypted.chat/
• File
  • Code: https://github.com/positive-intentions/dim/blob/staging/src/stories/05-Hooks-useFS.stories.js
  • Demo: https://dim.positive-intentions.com/?path=%2Fdocs%2Fusefs--docs
• Crypto
  • Code: https://github.com/positive-intentions/cryptography
  • Demo: https://cryptography.positive-intentions.com/
• Signal Protocol
  • Code: https://github.com/positive-intentions/signal-protocol
  • Demo: https://signal.positive-intentions.com/

FAQ:

• Why git?
  • When it comes to secure messaging, self-hosting is generally encouraged. While not quite nessesarily self hosted, it would make it easier for the majority of users to get started. Users can choose a git storage provider of their choice (GitHub, Gitlab, etc), or host their own git server.
• Ready for production?
  • No. While this is aiming to provide a secure experience, it cannot be audited or reviewed. Shared for testing, feedback and demo purposes only. Please use responsibly.
• Where can I find out more?
  • https://positive-intentions.com/
  • https://www.reddit.com/r/positive/_intentions
  • Feel free to reach out for clarity instead of diving into the docs.

this is following a previous post as seen here: https://programming.dev/post/51866250

apps like Whatsapp, Signal and SimpleXChat are great for secure messaging and far more mature than this project, but this approach is yet distict in the market. the core philosophy around secure messaging here is that it can work in a way that avoids installation and registration by enabling users to host their own data.

docs: https://glitr.io/

demo

note: feel free to ask for clarity on any of the details around how the project works.

FAQ:

• but why? - git over https adds an additional capability i had previously oerlooked https. webrtc cannot work over TOR and similar networks. this way, you can take advantage of the "gold standard" for onion routing while being able to avoid IP leaking from webrtc.

• when is it ready for production? - not any time soon. standby for updates.

• audit/review? - no, niether is possible/available. its simply too expensive. this project is close-source so you cannot verify it either. DO NOT "trust me bro"... this demo is proided for testing and demo purposes only. use responsibly.

• the abridged version of how its put together: https://www.reddit.com/r/VibeCodeDevs/comments/1vme48q/refactor_js_to_rust/

IMPORTANT: i dont reccommend you read through my code here. feel free to reach out for clarity on the details.

id like to investigate about rewriting my "decentralized p2p encrypted messaging app" in Rust. if you are familiar with any of the details, id like to hear your opnions on the approach.

my project is complex and would carry a significant overhead to redo in Rust. the core reason behind investigating rust is that it has better tooling for things like formal-verification. in general it seems like a better language for a project like mine. as a webdev, it was easy enough for me to put together and while i can use things like tauri to build for native, i think dioxus's approach for a native build is good.

im aiming to create something fairly unique for "secure messaging". i created a prototype (without AI) for my project to share and discuss. it demonstrates the core-concept around client-side managed secure cryptography in javascript.

https://github.com/positive-intentions/chat

javascript doesnt have a great reputation in the cryptography communities and its always a struggle to promote, so it was important for it to be open source. im proud of the work there, but i see details i overlooked. this led me to creating a new version to fix the outstanding issues. (it was things like handling key-rotation, group-messaging, etc).

https://positive-intentions.com/blog/introducing-enkrypted-chat

the MVP version lacked things like unit-tests, while the second-iteration not only had unit-test, but armed with AI, i was able to do things like create audits and formal-verification. the whole project is absurdly complicated and not worth your time to review. things like audits and formal-proofs/verification are fundamentally invalid because i used AI to create it. the attempt is genuine and i found the process educational, but cybersecurity and cryptography is specialized and has countless nuances to consider. it isnt worth your time to debug my code.

i now i think the project could benefit from being rewritten in Rust. its a much more suitable and respected language for what im trying to do, but i have never used rust to do something of this scale. i expect it will carry a huge learning curve given my background as a webdev.

https://github.com/positive-intentions/whatsup

creating a webapp for me is easy enough, but my project relies on some core technologies which i want supported on all platforms consistently. some core things i need to consider:

