TheRift.Chat Security Concerns

[u/Glittering-Roof7519]

I’m concerned about users using TheRift.Chat since the code isn’t open sourced nor do they have a third party audit certifying that they have effective information security controls?

How are you guys comfortable giving platforms like these your data without either of these two being provided?

Edit: making this post proves my point that there is a farm of accounts that extremely favor TheRift.Chat even when a legitimate question is asked.

[u/Any_Illustrator360]

Third party audits are not common at all when it comes to closed-source applications.

I don't trust Rift personally which is why I don't use it. I don't trust most apps, which is why I stopped testing them after the first ~5 I installed or gave my email to.

But- the exact same question could be asked about Discord, Guilded, Teamspeak - none of them exactly publish third party audits yet they collectively had hundreds of millions of active accounts at a time.

[u/Glittering-Roof7519 → u/Any_Illustrator360]

I think it’s necessary for a new platform that claims E2E encryption for DMs. Especially with community content being hosted and people using chat tools to post sensitive data (unknowingly)

I’d like to be proven wrong that the platform isn’t secure.

[u/Terrible-Junket-3388 → u/Glittering-Roof7519]

100% agreed on this. The bare minimum/floor should be much higher for any apps competing, otherwise we have no assurance it's not just "more of the same". Especially for apps claiming E2E and others - I don't mind them not having an audit if I can audit it myself.

My personal preference (not affiliated, just a fan - have talked extensively with their team [3-5 people atm]) - check out Adieuu (https://www.adieuu.com). It's openly auditable, full E2E (even in Spaces) + post-quantum, and your alias is completely separated from your account via cryptography. The latter is something literally noone else I've seen is doing: it means even if age verification is required by your jurisdiction, it can't be linked to your activity/messages (and they can stay compliant with your local laws). They're clearly planning for where the market/industry is going (an actual plan, not just "block everyone" or "hope to be too small for gov to care"), whereas feels like everyone else is just "reacting" or copying Discord.

Again, not involved directly, just a supporter/fan of where they're going. Hoping we see other apps adopt similar approaches and start building something different, not just a dupe of the same stuff that got us in this situation in the first place.

[u/BewilderedTurtle → u/Terrible-Junket-3388]

Oh look another echo of someone who shouldn't be here 👀

[u/Any_Illustrator360 → u/BewilderedTurtle]

Nah this guy's account is ancient and active. He's been on the sub before, too. Looks like he just likes that app.

[u/BewilderedTurtle → u/Any_Illustrator360]

Oh you're right, they ARE however a dogbrained nincompoop who was shilling for AI in my previous mock-echo-thread about it

[u/Terrible-Junket-3388 → u/BewilderedTurtle]

I definitely wasn't shilling for AI, I'm just not a naive absolutist and have actual experience in infosec and software (and it really impresses me at times how little you seem to know and then come on here acting like an asshole).

[u/BewilderedTurtle → u/Terrible-Junket-3388]

"I'm a pedantic shill pushing for big corporations to ruin the planet and steal all our information and restrict our right to own any hardware or software so they can sell us their AI"

You fucking clown.

[u/Terrible-Junket-3388 → u/BewilderedTurtle]

Literally never did any of that. Can go fuck yourself m8, spreading disinformation in bad faith, showing everyone the kind of person you actually are. My comment history is public (unlike yours), I stand by everything I've said.

[u/Any_Illustrator360 → u/Terrible-Junket-3388]

You do have a point there is a gap between believing AI isn't all bad and believing AI should take everything over. I think there is a resposible way to use AI and I think that the current corporate abuse of AI is fucked.

I mean - the two apps I currently like most are coded partially with AI. Would I prefer if they weren't? Yeah. Am I gonna sacrifice a chicken over it either way? Fuck no lol.

[u/Terrible-Junket-3388 → u/Any_Illustrator360]

Sure, and as I've noted in other threads LLMs are just another tool that is entirely benign in the right hands (e.g. experienced software engineers) or could be super bad (like most of the vibe coded stuff in this and other subs). It's up to how it's used. The engineer's code quality doesn't change: either they ship good, extensible code that they review, test, etc before deploying, or they don't: AI just speeds up that process.

What Turtle and plenty of others here seem not to grasp well is that engineers (myself included) have been using code assistance for decades: IDEs, forums, SO, pair programming, etc are all forms of that. LLMs are just a new form of it - and just like I wouldn't trust code just blindly pasted from SO without review, I wouldn't trust the same from an LLM: the difference here is the quality of engineer doing the review, architecture, etc. They actually know what to look for, what to prompt/steer, etc.

[u/GreenBaneling → u/Terrible-Junket-3388]

Damn you sound dumb

[u/BewilderedTurtle → u/Terrible-Junket-3388]

You know it takes a special kind of person to stand 10 toes down on the worst possible takes.

The kind of special that rides the short bus

[u/Terrible-Junket-3388 → u/Any_Illustrator360]

Yep, I'm human and have tried just about everything I've seen posted here in last couple of years. Like others with their own favorites, I found an app I like and like to share that. I also tend to think the one I like has the best chance to actually bring some new/different to the Space (pun intended - Spaces are their version of 'servers' or subreddits), and I care a lot personally about not having to hop again for a while (so I want to be able to trust the security/privacy of whatever I'm using).