Scuttlebot: Peer-to-peer database, identity provider, and messaging system

Post by sneak » Sun, Apr 19, 2020, 3:21 PM UTC

rakoo wrote: post #88

sneak wrote: post #43

Earlier quoted context omitted.

When I was faced with this (signing a structure), I serialized the json into base64, then put that base64 string as a value (along with the MAC) into a new json document. It of course increases deserialization overhead (json, verify, unbase64, inner json) but sidesteps this issue. I thought about sorting keys and other things like that, and the dozen edge cases and potential malleability issues dissuaded me for the c…

Use Bencoding, like bittorrent does: https://en.wikipedia.org/wiki/Bencode As I put in another comment, a torrent id is a hash of a map, where one of the keys contains binary data. bencoding solved that decades ago already.

Post by capableweb » Sun, Apr 19, 2020, 7:25 PM UTC

snicky wrote: post #110

capableweb wrote: post #101

Earlier quoted context omitted.

Basically Scuttlebot is a collection of linked lists (or blockchains if you will) because you only have to discover one message to be able to fetch the rest of the related content, since it's all linked as a DAG.

Yeah, so this is the design decision that I don't really understand. Each message on the blockchain contains the author's public key representing his identity. If I already know the identity of the author, I could just go ahead and befriend him and later ask him or other peers who are his friends to share his "feed" with me. If the feed lives in a relational DB, I could then use SQL to ask for particular messages lik…

Post by codygman » Sun, Apr 19, 2020, 11:09 PM UTC

fabianhjr wrote: post #112

codygman wrote: post #90

Earlier quoted context omitted.

> I tried with haskell and gave up when I noticed I couldn't easily get json serialization to be in the same order as the javascript implementation and therefor couldn't verify nor sign messages with interoperability with the current clients. This gets you most of the way there: > With the Aeson library, the order of keys in objects is undefined due to objects being implemented as HashMaps. To allow user-specified ke…

Well, the problem is replicating the javascript order which isn't lexicographical. :/

    {
      "baz": ...,
      "bar": ...,
      "foo": ...,
      "quux": ...,
    }

    comp :: Text -> Text -> Ordering
    comp = keyOrder ["foo","bar","baz","qux"] `mappend` comparing length

    encodePretty' defConfig { confCompare = comp } YourType

    {
      "foo": ...,
      "bar": ...,
      "baz": ...,
      "quux": ...,
    }

Post by boomlinde » Mon, Apr 20, 2020, 9:52 AM UTC

sneak wrote: post #43

Vendan wrote: post #31

Scuttlebutt is a neat concept, burdened by a bad protocol. Signing a message involves serializing a json object, signing it, adding the signature as a field on that json object, and then serializing it again. To verify, you deserialize the message into an object, remove the signature field, and then reserialize it, and verify the signature against that new serialization. This means that all the clients have to have a…

When I was faced with this (signing a structure), I serialized the json into base64, then put that base64 string as a value (along with the MAC) into a new json document. It of course increases deserialization overhead (json, verify, unbase64, inner json) but sidesteps this issue. I thought about sorting keys and other things like that, and the dozen edge cases and potential malleability issues dissuaded me for the c…

Post by capableweb » Mon, Apr 20, 2020, 10:17 AM UTC

Aeolun wrote: post #114

capableweb wrote: post #109

Earlier quoted context omitted.

I think the quality of X doesn't determine what X is. npm is a package manager, it manages packages for you. Hard to escape that fact. It's a bit rubbish, but it doesn't make it _not_ a package manager. Same with the USA, might be a shitty country, doesn't mean it's barely a country

Depends I think. If you make a package manager, but the only function it has is text editing, is it a package manager? If you get too far from what people aim to use your tool for, are you still a tool for x?