Are tox clients also open source

[ugintl]

Are tox clients created by tok, also open source?

[anthonybilinski]

The app "Tok" is unrelated to Toktok that maintains this (c-toxcore) repo.

Toktok's c-toxcore is open source. Clients that use c-toxcore, like all of https://wiki.tox.chat/clients are also open source, as is required by the license of c-toxcore.

"Tok Messenger - Lite" https://play.google.com/store/apps/details?id=com.client.tok.gp (probably) uses the library, with their own changes that make it less secure, but their repo at https://github.com/InsightIM/Tok-Android hasn't had a commit in months, despite their latest release on the play store being 3 days ago. This is a license violation, and a security concern for anyone wanting to use the app.

Some conservation about this before can be found here #1319

I'd recommend against using "Tok Messenger - Lite". Their reviews are seemingly all (except for maybe one) fake, they violate the license despite being contacted multiple times, and they added centralized elements to their fork of toxcore that reduces the security of the app.

If you're looking for an Android client, take a look at:
aTox which uses an old version of c-toxcore and is fully open source an actively developed, TRIfA which uses a modified version of c-toxcore that is still open source and is actively maintained, or Antox which uses an old version of c-toxcore but the app is no longer maintained.

[zoff99]

for a comprehensive list of tox clients rather look at:
https://toktok.ltd/integrations.html
(which is more uptodate)

[nurupo]

@ugintl c-toxcore is licensed under GPL, so any application using c-toxcore has to comply with GPL, which essentially forces those applications to be open source. So yes, Tox clients are opensource, and if there is a client which isn't - it's likely committing a license violation.

Some of our developers have looked into Tok and it appears like it's violating the license by not providing its users with the up-to-date source code of the application. It has also modified c-toxcore in some questionable ways, e.g. everyone using Tok's version of c-toxcore connects to Tok's bot, so Tok knows IP-to-Tox Id relation of everyone using it. I haven't looked into its code past that, so maybe there is more that it's doing. Other developers (I think it was @zugz?) have looked into Tok more than I, so they would know better. They have also requested Tok to provide the up-to-date source code multiple times, which resulted in nothing. It's really frustrating.

Anyone knowledgeable about this whole Tok thing willing to write a blog post about it? I have asked this on IRC before, but it didn't get anywhere.

[ugintl]

I read the conversation shared by @anthonybilinski and I think I will not use tok clients for tox, but the problem is my friends, those are the only clients offering the most features and are updated till nov or dec 19. Why not one of you, copy their clients and improve TRIFA or for that matter any of the tox clients you want to work on. Honestly, I have not found any tox client with good feedback. No offense. I respect you guys work very hard, but I guess I have a point.

[Renha]

This is a license violation

That's not neccesary true. The open source code doesn't need to be published, it could be shared with customer by request, for example.

[Klagio]

aTox which uses an old version of c-toxcore and is fully open source an actively developed, TRIfA which uses a modified version of c-toxcore that is still open source and is actively maintained, or Antox which uses an old version of c-toxcore but the app is no longer maintained.

which do you recommend?

1. I use Antox, which is great, work almost perfect to me. Is it safe to use?
2. I tried Trifa but
   a) it does not allow to use yur previously generated personal TOX ID which is non-sense, I can't send all my friends a new TOX ID, is highly impractical
   b) I couldn't find a way to make Voice call only (without video) ... very strange
3. aTox? Will try now

[zugz]

* Thursday, 2020-02-06 at 03:00 -0800 - Artem Grunichev <[email protected]>:

> This is a license violation That's not neccesary true. The open source code doesn't need to be published, it could be shared with customer by request, for example.

6d in GPLv3 is what's relevant here, I believe. So the corresponding source needs to be available from a network server, with a link (or other "clear directions") to it provided alongside the object code. Maybe you're thinking of 6b -- if the distribution is in a physical medium, it's enough to provide source on request.

[ugintl]

@Renha What would you say about the security issues people are raising about your apps?

Many of us out there wanted to use the apps provided by tok for tox, but now I am really confused. Are these just rumors against Tok?

[Klagio]

Their reviews are seemingly all (except for maybe one) fake

they are definetely full of fake reviews. All chinese beautiful faces. Wonder if Chinese government put that app and those reviews

ANyway useless to me since has not voice calls, just chat

[ugintl]

It is a pity that tox is such a good product, but there is no mobile client which uses its features to the full. I hope it just does not disappear into the shadows of history.

[likern]

It is a pity that tox is such a good product, but there is no mobile client which uses its features to the full. I hope it just does not disappear into the shadows of history.

I think the problem is the license. I started considering to implement TOX-based alternative to Telegram. But it looks like I have to open source my whole commercial application. No doubt it's a deal breaker.

