I'm actually not against vibe coding, but this is the kind of stupid shit people point to when they say vibe coding is bad.
I'm genuinely curious. Can you elaborate?
I've seen vibecoded slop too. To avoid it being mistaken for slop I created documentation, tests, etc.
Perhaps individuals shouldn't be allowed to make cybersecurity software. You may understandably want this done by a group of experts.
Getting traction on any project can be hard and I'm curious what nuances I might be overlooking.
You've insufficiently described any technical reason to use git as the basis for your chat history. Git is a poor choice for all the reasons I explained in your last post and more. It's like using paint as glue or using a microwave to heat your bathwater.
While it might be technically possible and work on first glance, there are few to no technical advantages to doing so, and anyone could tell you as such. In fact in some cases it might even be a detriment.
In your posts, you're talking about the usage of Tor and how WebRTC is a bad fit compared to Git and I can only guess at how you reached the conclusions you did.
Literally just ask your AI why using Git as the basis for a secure encrypted messaging application is a bad idea and I'm sure it could do so more eloquent than I.
Like, my first thought is "why not use https or even TCP directly rather than Git" sqlite and a TCP socket is more sane than this.
when it comes to secure messaging, self-hosting is generally encouraged... while not quite self hosted, it would make it easier for the majority of users to get started.
users can choose a git storage provider of their choice (GitHub, Gitlab, etc), or host their own git server.
for self hosting it’s overkill but makes deployment easier. You can choose any git provider.
I introduced git as an replacement for peerjs in my project. I describe my app as a "decentralised P2P messaging app"... Using peerjs introduces a centralisation in an otherwise decentralised architecture. It also has the additional advantage of allowing users to send messages when peers are offline. Previously not possible with the pure webrtc approach.
GIT tracks changes, which doesn't strike me as something that often happens with messaging. Unless you just always replace your last message with the new one, I guess, then sure!
The git usecase here is not version control. The repo size would swell to a large size easily if people exchange large files. The app flattens and truncates the history.
If the project was FOSS, it would have been interesting to follow the development and learn from it. But it being proprietary, I don't see why anybody would be interested in it, TBH.
i was unable to get traction on my project as FOSS. in fact, it only seems to put me at a competative disadvantage.
https://www.reddit.com/r/positive_intentions/comments/1tq1u62/introducing_enkrypted_chat
i sweated to get the project to that point. the key pushback was that it didnt have an audit. cybersecurity has a paywall nobody seems to talk about. a security audit that is worth respecting is prohibitively expensive. as someone feeling the hit of AI (im unemployed), im especially not investigating options for a security audit when i cant pay myself.
it isnt for lack of trying either i have countless rejections from providers of funding for open source projects. i have several open source examples if youre really curious to discuss details.
There are organizations that audit software for free, for smaller developers.
But they only do so if it is FOSS.
You have now essentially killed your project, since you will not be able to afford an audit, and nobody who knows what they are doing will look at an encryption protocol or app that hasn't been audited.
(Sorry for this being so long... Feel free to reach out for clarity on the details. Long-story-short. Sure those orgs exist... But they aren't rushing to fund projects that are simply open source)
You're over simplifying. So let's add some context relative to this project.
I have several open source projects. This project started off open source and I keep the version open source because it demonstrates a fairly unique concept around avoiding installation and registration.
https://github.com/positive-intentions/chat
I handcrafted that version. It's open source with the commit history. It was before the days of agentic AI. I spent countless hours considering countless details. I could spend countless more on improving the quality there for things like unit tests.
I had something reasonably unique and so I tried to apply for funding. I tried very hard, several places, several times. All rejections.
Grant applications are a horrible experience. It's not something I had experience in before and it carried a exhausting learning overhead... But if I could get funding, it would be worth it. As AI become more prominent, I'm sure these organisations are overwhelmed with how many submissions they have.
My conclusion is clear; if it's been this hard to only receive rejections, I'm no longer going to bet on open source. It's clearly not a good business plan.
I consider myself a seasoned developer. So as I'm working on my project, I'm taking on feedback and made improvements throughout.
I still believe in things like kerkhoffs principles. So as part of the continued development, I created a version of the signal protocol.
https://github.com/positive-intentions/signal-protocol
I aim for it to be for production use, but without a third party audit, open source is worthless. When sharing it online, the conversation cannot move past that it's created with AI. It undermines all the time and effort I put into it. I created things like formal proofs/verification and security audits. I kept all the documentation honest that it was created by myself with AI. I think the approach is honest and transparent.
