Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scuttlebutt, a Decentralized Alternative to Facebook

inthemesh.com

Post reply on HN
Print view View original

131–140 of 356 posts

Re: Scuttlebutt, a Decentralized Alternative to Facebook

#131

Post by hw »

Why are we finding alternatives to Facebook, when in fact we should really be educating ourselves and people to stop sharing every single bit of personal information about themselves online, be it on Facebook or a decentralized application.

The problem with Facebook is that it holds way too much personal information about a person - phone numbers, emails, a person's likes/dislikes, hometown, current location, etc, and because society has been 'programmed' to share so much about themselves, no thanks to social networks like Facebook that promotes building your 'profile'.

In fact, strip away all that personal information and have people share their thoughts and their dinner photos and what you get is just Twitter, Instagram, Snapchat or a blogging platform.

A decentralized alternative to Facebook will not solve the problems Facebook has because in the end even if you own the private key to your own data it's up to you if you want to share your data with someone or an app, and once you've done that to a malicious party, your social network is compromised. And as some have pointed out in this thread, a decentralized and open source alternative would be worse.

In the end, it's up to the individual to be smart about what to share and what not to share, and reveal as little about themselves as possible rather than parade it all out to the world or to their 'friends' list. All it takes is for someone not too technical to download a hacked 'client update' to their decentralized Facebook alternative to have everything they thought to be secure be leaked out.

An alternative that promises to be more secure than what it's replacing is just asking for more complacency. I'm sure we thought Facebook was extremely secure at some point, so why not share everything?

Re: Scuttlebutt, a Decentralized Alternative to Facebook

#132

Post by lgierth »

Vendan wrote: post #125
staltz wrote: post #114

Earlier quoted context omitted.

https://github.com/andyleap/go-ssb

(I'm the author of the repo in question) Note that this repo has been sidelined, as I have fundamental issues with the protocol SSB is built on. Unless there's changes to how the messages are signed and verified, I'm not planning on putting any serious effort into SSB.

I'm curious to hear about the issues. SSB's network transport is supposed to be pretty okay: https://github.com/auditdrivencrypto/secret-handshake

Re: Scuttlebutt, a Decentralized Alternative to Facebook

#133

Post by wybiral »

Vendan wrote: post #74
notheguyouthink wrote: post #25

Earlier quoted context omitted.

> The whole Cambridge Analytica issue was caused by APIs that are too open. For distributed systems there are more ways to exploit the APIs and gather data on users. Huh? Scuttlebutt is fully encrypted.. doesn't that make the API vastly more locked down than Facebook/etc? > There is a clear issue with Facebook's accountability in these areas. Distributed systems are typically open source, they run on multiple servers…

Scuttlebutt is not at all "fully encrypted", it's fairly trivial to spider and download just about everything. The hardest part is the first foothold (which can be found posted various places, including the official docs on ssb), from there, downloading the entire "social web" it has can be done with the "main client" by basically changing a single config value.

I haven't looked into the protocol in any depth yet but it does seem like it supports end-to-end encrypted updates.

What data are you talking about that can easily be crawled without any permissions?

If it is that simple then maybe Scuttlebutt isn't a good protocol, but a secure end-to-end platform like this is definitely possible. And if anyone is going to build it it's not going to be a company who makes all of their cash from harvesting user data.

Re: Scuttlebutt, a Decentralized Alternative to Facebook

#134

Post by Vendan »

lgierth wrote: post #132
Vendan wrote: post #125

Earlier quoted context omitted.

(I'm the author of the repo in question) Note that this repo has been sidelined, as I have fundamental issues with the protocol SSB is built on. Unless there's changes to how the messages are signed and verified, I'm not planning on putting any serious effort into SSB.

