This is what I've waited for for quite some time.
Freenet has done this for over a decade.
ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network
21–30 of 171 posts
Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network
#22Earlier quoted context omitted.
It would be interesting to create a distributed catalog of torrents itself.
Maybe I'm not picking up what you're putting down, but how does this differ from DHT?
It might be possible with the DHT alone, but I think for what the grandparent poster wants it would depend on the ability to query the DHT. Both in general and by popularity and insert date.
That might be possible, but with the prvelence of magnet links instead of everyone using that, I just assumed not.
Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network
#23Has the code quality improved since I was told to screw off for bringing up security?
* 2 years out of date gevent-websocket
* Year old Python-RSA, which included some worrying security bugs in that time. [0](Vulnerable to side-channel attacks on decryption and signing.)
* PyElliptic is both out of date, and actually an unmaintained library. But it's okay, it's just the OpenSSL library!
* 2 years out of date Pybitcointools, with just a few bug fixes around confirmation things are actually signed correctly.
* A year out of date pyasn1, which is the type library. Not as big a deal, but covers some constraint verification bugs. [1]
* opensslVerify is actually up to date! That's new! And exciting!
* CoffeeScript is a few versions out of date. 1.10 vs the current 1.12, which includes moving away from methods deprecated in NodeJS, problems with managing paths under Windows and compiler enhancements. Not as big a deal, but something that shouldn't be happening.
Then of course, we have the open issues that should be high on the security scope, but don't get a lot of attention.
Like:
* Disable insecure SSL cryptos [3]
* Signing fail if Thumbs.db exist [4]
* ZeroNet fails to notice broken Tor hidden services connection [5]
* ZeroNet returns 500 server error when received truncated referrer [6] (XSS issues)
* port TorManager.py to python-stem [7] i.e. Stop using out of date, unsupported libraries.
I gave up investigating at this point. Doubtless there's more to find.
As long as:
a) The author/s continues to use out-dated, unsupported libraries by directly copying them into the git repository, rather than using any sort of package management.
b) The author/s continue to simply pass security problems on to the end user
... ZeroNet is unfit for use.
As simple as that.
People have tried to help. I tried to help before the project got as expansive as it is.
But then, and now, there is little or no interest in actually fixing the problems.
ZeroNet is an interesting idea, implemented poorly.
[0] https://github.com/sybrenstuvel/python-rsa/issues/19
[1] https://github.com/etingof/pyasn1/issues/20
[3] https://github.com/HelloZeroNet/ZeroNet/issues/830
[4] https://github.com/HelloZeroNet/ZeroNet/issues/796
[5] https://github.com/HelloZeroNet/ZeroNet/issues/794
Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network
#24As for uncensorable, if the content is illegal, the torrent peers may be incriminated distribution of illegal content
Neither argument has been tested, but the defense would that you were acting as an ISP with dumb pipes. Which logically leads to an unrelated question -- if ISPs are doing DPI on every packet, they at least theoretically 'know' whether you're transmitting 'illegal' content. If I were a rights holder, I'd be making that argument against ISPs. I don't know how I'd sleep at night, maybe, but I wouldn't let ISPs have the…
> Neither argument has been tested, but the defense would that you were acting as an ISP with dumb pipes.
Unlikely.
To become a peer, you must first visit the website, fully downloading the content.
Which makes an argument to you consenting to share the information.
Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network
#25Sounds incredible, we'll probably be seeing much more of this type of thing in the near future.
Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network
#26No comment about ZeroNet itself, but am I alone in the opinion that this website takes grid layout too far? It looks outright cluttered and overloaded.
Looks great on mobile however
Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network
#27I thought it was pretty easy to disrupt / censor torrents, hasn't that been going on for a while?
"I thought it was pretty easy to disrupt / censor torrents, hasn't that been going on for a while?"
Not torrents themselves, only torrent search engines. Torrents are distributed by design, but traditional torrent directories/aggregators/search engines are centralized, thus easy targets for DCMA take-downs, ISP blocks, trials etc.
Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network
#28Presumably you only download the site you want when you visit it. If that's the case then can you view revisions of the web sites or do you only have the current copy?
If you click on "How does it work?" you get redirected to a short and sweet presentation[0]. According to the presentation, when you, as the site owner, push an update, content.json gets updated, the peers get a notification (using the WebSocket API) that a new content is available, and then they download the new version of content.json that contains the sitemap of the updated version of the website. Cleverly thought…
Unless your site is too big: [0].
Then you can have users end up browsing stale versions of the site. Still an issue as of before Christmas last year.
Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network
#29> Page response time is not limited by your connection speed.
Huh? What do they mean?
Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network
#30Earlier quoted context omitted.
Neither argument has been tested, but the defense would that you were acting as an ISP with dumb pipes. Which logically leads to an unrelated question -- if ISPs are doing DPI on every packet, they at least theoretically 'know' whether you're transmitting 'illegal' content. If I were a rights holder, I'd be making that argument against ISPs. I don't know how I'd sleep at night, maybe, but I wouldn't let ISPs have the…
> Neither argument has been tested, but the defense would that you were acting as an ISP with dumb pipes. Unlikely. To become a peer, you must first visit the website, fully downloading the content. Which makes an argument to you consenting to share the information.
Just like an ISP has to take your request and transmit it and the response. No difference in theory. In practice, I would worry whether courts would ignore theory.