xoron :verified:

Creating decentralized P2P technology. Aiming to provide industry-grade cryptographic capabilities encapsulated into a webapp.

Public Key

npub13mvwlw87pzn2jztgzs88fpzpfpxj5p4m25qyfglkppvwwwznhlvsy25cuk

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsgak80hrlq3f4fp95pgrn5s3q5snf2q6a42qzy50mqsk888pfmlkgpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43qzj34ky

Publishing to

relay.ditto.pub

Author Public Key

npub13mvwlw87pzn2jztgzs88fpzpfpxj5p4m25qyfglkppvwwwznhlvsy25cuk

Show more details

Last Notes

2026-05-28 12:48:28 GMT

Enkrypted.Chat
This is intended to introduce a unique approach in client-side managed secure cryptography. We can avoid registration of any sort.
Features:
PWA
P2P
End to end encryption
Signal protocol
Post-Quantum cryptography
Multimedia
File transfer
Video calls
Local-first
No registration
No installation
No database
TURN server
https://www.reddit.com/r/positive_intentions/comments/1tq1u62/introducing_enkrypted_chat
#Privacy #OpenSource #P2P #WebRTC #Decentralization #DigitalSovereignty #CyberSecurity #FOSS #SelfHosted #NoCloud #AntiCorp #Encryption #WebDev #TechLiberty #PrivateMessaging #Networking #DataPrivacy #InternetFreedom #LocalFirst #SoftwareEngineering #WebApps #ZeroKnowledge #PrivacyTech #IndieDev #NoSignup #NoInstall #DecentralizedWeb #SecureMessaging #BrowserApp #TechEthics #P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #CloseSource #OpenSource #WebDev #GitHub #TechDevelopment #WhatsApp #ChatApp #InstantMessaging #PWA
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/652/271/457/585/955/original/c700bb37afb8bd23.png

2026-04-23 07:27:36 GMT

Decentralized WhatsApp Clone - No Setup or Signup
https://positive-intentions.com
This is intended to introduce a new paradigm in client-side managed secure cryptography. We can avoid registration of any sort. A fairly unique offering for a messaging app.
No need for things like phone numbers or registering to any app stores. There are no databases to be hacked Allowing users to send E2EE messages; no cloud, no trace.
#Privacy #OpenSource #P2P #WebRTC #Decentralization #DigitalSovereignty #CyberSecurity #FOSS #SelfHosted #NoCloud #AntiCorp #Encryption #WebDev #TechLiberty #PrivateMessaging #Networking #DataPrivacy #InternetFreedom #LocalFirst #SoftwareEngineering #WebApps #ZeroKnowledge #PrivacyTech #IndieDev #NoSignup #NoInstall #DecentralizedWeb #SecureMessaging #BrowserApp #TechEthics

2026-04-01 12:39:58 GMT

Is this a #secure #MessagingApp? Maybe not yet, but it’s time to think about #DigitalPrivacy.
Imagine a #Messaging platform that’s as #secure as #Signal but requires #NoRegistration and #NoInstallation. By leveraging #WebRTC for direct #BrowserToBrowser communication, this #OpenSource project eliminates the #Middleman entirely. Simply share a unique #URL to establish an #Encrypted #PrivateChannel. It is a #Lightweight, #Disposable method to bypass #DataHarvesting and reclaim #DigitalSovereignty.
This project introduces a new #Paradigm in #ClientSide managed #Encryption. Send #Secure messages with #NoSetup, #NoCloud, and #NoTrace.
Experience the #Features:
* #PWA (#ProgressiveWebApp) for instant access
* #P2P (#PeerToPeer) connectivity
* #EndToEndEncryption (#E2EE)
* #SignalProtocol & #PostQuantum #Cryptography
* #Multimedia, #FileTransfer, & #VideoCalls
* #NoDatabase & #Stateless architecture
* #TURN server support for reliable connections
While not yet a direct replacement for #Simplex or #WhatsApp, this introduces a unique approach to #SecureCommunication.
Try the #LiveDemo now:
https://p2p.positive-intentions.com/iframe.html?globals=&id=demo-p2p-messaging--p-2-p-messaging&viewMode=story
Explore the #Technical roadmap:
https://positive-intentions.com/docs/technical/p2p-messaging-technical-breakdown
Read the full #Documentation:
https://positive-intentions.com/docs/technical
#PrivacyTech #Privacy #CyberSecurity #Infosec #WebDev #JavaScript #Decentralized #EncryptionProtocol #QuantumResistant #Tech #FOSS #SoftwareEngineering #DataPrivacy #SecureChat #NoLog #P2PChat #WebRTCProtocol #Coding #DevCommunity #DigitalPrivacy #InternetFreedom #SecureMessaging #WebTech #AppDevelopment #CryptographyResearch #PrivateMessaging #WebPlatform #ZeroTrust #Innovation

2026-03-03 18:30:21 GMT

- reply

@nprofile…r70g
An underdable concern. The app runs on a browser, but the aim is for it to not rely on the internet for the static functionally. It's better demonstrated on the open source version where you can run index.html in a browser without a static server (making it portable). Check the readme for more details.
https://github.com/positive-intentions/chat
The Encrypted.Chat app (as seen on the landing page) is currently close-source and far from finished.
That's right that if you open it in a different browser, it'll be a different identity. I'm working towards that not being an issues by moving towards using the filesystem API, but that's further from finished as I consider how to handle encryption-at-rest (a required feature)
@nprofile…463r
Thanks for the interest in my app. I'd like to make it clear a lot of my work is still in development and not ready to replace any other app or service. The app is working as described in the docs. You can reach out for clarity on any details, but at this early stage in development, there will be breaking changes as I introduce improvements like changing the data structure management... so use cautiously.
Ultimately the app is presented for testing and demo purposes as I work towards something that is production-ready(, which is not the case at the moment!)

2026-03-02 13:47:58 GMT

TLDR: I’ve implemented #QuantumResistant #Encryption into my #P2P messaging #webapp using #MLKEM (#Kyber) to protect against future #QuantumComputing threats. Read my latest #Blog post to see how I’m securing #DataPrivacy today.
My journey into #PostQuantum #Security
I’ve been working hard on my latest project update, focusing on how we can protect our #Privacy from the looming threat of "harvest now, decrypt later" attacks. I just finished writing a technical deep dive into how I’ve implemented #QuantumResistant #Cryptography into my #P2P messaging platform.
The core of my approach involves using #MLKEM (formerly #Kyber) to ensure long-term #DataSecurity. I’m particularly proud of the #CascadingEncryption layer I’ve built; by combining #NIST standards with the #SignalProtocol, I'm ensuring that your #Communications remain #Secure even if a single algorithm is compromised in the future.
If you are into #OpenSource, #InfoSec, or #Decentralized #Tech, I’d love for you to read about my implementation and the challenges of bringing #QuantumResistance to the #Browser using #JavaScript.
Read my write-up here:
https://positive-intentions.com/blog/quantum-resistant-encryption
Demo: https://cryptography.positive-intentions.com/?path=/story/cascading-cipher-ml-kem-demo--mlkem-standalone
Crash course in ML-KEM: https://positive-intentions.com/blog/ml-kem-beginner-tutorial
I'm excited to hear what the #Developer and #CyberSecurity community thinks about this #PrivacyFirst milestone!

2026-02-24 07:51:41 GMT

- reply

@nprofile…g04v
I'm trying it out. While I have a basic version of it, there is much to consider. Group messaging isn't working well in the app. 3 people in a group can be a struggle in a P2P system... I basically sent the messages to all the participants.
MLS is good for group messages at a scale and I think I'm a while from being able to demonstrate that.
MLS key updates per epoch are not great on a P2P system where people can be offline.

2026-02-24 06:40:24 GMT

- reply

@nprofile…wlcq
Webrtc doesn't work well on the tor network. (UDP isnt supported)
As an alternative, I'm investigating on having peers use different turn servers relay messages to provide an extra layer of IP masking.

2026-02-24 06:33:00 GMT

- reply

I'm trying it out. While I have a basic version of it, there is much to consider. Group messaging isn't working well in the app. 3 people in a group can be a struggle in a P2P system... I basically sent the messages to all the participants.
MLS is good for group messages at ascale and I think I'm a while from being able to demonstrate that.
MLS key updates per epoch are not great on a P2P system where people can be offline.

