201–210 of 576 posts
Earlier quoted context omitted.
DHT makes trackers simply an aggregation and redundancy measure.
It should, but in practice it doesn't. I've had torrents that I left sitting for weeks not being able to complete, until I added a list of trackers to them and found some seeders with 100% of the torrent.
BT only worked for new popular stuff.
There are a few things I wish this addressed, but it doesn't. Off the top of my head: 1. the new hash function is going to be broken eventually - what happens then? 2. support for "remixes". It would be nice to reference pieces from another torrent. Example use case: adding subtitles for a movie. Right now it requires either downloading the "main" version of the movie and getting the subtitles externally, or sharing…
SHA-2 will not be broken as easily as SHA-1. This seems to be a common misconception in this thread.
Wikipedia: "Since 2005, SHA-1 has not been considered secure against well-funded opponents".
This was 10 years after its introduction (1995) and 15 years ago. We had 15 friggin' years and we're finally switching git and bittorrent around. It took 2017-2005=12 years to get from first serious signs of issues to https://shattered.io.
SHA-2 is now 19 years old and the "uh oh, better switch before it's too late" recommendation has not come yet. It's withstanding the test of time better and there haven't been 12 years to mature any weaknesses. The theoretically known attacks for SHA-2 are fairly insignificant.
Since SHA-2 had a similar construction to SHA-1 (Merkle-Dåmgard), NIST figured they better launch the SHA-3 competition at the first sign of trouble and picked something with a very different operating principle. For now, however, it's still fine. Thomas Pornin put this a bit better than I can: https://security.stackexchange.com/a/21116/10863
As for "what happens if/when it will be broken": we could make BitTorrentv2 another multi-crypto soup like with TLS, but then you open up a can of downgrade attacks, potential null ciphers or other such tricks simply due to increased complexity, and you still can't switch that quickly because everyone needs to take manual action in changing configuration files. Much better if we can instead do apt upgrade and let the software take care of making security decisions rather than those who install the software. (Remember that SSL was designed in 1994, when LiveScript/JavaScript didn't even exist yet, DES was state of the art, and we wrote books with algorithms because cryptography was ammunition. Having multiple options for strong/weak ciphers was not yet a crazy idea.)
Earlier quoted context omitted.
You're delirious. Setting aside the fact that BitTorrent came about long before BitCoin was a glint in Satoshi's eye, it's still massively used for content distribution, on top of being a foundational technology to several industrial applications: Apache Spark, for example, uses BitTorrent to shuffle/broadcast data around cluster nodes. Even when BitTorrent alternatives are used in its place (such as IPFS, Dat, or Ka…
> it's still massively used for content distribution Is it, though? Youtube doesn't use it, neither do Netflix, Hulu, Amazon Prime Video, Disney+, Spotify, etc. Does anybody (except for Blizzard) use it? I don't think Steam or the Epic store or the App Store or the Play Store use it, either. I'd be extremely glad to be proven wrong.
Very interesting. But I'm not totally clear -- what does this mean for compatibility with v1? The article states that hybrid torrents that support v1 and v2 can be created. But what does this mean for end-users (clients)? Will most torrent software be upgraded to support both v1 and v2? And will a client be forced to choose from the v1 or v2 swarm, or will it be able to download from and seed to both? I mean it seems…
You would need the file data to do that, so torrent indexing sites could not do it. And since you need the full data you could only do it after downloading at which point it doesn't add that much value.
> Or would this solely be for new torrents moving forwards?
Indeed. v2 offers a few nice improvements but not world-changing ones. So there's no pressure to upgrade existing torrents. They'll keep working as-is.
It feels like this isn't a large enough leap forward. It would be nice if BitTorrent v2 made it harder for ISPs to identify what is bit torrent traffic. AT&T artificially slows down upload speeds.
It's nearly impossible to obfuscate a protocol to work around filtering. You'd want to look like some other protocol and you want that protocol be encrypted by default. Otherwise yours will get fingerprinted via the deep packet inspection. The most obvious choice is to run your protocol over TLS. But then they can just throttle long-lived bulky TLS connections where neither side is on 443. You can then require the re…
Fundamentally, nothing has the same characteristics as BitTorrent - almost nothing has the same high uplink requirements, which is an absolute signature of BitTorrent traffic.
Oh, also some of the shaping is implicit, not explicit. Most home internet connections are asymmetric - they dedicate more channels to downlink than uplink.
I make P2P tools too. [0] Let me tell you this: Bittorrent is one of the few things in the space that actually ... works. It works not in the sense that there is a white paper that should work. Not in the sense that there are a few company-made swarms hosted on industrial servers that keep everyone up and alive, so that the thing gives the impression the 'P2P' network does work. Not in the sense that there is a very-…
> It's a tool that doesn't pitch that it's a P2P tool - it doesn't try to convince you with sob stories in how using P2P helps fight against the big bad evil web. Instead, you use it because it's genuinely the best at what it does: it being P2P is not a selling point, it's just how it happens to work, and that is exactly what it should be. This should be something that every creator who markets or sells products shou…
I can’t remember who aid it originally, but there’s a great test you can give to any statement or idea. Just immediately ask “who cares?” The best product demos I’ve ever seen answer who cares in each part of the pitch. The worst ones just rattle off mumbo jumbo forever.
It feels like this isn't a large enough leap forward. It would be nice if BitTorrent v2 made it harder for ISPs to identify what is bit torrent traffic. AT&T artificially slows down upload speeds.
> AT&T artificially slows down upload speeds Do you have a source on this? I believe you I just want to know more. It explains a lot. I have a gigabit link. I can download torrents at almost line speed. But I can barely get uploads past 5K/s. I spent hours at one point trying to tweak every possible setting and eliminate every bottleneck, and still couldn't get past 5K/s.
There is little to know, it's largely a commercial preference (that has, over the years, driven technological research; see ADSL for example, the first A is for Asymmetric).
Average consumers are precisely that, consumers: they rarely upload anything, but they download tons of content (from webpages to streamed media). So it makes sense for residential ISPs to maximize downstream bandwidth, since it's what consumers will evaluate them on. One way to do that is to simply throttle upstream, to ensure resources stay available for downstream. (This has the side benefit of reducing headaches, i.e. less people distributing questionable material on your network...).
If you need good upload speeds, you simply have to talk to your ISP.
I make P2P tools too. [0] Let me tell you this: Bittorrent is one of the few things in the space that actually ... works. It works not in the sense that there is a white paper that should work. Not in the sense that there are a few company-made swarms hosted on industrial servers that keep everyone up and alive, so that the thing gives the impression the 'P2P' network does work. Not in the sense that there is a very-…
It is the software I download for free that is the most reliable IME. Spending more money does not make today's consumer computers any more valuable. And that's how it should be. The price of hardware (and software) should continue to fall.