• webrtc - its the core data-channel for my project. im sure that as a webapp it can be done... it might be a stretch to build a wasm to bridge to JS if nessesary, but im sure it can work. i would also like rust to build for other architectures. i think the support is also reasonable for the native build, but i wonder it there could be issues for a CLI version.
• Module federation - in the browser-based version im using module-federation and its working as exected. it particularly helps to separate functionality, which is generally a good approach for a complex project. in Rust's cargo file, it seems i could add something like `foo_crate = { git = "https://github.com/MyOrg/foo/_crate"}`. that seems like it would also limit how i handle close-source details of the project
• local-only storage - a core detail to my app is that it works p2p without registration. there are no databases of registered users. in a pwa i can use various forms of storage provided by the browser. i would like to use an approach that is consistent in rust to avoid bespoke code for different platforms (easier maintainance).\
• ui framework - im using dioxus for far, but its largely AI slop... its could just as easily be leptos (im still investigating comparing the two)... but if i really think outside the box... i wonder how difficult it would be to use webcomponents from rust. i was working on a webcomponent framework and it would be interesting to seem if there would be a performance advantage to using something closer to vanillajs. webcomponents probably are not a good idea if i want better support between platforms.

maybe there are other details i should keep in mind? i think i will have to create multiple creates for things like UI components library and p2p-framework (similar to how i did it for the javascript version)

thanks for reading this far. have a nice day.

Hey, I'm a webdev. I previously approached my project with JavaScript. I'm familiar with the js ecosystem.

I put a fair bit of consideration and in contrast to my JavaScript-approach, I'd like to investigate Dioxus.

I'm not completely new. I've dabbled in Rust before. I have read a lot of the docs and I'm sure there is much more to learn and practice.

What advice would you give to getting started with the Rust ecosystem approach?

Similar to a lot of languages there are considerations for things like tests. So it would be useful to see the options there. As well as any other best-practices and nuances.

In relation to my project, I'm particularly interested in the tooling available in rust for formal verification.

Just to be clear, im not here to waste your time on my slop, but if you want to see what I've got so far (practically nothing):

• Code: https://github.com/positive-intentions/whatsup
• Demo: https://positive-intentions.github.io/whatsup

Hey, I'm a webdev. I previously approached the project with JavaScript. I'm familiar with the js ecosystem.

I put a fair bit of consideration and in contrast to my JavaScript-approach, I'd like to investigate Dioxus.

I'm not completely new. I've dabbled in rust before. I have read a lot of the docs and I'm sure there is much more to learn amd practice. I also don't want to downplay that I'm ai-slop-maxxing at scale.

What advice would you give to getting started with the rust ecosystem approach?

Similar to a lot of languages there are considerations for things like tests. So it would be useful to see the options there. As well as any other best-practices and nuances.

In relation to my project, I'm particularly interested in the tooling available in rust for formal verification.

Just to be clear, im not here to waste your time on my slop, but if you want to see what I've got so far (practically nothing):

• Code: https://github.com/positive-intentions/whatsup
• Demo: https://positive-intentions.github.io/whatsup

Lemmy isnt ready for this project and so deleting the post

I hope this project has reached a level i can share the following details. I've made a genuine effort towards documentation and transparancy. I dont think it'll ever be enough and so im still concerned it isnt ready to share. While im using AI throughout. This is not a vibecoded project. There is attention throughout for unit tests and formal-verification. With your feedback, id like to make improvements for clarity throughout.

This version of the app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. I know it's impossible for any system to be the "world's most secure", but that isnt a reason to not try. By rigorously implementing an exhaustive list of security features and practices, the aim is to get as close as possible.

• Enkrypted.Chat

This is intended to demonstrate client-side managed secure cryptography.

• Introducing Enkrypted Chat
• Whitepaper (work-in-progress)
• Protocol Spec (work-in-progress)
• Roadmap

I know the project above is going to be tricky to understand. It might help to understand with an open-source version of the concept for educational purposes. Its's important to note, i have since deprecated it in favour of the version linked above.

Open source demo (deprecated)

PS. Im calling it a "Signal Messenger Clone"... that's just a matter of how to frame it for users getting started. It doesnt work in a way thats comparable to the signal architecture. This project is fairly complicated and the links above are likely not going to be enough, so feel free to reach out for clarity on the details.