2026-02-23 14:48:12 GMT

- reply

@nprofile…7cp4
fraid so.i would prefer to void it, but seemed nessesary. i had an older version of it that was using the js primitives from the browser, but the issue there was that crypto primitives were not always provided by the browsers and different browsers have their only roadmap for supporting it.
so rust to wasm was a reliable way to get the crypto primitives needed. that was how it was done on several other projects including the official signal one.

2026-02-23 14:28:19 GMT

Signal Protocol for a P2P Webapp
TL;DR: I have open-sourced a #Rust implementation of the #SignalProtocol that compiles to #WASM for #Browser-based #P2P messaging, overcoming the #NodeJS limitations of the official library.
I am sharing my implementation of the Signal Protocol designed specifically for the #Frontend. While the official libsignal is the gold standard, its #JavaScript targets are often optimized for Node.js, which creates integration challenges for client-side web applications.
My version is built in #RustLang and compiles to #WebAssembly, utilizing #ModuleFederation to provide robust #Encryption for decentralized environments. It currently powers the end-to-end security for my #P2P messaging project.
Protocol Demo:
https://signal.positive-intentions.com/
P2P App Demo:
https://p2p.positive-intentions.com/iframe.html?globals=&id=demo-p2p-messaging--p-2-p-messaging&viewMode=story
I am looking for feedback from the #Dev and #Infosec community. If you have experience with #Cryptography audits or formal-proof verification, I would appreciate your eyes on the codebase as I work toward a more finished state.
GitHub Repository:
https://github.com/positive-intentions/signal-protocol
#Signal #SignalProtocol #Rust #RustLang #WASM #WebAssembly #OpenSource #OSS #Privacy #Encryption #E2EE #WebDev #Frontend #BrowserTech #Decentralized #WebApps #Coding #Security #SoftwareEngineering #Networking #PeerToPeer #P2P #Cryptography #Audit #CyberSecurity #Tech #JavaScript #Programming #ModuleFederation #P2PWeb #PrivacyTech #SecureMessaging #WebPerf #TechCommunity #InfoSec #WebSecurity
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/120/408/254/062/724/original/8dda0f088ae8bd0a.png

2026-02-17 12:52:56 GMT

Local-Only File Encryption with JavaScript.
I've been exploring the #WebCryptoAPI and I'm impressed!
When combined with the #FileSystemAPI, it offers a seemingly secure way to #encrypt and #store files directly on your device. Think #localstorage, but with #encryption!
I know #webapps can have #security vulnerabilities since the code is served over the web, so I've #OpenSourced my demo! You can check it out, and it should even work if #selfhosted on #GitHubPages.
Live Demo: https://dim.positive-intentions.com/?path=/story/usefs--encrypted-demo
Demo Code: https://github.com/positive-intentions/dim/blob/staging/src/stories/05-Hooks-useFS.stories.js
About the Dim framework:
https://positive-intentions.com/docs/category/dim
IMPORTANT NOTES (PLEASE READ!):
* This is NOT a product. It's for #testing and #demonstration purposes only.
* It has NOT been reviewed or audited. Do NOT use for sensitive data.
* The password encryption currently uses a hardcoded password. This is for demonstration, not security.
* This is NOT meant to replace robust solutions like #VeraCrypt. It's just a #proofofconcept to show what's possible with #browser #APIs.
#Encryption #Cryptography #JavaScript #Frontend #Privacy #Security #WebDevelopment #Coding #Developer #Tech #FOSS #OpenSource #GitHub #MastodonDev #Programming #WebStandards #FileSystem #WebAPI #ProofOfConcept

2026-01-27 17:27:30 GMT

- reply

@nprofile…7jpv
Webrtc replies on exchanging ip addresses. It could help to use a VPN. A previous post about it: https://www.reddit.com/r/CyberSecurityAdvice/s/xZ2RjykZKX
If you register on metered.ca and use you own API key in the app, there is an additional option unlocked for "relay mode" for messages so the IP of the peer isn't exposed... It would however exposed it to the metered.ca turn servers. This also strays further from the direct browser-to-browser connection.

2026-01-27 10:09:46 GMT

- reply

@nprofile…2e5r
thanks!
the key focus is that its presented as a webapp to reduce friction in getting-started.
i took a look at your website andto quote you, its the approach i think "aims to be accessible to the widest possible audience, with a focus on those less tech-savvy"
i wouldnt like to have it "only" in the browser. i hope to have native app version when this app reaches a reasonable level of stability. using something like Tauri or CapacitorJS, i would use the same codebase.

2026-01-27 09:27:54 GMT

A high-performance WhatsApp alternative has emerged that operates entirely on a peer-to-peer basis. This tool requires no installation, no account sign-up, and no centralized servers to facilitate messaging.
By leveraging WebRTC for direct browser-to-browser communication, it eliminates the middleman entirely. Users simply share a unique URL to establish an encrypted, private channel. This approach effectively bypasses corporate data harvesting and provides a lightweight, disposable communication method for those prioritizing digital sovereignty.
The project is open-source and focuses on the core utility of instant messaging without the bloat of modern social ecosystems.
The project is far from finished and presented for testing, feedback and demo purposes (USE RESPONSIBLY!).
Technical breakdown: https://www.reddit.com/r/CorpFree/comments/1qnouh8/whatsapp_clone_but_peertopeer_no_install_or_signup
Demo: https://p2p.positive-intentions.com/iframe.html?globals=&id=demo-p2p-messaging--p-2-p-messaging&viewMode=story
#Privacy #OpenSource #P2P #WebRTC #Decentralization #DigitalSovereignty #CyberSecurity #FOSS #SelfHosted #NoCloud #AntiCorp #Encryption #WebDev #TechLiberty #PrivateMessaging #Networking #DataPrivacy #InternetFreedom #LocalFirst #SoftwareEngineering #WebApps #ZeroKnowledge #PrivacyTech #IndieDev #NoSignup #NoInstall #DecentralizedWeb #SecureMessaging #BrowserApp #TechEthics
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/966/344/526/705/051/original/4043eb1d813feddf.png

2026-01-06 14:40:25 GMT

WhatsApp Clone... But Decentralized and P2P Encrypted (No Install or Signup)
The following is a technical breakdown of progress and how it works.
https://programming.dev/c/[email protected]
#P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #CloseSource #OpenSource #WebDev #GitHub #TechDevelopment #WhatsApp #ChatApp #InstantMessaging

2025-12-15 17:57:38 GMT

Encrypted P2P Messaging App
Want to send E2E encrypted messages and video calls with no downloads, no sign-ups and no tracking?
This prototype uses PeerJS to establish a secure browser-to-browser connection. Using browser-only storage—true zerodata privacy!
enkrypted.chat
The aim is to have an experience as close to Whatsapp as reasonably possible so that the experience is intuitive.
Some features include:
P2P
End to end encryption
Browser-based
No installation/registration
Messaging
Text Messaging
Multimedia Messaging
File Transfer
Video Calls
Data Ownership
passkeys-based encryption
Local-Only storage
Encrypted at rest
NOTE: This is still a work-in-progress and a close-source project. To view the open source MVP see here. It has NOT been audited or reviewed. For testing purposes only, not a replacement for your current messaging app.
Reddit: https://www.reddit.com/r/positive//_intentions
Mastodon: https://infosec.exchange/@xoron
Docs: https://positive-intentions.com

2025-11-28 16:55:34 GMT

- reply

@nprofile…qrqf
thanks?! I hope it's not coming across as spam.

