Don't use Speek! App (dangerous)

jerm · March 3, 2023, 9:38am

First, it is a fork of Ricochet-Refresh. proof from the maintainer

Full review from @dngray (Privacyguides member)

Feedback from Privacy Guides

opened 07:41AM - 03 May 22 UTC

Hi, A little while ago, one of your developers came to our room, and asked fo…r feedback. I thought I'd write something up here. I'll touch on each thing here. ### 1. Use the fork option As this is a fork of [Ricochet Refresh](https://github.com/blueprint-freespeech/ricochet-refresh), you should fork that repository. This will keep commit and ownership information for files you didn't write. There's no reason not to do this. It looks a lot less dodgy which has already been noted in other places like Reddit by [upstream](https://libreddit.spike.codes/r/TOR/comments/tkgk41/ricochet_reborn_a_user_friendly_torchat_for/i2hnq35/). ### 2. Use proper development cycle Whoever is writing code here, really should **not** be pushing to main, and using silly commit messages like "fix". - https://www.freecodecamp.org/news/how-to-write-better-git-commit-messages/ What you should be doing is branching and using the pull requests feature of Git. I suggest squashing commits before merging them into main. The feature-style commit workflow seems most appropriate - https://www.atlassian.com/git/tutorials/comparing-workflows/feature-branch-workflow The idea is you want each commit to main to be a "feature" that has been tested in a development branch. One of your developers did mention that there was an interest in working with upstream. They will likely only be interested if you start doing things properly. Make it easy for them to cherry pick https://www.atlassian.com/git/tutorials/cherry-pick Once a particular version of the software is ready "tag it" and do a [proper release](https://docs.github.com/en/repositories/releasing-projects-on-github/managing-releases-in-a-repository). We would generally recommend using the "git tag" command because you want to sign it with your PGP or SSH key. We show an example [in our readme](https://github.com/privacyguides/privacyguides.org/#releasing). On a side note the benefit to doing it the way I described is you won't have to manually write a changelog each release, as those can be autogenerated from your pull requests, including those contributed by other people. ### 3. Don't share credentials, and don't use the [Speek-App](https://github.com/Speek-App) account What you should be doing is creating a [github org](https://docs.github.com/en/organizations/collaborating-with-groups-in-organizations/about-organizations) and inviting your developers. It's important to provide accountability, of which account did what. While you're at it, either set up PGP or SSH signing. - https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits - https://calebhearth.com/sign-git-with-ssh ### 4. Use submodules For [external modules](https://github.com/Speek-App/Speek/tree/main/src/extern) like tor these should be submodules, **not** the commited source code of Tor. https://github.com/blueprint-freespeech/ricochet-refresh/tree/main/src/extern See the difference? If there is a vulnerability with Tor this depends on your developer happening to commit new source code for Tor. This is bad and should be fixed immediately. - https://www.atlassian.com/git/tutorials/git-submodule **This is particularly important** what you've currently got is Tor frozen at a particular time, 3 months ago. If a vulnerability is discovered in Tor, it may go unfixed in Speek, for a length of time. ### 5. Marketing I know you guys are spending quite a bit of effort on this, it's important that you get your ship into good shape before you go about doing that. I've seen various evidence of activity from this project, on [Twitter](https://nitter.eu/LetsSpeek/status/1510025697124929542) seems people were under the impression they were going to get a free "gift card". There has also been soliciting listings, backlinks etc on other sites. It shouldn't be your priority, please, get things right first. ### 6. Remove Travis credentials: [I know this was](https://github.com/Speek-App/Speek/blob/main/.travis.yml#L82) imported when you uploaded [Ricochet refresh's code](https://github.com/blueprint-freespeech/ricochet-refresh/blob/main/.travis.yml), but it's still not a good look. If you use Travis, do https://docs.travis-ci.com/user/environment-variables/#Defining-Variables-in-Repository-Settings ### 7. License Put the license in a sane place, normally it's found in the root of your source code repo. I would suggest keeping it there so it's easy for package maintainers to find. ## Suggestion how to fix this 1. Create a Github Org, invite your developers 2. [Require that they enable 2FA](https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization) on their accounts 3. Transfer this repository to your organization 4. Archive this repository. Don't worry about the stars it's not a huge amount, It's 235. As your project gains momentum which it will be if you do the above (as it will be easier for people to contribute), you'll end up with many more. You can mention something in the README.md about why you've done this and point to the new repo 5. Fork the [Ricochet Refresh](https://github.com/blueprint-freespeech/ricochet-refresh) repo, start making [pull requests](https://www.atlassian.com/git/tutorials/making-a-pull-request) from this repository into it. 6. This will fix your commit history, (which is dreadful right now). ## Some other benefits that you'll gain from doing things properly - A much clearer picture of when a regression makes its way into your code, which can be assisted by `git bisect` https://interrupt.memfault.com/blog/git-bisect - Easier for third parties to audit. Nobody is interested in even looking at what has changed between releases because none of your commits have useful names

Topic	Replies	Views
V3.7 Changelog discussion	526	April 6, 2023
V2.29 Changelog discussion	649	November 28, 2022
V2.27 Changelog discussion	685	October 15, 2022
V2.28 Changelog discussion	608	November 1, 2022
V3.20 Changelog	339	February 1, 2024

Don't use Speek! App (dangerous)

Related Topics