PPS. I made a similar post on Reddit and it seems to be reasonably well recieved and so branching out to Lemmy here. It might help to take a look there if questions are asked/answered already.

Lemmy isnt ready for this project and so deleting the post

I hope this project has reached a level i can share the following details. I've made a genuine effort towards documentation and transparancy. I dont think it'll ever be enough and so im still concerned it isnt ready to share. While im using AI throughout. This is not a vibecoded project. There is attention throughout for unit tests and formal-verification. With your feedback, id like to make improvements for clarity throughout.

This version of the app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. I know it's impossible for any system to be the "world's most secure", but that isnt a reason to not try. By rigorously implementing an exhaustive list of security features and practices, the aim is to get as close as possible.

• Enkrypted.Chat

This is intended to demonstrate client-side managed secure cryptography.

• Introducing Enkrypted Chat
• Whitepaper (work-in-progress)
• Protocol Spec (work-in-progress)
• Roadmap

I know the project above is going to be tricky to understand. It might help to understand with an open-source version of the concept for educational purposes. Its's important to note, i have since deprecated it in favour of the version linked above.

Open source demo (deprecated)

PS. Im calling it a "Signal Messenger Clone"... that's just a matter of how to frame it for users getting started. It doesnt work in a way thats comparable to the signal architecture. This project is fairly complicated and the links above are likely not going to be enough, so feel free to reach out for clarity on the details.

PPS. I made a similar post on Reddit and it seems to be reasonably well recieved and so branching out to Lemmy here. It might help to take a look there if questions are asked/answered already. https://www.reddit.com/r/BuyFromEU/comments/1v8cx0s/europeanbased_signal_messenger_alternative/

i am working on a messaging app and created some details in rust. rust is useful because it has tooling for formal verification. my rust code compiles to WASM to be used in a browser.

my project itself is using cryptography beyond the WASM because browsers provide a crypto api for basic functionality out-of-the-box.

to work with what i have now (javascript/typescript) i came across this page, but the links lead to 404 pages on github. not sure about the status of the project. i dont know if there are other similar projects.

https://formal.land/docs/verification/typescript

i would like to improve the "formal-verification coverage" in my project and wanted to investigate if it could be worth considering rewriting the frontend with dioxus. im happy with an ugly UI (initially) in favour of having formal-verification on a broader scope of my project.

(context: the project where i have formal verification is found here: https://github.com/positive-intentions/signal-protocol (this isnt the gold-standard implementation and its far from finished)

This is a technical demo of a fairly unique approach using a browser-based, local-first and webrtc approach.

• Enkrypted.Chat

This is intended to demonstrate client-side managed secure cryptography.

• Introducing Enkrypted Chat
• Whitepaper (work-in-progress)
• Protocol Spec (work-in-progress)
• Roadmap

Features:

• Core
  • PWA
  • P2P
  • Local-first / Local-only
  • No installation
  • TURN server
  • Encrypted-at-rest
• WhatsApp clone
  • End to end encryption
  • Signal protocol
  • Post-Quantum cryptography
  • Multimedia
  • File transfer
  • Video calls
• Nextcloud clone
  • Word
  • Spreadsheet
  • PDF
  • file-transfer
  • Encrypted vault

Some open source versions of the core concepts.

• Chat
  • Code: https://github.com/positive-intentions/chat
  • Demo: https://chat.positive-intentions.com/
• File
  • Code: https://github.com/positive-intentions/dim/blob/staging/src/stories/05-Hooks-useFS.stories.js
  • Demo: https://dim.positive-intentions.com/?path=%2Fdocs%2Fusefs--docs
• Crypto
  • Code: https://github.com/positive-intentions/cryptography
  • Demo: https://cryptography.positive-intentions.com/
• Signal Protocol
  • Code: https://github.com/positive-intentions/signal-protocol
  • Demo: https://signal.positive-intentions.com/

Feel free to reach out for clarity instead of diving into the docs.

IMPORTANT: While this is aiming to provide a secure experience, it isnt audited or reviewed. Shared for testing, feedback and demo purposes only. Please use responsibly.