2025-11-28 14:31:16 GMT

Want E2E encrypted messages and video calls with no downloads, no sign-ups and no tracking?
This prototype uses webRTC to establish a secure browser-to-browser connection. Everything is ephemeral and cleared when you refresh the page—true zerodata privacy!
Check out the pre-release demo here: https://p2p.positive-intentions.com/iframe.html?globals=&id=demo-p2p-messaging--p-2-p-messaging&viewMode=story
(For those who have seen it before, i've added fixes and improvements throughout, so it might still be worth checking out)
NOTE: This is still a work-in-progress and a close-source project. Its far from finished and doesnt have the user-experience needed to promote the project to a wider audience. The implementation is based on the open source MVP seen [here](https://github.com/positive-intentions/chat). It has NOT been audited or reviewed. For testing purposes only, not a replacement for your current messaging app.
* Docs: https://positive-intentions.com/docs/category/sparcle
* Reddit: https://www.reddit.com/r/positive/_intentions
* More: https://positive-intentions.com
#P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #CloseSource #OpenSource #WebDev #GitHub #TechDevelopment #WhatsApp #ChatApp #InstantMessaging
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/627/802/789/844/363/original/55b70e21db73542d.png

2025-11-02 10:26:42 GMT

Application-Level Cascading Cipher
https://positive-intentions.com/blog/cascading-cipher-encryption
#encryption #cryptography #defenseindepth #AES #DiffieHellman #MLSCrypto #SignalProtocol #browsercrypto #JavaScriptsecurity #cascadingcipher #layeredencryption #WebCryptoAPI #security

2025-10-27 10:31:30 GMT

E2EE P2P Messaging App
I recently introduced [metered.ca](http://metered.ca) for the STUN/TURN servers and the stability has hugely improved and so i'd like to ask for your feedback if you'd like to try it out.
Demo: https://p2p.positive-intentions.com/iframe.html?globals=&id=demo-p2p-messaging--p-2-p-messaging&viewMode=story
Data isnt persisted (yet), so each page refresh will clear all keys.
(IMPORTANT: For testing and demo purposes only. This is a work-in-progress and far from finished. It has not been reviewed or audited. Do not use it for sensitive data.)
#P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #Encrypted #infosec #cryptography #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #WebDev #TechDevelopment #ChatApp #javascript #InstantMessaging
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/445/639/032/610/932/original/6596b735de9d7e62.png

2025-10-16 08:06:04 GMT

🔔 Update: Changes Coming to https://positive-intentions.com 🔔
We’re planning to introduce analytics and ads on our website and blog (). We’ll be testing solutions from Google, Facebook, and possibly others.
To stay competitive with platforms like WhatsApp and Telegram, new projects will be closed-source.
**Why this change?**
Unfortunately, we haven’t been able to build a sustainable open-source model.
**What about current open-source projects?**
Existing open-source projects will remain open and free from invasive analytics or ads. They continue to showcase transparency and innovative ideas.
#OpenSource #Transparency #TechUpdate #Analytics #Ads #Privacy #WebDevelopment #PositiveIntentions #Sustainability #TechNews #Mastodon #Community #Innovation #SoftwareDevelopment #DigitalEthics #P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #CloseSource #OpenSource #WebDev #GitHub #TechDevelopment #WhatsApp #ChatApp #InstantMessaging

2025-10-09 08:50:26 GMT

- reply

@nprofile…j077 thanks for the heads up.

2025-10-09 07:48:08 GMT

Want to send messages and video calls with:
* no installs
* no sign-ups
* no tracking
* end-to-end encryption
This new prototype uses PeerJS to establish a secure browser-to-browser connection. Everything is ephemeral and cleared when you refresh the page—true zerodata privacy!
Check out the [testable demo here](https://p2p.positive-intentions.com/iframe.html?globals=&id=demo-p2p-messaging--p-2-p-messaging&viewMode=story).
I am working towards a look-and-feel to match Whatsapp as seen in this [hardcoded UI demo](http://glitr.positive-intentions.com).
IMPORTANT NOTE: This is still a work-in-progress and a close-source project. It is based on the open source MVP see [here](https://github.com/positive-intentions/chat). It has NOT been audited or reviewed. For testing purposes only, not a replacement for your current messaging app.
* Docs: [https://positive-intentions.com/docs/category/sparcle](https://positive-intentions.com/docs/category/sparcle)
* Reddit: [https://www.reddit.com/r/positive\_intentions](https://www.reddit.com/r/positive_intentions)
* GitHub: [https://github.com/positive-intentions](https://github.com/positive-intentions)
#P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #CloseSource #OpenSource #WebDev #GitHub #TechDevelopment #WhatsApp #ChatApp #InstantMessaging

2025-10-06 17:20:06 GMT

Want encrypted #WebRTC video calls with no downloads, no sign-ups, and no tracking?
This prototype uses PeerJS to establish a secure browser-to-browser #connection. Everything is ephemeral and cleared when you refresh the page—true #zerodata #privacy!
Check out the #democall: P2P Call
NOTE: This is a close-source project and has NOT been audited or reviewed. For testing purposes only, not a replacement for your current #messaging app. #decentralized #p2p #app #techdemo #webstandards
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/328/362/285/971/130/original/c71f36980b521045.png

2025-09-10 14:14:50 GMT

Help me understand if ChatControl could affect my P2P messaging app.
im working on a proof-of-concept messaging app. it has a fairly unique architecture which i think makes it so ChatControl wouldnt affect it... but im not an expert in laws, so im sure im not asking the right questions. any guidance is appriciated.
to make things clear: my project is far from finished. its pretty experiemental, unstable and buggy. im not at a stage where i can say my app is watertight... but that is my general aim.
i think the code for my app is too complicated and not well documented for anyone to pick up and look at in their spare time, so i think its better i describe how it works (please reach out for clarity on any details i may miss!). i hope it can be used to determine how ChatControl can apply to my project.
- im working on a fully client-side messaging app. cryptography is done client-side using browser API's to generate encryption keys. messages are encrypted client-side and decrypted on the recieving client-side
- as a webapp i can avoid installation and registration so there are no databases with registered users that can be compromized. user ID's are cryptographically random. this allows allows profiles to be as ephemeral or persistent as the user wants.
- the app is using webrtc to exchange messages which are then stored on the recieving device client-side only. there is no database storing "pending" messages. if your peer is offline, you cannot send a message.
there are a lot of nuances to a p2p-only messaging app, but i hope that by reducing the amount of infrastructure, it can simplify e2ee.
i dont think its written well enough to be worth your time to do a deep dive into my code, but you can find it here: https://github.com/positive-intentions/chat

2025-08-24 07:54:04 GMT

- reply

@nprofile…a4xd
It's mainly provided for testing and demo at the moment.
It's secure and functional, but there is more that needs to be done before it's ready for general use. (Like security audits and peer review).
I hope that gives clarity. Thanks for taking an interest!

2025-08-23 18:38:46 GMT

- reply

@nprofile…nx3k ha! I like your whale. And yeah I did draw the whale in the logo.
I'm glad you called it a whale. Loads of people think it's a fish... I can't take it personally... I'm hardly an artist.

2025-08-23 18:17:57 GMT

Send files privately. No cloud. No trace.
https://glitr.io
I’m working towards something for #secure / #private / #simple #P2P #filetransfer. It isnt as “simple” as it could be, im still working on it, but ive got it down to:
Zero-installation as a #PWA
Zero-registration by using local-only storage
#P2P-authentication using #WebCryptoAPI
Fast #datatransfer using #WebRTC, #syncthing, #croc, #sphynctershare and countless others. the key difference in my approach is that its a #webapp thats ready to go without any "real" setup process. you just need a browser.
I’m aware there are things like #SFTP and several other established protocols and tools. I started doing this because I was learning about #WebRTC and it seems suprisingly capable. This isnt ready to replace any existing apps or services.
(Note: I know you guys are typically interested in #opensource code. this project is a spin-off from a bigger project: https://github.com/positive-intentions/chat)
Let me know what you think about the app, features and experience you would expect from a tool like this.
---
SUPER IMPORTANT NOTES TO PREVENT MISLEADING:
These projects are not ready to replace any existing apps or services.
These projects are not peer-reviewed or security audited.
The chat-app is #opensource for transparency (as linked above)... but the file-app is not open souce at all (especially spicy when not reviewed or audited.).
All projects behind positive-intentions are provided for testing and demo purposes only.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/079/447/879/508/524/original/436700f8e0dfca03.png

