Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Weave is kinda slow

generictestdomain.net

Post reply on HN
Print view View original

151–160 of 164 posts

Re: Weave is kinda slow

#151

Post by DanBC »

weavenetwork wrote: post #84
msutherl wrote: post #75

Earlier quoted context omitted.

To put it simply, if @monadic were receptive to @lclarkmichalek's ideas, why did he end the conversation? But let's look at the Tweet in question: "@lclarkmichalek @weavenetwork please, if it is so simple and robust you are very welcome to contribute a patch." 1. He says "please", which in this case is sarcastic. 2. Then he says "if it is so simple," which is a dismissive way of saying "you think that it's simple, bu…

I'm sorry but I find your interpretations of 1-4 completely uncharitable and unreasonable.

What you meant is clear to you. It's not clear to other people. You can chose to ignore them - maybe the people who misread the tweet are a small minority. Or you can chose to think about communication style and whether more people had the same "uncharitable" interpretation.

For what it's worth I lean more to the uncharitable reading of the tweet, although I'm not as firm about that reading as others appear to be.

Tweets for communication are hard so it's not particularly suprising when what you say and what you think you say doesn't match what other people think you said.

Re: Weave is kinda slow

#152

Post by jheriko »

mradestock wrote: post #122
jheriko wrote: post #114

Earlier quoted context omitted.

"they do not use a password hashing function" this is a bit of a facepalm whenever i hear this.

> "they do not use a password hashing function" From the weave crypto docs at http://weaveworks.github.io/weave/how-it-works.html#crypto : "The public key from the remote peer is combined with the private key for the local peer in the usual Diffie-Hellman way, resulting in both peers arriving at the same shared key. To this is appended the supplied password, and the result is hashed through SHA256, to form the final…

thanks for clearing that up. good work. :)

Re: Weave is kinda slow

#153

Post by takeda »

weavenetwork wrote: post #98
api wrote: post #94

Earlier quoted context omitted.

"demonstrably safe" -- this is another issue I have with this crypto conservative FUD. "Use SSL, don't roll your own!" Then we get BEAST, CRIME, Heartbleed, etc., and we discover that the dominant SSL/TLS implementation is a rat's nest of comically awful code: http://opensslrampage.org Look at the older posts for LuLz like: http://opensslrampage.org/post/83007010531/well-even-if-time... I wonder just how much scrutin…

indeed. at the risk of entering tinfoil hat land, note the following http://blog.cryptographyengineering.com/2014/12/on-new-snowd... ..although also the not 100% reassuring https://nohats.ca/wordpress/blog/2014/12/29/dont-stop-using-...

What about other libraries? GnuTLS, NSS, PolarSSL, wolfSSL?

Re: Weave is kinda slow

#154

Post by weavenetwork »

yellowapple wrote: post #150
weavenetwork wrote: post #125

Earlier quoted context omitted.

No, for example it is 100% uncharitable and unreasonble to assert that "please" is sarcastic. The truth is quite the opposite.

I think we'll have to agree to disagree on that one, then, though thanks for the clarification nonetheless. Typically (at least in American English vernacular), "please" is very frequently used in a sarcastic manner (e.g. "You think you can jump from the top of that building and not get hurt? Bitch, please ." or "Oh please , like you know the difference between a grape and a grapefruit."). While this sarcastic usage…

I'll have to stop saying please when in the US then ;-) But seriously, thanks for taking the time to explain your point of view. alexis.

Re: Weave is kinda slow

#155

Post by msackman »

msackman wrote: post #145
heavenlyhash wrote: post #144

Earlier quoted context omitted.

What you're looking for here is usually referred to as "PBE" (Password Based Encryption) or "KDF" (Key Derivation Function). There's a couple extra concerns for transforming a human-readable password into a symmetric key. Hashing is the start, so it's great that your project already has that, but there's more to do, and this is a well-studied topic with lots of literature and pre-existing solutions. "PBKDF2", "HDKF",…

DH is used to ensure that every connection between every pair of weave router nodes that ever gets established uses a unique session key. Yes, the public key is exchanged in the clear, and yes, that is MITMable. But as you say, the subsequent combination of the result of the DH with the non-exchanged password solves that. What is the weakness with this approach? Is your point that there's nothing gained from doing th…

> There is no requirement for weave that the password is human readable. It can be supplied through a file, so you can happily dd if=/dev/random of=/my/weave/passwd bs=1k count=1 to create a suitable weave password

Turns out that feature I was thinking about has been removed, so the above is not true.

