• 3 Posts
  • 49 Comments
Joined 4 years ago
cake
Cake day: December 20th, 2021

help-circle






  • Joined 5 hours ago

    Who are you? Even a known and respected cryptographer would not release a tool with such confidence. First you need to request testing and code review before you announce to people that it is a “secure, anonymous file-sharing platform.”

    This is not a community for sharing your personal programming projects for feedback. If you post here, there will be non-technical users who don’t know how to evaluate the security of tools and won’t understand they are taking a huge risk by using your unknown alpha release project.



  • They front a huge percentage of the internet, so you can pretty much guarantee that all of the three-letter agencies have their fingers in Cloudflare’s infrastructure, whether they cooperate willingly or not.

    If you care about your privacy you should avoid these kind of infrastructure monopolies, since they are such a juicy target.







  • You need to put yourself in the shoes of a non-technical person who doesn’t know how to evaluate the relative security of all the tools that are out there available to them. If you are posting your pre-alpha untested software with a title like “Anti-forensic and secure messenger” then there are many people who will read that and think that it’s on an equal footing as the other tools they have heard of. The vast majority of people are not software engineers, and even fewer are cryptographers.

    this project is still in heavy development so without it getting professional security audit i wouldn’t recommend using it for sensitive stuff.

    You’ve got to lead with this.


  • Well a professional security audit would be at the top of the requirements for an established product that has a userbase and some kind of funding, but as a solo developer the least you can do before releasing your software to the world is to have at least one other person who has some experience in security look it over - that’s what I was asking.

    If you can tell people that your software is secure and “anti-forensic” (!) then you must be pretty confident in your understanding of security systems to release that without even a single code review by a peer.