2025-08-23 18:02:33 GMT

Selhosted P2P E2EE File Transfer & Messaging PWA
https://positive-intentions.com
* #OpenSource
* #CrossPlatform
* #PWA
* #iOS, #Android, #Desktop (self compile)
* App store, Play store (coming soon)
* Desktop
* #Windows, #MacOS, #Linux (self compile)
* run `index.html` on any modern #browser
* #Decentralized
* #Secure
* #NoCookies
* #P2P #encrypted
* No registration
* No installing
* #Messaging
* Group Messaging (coming soon)
* Text Messaging
* #Multimedia Messaging
* #Screensharing (on desktop browsers)
* Offline Messaging (in #research phase)
* #FileTransfer
* #VideoCalls
* #DataOwnership
* #SelfHosted
* GitHub pages Hosting
* #LocalOnly storage
Check them out!
(Degoogled links to the apps)
- P2P Chat: https://chat.positive-intentions.com
- P2P File: https://file.positive-intentions.com
- Encrypted drive storage: https://dim.positive-intentions.com/?path=/story/usefs--encrypted-demo
- GitHub: https://github.com/positive-intentions
IMPORTANT NOTES (PLEASE READ!):
* These are NOT products. It's for #testing and #demonstration purposes only.
* They have NOT been reviewed or audited. Do NOT use for sensitive data.
* All functionality demonstrated is experimental.
* This is NOT meant to replace robust solutions like #VeraCrypt, #Simplexchat, #Signal, #Whatsapp, #wetransfer. It's just a #proofofconcept to show what's possible with #browser #APIs.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/079/390/353/880/012/original/e2003109f41d5414.jpg

2025-08-23 17:58:12 GMT

File Encryption with JavaScript.
I've been exploring the #WebCryptoAPI and I'm impressed!
When combined with the #FileSystemAPI, it offers a seemingly secure way to #encrypt and #store files directly on your device. Think #localstorage, but with #encryption!
I know #webapps can have #security vulnerabilities since the code is served over the web, so I've #OpenSourced my demo! You can check it out, and it should even work if #selfhosted on #GitHubPages.
Live Demo: https://dim.positive-intentions.com/?path=/story/usefs--encrypted-demo
Demo Code: https://github.com/positive-intentions/dim/blob/staging/src/stories/05-Hooks-useFS.stories.js
About the Dim framework:
https://positive-intentions.com/docs/category/dim
IMPORTANT NOTES (PLEASE READ!):
* This is NOT a product. It's for #testing and #demonstration purposes only.
* It has NOT been reviewed or audited. Do NOT use for sensitive data.
* The "password encryption" currently uses a hardcoded password. This is for demonstration, not security.
* This is NOT meant to replace robust solutions like #VeraCrypt. It's just a #proofofconcept to show what's possible with #browser #APIs.
#Encryption #Cryptography #JavaScript #Frontend #Privacy #Security #WebDevelopment #Coding #Developer #Tech #FOSS #OpenSource #GitHub #MastodonDev #Programming #WebStandards #FileSystem #WebAPI #ProofOfConcept
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/079/372/849/664/609/original/d9aacb28313242fd.jpg

2025-08-12 08:15:10 GMT

Building secure peer-to-peer messaging apps is tough, and it's even tougher to get people to switch from what they already use. I've noticed that a great user interface and an intuitive design often matter more to people than terms like cryptography or end-to-end encryption.
That's why I've started building a UI library to tackle this head-on! It's a work in progress, but the goal is to create a more welcoming and seamless experience for new users.
Check out the UI library here: https://ui.positive-intentions.com
And you can see a live demo of the UI in action here: https://glitr.positive-intentions.com
I'd love to hear your thoughts and feedback as I continue to shape it!
#PeerToPeer #SecureMessaging #P2P #UIUX #WebDevelopment #MaterialUI #ModuleFederation #DesignSystem #Cryptography #UI

2025-08-03 09:31:54 GMT

An #E2EE messaging app unaffected by #ChatControl
* App: https://chat.positive-intentions.com/
* Code: https://github.com/positive-intentions/chat
* Mastodon: https://infosec.exchange/@xoron
* Reddit: https://www.reddit.com/r/positive_intentions
How it works: https://positive-intentions.com/docs/projects/chat
TLDR: I'm working on a #P2P messaging #webapp. Webapps are generally not considered secure because of the nature of serving statics over the internet. This is correct, but not a limitation of this project. (#selfhosting options: https://positive-intentions.com/blog/docker-ios-android-desktop).
As a webapp, I can provide the app with zero-installation and no-registration. The app is only using (local-only) browser storage (specifically #indexedDB). So in a P2P interaction, the traditional concept of "the cloud" is just the physical devices connected over #WebRTC. This allows for things like P2P authentication: https://positive-intentions.com/blog/security-privacy-authentication.
Future:
I'm aiming to create the most secure messaging app out there... (more than #Signal, #Simplex, #threema, #session, #deltachat, #bitchat, etc). I know I have a long way to go to get there. The UI is fairly ugly for the average user, but I think the mechanics are working as expected. I think #JavaScript is underrated in what you can do with it. I'm actively investigating improving the #encryption approach further to align to how the Signal protocol works (currently using a #DiffieHellman key-exchange).
Support:
In the age of #ChatControl, I would like to keep this project #opensource, but open-source funding is not working for me. I don't want your donations (but don't let that stop you) because it isn't sustainable for a long-term project. I have so far only experienced grant-funding rejections. I have no idea what I'm doing in trying to get funding for this project, so any support/advice is appreciated. In recognition of the project in its current state not being able to get funding... (sorry) I will have to go #closedsource (which I'd like to avoid because it undermines several #cybersecurity claims I'd like to make). I don't accept collaboration on the project because this would make tough decisions like going closed-source also immoral.
#privacy #security #messaging #decentralized #peer2peer #webdev #cryptography #selfhosted #FOSS #tech #infosec #developer #funding #startup

2025-07-30 07:09:17 GMT

- reply

@nprofile…te5v hey. Just seeing this now. That's sounds great.
Collaboration on this project is something I'd like to work towards. I think it involves me creating a lot more documentation to help explain how it works... I hope breaking things up into things like ui-library, P2P-framework, etc. could help make it easier.

2025-07-29 17:31:22 GMT

- reply

@nprofile…te5v no offence taken. I completely understand... It's what leads to creating this new UI library. Trying to get that consistent professional look and feel 🤞
Rebranding is something I keep pushing back. I tell myself that it's best to go all-in on the rebranding when I have a product that looks like more professional.

2025-07-29 16:24:55 GMT

- reply

@nprofile…te5v thanks.
Someone else also gave similar advice... I don't know much about what I'm doing, but I plan to do a rebranding at some point to "Glitr.io"

2025-07-29 07:43:39 GMT

Quick project update on my new UI component library based on Material UI. Hitting a key milestone on bringing a sleek and powerful UI to life for my apps. More to share soon!
#WebDevelopment #FrontendDev #javascript#ReactJS #MUI #Developers #Programming #DesignSystem #components #ComponentLibrary #AppDev #DevelopmentUpdate #CodeProgress #SoftwareDevelopment #PrivateProject #sideproject
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/935/398/003/477/713/original/fa3954690b7780df.png

2025-07-27 15:44:00 GMT

Roast my docs
https://positive-intentions.com
Some say they don't know what my project is about. My website is the nearest thing to documentation I have for my app.
I think as I work more on the project, it's spawning into multiple projects and the documentation is become disorganised.
Are there any tips or resources for me to take a look at for organising my docs/website?
I want it to be the go-to place to find out information about my project. So it needs to be technical, but also coherent... I don't think I have enough of either.