Re: Weave is kinda slow

#156

Post by mradestock »

msackman wrote: post #155
msackman wrote: post #145

Earlier quoted context omitted.

DH is used to ensure that every connection between every pair of weave router nodes that ever gets established uses a unique session key. Yes, the public key is exchanged in the clear, and yes, that is MITMable. But as you say, the subsequent combination of the result of the DH with the non-exchanged password solves that. What is the weakness with this approach? Is your point that there's nothing gained from doing th…

> There is no requirement for weave that the password is human readable. It can be supplied through a file, so you can happily dd if=/dev/random of=/my/weave/passwd bs=1k count=1 to create a suitable weave password Turns out that feature I was thinking about has been removed, so the above is not true.

I don't think that feature ever existed.

Though a representation in a particular character set does not prevent the password from being strong.

Re: Weave is kinda slow

#157

Post by weavenetwork »

takeda wrote: post #153
weavenetwork wrote: post #98

Earlier quoted context omitted.

indeed. at the risk of entering tinfoil hat land, note the following http://blog.cryptographyengineering.com/2014/12/on-new-snowd... ..although also the not 100% reassuring https://nohats.ca/wordpress/blog/2014/12/29/dont-stop-using-...

What about other libraries? GnuTLS, NSS, PolarSSL, wolfSSL?

What about them? Would you recommend one of them over the others?

Re: Weave is kinda slow

#158

Post by garthk »

msutherl wrote: post #51
lclarkmichalek wrote: post #49

Earlier quoted context omitted.

Yeah, I feel a little guilty after writing this article, as the speed of the implementation is simply a detail. However, I feel no such guilt in condemning Weave's security. This is a conversation I had with @weave a while ago about their encryption https://twitter.com/lclarkmichalek/status/544882194456776705

This "our project is open source, feel free to submit a patch" dismissal is so passive aggressive. If you mean "fuck you," then just say "fuck you." That said, you shouldn't be saying "fuck you" in the first place: it's rude, it contributes to bad vibes in the OSS community, and it hurts you more than anybody. Try instead something like: "I'm having trouble understanding your argument, do you mind explaining in more…

See also: E_NOTADATABASE.

http://howfuckedismydatabase.com/nosql/

Re: Weave is kinda slow

#159

Post by garthk »

bboreham wrote: post #33
d136o wrote: post #12

what I appreciate about weave is that it solved the cross host container networking problem easily (it's very very easy to use) and now , i.e. no waiting for promises of future solutions or fooling around with more complicated set ups. Here's where I got burned: I set up an elastic search cluster using containers and weave and life was great, but it then grew to need another node. Upon setting up the new host with do…

Hi, I work on Weave; it may well have been one of my commits that broke the protocol compatibility for you. We've changed things over time to improve performance and resilience. It should be fairly straightforward to deploy the same version on every host, but maybe that wasn't explained well enough, or didn't work for you. We'd welcome more feedback. Lastly, I appreciate the positive comments. "Very very easy to use"…

Thanks for using your own account.

Re: Weave is kinda slow

#160

Post by takeda »

weavenetwork wrote: post #157
takeda wrote: post #153

Earlier quoted context omitted.

What about other libraries? GnuTLS, NSS, PolarSSL, wolfSSL?

What about them? Would you recommend one of them over the others?

Yes, any of them is better than rolling your own.

Even if they have bugs (it is unlikely they don't), they'll still have less bugs than own implementation.

If you are still not convinced, at least give user option what to use.

curl[1] is a good example of giving freedom to the user.

[1] http://curl.haxx.se/docs/ssl-compared.html

Post reply on HN