CUBELinux · CUBE Contact

Announcement · 2026-10-20 · the first application built on the substrate · Linux today, Android next

Try the store behind this channel. The standalone cube this application runs against is available as a free, time-limited evaluation build for Linux x86_64 — the binary, the demo and the production vocabulary profile in one archive. Download the evaluation build (sha256 9983e2ed4edc5f99f54f65aee2f87126cd5185f56eea538e04e8756727062d37). The licence window ends 2027-01-18, and the build refuses to run after that date. It is evaluation software: no warranty, and not a supported product.

What it is

CUBE Contact is a desktop application for private messaging and signed, publishable pages between people who do not want a service in the middle. It is not a protocol sketch or a design document with a screenshot of a mockup: it was built this week, its parts are measured, and the screenshots on this page are of the running application talking to itself over the real sealed channel.

The idea is old and the substrate is new. Every messenger anyone actually uses has the same three things — an account, a directory, and a company's server between the two people. The contents may be encrypted; the channel still belongs to somebody else. CUBE Contact removes the three things rather than encrypting around them.

How it works

piece	what it does
the channel (`CTP0`)	Two machines speak a small handshake: hybrid X25519 + ML-KEM-768 key exchange, Ed25519 identity keys on both ends, AES-256-GCM cells that are strictly sequenced. Every sender is on the receiver's allowlist or it is turned away before hello — and nothing it sends is stored.
the store	Every message is a record at a coordinate in the receiver's own store, written by the receiver's own process. Delivery means the store acknowledged the record — the machine, not the person.
signed pages	Any HTML page can be signed and published into the same store, and is shown with an attestation banner drawn only when the signature verifies against the exact bytes on screen. One changed byte and the page is refused.
listing search	A publisher may opt a page into a listing. A reader searches those listings by host, title, or summary. A page that never opted in appears on no one's search.

CUBE Contact chat between two machines — The chat, as the app shows it. The conversation crossed the sealed channel in both directions; each row is a record in a real store at a real coordinate (“soapp : 3.1.1.1” is a message received from the peer named soapp).

Why it is safer than the usual private messenger

Not because the cipher is exotic — the pieces are standard and public — but because of what does not exist:

No account, so no identity profile to leak. Your identity is a key pair that lives in the store on your machine. Nobody issues it, nobody can enumerate the humans on the network.
No directory, so no list of who talks to whom. Peers are pinned by public key and the receiver's allowlist decides who exists to it.
No provider in the middle. The transport runs directly between the two machines; the only third party that ever sees anything is the receiving machine itself.
No temporary inbox. A message is a durable record in the receiver's own store; a signed page keeps existing on the machine that signed it, and the signature verifies each time it is opened.
Failure is visible. Unlisted sender: 502 at the sender, nothing stored. One changed byte: 409 at the reader. Wrong pinned key: 502. There is no silent gap where a disagreement passes as success.

A signed page opened in CUBE Contact — A signed page, as the app shows it. The banner is not decoration: it is drawn only after the Ed25519 signature in the attestation record verifies against the exact bytes displayed.

Listing search — Discovery without a registry: the search walks opt-in listing records — three pages published by “workhorse”, each with its title and an honest summary. An unlisted page is invisible here.

Publishing a signed page — Publishing: upload an HTML file and a required summary, tick “list this page in search” if it should be findable. “Sign + publish” writes the page and its attestation as records in the store.

The honest limits

What this is not yet. The first slice is Linux-first (the Android phase is next), group conversations are not there, and a message send is one message per channel session at this layer. The transport is v0: hybrid key exchange and signatures now; forward secrecy and a wider mailbox floor are the next slice. And the gap that matters most, stated plainly: “delivered” means the receiver's store wrote the record, not that a human read it.

How to test it

CUBE Contact is still under active development, and no product licence has been designated yet — it is not offered for general installation or redistribution. A time-limited evaluation build is published so testers can try the system and tell us what breaks:

Linux x86_64 evaluation build — download the beta (3.3 MB). Needs the system packages libwebkit2gtk-4.1-0 and libgtk-3-0; everything else is inside the archive, with a README that shows the run lines.
Term: the evaluation licence ends 2027-01-18, and the binary refuses to run after that date. Evaluation only — no production use, no warranty, no redistribution beyond the archive as shipped. LICENSE-BETA.txt inside states the terms in full.
Integrity: SHA-256 bac3a2e08d6de68eb14ab69e3f87ad052a1467ba485dd1b96ed8439abe4f85e6 (also in the .sha256 file beside the download).
The whole network is two machines: each instance prints its public key; put the other's key in --allow and each side has its own listener.

A fuller, full-width version of this page — with the same screenshots — is at cubelinux.com/cube-contact.html.

sealed channelsigned pagesno accountsno directoryno middleLinux first