Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BitTorrent secures and open-sources DHT bootstrap server

engineering.bittorrent.com

Post reply on HN
Print view View original

1–10 of 26 posts

Re: BitTorrent secures and open-sources DHT bootstrap server

#2

Post by ritonlajoie »

A little bit off topic, but I tried to get a developer API key for Bittorrent Sync, and never heard of them.

Same thing for Bittorrent Live.

Has anyone been successful in getting those ? Also, with the twitch flop (quality of the website, lags, 60 sec delay, PR problems) why don't we hear more about the Live service ?

Re: BitTorrent secures and open-sources DHT bootstrap server

#4

Post by nly »

I'm always amazed the BitTorrent DHT infrastructure has been working so well for so long:

Real-World Sybil Attacks in BitTorrent Mainline DHT: http://www.cs.helsinki.fi/u/lxwang/publications/security.pdf

Crawling BitTorrent DHTs for Fun and Profit: https://jhalderm.com/pub/papers/dht-woot10.pdf

Profiling a Million User DHT: http://www.michaelpiatek.com/papers/dht_imc_falkner.pdf

Lying To The Neighbours - Nasty effects with tracker-less BitTorrent: http://events.ccc.de/congress/2010/Fahrplan/events/4210.en.h...

Re: BitTorrent secures and open-sources DHT bootstrap server

#6

Post by aroch »

steeve wrote: post #5

Question for the HN crowd: how does one can use DHT/trackerless to not only distribute files, but updates to them too? Sort of like an ever continuing magnet link if you will?

BTSync is the obvious "Duh!" answer. Since its UDP traffic, controlled by DHT (so long as you disable their central tracker in your conf) and updates on the fly.

What I wind up doing (since I don't trust BTsync) is using inotify to watch the sync directory + mktorrent to create a new torrent on file change + pypush to push the new .torrent to various servers

Re: BitTorrent secures and open-sources DHT bootstrap server

#7

Post by oakwhiz »

nly wrote: post #4

I'm always amazed the BitTorrent DHT infrastructure has been working so well for so long: Real-World Sybil Attacks in BitTorrent Mainline DHT: http://www.cs.helsinki.fi/u/lxwang/publications/security.pdf Crawling BitTorrent DHTs for Fun and Profit: https://jhalderm.com/pub/papers/dht-woot10.pdf Profiling a Million User DHT: http://www.michaelpiatek.com/papers/dht_imc_falkner.pdf Lying To The Neighbours - Nasty effects…

Re: the last link

>In the Kademlia adaption for Bittorrent a peer's address (NodeID) is to be generated randomly, or more appropriate: arbitrarily. Because randomness isn't verifiable, an implementation can advertise itself with popular NodeIDs or even change them on a per-packet basis.

At the end of the slides they suggest sha1(ip+port) as a possible fix. This would increase the barrier-to-entry of a Sybil attack to the point where an attacker needs to be able to spoof IP addresses or connections. However, I believe that a sufficiently motivated and financially equipped attacker may already exist who would still be able to attack this scheme. Perhaps an alternative to sha1(ip+port) could be some form of cryptographic signature scheme, where the NodeID is a public key or hash of a public key, and a node is only considered "real" if it is at least able to sign responses with the private key that corresponds with the NodeID.

Maybe operators of nodes should be allowed to tweak some kind of setting that controls how paranoid the node should be of Sybil attacks.

Maybe it would be possible to include some kind of hashcash or Bitcoin scheme to make Sybil attacks more costly. There has to be some way of requiring an attacker to expend considerable computation power.

Re: BitTorrent secures and open-sources DHT bootstrap server

#8

Post by steeve »

aroch wrote: post #6
steeve wrote: post #5

Question for the HN crowd: how does one can use DHT/trackerless to not only distribute files, but updates to them too? Sort of like an ever continuing magnet link if you will?

BTSync is the obvious "Duh!" answer. Since its UDP traffic, controlled by DHT (so long as you disable their central tracker in your conf) and updates on the fly. What I wind up doing (since I don't trust BTsync) is using inotify to watch the sync directory + mktorrent to create a new torrent on file change + pypush to push the new .torrent to various servers

Yeah but then you end up changing the info hash, and thus your magnet is changed.

What I'm trying to do is to basically embed the magnet link in my program and sort of having it self check itself for updates. It that makes sense :)

Re: BitTorrent secures and open-sources DHT bootstrap server

#9

Post by unsignedint »

unsignedint wrote: post #3

I applied for BTSync API and ended up in my inbox that same night. You may want to ping them in their forum if you aren't receiving one...

This was meant to be in response to the earlier comment by ritonlajoie. Sorry about confusion posting this on its own...

Re: BitTorrent secures and open-sources DHT bootstrap server

#10

Post by fredsted »

steeve wrote: post #8
aroch wrote: post #6

Earlier quoted context omitted.

BTSync is the obvious "Duh!" answer. Since its UDP traffic, controlled by DHT (so long as you disable their central tracker in your conf) and updates on the fly. What I wind up doing (since I don't trust BTsync) is using inotify to watch the sync directory + mktorrent to create a new torrent on file change + pypush to push the new .torrent to various servers

Yeah but then you end up changing the info hash, and thus your magnet is changed. What I'm trying to do is to basically embed the magnet link in my program and sort of having it self check itself for updates. It that makes sense :)

Correct me if I'm wrong, but isn't the magnet link a hash of the files? Then it would not be possible to change the files without changing the link.
Post reply on HN