Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Upspin – Another option for file sharing

security.googleblog.com

Post reply on HN
Print view View original

161–170 of 170 posts

Re: Upspin – Another option for file sharing

#161

Post by skierpage »

vzaliva wrote: post #90

It is odd they do not use URLs (or URIs) with 'upspin' scheme.

> It is odd they do not use URLs (or URIs) with 'upspin' scheme.

Yes it is. An Upspin file path like ann@example.com/dir/file is not obviously part of any scheme. If Upspin takes off, all the automagic parsing of plain text (that makes ann@example.com and news.ycombinator.com/formatdoc automatically turn into a clickable e-mail link and an HTTP URL) could be extended to turn ann@example.com/dir/file into a link that fires up a GUI to the Upspin service. The problem is that the file path also looks like an HTTP/S URL for https://example.com/dir/file specifying the username ann, so copying it into your browser's location bar without a scheme is fundamentally ambiguous.

Even though Upspin uses HTTPS for its API (e.g. https://store.upspin.io/api/Store/Get/something), there doesn't seem to be an HTTPS URL for access to a particular file. Since ann@example.com is by design just an email identifier disconnected from the directory server and storage server that ann uses to store her files, clients can't skip the root key server and talk to example.com to request ann's files, even though in some cases it will be the same server name.

Re: Upspin – Another option for file sharing

#162

Post by skierpage »

zzzcpan wrote: post #61
electriclove wrote: post #43

Overview that explains the problem this is meant to solve: https://upspin.io/doc/overview.md

"This “information silo” model we have migrated to over the last few years makes sense for the service providers but penalizes the users" Well, there were many discussions about this topic. Ultimately non-tech users have to use the software that somebody has to make, market, maintain, etc., so for most users upspin model simply pushes service providers from web browsers to apps where service providers are still very…

> I think only protocols could give some control to the users for the longest time.

They do. If you run your own web or blog server you can provide resources at HTTP URLs forever. The server cost is dropping to zero either by running it on your home router or paying pennies/free for a small cloud instance. The biggest expense is owning and maintaining a domain name forever.

If Upspin takes off, you could provide resources at Upspin file paths forever without needing your own domain.

The problem is people like social sites, most of us now expect to be able to like and share and comment on resources. So although I will consider Upspin as a way to provide pictures to friends and family who aren't on Facebook, I'm unlikely to ever stop also putting them in the walled garden on Facebook for the upvotes. And building a social protocol in which Facebook will give a damn competing with other implementations seems vanishingly unlikely right now.

Re: Upspin – Another option for file sharing

#163

Post by DannyBee »

cookiecaper wrote: post #87
enneff wrote: post #12

Earlier quoted context omitted.

Upspin is one of Google's many Open Source projects. It's not really skunkworks, per se, just something that we wanted to work on and were lucky enough to be supported by Google in doing so. The email addresses are Upspin user names whose public keys are registered with a central server, key.upspin.io. To act as an Upspin client, you need to sign up: https://upspin.io/doc/signup.md Requests made by Upspin users are s…

This doesn't really clarify what an "unofficial" Google project is. Does it mean that people don't work on it full-time and it's a 20% project? Does it mean that it was developed at home without using Google's resources, so they don't have an ownership interest in it, but they are letting it be hosted on their infrastructure and announced on their blog to be nice? Does it mean that Google isn't sure how long it will…

"This doesn't really clarify what an "unofficial" Google project is."

Okay, so since i wrote this disclaimer, and the policy that requires it, let me try to explain this simply.

Historically, people were discovering projects were made by googlers, etc, and thinking this somehow meant it was an official google thing that google was supporting (though, admittedly, i have no better idea of what that really means at heart than anyone else). You'd even see tons of press stories about how Google had done x, y, or z, and worse, people would take it as a sign of strategy or best practices or whatever. IE "Google released j2objc, and thus thinks you shuold write your ios apps in java". But Google hadn't done anything. A bunch of people who worked there had done something, and someone discovered they were googlers (usually. There were a number of cases of people trying to associate their project with google in order to try to gain publicity, etc, but this was significantly more rare)

So I got asked to go solve this problem, and tried to do so in the lowest effort (for everyone involved) and simplest way:

Anything that was not an official google product, was marked as such. Now press, etc, can't claim they thought it was official anything :) People look at it get the right impression, even if they don't know precisely what it means. It raises a few questions sometimes (what does it mean to be official), but for over 5000 projects, i think the number of questions of people trying to understand what i means is "small".

In that regard, i believe doing this was a resounding success. [1]

This was simple back in the day. These days, there are projects, like upspin, that seem to be like they are are somewhere in the middle (honestly, i haven't looked at all to determine it).

So maybe i'll reevaluate.

[1] Almost as successful as me marking Chromium "copyright the chromium authors" (now copied everywhere), with nobody really understanding why that was done.