[iphydf]

@likern you only have to make the client open source. You can have backends running tox on network nodes that are closed source.

[redmanmale]

Btw official Telegram clients are open source.

[ugintl]

@redmanmale Can we use telegram clients with tox?

[iphydf]

Theoretically we could take those clients and change the backend code in them to use tox instead. I don't know how they are written so I don't know how hard that would be.

[ugintl]

@iphydf I asked this question because @redmanmale comment is irrelevant to this post if those clients cannot be used with tox or are difficult to adapt. There has to be a reason why he commented.

[redmanmale]

Just answering @likern that license isn't the biggest problem with developing tox clients.
Telegram clients are open source and they haven't lack of contributors.

[likern]

Just answering @likern that license isn't the biggest problem with developing tox clients.
Telegram clients are open source and they haven't lack of contributors.

I don't get your point. I'm a mobile software engineer, I don't want to manage my own servers or having any backend. If I'm correct Tox protocol is decentralised and doesn't require having own servers.

I would / might want to develop first-class mobile client, hire for it's design good UI / UX specialists. And provide paid version.

I'm not sure, but I don't see reasons to only have open-source clients (except license requirements). Security / privacy should be encoded in Tox protocol itself to work in untrusted environment. Open source clients doesn't help in that at all. No one will analyze that code for every commit and verify checksums of every update.

Noone never ever open source main business products - neither Google, nor Facebook, Microsoft, Telegram, etc. They open source only partial, core technologies and get benefits for that (extended testing under different conditions and environments, free testing, free bug submitting, and sometimes free contributions).

For me, to do that professionally, that client would mean "main" / core business. And of course and don't want to open source it - noone need another yet abandoned client without support.

When it comes to Telegram, could you provide links to their open-sourced backend? Couldn't find it. What they have opened clients doesn't change anything at all in terms of business and control. What's the point to not open source clients in this case?

[nurupo]

Security / privacy should be encoded in Tox protocol itself to work in untrusted environment.

Tox protocol can be the most secure/private protocol there is, but it can't stop a client from simply sending a copy of your message to e.g. Chinese government before passing it over to toxcore. So aside from trusting the Tox protocol you also have to trust the client application not to be malicious, which is a lot easier to do if it is open source, as that makes it a lot easier to examine what the client does, and it also allows to build a binary off of the verified source code instead of trusting that the pre-built client used this exact source code, as it could have been built with some unpublished backdoor patches added on top.

[likern]

This is all true. In theory. In reality noone will look at the commits to check against backdoor. Noone will even understand that code (if they decide to look at code) except core contributors or security researchers with devoted resources for analysis against bugs / backdoors.

And of course noone, as usual users, will compile their own verified trusted binary (not talking reproducible builds are a difficult task - you eventually will have to open all build pipeline, which nowadays is quite complex)

Noone compiles Telegram or Signal messaging app from sources, except few nerds (but for them there is already exists open source Tox clients). Even drug sellers or terrorists don't that.

And still for super suspicious people that's possible to provide audited by researchers (giving them access by NDA, if someone willing to pay for that audit) and verifiable app version, without compromising of exclusive rights.

Of course it's all cool to have ability at any time to look at source code (and all it's dependencies with tens of millions LOCs) and "verify" (pretending you will understand them) it at any time. But it's in theory. In reality you barely will find yet another contributor willing to look at your code - even top open source projects are driven by few most active developers and lacks of developers. And tens of security incidents like with ps-tree npm package prove that.

And before compiling you have to audit and verify all build scripts, make files, etc. that they don't do something bad like stealing your ssh private keys they have access to (as arbitrary code execution with user level rights)

[likern]

So reality is more complex. But high quality commercial app client, even with closed sources, will be a good drive for overall Tox project. Such app will satisfy 99.9% of users for whom "trust is enough".

And access to source can still be given for audit / trust / whatever remaining closed source.

But GPL3 is invasive in that terms. I personally always open up my sources under Apache 2.0 version.

[Renha]

What stops you from selling paid open source clients? Open source doesn't mean free as a beer

[likern]

What stops you from selling paid open source clients? Open source doesn't mean free as a beer

Too easy to derive work to which I will put all my professional and financial resources. Because it's open-source.

Too easy for someone else to violate GPLv3 license, just not opening derived code.

Too difficult to prove they derived their code from mine's GPLv3 one. Just to force them to show their code (to prove) you need legally sue them. It's very time-consuming and costs a lot.

Too difficult to oblige someone to open it's code when they violated GPLv3. You need some protectors for that like Free Software Foundation and it's lawers help.

And multiple cases starting from linux videos drivers code, Cisco, etc. to Chinese companies prove that. Even NVidia didn't open their drivers while they should. They use their own interpretation of the license.