Are tox clients also open source

[ugintl]

Are tox clients created by tok, also open source?

[anthonybilinski]

The app "Tok" is unrelated to Toktok that maintains this (c-toxcore) repo.

Toktok's c-toxcore is open source. Clients that use c-toxcore, like all of https://wiki.tox.chat/clients are also open source, as is required by the license of c-toxcore.

"Tok Messenger - Lite" https://play.google.com/store/apps/details?id=com.client.tok.gp (probably) uses the library, with their own changes that make it less secure, but their repo at https://github.com/InsightIM/Tok-Android hasn't had a commit in months, despite their latest release on the play store being 3 days ago. This is a license violation, and a security concern for anyone wanting to use the app.

Some conservation about this before can be found here #1319

I'd recommend against using "Tok Messenger - Lite". Their reviews are seemingly all (except for maybe one) fake, they violate the license despite being contacted multiple times, and they added centralized elements to their fork of toxcore that reduces the security of the app.

If you're looking for an Android client, take a look at:
aTox which uses an old version of c-toxcore and is fully open source an actively developed, TRIfA which uses a modified version of c-toxcore that is still open source and is actively maintained, or Antox which uses an old version of c-toxcore but the app is no longer maintained.

[zoff99]

for a comprehensive list of tox clients rather look at:
https://toktok.ltd/integrations.html
(which is more uptodate)

[nurupo]

@ugintl c-toxcore is licensed under GPL, so any application using c-toxcore has to comply with GPL, which essentially forces those applications to be open source. So yes, Tox clients are opensource, and if there is a client which isn't - it's likely committing a license violation.

Some of our developers have looked into Tok and it appears like it's violating the license by not providing its users with the up-to-date source code of the application. It has also modified c-toxcore in some questionable ways, e.g. everyone using Tok's version of c-toxcore connects to Tok's bot, so Tok knows IP-to-Tox Id relation of everyone using it. I haven't looked into its code past that, so maybe there is more that it's doing. Other developers (I think it was @zugz?) have looked into Tok more than I, so they would know better. They have also requested Tok to provide the up-to-date source code multiple times, which resulted in nothing. It's really frustrating.

Anyone knowledgeable about this whole Tok thing willing to write a blog post about it? I have asked this on IRC before, but it didn't get anywhere.

[ugintl]

I read the conversation shared by @anthonybilinski and I think I will not use tok clients for tox, but the problem is my friends, those are the only clients offering the most features and are updated till nov or dec 19. Why not one of you, copy their clients and improve TRIFA or for that matter any of the tox clients you want to work on. Honestly, I have not found any tox client with good feedback. No offense. I respect you guys work very hard, but I guess I have a point.

[Renha]

This is a license violation

That's not neccesary true. The open source code doesn't need to be published, it could be shared with customer by request, for example.

[Klagio]

aTox which uses an old version of c-toxcore and is fully open source an actively developed, TRIfA which uses a modified version of c-toxcore that is still open source and is actively maintained, or Antox which uses an old version of c-toxcore but the app is no longer maintained.

which do you recommend?

1. I use Antox, which is great, work almost perfect to me. Is it safe to use?
2. I tried Trifa but
   a) it does not allow to use yur previously generated personal TOX ID which is non-sense, I can't send all my friends a new TOX ID, is highly impractical
   b) I couldn't find a way to make Voice call only (without video) ... very strange
3. aTox? Will try now

[zugz]

* Thursday, 2020-02-06 at 03:00 -0800 - Artem Grunichev <notifications@github.com>:

> This is a license violation That's not neccesary true. The open source code doesn't need to be published, it could be shared with customer by request, for example.

6d in GPLv3 is what's relevant here, I believe. So the corresponding source needs to be available from a network server, with a link (or other "clear directions") to it provided alongside the object code. Maybe you're thinking of 6b -- if the distribution is in a physical medium, it's enough to provide source on request.

[ugintl]

@Renha What would you say about the security issues people are raising about your apps?

Many of us out there wanted to use the apps provided by tok for tox, but now I am really confused. Are these just rumors against Tok?

[Klagio]

Their reviews are seemingly all (except for maybe one) fake

they are definetely full of fake reviews. All chinese beautiful faces. Wonder if Chinese government put that app and those reviews

ANyway useless to me since has not voice calls, just chat

[ugintl]

It is a pity that tox is such a good product, but there is no mobile client which uses its features to the full. I hope it just does not disappear into the shadows of history.

[likern]

It is a pity that tox is such a good product, but there is no mobile client which uses its features to the full. I hope it just does not disappear into the shadows of history.

I think the problem is the license. I started considering to implement TOX-based alternative to Telegram. But it looks like I have to open source my whole commercial application. No doubt it's a deal breaker.