2025-07-26 07:08:30 GMT

Decentralized Module Federation For Microfrontends
https://positive-intentions.com/blog/decentralised-architecture
#javascript #ModuleFederation #webpack #Microfrontend #opensource

2025-07-21 08:57:32 GMT

#Decentralized #Module #Federation #Microfrontend #Architecture
I'm working on a #webapp and I'm being #creative on the #approach. It might be considered #overcomplicated (because it is), but I'm just trying something out. It's entirely possible this approach won't work #longterm. I see it as there is #onewaytofindout. I don't recommend this approach. Just sharing what I'm trying/#investigating.
How it will be #architected: [https://positive-intentions.com/blog/decentralised-architecture](https://positive-intentions.com/blog/decentralised-architecture)
Some #benefits of the #approach: [https://positive-intentions.com/blog/statics-as-a-chat-app-infrastructure](https://positive-intentions.com/blog/statics-as-a-chat-app-infrastructure)
I find that #modulefederation and #microfrontends to generally be #discouraged when I see posts, but I think it works for me in my #approach. I'm #optimistic about the approach and the #benefits and so I wanted to #share details.
When I serve the #federatedmodules, I can also host the #storybook statics so I think this could be a good way to #document the modules in #isolation.
#Cryptography modules - [https://cryptography.positive-intentions.com/?path=%2Fdocs%2Fcryptography-introduction--docs](https://cryptography.positive-intentions.com/?path=%2Fdocs%2Fcryptography-introduction--docs)
#P2P framework - [https://p2p.positive-intentions.com/?path=%2Fdocs%2Fe2e-tests-connectionstatus--docs](https://p2p.positive-intentions.com/?path=%2Fdocs%2Fe2e-tests-connectionstatus--docs)
This way, I can create #microfrontends that consume these #modules. I can then #share the #functionality between #apps. The following apps are using a different codebase from each other (there is a #distinction between these apps in #opensource and #closesource). Sharing those #dependencies could help make it easier to roll out #updates to #coremechanics.
#P2P chat - [https://chat.positive-intentions.com/](https://chat.positive-intentions.com/)
#P2P file transfer - [https://file.positive-intentions.com/](https://file.positive-intentions.com/)
The #functionality also works when I create an #Android build with #Tauri. This could also lead to it being easier to create #newapps that could use the #modules created.
I'm sure there will be some distinct #test/#maintenance #overhead, but depending on how it's #architected I think it could work and make it easier to #improve on the current #implementation.
Everything about the #project is far from finished. It could be seen as this is a #complicated way to do what #npm does, but I think this #approach allows for greater #flexibility by being able to #separate #opensource and #closesource code for the #web. (Of course as #javascript, it will always be "source code available". Especially in the age of #AI, I'm sure it's possible to #reverseengineer it like never before.)
(mastodon might not be the place for something like this, so let me know if you dont like this kind of content. i typically post on reddit and would like to shift it more towards mastodon. i also use lemmy, but mastodon has a better reach.)

2025-07-18 14:31:43 GMT

https://glitr.io
im looking for feedback on my project.
IMPORTANT NOTES (PLEASE READ!):
* this is NOT a product. It's for #testing and #demonstration purposes only.
* It has NOT been reviewed or audited. Do NOT use for sensitive data.
* All functionality demonstrated is experimental.
* This is NOT meant to replace robust solutions like #magicwormhole
#p2p #e2ee #encrypted #pwa #javascript #filetransfer #webrtc #secure #cybersecurity
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/874/702/390/960/388/original/a1389597225ff0e8.png

2025-07-15 09:41:02 GMT

- reply

@nprofile…k22t
so basically its using webrtc as you suggested. i added something else on top to handle my own encryption keys. while webrtc is already encrypted, the additional layer of encryption can be used to do things like validate public-key hashes (to prevent mitm).
i havent settle on the implementation enough to derfine a protocol around it, but thats on the todo.
there is no need for things like nginx. its selfhosted from the static binaries.
https://github.com/positive-intentions/chat
in that repo, there is a "Frontend" folder. that is what you typically serve with nginx... in the case of this app you can just run index.html without node or nginx. there are no databases involved in the stack because storage is all provided by the browser (im using indexDB to allow for a large capacity)
activitypub and nostr are good tried-and-tested protocols as is the one for signal, but ultimately im trying out what i think is a unique approach in "how it works" and i dont think its implemented well enough to demonstrate it... so more effort from me needed to get there.
WebVR is more a an gimmick/investigation into how far i can push the p2p framework im developing. the biggest challenge there would be to create an experience that users find useful and enjoyable (compared to something like a video call).
im sure i need to work on my communication with regards to the project. im glad you like that decentralized architecture page, i tried to be thorough in it, but its a heavy document for me to point to as "clarity".
let me know if this answers or raises questions... its at least helpful for me to be able to practice in communicating such concepts.

2025-07-15 08:05:50 GMT

- reply

@nprofile…y5sz
are you able to advise about how i can go about hiring someone to do the application process for me?
maybe there is a better tone or communication style needed for this that im not doing.
ive tried doing it myself a few times, but it seems to have always been rejected.
the feedback i get leads me to think people like the concept... so i think it isnt entirely bad.

2025-07-15 07:38:13 GMT

- reply

@nprofile…k22t
as a webapp i provide it with a DNS... it works as a html file from your desktop without something like a static server. you can also host it for free on github pages.
perhaps this helps: https://positive-intentions.com/blog/docker-ios-android-desktop
the webXR is quite interesting if i can pull it off. id like to add hand-tracking in AR so i can then use it to interact with things in AR. 8thwall has a nice demo of this, so its definately possible, but i think it might be a while before i get there. https://www.8thwall.com/products/human-ar
issues around when a developer discontinues a project are especially something to be catious about in my case because its a side project.. its open source and ive provided a reasonable amount of documentation and transparency, but thats the best i can offer at the moment.

2025-07-14 21:14:20 GMT

- reply

@nprofile…xe8c
It could be possible, but at the moment I dont have anything formalised into a protocol.
I hope a related p2p-framework project could lead to some formal standard, but I can't promise anything at this stage.
(I've already seen the xkcd standards meme)

2025-07-14 14:35:19 GMT

- reply

@nprofile…te5v
thanks! ive tried a few european grant applications and so far all of them rejected my project 😢. i tried things like @nprofile…klwf and @nprofile…4kmp (and many more)
it could just be that im no good at applying for grants, so any advice there would also be great.
as for proton, is this the org you mean? https://proton.me/foundation (ive just sent them an email 🤞 )

2025-07-14 12:43:46 GMT

👋 Hey #FOSS community! Need your wisdom on grant funding...
I've been developing a decentralized chat app that challenges the centralized model - think WhatsApp but with zero servers, complete privacy, and VR capabilities built right into the browser.
🔍 What makes it different:
- Runs entirely in browser (JavaScript/PWA)
- Direct P2P connections via WebRTC
- Industry-grade encryption by default
- Experimental AR/VR shared spaces
- Users own 100% of their data
The project is open-source and functional, but needs funding to:
- Improve security auditing
- Expand mobile platform support
- Develop accessibility features
- Build developer documentation
Has anyone had success with grants for privacy-focused or decentralization projects? Especially interested in orgs that value user empowerment over profit.
🔗 https://github.com/positive-intentions/chat
#Privacy #Decentralization #WebRTC #Grants #OpenSource #P2P

2025-07-03 10:37:18 GMT

Selhosted P2P E2EE File Transfer & Messaging PWA
* #OpenSource
* #CrossPlatform
* #PWA
* #iOS, #Android, #Desktop (self compile)
* App store, Play store (coming soon)
* Desktop
* #Windows, #MacOS, #Linux (self compile)
* run `index.html` on any modern #browser
* #Decentralized
* #Secure
* #NoCookies
* #P2P #encrypted
* No registration
* No installing
* #Messaging
* Group Messaging (coming soon)
* Text Messaging
* #Multimedia Messaging
* #Screensharing (on desktop browsers)
* Offline Messaging (in #research phase)
* #FileTransfer
* #VideoCalls
* #DataOwnership
* #SelfHosted
* GitHub pages Hosting
* #LocalOnly storage
Check them out!
https://positive-intentions.com
(Degoogled links to the apps)
- P2P Chat: https://chat.positive-intentions.com
- P2P File: https://file.positive-intentions.com
- Encrypted drive storage: https://dim.positive-intentions.com/?path=/story/usefs--encrypted-demo
- GitHub: https://github.com/positive-intentions
IMPORTANT NOTES (PLEASE READ!):
* These are NOT products. It's for #testing and #demonstration purposes only.
* They have NOT been reviewed or audited. Do NOT use for sensitive data.
* All functionality demonstrated is experimental.
* This is NOT meant to replace robust solutions like #VeraCrypt, #Simplexchat, #Signal, #Whatsapp, #wetransfer. It's just a #proofofconcept to show what's possible with #browser #APIs.

