maxtaco

It scares me to use something other than something random here because any scheme to remember which nonces you've used before seems bug-prone and vulnerable. As for whether it's called a nonce or IV, I've seen it written as both and IV is 3 characters shorter :)

Agreed.

SJCL is good software and has good defaults for its high-level encrypt function `sjcl.json.encrypt`. It uses CCM so you don't have to MAC in addition to encrypting (as TripleSec does). Depending on what parameters and degree of safety you want for PBKDF2, you might wind up locking up the browser while your keys are being derived. It's hard to speed up this part of the encryption process because it's meant to be intentionally slow to prevent password cracking.

The biggest problem you'll have in building a secure chat app is establishing the connection in the first place. To do that, either the participants will have to share a secret, or there will have to be some sort of public-key based handshakes with certified public keys.

Hi, Max here. I'm happy to answer questions about TripleSec, so let me know.

I wrote a little wrapper while at OkCupid for dealing with adhoc JSON objects in Go, available here: https://github.com/okcupid/jsonw

Thanks for the 1.3 release, I was running out of lowercase letters. I'll try to reply to these concerns in the pull-request, but have been busy. Also, looks like I have rebasing work to do....

The good news is that ICS is working well in practice for us, we're still really happy with it!

A key advantage of fibers of course is that they preserve exception semantics, whereas tame can't in all cases. I'm not too interested in reviving the stalemated thread v. event religious war. I prefer explicitly-managed events, but if others prefer a more thread-like API, by all means....

It's on the list of todos to preserve the input line-numbering in the output code. This would mean some changes to the code emitter, and also to the code emitted to preserve the ordering of statements.

In tame/C++, debugging either compiler or runtime errors is straight-ahead, as the developer doesn't need to examine the mangled code. Now if only JavaScript had the equivalent of cpp's #line directive....

My first thought for implementing tame.js was with yield, but V8 doesn't currently support it (though it's reserved as a "future" keyword). A direct use of yield (without anything like twait) would probably make node code look more like Python/Twisted code, which while better than the status quo, still can get unmanageable in my experience.

Agreed that twait conflates concurrency with blocking/callbacks, but it my experience, it's a natural and useful combination.

Send an email to userfeedback@okcupid.com, subject: gdulli, and I'll ask you to visit a few links. Thanks a lot, I really appreciate the help!

Manual memory management is for the birds. Use something like Boost's shared pointers and you never need to worry about it.

We rarely get complaints such as this one. Would you mind helping me debug it?