With “guarantees” I meant things like whether you want to have perfect forward secrecy, or whether you want to provide some degree of deniability, and so on, not so much what kinds of guarantees you’re relying on although they’re definitely also good to keep in mind.

“As secure as possible” is a very all-encompassing goal which doesn’t really say much – what I was trying to get at with my point about the guarantees you want to make is that you’ll want to have a clear idea of what you actually mean with “as secure as possible” so you’ll know what sort of eg. architectural decisions to make before you do a lot of work and paint yourself into a corner.

It’s a very ambitious project, but I can guarantee it’ll probably be very interesting to work on and you’ll learn a lot regardless of the outcome, and I’m definitely rooting for you.

I have a background in distributed systems and some background in security (I’m by no means a cryptography expert but I do know more about the subject than average developers), and I’d say that at this stage you shouldn’t worry too much about meeting all parts of some guideline or another; they’re often geared more towards bigger teams and slightly more established projects. What I think could benefit you would be first of all to have a clear idea of what exactly you want to accomplish (from a security standpoint, not necessarily so much from a functionality standpoint) if you don’t already have have one, ie. what sort of guarantees do you want to be able to make. Doesn’t have to even be a public document at first, just some notes and sketches for yourself. Then you’d want to find other projects with similar guarantees and aims and see how they did things, find research papers on the subjects and so on. Security guidelines can be useful, but generally it’s more useful to understand why something is in a guideline in the first place. For a project such as yourst I would personally really emphasize design documents and research over code at an early stage, because you need to have a clear goal in mind before you start cranking out code which might turn out to be worthless (at least to some degree) after you run into problems with your approach. Not saying that the documentation has to be public, just that you / the team know exactly what the goal is.

“Encrypted P2P chat” can mean vastly different kinds of projects, with very different aims. For example, do you want perfect forward secrecy? If so, you’d want to find out the challenges associated with it, especially in relation to interactivity since you’re building a P2P architecture, etc. etc. Same with anonymity / user “traceability” like I mentioned earlier; you need to have a clear picture of what kinds of guarantees do you want the users to have to be even able to say what kinds of best practices you’d have to follow.

Sorry, that turned into a bit of a ramble and might be completely obvious to you already, since I have no idea about your background and the level of research you’ve already done.

Right that makes sense.

But yeah, after glancing through the links you provided, I’d agree that you’ll definitely need to pay someone for an audit / review, there are so many pitfalls and gotchas when it comes to encryption alone, and depending on the guarantees you want to be able to make you’ll find even more pitfalls and gotchas – especially if you want to make even relatively light guarantees about anonymity. The classic problem is that even with encrypted payloads the metadata / protocol itself leaks information, which might or might not be a problem depending on what your guarantees are.

I’d suggest writing at least some level of documentation for the protocol. I’d assume a lot of the more security-minded folks – who your app seems to be targeting – won’t be too enthusiastic about using a chat service that promises security but doesn’t tell you how it plans on achieving it.

Is there a description of the protocol somewhere?

You can definitely care about whatever you want. Human rights aren’t the only potential issue though, but there’s things like eg. do you trust that you’ll be able to retain control of the site. So for example if you set it up in Russia and you’re not Russian, do you trust the Russian government not to pull the rug out from under your feet at some point?

That’s assuming that the only potential issue you care about is tampering though

At least not one that’s hosted in a country where the IP mafia has any power, which is unfortunately most countries excluding places like Russia or China where you probably wouldn’t want to host it anyhow due to a variety of other, uh… issues

Sure, but that doesn’t mean Discord’s “secret weapon” has anything to do with PluralKit specifically.

Discord is popular compared to both commercial competitors and eg. FOSS projects like Matrix because of a variety of different factors, usability being one of the biggest ones. Accessibility may well be a factor (even a big one), but attributing all of that to just PluralKit honestly seems a bit short-sighted

You can thank the completely obscene financialization of everything for that. Suits don’t care about making things people enjoy, they care about making things that generate money. Skinner box microtransaction mechanisms etc. are just a result of that – many games aren’t made to be fun, they’re made to make you pay

I was thinking exactly the same. It’s nice that so many of the new handhelds run Linux and are generally way less “hostile” to develop for and hack than closed ecosystem devices, so there’s a lot more community-driven development going on

At least in RDR2 (the only Rockstar game I have) the launcher works like you’d expect – ie. it’s annoying as shit but no different from the PC version. I’ve had a Deck for a couple of years now and haven’t needed my desktop for anything related to it.

Yes exactly, and this is the beauty of games as a medium.

I think the label originally was pejorative, but then fans of the genre took it as their own. Personally I like walking sims and I think it’s a hilarious way to describe them, but yes it was originally some neckbeard complaining about how as a genre they’re barely even games

Note that even though a game isn’t verified, it doesn’t necessarily mean you’ll need to do any tinkering. You might have to, but it’s not a guarantee or even necessarily incredibly likely.

The only time I’ve had to do eg. configuration file editing was to get Starfield (yes yes I know, shame on me) to run a bit better, but otherwise I haven’t had to do any sort of fuckery to get non-verified games to run.

Yeah the Steam user is just used for Steam, which is just an application that the deck user (that you also pointed out) runs

But what are the current alternatives? Really seems like the options are either using Emudeck or a whole lot more work

Hey @lounges@lemmy.world (do pings even work on Lemmy?), do your buttons not work both in game mode and desktop mode?

But yeah like you said, the problem having survived a factory reset makes this feel more like a hardware issue, but it doesn’t hurt to check if the problem persists on “both sides” of the OS.

Hmm, looks like iFixit has a Steam Deck page, which could be helpful. The fact that none of the buttons work is a bit strange; I wonder how they’re attached to the motherboard? Feels like some sort of connector or controller problem (as in hardware controller, not game controller 😄), but I haven’t looked into how the Deck’s hardware handles the button inputs

I gamed on a regular 'ol potato PS4 (not the Pro) up until last year when I bought a Deck. Gave the PS4 to a friend who’s still using it.

Not everybody has to have the absolute latest tech the second it comes out.