DRIFT needs builders.
v0.20.0 "Show Your Work" — 16,900 lines of application Python across 34 modules, 9,450 lines of tests, a published protocol spec (DRIFT-P/1), a desktop app with Tor bundled, and three unbuilt phases. The architecture is modular, the crypto is documented, and the threat model is honest. Come break things or build things.
Modular by layer.
┌──────────────────┐ ┌──────────────────────────────┐
│ drift/ui/ │ │ Tauri + React desktop app │
│ Textual TUI │ │ PyInstaller-frozen core · │
│ │ │ Tor bundled · no Python │
└────────┬─────────┘ └──────────────┬───────────────┘
│ │
┌────────▼─────────────────────────────▼───────────────┐
│ drift/cli.py ← Typer · ~30 commands │
├───────────────────────────────────────────────────────┤
│ drift/crypto/ ← Double Ratchet · X3DH · stealth │
│ (scan/spend) · FMD · cover traffic · panic vault │
│ built on PyNaCl/libsodium · XChaCha20-Poly1305 · │
│ Ed25519/X25519 · Argon2id │
│ ── no hand-rolled primitives. ever. ── │
└────────┬──────────────────────────────────────────────┘
│
┌────────▼─────────┐ ┌──────────────────────────────┐
│ relay/ FastAPI │───▶│ WITNESS — blindness certs │
│ federated · │ │ every 60s · hash-chained · │
│ ~30s envelope │ │ /cannot-see │
│ TTL │ └──────────────────────────────┘
└────────┬─────────┘
│ scripts/gauntlet.py ──▶ attacks
┌────────▼─────────┐ all of it · 10 probes · 0 mercy
│ Tor / network │ ← sealed sender, onion routing
└──────────────────┘
Six ways in.
Run python scripts/gauntlet.py and try to make a probe fail. Write a new probe that tests something we missed. Every broken invariant is a bug report — open an issue with your finding and the probe that exposed it.
Clone the repo, run python -m relay.server, and you're part of the federated network. If you run it publicly, open an issue to get listed as a community relay. Pi Zero nodes especially welcome — see Phase 4 docs.
The entire cryptographic surface is in drift/crypto/ and drift/protocol/. The internal audit found and resolved five findings — the remaining deferred items (L2, L4) are documented openly. Fresh eyes on the stealth address math and the X3DH prekey pool are especially welcome.
Phases 14–16 are unbuilt and open. Mobile companion, Drift Names resolution, Pi Zero relay image. Each phase has a design doc stub. Pick one, read the architecture, open a discussion issue before writing code.
open issues →The Tauri + React desktop client shipped in v0.17 and bundles Tor — end users never touch Python. It needs UI polish, update-flow work, and Linux packaging love. React skills welcome; no crypto knowledge required.
see the releases →The Textual TUI lives in drift/ui/app.py. Arrow key navigation on the welcome screen is missing. The 95-character contact code needs a better UX story. The theme system supports five palettes — an in-app theme switcher would be a clean contribution. No crypto knowledge required.
Things we need input on.
Drift Names (name@relay) — how should name resolution work without creating a central authority?
Phase 7 (multi-device) — is there a ratchet sync approach that doesn't require a trusted sync server?
open a discussion →Spend key reuse (audit L4) — what's the cleanest migration path that doesn't break existing vaults?
open a discussion →Pi Zero relay image — what's the right base OS and update mechanism for an appliance that runs unattended?
open a discussion →Cover traffic tuning — what Poisson rate and envelope size actually balance battery and bandwidth against timing resistance on mobile-class hardware?
open a discussion →