HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
TokTok
c-toxcore
C2016–2025
TokTok / c-toxcore

c-toxcore

The future of online communications.

Systems & InfrastructureSecurity & PrivacyNetworking
Explore on GitHubRead Hacker News discussions
21Distinct people
24Mentions
0Explicit recommenders
2.7KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

The future of online communications.

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year24 dated mentions

Observed mentions: 2016-10-07 17:44:56 UTC to 2025-09-02 13:05:59 UTC.

02462016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20162017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 6 mentions; 1 submissions, 5 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments20202021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 4 mentions; 2 submissions, 2 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2025

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC101
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC615
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC202
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC202
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC202
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC101
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC101
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC404
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC422
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC101

What Hacker News says

24 sources
e2le·Sep 2, 2025
> open source P2P chat messaging with encryption Tox/aTox [0][1] fits that description and both continue to be developed. > Empower criminals so that they cant use this excuse to target civilian infra. According to one webinar from CSIAC (2023) [2], XMPP is popular with Tox slowly catching up. [0]: https://github.com/TokTok/c-toxcore [1]: https://github.com/evilcorpltd/aTox [2]: https://csiac.dtic.mil/wp-content/uploads/2023/03/CSIAC-Webi...
In Europol said ChatControl doesn't go far enough; they want to retain data forever
swiatlo·Jul 16, 2024Submission

Ask: Direct sending and receiving data trought WiFi

It takes a long time to connect to the server. I would like to be able to send data packets directly without connecting to the wifi server. I would create a mesh wifi. (similar https://reticulum.network/, tox https://github.com/TokTok/c-toxcore etc) I would like in root/administrator mode to send and receive packets directly. How to do this in linux? How to send a message when the wifi devices only pass each other for a few or a few tens of seconds for example.
8 points · Open discussion
some_furry·May 23, 2024
> but at the very least I think Bluesky could start with generating a private key on each client device, and then using a simple box algorithm to encrypt messages towards the user they want to talk to. Furry cryptography nerd here. No. This is inadequate. > I don't think https://tweetnacl.cr.yp.to/ is hard to mess up. Yes it is! If you're doing to encrypt some things in a constrained use-case, sure, NaCl is better than hand-rolling it yourself. But it's not sufficient for end-to-end encryption. Here's a few things that TweetNaCl (and other NaCl variants) is, without further protocol design, inadequate to protect against: 1. Invisible Salamanders. NaCl uses xsalsa20poly1305, which is not key-committing. 2. Forward Secrecy. NaCl's crypto_box doesn't give you this at all. 3. Key Compromise Impersonation. See also, Toxcore, which built atop N
Read the rest
aCl: https://github.com/TokTok/c-toxcore/issues/426 4. How do you do group messaging? If you do it as just pairwise, do you use the same public key as your p2p messaging? There's a lot of ways that can subtly go wrong. There is a damn reason end-to-end encryption involves authenticated key exchanges and forward-secure double ratchets.
In Bluesky adds direct messages
peter_d_sherman·Jun 15, 2023
Related: List of Tox clients: https://tox.chat/clients.html What is Tox? https://tox.chat/about.html Tox library source code: https://github.com/TokTok/c-toxcore (Note that I am not interested in the security/cryptography aspects of Tox (if it is indeed secure -- which is questionable/unproven to me at this point in time) -- I am interested in the ability to write Chat/Voice/Video apps around the library (basically apps like Skype, Signal, etc.) To that purpose, Tox (and the tox clients) provide an interesting and potentially very useful source code base...)
In uTox – Lightweight Tox Client
dngray·Apr 12, 2022
The problem with lists like this is they really are just a "here's 100 open source products", without any criteria or individual evaluation. It is often just parrots repeating what other parrots say. Something which is clearly alpha-state isn't usable to regular users shouldn't have a "recommendation". Then you get sub optimal recommendations, listing some projects which are unmaintained etc. With the cleanup at https://privacyguides.org, (since we split from PTIO) we've removed a lot of things, and gone down the part of actually providing guidance rather than "use this software to make you magically more private". I think it's important to think privately, modify behavior rather than rely on technology to do it all for you. Looking at this particular list there are some bad choices: - LessPass: We explicitly removed deterministic passwor
Read the rest
d managers https://github.com/privacyguides/privacyguides.org/pull/323, https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw... - AndOTP: Uses PBKDF2 and a heap of rounds that is unbelievably slow when you have a number of OTPs. Aegis uses Argon, which doesn't have this problem, and we think it's code is developed by someone who is security conscientious. - Qwant: https://github.com/privacyguides/privacyguides.org/pull/342#..., we removed due to "due to bad privacy policies data is collected and shared with third parties" - Silence: Unmaintained, uses SS7 network, should never be recommended. - Off-The-Record: Doesn't cover group chats or other side channels, such as status updates, VOIP. In general XMPP isn't particularly "privacy friendly" https://web.archive.org/web/20211215132539/https://infosec-h... - PGP: NO. It has no forward secrecy, it's a terrible way to encrypt real time communication. - Matrix + Riot client: Seriously, it's been "Element" for ages now, makes me think the author really isn't up to date with current events. - Ricochet: Unmaintained, (2016) domain dead, Only supported .onion HSv2 - Tox + qTox: Developed wrong. They developed the software then decided to write the spec afterwards. There's also https://github.com/TokTok/c-toxcore/issues/426 - Mailfence: Last email I sent to them they don't use any kind of disk encryption - CriptText, these things really don't help, they are walled, in that everyone has to be on a centralized service to get the benefit. E2EE that comes with web-apps can often be dangerous as it can change, have vulnerabilities introduced after an audit etc. - TorBirdy: Unmaintained - Mumble: Not really private - Linphone: Not really private - Rocket Chat: Experimental E2EE - Browser Extensions: NO JUST NO. https://blog.privacyguides.org/2021/12/01/firefox-privacy-20... https://github.com/arkenfox/user.js/wiki/4.1-Extensions - Video Platforms: These are not private - RSS Clients: There are better options - Mobile Operating Systems: Options without Verified Boot. NO. https://source.android.com/security/verifiedboot - Linux recommendations: Those are also awful and don't have any threat model in mind. I'm going to stop now, it's basically every bad thing that was ever on PTIO, that we removed. Basically there are terrible recommendations with a few good ones sprinkled in. This list is *not* maintained!
In Privacy-Respecting Software
shp0ngle·May 8, 2020
I remember back few years ago, they had some very serious foundational mistakes in their protocol, which they handwaved away and started blaming people for pointing them out, as in "it's more important to get something working than do it properly". Not sure if they got better since then. edit: yeah this issue https://github.com/TokTok/c-toxcore/issues/426 and the discussion here (2017) https://news.ycombinator.com/item?id=13392128
In Cross-signing and end-to-end encryption by default

Showing the 15 most recent of 24 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.