I'm curious to hear about the issues. SSB's network transport is supposed to be pretty okay: https://github.com/auditdrivencrypto/secret-handshake

example message:

    {
      "previous": "%26AC+gU0t74jRGVeDY01...MnutGGHM=.sha256",
      "author": "@hxGxqPrplLjRG2vtjQL87...0nNwE=.ed25519",
      "sequence": 216,
      "timestamp": 1442590513298,
      "hash": "sha256",
      "content": {
        "type": "vote",
        "vote": {
          "link": "%WbQ4dq0m/zu5jxll9zUb...KjZ80JvI=.sha256",
          "value": 1
        }
      }
    }
Signed example message:

    {
      "previous": "%26AC+gU0t74jRGVeDY01...MnutGGHM=.sha256",
      "author": "@hxGxqPrplLjRG2vtjQL87...0nNwE=.ed25519",
      "sequence": 216,
      "timestamp": 1442590513298,
      "hash": "sha256",
      "content": {
        "type": "vote",
        "vote": {
          "link": "%WbQ4dq0m/zu5jxll9zUb...KjZ80JvI=.sha256",
          "value": 1
        }
      }
      "signature": "Sjq1C3yiKdmi1TWvNqxI...gmAQ==.sig.ed25519"
    }
The signature covers the whole message, and is then added into the message it signed. The way this works means you have to encode json exactly the same way as the "main" node.js implementation. Emojis, unicode, html literals, EVERYTHING. Or else it will fail to verify. I've gotten most of it working, but there's still edge cases where I gave up trying to get them to work correctly.

Re: Scuttlebutt, a Decentralized Alternative to Facebook

#135

Post by Vendan »

wjh_ wrote: post #129
Vendan wrote: post #125

Earlier quoted context omitted.

(I'm the author of the repo in question) Note that this repo has been sidelined, as I have fundamental issues with the protocol SSB is built on. Unless there's changes to how the messages are signed and verified, I'm not planning on putting any serious effort into SSB.

Would you be able to elaborate on these issues?

did so in sibling comment

Re: Scuttlebutt, a Decentralized Alternative to Facebook

#136

Post by aeorgnoieang »

agmcleod wrote: post #45
notheguyouthink wrote: post #39

Earlier quoted context omitted.

> It's worse than facebook because there's no one to have responsibility to be accountable. I guess I just don't understand what accountability there is to be even had? If I send an encrypted message to my friend, who is accountable? What are they accountable for? If I'm sending illegal content to someone only I can be held accountable (and possibly the person I'm sending to) . Is that any different in Scuttlebutts c…

Ah i think i may have misunderstood how the system is made. It is purely peer to peer. So any issues could be if the software has a security vulnerability, but I'm not sure how that ties in with things like "as-use" open source licensing. This post explained the network fairly well I found: https://staltz.com/an-off-grid-social-network.html As far as GDPR goes, you're right because you're specifically choosing people…

Are you claiming that GDPR holds individuals liable to delete info they might have about another person on request?

Re: Scuttlebutt, a Decentralized Alternative to Facebook

#138

Post by Vendan »

wybiral wrote: post #133
Vendan wrote: post #74

Earlier quoted context omitted.

Scuttlebutt is not at all "fully encrypted", it's fairly trivial to spider and download just about everything. The hardest part is the first foothold (which can be found posted various places, including the official docs on ssb), from there, downloading the entire "social web" it has can be done with the "main client" by basically changing a single config value.

I haven't looked into the protocol in any depth yet but it does seem like it supports end-to-end encrypted updates. What data are you talking about that can easily be crawled without any permissions? If it is that simple then maybe Scuttlebutt isn't a good protocol, but a secure end-to-end platform like this is definitely possible. And if anyone is going to build it it's not going to be a company who makes all of the…

I've written a partial implementation of the scuttlebutt p2p protocol (not the encryption, but everything on top). While point to point is encrypted, the bulk of the data is not encrypted. You can specifically send "private" messages that are encrypted such that only a set of keys (users) can decrypt (read) them, but this is by no means the default for anything.

Re: Scuttlebutt, a Decentralized Alternative to Facebook

#140

Post by dymk »

twtw wrote: post #127
ibdf wrote: post #120

2018 will be the year of "alternative to facebook" apps that are in no way an alternative to facebook. To be an alternative to facebook, it should at least do 50% of what facebook does, and it should be accessible to all. Anything that takes more than 3 steps to get it running it's going to keep people out. And if you keep people out, you don't have a social network, at least not anything like facebook where your gra…

"You need ... a business plan." I don't agree. What is the business plan of email (by which I mean SMTP, not some webmail provider)?

You're confusing a protocol with a product (or in Facebook's case, hundreds of products).
Post reply on HN