Bit of an odd intro: I’m a carpenter, 42 years at the bench. I’m the type who can’t stand making the same thing everyone else makes, so I’ve always chased the technical side too - CNC, laser cutting, and lately building software to run my machines.
At some point I wanted to send my own designs to people without them leaking anywhere, and I went down the rabbit hole of how messaging actually works. What got me was realising how much of the “free” stuff is paid for with our privacy. That annoyed me enough that I decided to build my own messenger, mostly to learn. It grew from something simple into a real thing. I called it Sherlock.
Two things I cared about: proper encryption, and NOT tying it to a phone number - I built a different system for that.
I’m not going to pretend I reinvented cryptography. I’m a woodworker who got obsessed. So I’d rather hear it straight from people who actually know this stuff:
- How much does the “no phone number” approach really buy you if I get the rest wrong?
- For a small independent project, what’s the bar before any of you would even consider trusting it - open source, audit, something else?
Genuinely here for the criticism, not the pats on the back.
Honestly, I wouldn’t even consider using it unless it were reviewed by a professional cryptographer. There are already battletested options that don’t require a phone number or sharing info with a company. For that, I like XMPP with a client that uses OMEMO for encryption.
That’s fair, and honestly it’s the right instinct - I wouldn’t tell anyone to bet their safety on something unreviewed either, including mine. I’m one guy who got obsessed, not a cryptographer, and I’m not going to pretend otherwise.
Genuine question since you clearly know the space: for a small independent project, what’s the realistic path to that kind of review? Is a professional audit the only thing that counts, or does open-sourcing the code so people can poke at it move the needle at all on its own?
And thanks for the XMPP/OMEMO pointer - I’ll go read up on how they handle the no-phone-number side, since that’s the part I cared most about.
Is a professional audit the only thing that counts, or does open-sourcing the code so people can poke at it move the needle at all on its own?
To me, open sourcing the code is a move in the right direction but it doesn’t make up for a professional review of your encryption system.
The thing about encryption is that there are many subtle ways to get something wrong, even when just implementing it with a well known and trusted library. I took a deep dive course on Designing Secure Encryption for Practical Use and while I learned a ton from it, the main take away for me was that I shouldn’t do it if its intended for serious use. At least not without expert reviewers.
Regarding XMPP, it’s architecture is like email. Anyone can stand up their own server and your User ID looks like an email address: user@chatserver.org. Like email, you can send messages to anyone on any server if you know their ID. Phone numbers are simply never involved.
If I had a penny for every time I saw an AI written text about someone emphasising being a manual labourer of X years, talking about having built an App, in a post which is clearly written by AI, which use English not being their native language as an explanation for the AI usage, I’d have two pennies, which isn’t a lot, but it’s weird it happened twice.
Honestly, there’s more mature projects that already do all that, and I wouldn’t really see a reason to switch to a possibly vibe coded project, especially if I planned to use it for anything important. Also, most alternative messengers suffer from the network effect - most people won’t switch to a new messenger if they’re already using another, even if that other has clear deficiencies.
Also, this whole ‘I’m a woodsman that wrote a word processor’ thing feels like marketing copy. This isn’t shark tank, you don’t need a sob story. If your app is good, and you work on it consistently, people might join you in working on it and using it.