I see the project is well received in various subs, but the cryptography subs that can actually understand what I created, I just risk being banned for sharing AI slop... And thus this close source approach.
Going close source is particularly ambitious because there is an element of "trust me" to it (I don't like it either)... but it appears to be the only way to proceed at the moment.
I don't need it open source so people can debug my code. I open sourced it previously for discussion... I now realise my project is simply too complicated to discuss. It's not for lack of trying.
Have you investigated the open source security audit organizations?
I didn't mean to confuse audits and funding. I meant grant funding could be used to get a security audit.
Ive applied to several. I got an email the other day from NLNet to say they had a record breaking number of applications which is why they are taking so long to evaluate... It's not my first time applying there. I expect they will reject the project (it's for the signal protocol project).
JavaScript has a lot of rhetoric against it being used for cryptography. I've tried to justify the approach, but it was an uphill battle from the onset. My approach is still unique in that it can run locally from index.html without a static server. It's further explained here: https://www.reddit.com/r/CyberSecurityAdvice/comments/1ev5kqn/is_this_a_secure_messaging_app ... That version of the project is deprecated.
Glitr as seen in the main post above, is written in Rust. Not only avoids concerns around web crypto, but also being able to build for multiple platforms. I'm aiming for native build as well as a TUI. (I'm only promoting the webapp because I want to focus on that version first). The main reason for Rust is that there is more mature tooling around cryptography and formal verification.
https://ostif.org/get-an-audit/
But by making yourself closed source, you kill any chances of getting access.
It's not enough for the cryptography to secure. An unverified, unsigned, unhashed index.html that the user still has the same issues outlined in the article above. The supply chain has to be secure as well.
I've approached OSTIF.
"Sadly at this time, OSTIF is unable to provide you with security work. We wish you and your project the best of luck and much success to come."
They suggested to take a look at opentech.fund ... Similarly rejected.
"We very much appreciate your submission to the Open Technology Fund (OTF) for consideration. Upon evaluation, we have decided that OTF is not able to provide financial support for your project at this time."
Going close source is a fairly recent change in direction for my project. I hope it's more clear why Im not going to bet on support by open sourcing my project.
It certainly isn't enough for the cryptography alone to be secure. Cybersecurity is full of nuances when it comes to the supply chain. Concerns around apps like mine running on untrusted browsers sits in contrast to something like the Signal app running on untrusted hardware/OS/networks.
When talking about the supply chain vulnerabilities, security can be easily undermined if you have screen sharing malware on your device. Neither browser or native app can protect against that. As a browser app, you have more flexibility in choice of browser and OS compared to something like Signal.
The rust approach is intended to further break out of that limitation (albeit close-source, unaudited, etc).
"git as a backend" doesnt make sense at all. you didnt answer why this is a better option than signal. it sounds vibe coded.
No, using a directed acyclic graph as a backend for a messaging app makes perfect sense, it's what matrix does!
A significant portion of matrix's problems stem from the fact that it was originally a blockchain research project that somehow turned into a messaging app.
You right. It's slow and unoptimized for it. There is a clear reason this isn't a popular approach.
In the messaging app, I started off by making it so it worked with local-only data. It works over webrtc. I added bells and whistles like the signal protocol and multimedia messaging, but it lacks the ability to send messages offline (because webrtc).
The git approach can allow to publish encrypted messages for peers so when they come and online and your aren't there, it can decrypt a payload specific to them.
With git, it's hardly instant messaging, but I'm working on a feature where git can act as a peer-broker to establish a webrtc connection.
The git approach also would mean that it could work over tor with the signal protocol encryption (albeit hardly instant messaging).
It's a fairly unique approach and there are countless details to consider like how group-messaging would work. So I'll confirm it isn't ready to replace signal or any other app/service.
"Vibecoded" doesn't quite have the bite these days. I've clearly used AI, so let's get that out of the way. In my open source projects I tried to provide code, documentation, live examples. You can find out more about the open source projects at: https://positive-intentions.com/
Feel free to reach out for specifics. While this project is not open source (yet?), I am still trying to make some comprehensive docs.
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.
Resources
Rules
Git Logo by Jason Long is licensed under the Creative Commons Attribution 3.0 Unported License.