Re: Upspin – Another option for file sharing

#164

Post by scott00 »

zokier wrote: post #138
enneff wrote: post #102

Earlier quoted context omitted.

It'd be interesting to talk about how this might work.

SRV record for the domain part of the "email" address pointing to the key server for that domain. Isn't that the standard solution for this sort of thing?

Yeah, that's exactly what I had in mind.

Re: Upspin – Another option for file sharing

#165

Post by sliken »

enneff wrote: post #58
sytelus wrote: post #55

Can this enable following scenario: I've a 10 GB file I want to share with the world. But my bandwidth is usual cable modem and I certainly can't take on 100,000 simultaneous download. Does protocol in Upspin enable peer-to-peer file sharing so I can share large files with the world while still on limited bandwidth?

In Upspin you typically store your files in a remote server somewhere on the net (our default implementation uses Google Cloud Storage as its storage backend), which is something you need to pay for. The solution to the problem you describe is BitTorrent.

or IPFS.

Re: Upspin – Another option for file sharing

#166

Post by pjc50 »

Asooka wrote: post #136
StavrosK wrote: post #50

Earlier quoted context omitted.

Why do they have to deal with the piracy problem?

Because it's 2017 already. We, as programmers, should strive to make ethical software that doesn't infringe others' rights. Even Google's core motto is "don't be evil". The RIAA and MPAA are the supporting pillars of our culture - if they go down, our own culture dies. Making software that facilitates eroding the foundations on which our culture is built, seems pretty evil to me. Leveraging your position as a too-big…

Unfortunately, the cost of preventing piracy is building a global censor with authority to veto any use of the system. Which can also be seen as "evil".

Re: Upspin – Another option for file sharing

#167

Post by reitanqild »

Merovius wrote: post #155
driusan wrote: post #144

Earlier quoted context omitted.

"This is the official list of people who can contribute (and typically have contributed) code to the Upspin repository. The AUTHORS file lists the copyright holders; this file lists people. For example, Google employees are listed here but not in AUTHORS, because Google holds the copyright."

There is a difference between "a Google Product" and "Code to which Google holds copyright". Most importantly, the latter may include all code written by any Google Employee during their employment.

There is a difference but it is only interesting once you get really close like in a lawsuit IMO.

Google has copyright on the code and runs the infrastructure?

Very much a Google product to me. Paid or not. Official or not.

Re: Upspin – Another option for file sharing

#168

Post by 4ad »

reitanqild wrote: post #167
Merovius wrote: post #155

Earlier quoted context omitted.

There is a difference between "a Google Product" and "Code to which Google holds copyright". Most importantly, the latter may include all code written by any Google Employee during their employment.

There is a difference but it is only interesting once you get really close like in a lawsuit IMO. Google has copyright on the code and runs the infrastructure? Very much a Google product to me. Paid or not. Official or not.

From the docs:

> Terms of Service

> The Upspin website (the “Website”) is hosted by Google. By using and/or visiting the Website, you consent to be bound by Google’s general Terms of Service and Google’s general Privacy Policy.

Really a shame.

Re: Upspin – Another option for file sharing

#169

Post by yagurastation »

stefanha wrote: post #137
Merovius wrote: post #135

Several questions, some minor, some major: AIUI, the keyserver is centralized in two regards: a) if it's down, I can't access anyone's data and b) it centralizes trust, key.upspin.io has complete control over which key belongs to which person and where the data is, so it can just take over accounts. Why not use a federated model, e.g. putting the directory into the DNS or have the directory server listen on a well-de…

The centralized keyserver puzzles me a little too but it does have some advantages: 1. The email address adds a layer of indirection on top of your upspin directory and storage server addresses. You can migrate upspin providers without changing your identifier in the global namespace. 2. The email address is instantly recognizable to friends and family. It's more user-friendly than introducing a separate decentralize…

"An Upspin user joins the system by publishing a key to a central key server. We’re running our own server for the moment but anticipate converting to Key Transparency." https://upspin.io/doc/security.md

Re: Upspin – Another option for file sharing

#170

Post by Merovius »

reitanqild wrote: post #167
Merovius wrote: post #155

Earlier quoted context omitted.

There is a difference between "a Google Product" and "Code to which Google holds copyright". Most importantly, the latter may include all code written by any Google Employee during their employment.

There is a difference but it is only interesting once you get really close like in a lawsuit IMO. Google has copyright on the code and runs the infrastructure? Very much a Google product to me. Paid or not. Official or not.

But it makes a philosophical difference to the involvement of the company, of the people working on it and also a practical difference, because products and non-products have very different launch-requirements. You are perceiving Google as far more monolithic, than it really is; the difference between a product and a non-product is how different employees of the company interact. To the outside world, that might or might not have any meaning. But I feel for the original comment that I replied to, it does.
Post reply on HN