I'm still waiting for the day that somebody does a "super simple chat" with NO dependencies. Why do they all need REDIS or some kind of persistence? Why not just hold it in memory?

If you really have a use case where persistence & scaling is an issue you're likely not going to use any of those chat servers anyways.

One of authors is here.

Redis saves data to the disk by default but this can be turned off. That's what we did. GUIDs of connected users are stored in memory with expiration by the 10 min timeout.

I think scalability does not hurt privacy. It's nice to have 10 servers with 40GB memory instead of one with 4GB. Connections between servers can be encrypted with TLS.

"How safe is my tunnel?

Your tunnel remains safe until your password or our servers are not compromised."

uhhh...

Fair enough, huh :) Actually, it's mentioned because we wanted to note it somehow - it's always better to have this set up on your own server

I haven't looked deeply into this implementation, but with OTR's forward secrecy and 3.1+ authentication, is that not enough to defeat even the server being compromised? (meaning, at least you would know it was compromised assuming you trusted the actor on the other end)

If server is compromised, web app source code would probably change to something else.