2025-06-28 18:58:10 GMT

Are Web Components & Cybersecurity A Better Combo?
I'm not trying to dunk on popular #UI #frameworks – I'm sure they're totally fine for #cybersecurity stuff, probably get loads of reviews and #audits.
But from my angle: Web Components are *native* to the #browser. Doesn't that just inherently reduce the risk of **#SupplyChainAttacks** (you know, like a rogue `npm install` on a bad network) for your #AppSecurity?
Or am I overthinking it, and the #framework choice is less important than the #browser, #OS, or #device running it? What are your thoughts, #DevCommunity?
---
Quick context: I've got a #ReactJS #messagingApp (repo here: https://github.com/positive-intentions/chat) and a separate #UIFramework (repo here: https://github.com/positive-intentions/dim) built with #Lit (which uses Web Components). I'm genuinely wondering if there's a compelling #cybersecurity reason to refactor the chat app to use my #WebComponent UI framework. Might be a whole new level of #SecurityByDesign for #FrontEndDev.
FYI, same question's on Reddit here: https://www.reddit.com/r/ExperiencedDevs/comments/1lmk1rg/are_web_components_better_for_cybersecurity/, got some good #insights, but want to make sure nothing's getting overlooked! Let's discuss #InfoSec #WebDev #JavaScript #OpenSource #TechQuestion.

2025-06-21 08:26:53 GMT

- reply

@nprofile…vg7s
I've noticed a lot of push back of the web client form-factor, but I'm convinced that it could be an approach that could be superior.
It's a work in progress, but here is my attempt at a Signal-like app:
https://github.com/positive-intentions/chat
This is especially spicy when talking about it being secure, because users should learn about the nuances of cybersecurity... Something people are not going to typically want to do.
Signal has parts that are not open source as guard rails for from making insecure choices, which has nuanced benefits for the average-joe.

2025-06-21 08:04:24 GMT

- reply

@nprofile…gn0m
Good question.
I'm using a king of "password encryption" which is made of a password and an IV. I store the encrypted data with the IV... Then separately you can provide the password to decrypt.
the password there is hard coded there at the moment because I want investigate a passwordless solution. Maybe something with webauthn or passkeys.

2025-06-21 07:58:16 GMT

File encryption with a browser.
I've been exploring the #WebCryptoAPI and I'm impressed!
When combined with the #FileSystemAPI, it offers a seemingly secure way to #encrypt and #store files directly on your device. Think #localstorage, but with #encryption!
I know #webapps can have #security vulnerabilities since the code is served over the web, so I've #OpenSourced my demo! You can check it out, and it should even work if #selfhosted on #GitHubPages.
Live Demo: https://dim.positive-intentions.com/?path=/story/usefs--encrypted-demo
Demo Code: https://github.com/positive-intentions/dim/blob/staging/src/stories/05-Hooks-useFS.stories.js
Hook Code: https://github.com/positive-intentions/dim/blob/staging/src/hooks/useFS.js
IMPORTANT NOTES (PLEASE READ!):
* This is NOT a product. It's for #testing and #demonstration purposes only.
* It has NOT been reviewed or audited. Do NOT use for sensitive data.
* The "password encryption" currently uses a hardcoded password. This is for demonstration, not security.
* This is NOT meant to replace robust solutions like #VeraCrypt. It's just a #proofofconcept to show what's possible with #browser #APIs.
#Encryption #Cryptography #JavaScript #Frontend #Privacy #Security #WebDevelopment #Coding #Developer #Tech #FOSS #OpenSource #GitHub #MastodonDev #Programming #WebStandards #FileSystem #WebAPI #ProofOfConcept

2025-06-20 06:13:11 GMT

- reply

@nprofile…tvly
The screen reader support could do with improvement. It isn't missing but it isn't entirely there.
It's a webapp and works on anything with a modern browser. having a native build is also important for something like this so i'm actively investigating getting it on the play store... I hope to roll out for the other platforms too when I can. (I'm using Tauri which makes the process easier for webapps.)
Audio-only calls isn't supported because I haven't added that feature yet. But if it helps, you can send audio messages.

2025-06-20 05:50:06 GMT

#encrypted #secure and #private #filetransfer and #messaging app. (because thats the only type worth working on)
I've highlighted some features below:
- #Decentralized
- No #cookies
- #P2P #encrypted
- No #registration
- No #installing
- #GroupMessaging (coming soon)
- #TextMessaging
- #MultimediaMessaging
- #OfflineMessaging (in #research phase)
- #FileTransfer
- #VideoCalls
- #DataOwnership
- Optional #SelfHosting
- #Screensharing (on desktop browsers)
- #OpenSource
Check it out!
#Blog: https://positive-intentions.com/blog/introducing-decentralized-chat
#GitHub: https://github.com/positive-intentions/chat
#Demo: https://chat.positive-intentions.com
(Boosts appreciated)

2025-06-04 09:50:34 GMT

React-like functional components, but with vanilla HTML, JS and CSS
I've often faced pushback for using #JavaScript in my #Cybersecurity and #Cryptography projects, but I'm excited to share a concept I've been working on to demonstrate its #WebDev potential!
Introducing Dim – a new #Framework that brings #ReactJS-like functional #JSX-syntax with #VanillaJS. Check it out here:
🔗 Project: https://github.com/positive-intentions/dim
🔗 Website: https://dim.positive-intentions.com
My journey with #WebComponents started with Lit, and while I appreciated its native browser support (less #Tooling!), coming from #ReactJS, the class components felt like a step backward. The #FunctionalProgramming approach in React significantly improved my #DeveloperExperience and debugging flow.
So, I set out to build a thin, functional wrapper around #Lit, and Dim is the result! It's a #ProofOfConcept right now, with "main" #Hooks similar to React, plus some custom ones like useStore for #EncryptionAtRest. (Note: #StateManagement for encryption-at-rest is still unstable and currently uses a hardcoded password while I explore #Passwordless options like #WebAuthn/#Passkeys).
You can dive deeper into the #Documentation and see how it works here:
📚 Dim Docs: https://positive-intentions.com/docs/category/dim
This #OpenSource project is still in its early stages and very #Unstable, so expect #BreakingChanges. I've already received valuable #Feedback on some functions regarding #Security, and I'm actively investigating those. I'm genuinely open to all feedback as I continue to develop it!
#FrontendDev #JSFramework #Innovation #Coding #Programmer #Tech

2025-05-25 08:47:29 GMT

glitr.io
Finally got my app to the Play store after paying for 3 dev accounts.
what an ordeal!
im sure its all failures on my part. i have no idea what im doing and i stumbled the whole way through. id like to share my journey. in case it helps somone curious about my/the process.
im a webdev. i previously paid to get a developer account on the play store, but i didnt really do anything with it. probably for a few years... google sent an email that they would be delete/disable my account. i didnt think much of this. i didnt have any android apps. i thought unfortunate, but ok. my fault for paying for a dev account i wasnt using.
some time later, i created a webapp. as much as i tried to promote the app as being a webapp, i recieved a few requests to create a native version of the app. so with modern tools like Tauri, ths was relatively straight forward.
i wanted to put it on the Play store. it seems when the play store previously deleted/disabled my account. it seems i got blocked FOREVER. (dude!), i just wasnt using the account. im not able to pay to reactivate it or anything? i contacted support, they told me to create another account to then set up a dev account... so while annoying to pay again, i expected as much if theyre asking me to create another account.
i put my app on the store going through the internal-testing-closed testing... then to get into production, i have to have 12 registered tester for 14 days. i was keen to get it into the prod Play store. i asked on some subs if people were interested to join for a free copy of the app. my app was still then rejected. this was anoying it seemed i would have to do more to get people to join as testers. i was looking at all the the options i had a vailable and it seemed if i register it as a business i dont have do this whole "12 testers for 14 days".
i was already in the pocess of registering a business (something else i also dont know anything about.). so i created another Play store account, this time for business. i wish it was more clear. i would have created the business account to begin with.
so after the regular app review from the playstore, since a couple days now, im finally on the play store!
this is far from over with me. i now need to figure out if there is a way to hand over the organization to my personal account (where it should be from the beginning). so i dont have to handle multiple accounts. i'll contact Play store support for what my options are.

