Ask HN: What should I verify before releasing a P2P messenger?

6 points by Realman78 3 days ago | 5 comments

I’m releasing 1.0 of an open-source desktop P2P messenger tomorrow - Realman78/Kiyeovo on GitHub. In short, it's a feature rich messenger with clearnet “Fast mode” and an optional Tor-routed “Anonymous mode.” Before the "release" tomorrow, I want to catch anything I might have missed.

For people who have shipped tools from this domain (privacy/messaging/security): what would you verify now that you have less than 24 hours?

firefax 3 days ago |

Verify you have a well established way to contact you about security vulnerabilities. (There will be vulnerabilities. Things like "anonymous mode" are harder than you'd think to make... trust me.)

Realman78 3 days ago | |

The repo is open sourced so issues can be raised. I also included my email inside the app's info dialog

firefax 2 days ago | | |

Cool, for these things it's better to not have the only option be a PR. Good luck with your project!

fullstick 3 days ago |

What have you already verified?

Realman78 3 days ago | |

I have verified that the app works without an issue on clean installations of Ubuntu, Debian and MacOS. I have spent the last 2 days testing the app by pretending to be a malicious user and patched those holes up. I ran the whole app through a detailed security scan using Fable. I went through the whole app and reduced metadata leakage to a bare minimum required by the app to work. I implemented all electron security recommendations. Currently, I'm just doing manual testing which mostly doesnt bring up any bugs, but rather some UI issues (like flickering or text going out of bounds) that I immediately patch