161–170 of 174 posts
Forgive me if my comment too readily reveals my ignorance on these topics, but would the IPFS project [0] be useful for this? [0] http://ipfs.io
Definitely, checkout their example on how to host git on ipfs[0] [0] http://gateway.ipfs.io/ipfs/QmTkzDwWqPbnAh5YiV5VwcTLnGdwSNsN...
Earlier quoted context omitted.
bittorrent hashes as susceptible to collision attacks.
Collision attacks are not really a problem, since they only happen when the attacker gets to specify the hash, which wouldn't be the case here. Generating a file that hashes to an existing hash is called a Preimage attack, and SHA-1 (the algorithm used by bittorrent) isn't, for now and as far as we know, vulnerable to any.
Lovely work! We ask for the commit we want and connect to a node with BitTorrent, but once connected we conduct this Smart Protocol negotiation in an overlay connection on top of the BitTorrent wire protocol, in what’s called a BitTorrent Extension. Then the remote node makes us a packfile and tells us the hash of that packfile, and then we start downloading that packfile from it and any other nodes who are seeding i…
I agree it is really stellar. The billion dollar concept for me though is encrypted repo torrents. Imagine a group of servers that are hosting encrypted chunks which form the basis of a homomorphic encryption protocol for distribution using forward error correction to allow recovery of the deltas if n of m components of that delta can be recovered. Basically if you have the key you can pull out of this amorphous clou…
What's stopping a decentralized github from ending up in the same fate as the newsgroups, that the data set gets too large to handle !?
I think that Github is more then just a repository, it's a community. I kinda quit Facebook and signed up to Github instead :P And if it weren't for Github I would have never touched git.
Startup idea: Create something like Github and assembly.com, but with a complete tool-set (git+vps)
Earlier quoted context omitted.
Collision attacks are not really a problem, since they only happen when the attacker gets to specify the hash, which wouldn't be the case here. Generating a file that hashes to an existing hash is called a Preimage attack, and SHA-1 (the algorithm used by bittorrent) isn't, for now and as far as we know, vulnerable to any.
SHA1 is vulnerable to it, but you're right that ive drastically overestimated the practicality of a preimage attack. Thanks for the correction :)
It'd be interesting to see something like gitlab to have some sort of federation support; where multiple instances can talk to one another (a la xmpp/smtp), so as to clone/send pull-requests, etc across different instances.
Earlier quoted context omitted.
SHA1 is vulnerable to it, but you're right that ive drastically overestimated the practicality of a preimage attack. Thanks for the correction :)
Why do you say that SHA1 is vulnerable to second preimage attacks? Zero have been found.
So it's one of those situations where everyone was right: it's so impractical to exploit that it's as good as not vulnerable even though it's mathematically possible.
So as in distributed databases, you either:
* need to acquire exclusive lock on the repository metadata, or
* accept, that your push will be eventually discarded because you did not have up to date metadata
Earlier quoted context omitted.
It is hard to do issues and pull/merge requests in a decentralized way ...Over the web... I mean, Git and Linux are developed via email lists, which is a decentralized way of sending pull/merge requests, isn't it? I guess you could argue the mailing list is hosted on a server, fine. So then fine, usenet. Yeah, email and nntp are old crufty technologies and there are obviously advantages to having a web based interfac…
Wouldn't a decentralized web interface be webmail (i.e. Gmail)? Then along the Gmail theme, a plug in could make things look much like a static website. Where "conversation view" becomes a "repository view".
Earlier quoted context omitted.
Do you imply that PPSP's live stream protocol could be used to create updateable keys?
Yes, if append-only is enough then a streaming protocol like PPSP is good. Otherwise we need something else, which I hope to achieve in rakoshare ( https://github.com/rakoo/rakoshare ).