2025-05-17 11:00:51 GMT

- reply

@nprofile…npmg
thats right. the auto-generated ID is crypto-random to make it unique and unguessable... you can then share that link with a peer through some trusted channel (you can also share by QR code to keep it completely offline).
https://positive-intentions.com/docs/basics/peers
i hope it helps. feel free to reach out if anything is unclear.

2025-05-17 07:07:56 GMT

Send files privately. No cloud. No trace.
glitr.io
I’m working towards something for #secure / #private / #simple #P2P #filetransfer. It isnt as “simple” as it could be, im still working on it, but ive got it down to:
Zero-installation as a #PWA
Zero-registration by using local-only storage
#P2P-authentication using #WebCryptoAPI
Fast #datatransfer using #WebRTC
It’s far from finished, but i think ive got it “usable” enough to ask for feedback on it.
When comparing this project to things like #wormhole, #onionshare, #localsend, #syncthing, #croc, #sphynctershare and countless others. the key difference in my approach is that its a #webapp thats ready to go without any "real" setup process. you just need a browser.
I’m aware there are things like #SFTP and several other established protocols and tools. I started doing this because I was learning about #WebRTC and it seems suprisingly capable. This isnt ready to replace any existing apps or services.
(Note: I know you guys are typically interested in #opensource code. this project is a spin-off from a bigger project: https://github.com/positive-intentions/chat)
Let me know what you think about the app, features and experience you would expect from a tool like this.
---
SUPER IMPORTANT NOTES TO PREVENT MISLEADING:
These projects are not ready to replace any existing apps or services.
These projects are not peer-reviewed or security audited.
The chat-app is #opensource for transparency (as linked above)... but the file-app is not open souce at all (especially spicy when not reviewed or audited.).
All projects behind positive-intentions are provided for testing and demo purposes only.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/521/904/621/729/070/original/01ecbf7b5c8b5dba.png

2025-04-25 15:29:36 GMT

- reply

@nprofile…te5v
thanks! i'll keep it in mind. im open to ideas to try.
i feel like i "tried" open-source and seems like its difficult to pull off.
im keen to see if there is a way i can make it work. so far it doesnt seem the case.
i'll keep going because i have too many ideas to try out. i hope it keeps interest up on the project to gain traction.

2025-04-25 15:16:23 GMT

- reply

@nprofile…te5v
thanks for the advice! i hope you stay tuned for updates.
dipping my toes into the SaS subreddits they seem to suggest to get the app out asap for feedback.
i try to post about the project regularly to keep interest up. but on some platforms it can be a risk if it becomes seen as spamming.

2025-04-25 14:37:03 GMT

- reply

@nprofile…te5v
people are using it. i tried a fair bit to get traction. no doubt my lack of experience has me exploring suboptimal directions.
i started off by trying to get grants. so far i only have a string of rejection. grant application are not enjoyable or in my skillset. i tried my best with AI to help bridge knowlege gaps. i think its enough to conclude on that approach for now.
i can understand that as the project hardly looks mature compared to things like signal and im sure i didnt make a compelling enough case for it. the whole process was exhausting and unenjoyable.
i then tried google adsense and social media posts to draw traffic to the blog. at best, it was making 1p per day. im sure over time it would grow from this, but i think using any remote code like google tracking scripts would undermine a bit of security. so i turned it off.
an approach it seems foss projects use is to provide a service. the closes-thing to a service would be to setup my own peerjs-server with authentication. this couldnt work because there is a public peerjs-server that doesnt need regsitration. so charging for server access would be a step back on the whole "no registration" thing.
it could be done, but based on "general vibes", i dont think i'll get enough subscriptions to pay for the server. running a peerjs-server would be the biggest cost and there is no need. (i'm still keeping it mind to explore that at some point point, but hardly a priority.)
my latest investigation is to try get a native build on the play store and sell the convinience of a native app. i hope the native version could be framed as more secure without things like browser extensions.
while the whole play store approach could result in 0 downloads. its all a learning experience from applying to grants to putting an app on the play store.

2025-04-25 13:34:43 GMT

- reply

@nprofile…te5v
it seems open source isnt getting any traction for me.
the p2p file app is a simplified version of what is already open source, but as simplified version, i'm aiming to make it more stable and and competative.
i hope to get around to updating the chat app with some of the fixes and learnings.

2025-04-25 12:54:17 GMT

- reply

@nprofile…te5v
i think the post is best as it is. the chat project mentioned there is open source and more aligned for security and privacy standards.
with glitr.io rebranding and related p2p file transfer app. it isnt open source so it shouldnt be on that forum.

2025-04-25 12:43:26 GMT

- reply

@nprofile…te5v @nprofile…2q03
thanks for the tip. here is my post there:
https://discuss.privacyguides.net/t/selfhosted-p2p-file-transfer-messaging-pwa/24306

2025-04-25 07:44:55 GMT

no servers, no accounts, no installs
glitr.io
Need to send files privately without the risks of the cloud? Glitr offers serverless, account-free, and install-free direct file sharing. Your data stays between you and your recipient, with no trace left behind.
#PrivateSharing #SecureFileTransfer #Serverless #NoSignUp #NoInstallation #DataSecurity #PrivacyFirst #Decentralized #PeerToPeer #TechTools #DigitalPrivacy
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/397/475/905/632/361/original/25b4631e53c5f4e9.png

2025-04-21 14:02:16 GMT

- reply

@nprofile…q669 thanks!

2025-04-19 17:12:46 GMT

https://glitr.io
i wondered if im noticing the cieling of my current branding... and so ive decided to rebrand.
with positive-intentions.com, i dont think its working to have a hundred syllables in the name. doesnt seem to index in searchengines or people very well.
im dont know much about branding, but i could try out a new domain and see if i can get it to work.
what im doing:
- created a new domain glitr.io. this is going to represent the front face of the project.
- i will still keep positive-intentions.com. i'll try to frame it as a R&D branch.
- as much as i like doing the handdrawn pictures, it going against the value-proposition and so it has to go.
- i think having too many projects mentions on positive-intentions led to detering users from the landingpage. Glitr is currently solely focused on the single product that does file-transfer. i will create more content around this product for things like how-to's and FAQ's.
let me know what you think about this direction or if there is something im overlooking (im sure there is).

2025-04-17 11:45:29 GMT

JSX with Webcomponents.
https://positive-intentions.com/blog/dim-functional-webcomponents
I made something to try out and I'm working towards a UI framework for my personal projects. It's far from finished but perhaps this might be interesting to share.
#functional
#webcomponents
#javascript
#html
#css
#web
#components
#library
#webcomponents
#customelements
#lithtml
#lit
#polymer
#OpenSource

2025-04-12 06:43:41 GMT

- reply

@nprofile…gzck
I'm flattered the project is comparable to those apps, but this project isn't ready to replace any product or service yet.
I'm in the process of trying to get a version of it on the Play store (and soon, the Apple App store) to have something competitive in the space.

2025-04-11 19:19:53 GMT

Selhosted P2P E2EE File Transfer & Messaging PWA
* #OpenSource
* #CrossPlatform
* #PWA
* #iOS, #Android, #Desktop (self compile)
* App store, Play store (coming soon)
* Desktop
* #Windows, #MacOS, #Linux (self compile)
* run `index.html` on any modern #browser
* #Decentralized
* #Secure
* #NoCookies
* #P2P #encrypted
* No registration
* No installing
* #Messaging
* Group Messaging (coming soon)
* Text Messaging
* #Multimedia Messaging
* #Screensharing (on desktop browsers)
* Offline Messaging (in #research phase)
* #FileTransfer
* #VideoCalls
* #DataOwnership
* #SelfHosted
* GitHub pages Hosting
* #LocalOnly storage
Check it out!
https://positive-intentions.com
(Degoogled links to the apps)
- Chat: https://chat.positive-intentions.com
- File: https://file.positive-intentions.com
- GitHub: https://github.com/positive-intentions
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/320/902/696/920/215/original/e21a34a326daf82b.jpg

2025-03-26 13:31:00 GMT

Selhosted P2P E2EE File Transfer & Messaging PWA
https://positive-intentions.com
A p2p encrypted file transfer and messaging app. Here are some features below:
* #OpenSource
* #CrossPlatform
* #PWA
* #iOS, #Android, #Desktop (self compile)
* App store, Play store (coming soon)
* Desktop
* #Windows, #MacOS, #Linux (self compile)
* run `index.html` on any modern #browser
* #Decentralized
* #Secure
* #NoCookies
* #P2P #encrypted
* No registration
* No installing
* #Messaging
* Group Messaging (coming soon)
* Text Messaging
* #Multimedia Messaging
* #Screensharing (on desktop browsers)
* Offline Messaging (in #research phase)
* #FileTransfer
* #VideoCalls
* #DataOwnership
* #SelfHosted
* GitHub pages Hosting
* #LocalOnly storage
Check it out!
(Degoogled links to the apps)
- Chat: https://chat.positive-intentions.com
- File: https://file.positive-intentions.com
- GitHub: https://github.com/positive-intentions

2025-03-18 13:17:00 GMT

https://positive-intentions.com
A #webapp for #P2P #E2EE #messaging and #fileTransfer. its a fairly unique approach to #secure #encrypted messaging.
the project isnt ready to replace any existing apps or services, but given the competative market for this kind of project, id like to push it out to anyone interested.
i made an attempt to create documentation on the website, but otherwise feel free to reach out with questions about how it works.

