Yeah, I can understand that reaction. When I started on Tox, I had a similar reaction. It was a project whose code base was only understood by a single person. The current specification is something irungentoo and I worked on to try and document the workings of the protocol, so that we can then make improvements and allow others to understand it.

I am working on Tox because the basic architecture is sound, even though there are some easy to fix security issues. I've started on a well-documented rewrite, but I had to put that on hold to make time for toxcore itself. Zetok has been working on a rust rewrite. I have good hopes for that project and I support it in any way I can.

We are actively working on making the 19k lines of C code better tested, better understood, and better documented. This takes time, but we're focussing on it and I believe we are making good progress.

Again, I can understand that such a statement incites fear, but saying anything else would be a lie. We're working on it.

If your intention is the same as mine (https://github.com/TokTok/website/blob/master/toktok/mission...), then I would hope we can work together in some way. Whether that means helping with discovery of security flaws, by helping us clarify sections of the spec (at this point we can't really call it a spec yet, it's more of a brain dump of the original author), or any other way, I'm happy to discuss opportunities.

If your intention is to incite rage and hatred, our discussion is over. I hope we can do the former.

EDIT: This last sentence is not intended to point at anyone in particular. It's more of a general "you". I'm thankful to zx2c4 for starting the discussion.

> Again, I can understand that such a statement incites fear, but saying anything else would be a lie.

Thanks for the honesty. It's very much appreciated. I'd hate for somebody to somehow miss critical facts like these, and make a dangerous decision for themselves.

> If your intention is to incite rage and hatred

What a mystifying insinuation, especially toward somebody who actually took the time to try and write a clear explanation of the vulnerability and what KCI is and how resistance to it is an expectation of any modern AKE, etc. Such subtle jabs and hostility toward well-intentioned bug reporters doesn't inspire much faith.

I'm sorry, my words were poorly chosen. I am happy you reported this and I'm very happy with the discussion. This was an "if", not trying to point at you in particular.