2025-03-10 16:10:24 GMT

2025-03-02 08:56:20 GMT

Looking for #Android #ClosedTesting #testers
- Early Access: Join the Google group as a tester for FREE early access. https://groups.google.com/g/positive-intentions-testers
Join on Android: https://play.google.com/store/apps/details?id=com.positive_intentions.file
Join on web: https://play.google.com/apps/testing/com.positive_intentions.file
i think those links are correct, but i seems people have had mixed results there where they still face a paywall. is seems to . let me know if it works or doesnt (in case i need to update the links im sharing).

2025-03-01 14:29:37 GMT

i redit my homepage because it was worse.
https://positive-intentions.com
i was going for "warm and inviting". let me know what you think. i guess the purpose of the homepage is to guide people to more information about the projects.
im wondering about if i should replace all the images for some AI image-gen to make it seem more professional.
#webdev #homepage #docusaurus #blogging

2025-02-25 20:40:39 GMT

- reply

@nprofile…2vns
Thanks for the tip, an easier way to use the app would be to explore the PWA version.
I'd like to try sell it on the play store if people find it worth the convenience to use as a native app.

2025-02-25 19:21:53 GMT

I built a P2P E2EE file transfer PWA using PeerJS. Think super secure, direct sharing! I'm new to the Play Store and need 12 testers for 14 days to launch into production. Get FREE early access in return! Interested?
Step 1: You can join the google group.
Google Group: https://groups.google.com/g/positive-intentions-testers
Step 2: you have to click on this link to download to your android
Android: https://play.google.com/store/apps/details?id=com.positive_intentions.file
#P2P #E2EE #FileTransfer #Privacy #BetaTesting

2025-02-24 08:57:09 GMT

Looking for people to register #closeTesting #testers for my app.
- #GoogleGroup: https://groups.google.com/g/positive-intentions-testers
- #Android: https://play.google.com/store/apps/details?id=com.positive_intentions.file
- #Web: https://play.google.com/apps/testing/com.positive_intentions.file
I hope ive configured those links correctly. Im new to Android #development and trying to get my app into #production. it seems google has some hoops to jump through that i wasnt expecting. it seems i need 12 testers registered.
My app is free-to-use here: https://file.positive-intentions.com
Its a #P2P #fileSharing app. its further described here: https://positive-intentions.com/docs/file
The app on the web is a #PWA and im using #Tauri to build a native app for the play store. (its basically a native wrapper around a #webview)
Much appriciated to help me get my app into the #PlayStore.

2025-02-22 08:10:33 GMT

@nprofile…a52u
hey im new to tauri and i wonder if im overlooking something with getting access to the camera for my app.
my app is working as expected as a webapp, but when i open my app from a tauri built APK, it seems it doesnt have access to the camera permission and it doesnt ask for it either.
when searching in the docs, i would expect to see something related in the section here: https://v2.tauri.app/plugin and while i see things like barcode-scanner, im surprise there isnt something more explicitly related to regular camera access.
maybe im looking in the wrong place?

2025-02-14 17:16:29 GMT

Introducing our new app "pi/file"! It's a #secure, #P2P #E2EE #file #sharing app that works directly in your #browser as a #PWA. No installation or registration required!
App: https://file.positive-intentions.com
Learn more: https://positive-intentions.com/docs/file
We'd love to hear your feedback about the app! Your insights and suggestions are invaluable to us as we continue to improve and innovate.

2025-02-03 08:44:27 GMT

- reply

@nprofile…pzp2
the "saas" part about this project is still a work in progress as i try to figure out how to put up a payment system.
this is early in the process for me. so far i have something that works enough for an MVP. im putting it out there free-to-use for now to get feedback.
youre right about it being source-available. people can copy it and use it easily. this is fine for me at this stage in development.

2025-02-03 08:24:25 GMT

- reply

@nprofile…pzp2
thanks for the tip!
youre right, i should make it more friendly for a desktop/laptop screens. so far, i focused on a mobile view.

2024-12-09 17:29:08 GMT

- reply

@nprofile…5pgk
thanks for the feedback!
indeed there are a tonne of chat apps out there. i think the approach im using is reasonably unique and interesting enough to investigate further.
i asked chatgpt what open web is... and it gave me some vague answer referring to many buzzword technologies.
can you tell me what openweb means for you and maybe what tools are needed?

2024-11-29 14:54:54 GMT

id like to share some details about how my app works so you can discover/give me feedback on my app. id like to have wording in my app to say something like "most secure chat app in the world"... i probably cant do that because it doesnt qualify.
https://github.com/positive-intentions/chat
https://positive-intentions.com/blog/introducing-decentralized-chat
im not an expert on #cyberSecurity. im sure there are many gaps in my knowlege in this domain.
using #javascript, i initially created a fairly basic #chatApp using using #peerjs to create #encrypted #webrtc #connections. this was then easily enhanced by exchanging additional #encryption #keys from #cryptography functions built into browsers (#webcrypto api) to add a redundent layer of encryption. a #diffieHelman key #exchange is done over #webrtc (which can be considered #secure when exchanged over public channels) to create #serverless #p2p #authentication.
- i sometimes recieve feedback like "javascript is inherently insecure". i disagree with this and have #openedSource my #cryptography module. its basically a thin wrapper around vanilla cryptography functions of a #browser (webcrypto api).
- another concern for my kind of app (#PWA) is that the developer may introduce malicious code. this is an important point for which i open sourced the project and give instructions for #selfhosting. selhosting this app has some unique features. unlike many other #selfhosted #projects, this app can be hosted on #githubPages (instructions are provided in the readme). im also working towards having better support for running the index.html directly without a static server.
- to prevent things like browser extensions, the app uses strict #CSP headers to prevent #unauthorised code from running. #selfhosting users should take note of this when setting up their own instance.
- i received feedback the #Signal/#Simplex protocol is great. completely undertsandable and agree, but wonder if im reducing the #complexity by working with #webrtc. while it has its many flaws, i think risks can be reasonable mitigated if the #cryptography functions are implemented correctly. (all data out is #encrypted and all data in is #decrypted on-the-fly)
- the key detail that makes this approach unique, is because as a #webapp, unlike other solutions, users have a choice of using any #device/#os/#browser. while a webapp can have nuanced #vulnerabilities, i think by #openSourcing and providing instructions for #selfhosting and instructions to #build for various #platforms, it can provide a reasonable level of #security.
i think if i stick to the principle of avoiding using any kind of "required" service provider (myself included) and allowing the #frontend and the peerjs-server to be #hosted #independently, im on track for creating a #chatSystem with the "fewest moving parts". i hope you will agree this is true #p2p and i hope i can use this as a step towards true #privacy and #security. #security might be further improved by using a trusted #VPN.
while there are several similar apps out there like mine. i think mine is distinctly a different approach. so its hard to find #bestPractices for the functionalities i want to achieve. in particular #security practices to use when using #p2p technology.
(note: this app is an #unstable, #experiment, #proofOfConcept and not ready to replace any other app or service. It's far from finished and provided for #testing and #demo purposes only. This post is to get #feedback on the progress to determine if i'm going in the right direction for a secure chat app)