Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Locking the Web Open: A Call for a Distributed Web

brewster.kahle.org

Post reply on HN
Print view View original

31–40 of 100 posts

Re: Locking the Web Open: A Call for a Distributed Web

#31

Post by omouse »

heywire wrote: post #25
omouse wrote: post #24

That's been the goal of the Freenet project for a while, to build a distributed encrypted network protocol. It distributes storage and processing which is why full encryption is necessary; you don't want 10 people reading your email when it's distributed across their machines. The challenge for Freenet has been speed and fun. To have something like Facebook you have to download a JAR plugin for Freenet that adds that…

Am I the only one who is scared to even try things like Freenet and Tor, for the risk that someone will somehow transmit illegal content across my connection? I'm not talking about content piracy, but the types of things that I don't even want to type for fear of having the terms associated with my username.

First...IANAL (I Am Not A Lawyer)

You aren't the only one, but with Freenet it's fully encrypted. Let's say you had a Freenet Silk Road application. You won't know it's a Silk Road web page that's being saved along with images of marijuana to your computer unless you go through an indexer/search site and even then you still won't know that those bits of data are stored specifically on your machine.

So in order for the cops to know your machine was used to store the drug listings, the cops would have to spy on your machine and crack the encryption of the Freenet protocol and essentially monitor it. This is why undercover work is important to the police. If no one reports you for the crime of buying drugs and no one discovers the drugs in transit, then the police don't know what's happening. The only way to catch mobsters was through some undercover work and hoping that someone in the criminal network would squeal. If one criminal says the other 10 criminals actually had a hand in committing a crime, the police have more to investigate and can build a case.

If you're not buying drugs or selling drugs and the data related to the drug listings is encrypted when stored on your machine and encrypted when served from your machine, you may be unknowingly helping a criminal to buy or sell drugs. But I'm not sure how that's discoverable by the police and I'm not sure how it would be turned into a criminal investigation. By the argument that you're allowing this, then all ISPs and cell providers are in big trouble because they also enable drug dealing.

There are some horror stories for Tor node operators though.

Re: Locking the Web Open: A Call for a Distributed Web

#32

Post by dweinus »

kodablah wrote: post #29
dweinus wrote: post #12

I want this for all the reasons they list, but it seems there are huge unanswered questions for anything beyond a permission-less static page. Imagine you are developing a modern web app in the locked open paradigm. Is all system data distributed, including private user data and passwords? The only solution I can come up with is homomorphic encryption, which is not performant enough and still probably leaves a huge t…

Point by point...(sorry for the long post) "homomorphic encryption, which is not performant enough" It is fast enough on a per viewer basis, and in a DHT downloading the database doesn't mean it was all encrypted w/ one key. Each user encrypts his data as needed, or common groups of users encrypt data for each other with each others keys. "If I make any mistakes on the database security" This is why encryption is the…

Thank you for the thoughtful responses! I am still getting my head around some of this, so I love hearing solutions I have not thought of.

"common groups of users encrypt data for each other with each others keys"

I agree, but I think this can quickly lead to massive multiplication of data without careful cryptographic gymnastics. It puts more pressure on the application devs to do it right or more pressure on the network in terms of data if you don't.

"Sure you can still leak your private key like you can leak an SSH key today."

If I leak an SSH key, I can revoke it and only data that attackers have already grabbed is out. In the described paradigm, everything is already out to everyone. It is all or nothing. That might not be a difference from a theoretical point of view, but in practice it is.

MaidSafe is very interesting, thank you! It seems like more of a shared cloud, which is halfway between present cloud computing and the completely distributed utopia described in the article. It solves pretty much all of these issues, with the cost of being a less-centralized network rather than a fully distributed network. Awesome work, I hope they succeed!

Re: Locking the Web Open: A Call for a Distributed Web

#33

Post by erkose »

omouse wrote: post #24

That's been the goal of the Freenet project for a while, to build a distributed encrypted network protocol. It distributes storage and processing which is why full encryption is necessary; you don't want 10 people reading your email when it's distributed across their machines. The challenge for Freenet has been speed and fun. To have something like Facebook you have to download a JAR plugin for Freenet that adds that…

One would turn to twister.net.co, which addresses the "next" features discussed in this article, rather than pump dot io.

Re: Locking the Web Open: A Call for a Distributed Web

#34

Post by LukeB42 »

I've been thinking of how to decentralise the web as-is since 2011, the current development branch for this perspective on it is here: https://github.com/LukeB42/Uroko/tree/development

It's basically a collaborative caching proxy.

One process is a proxy that can also coordinate multiple users editing the same page and a subprocess acts as a DHT node.

You can use a raft-like log of hashes of pubkey,content and the previous hash to keep a history of edits in the network.

the hard part is this: How do you trust the validity of a singular node having a url you're requesting?

It entails a rating system, and then it becomes the byzantine generals problem where the overlay network should be able to tolerate up to a third of its malicious nodes saying they're all trustworthy.

Feedback/any help would be much appreciated.

Re: Locking the Web Open: A Call for a Distributed Web

#35

Post by kodablah »

dweinus wrote: post #32
kodablah wrote: post #29

Earlier quoted context omitted.

Point by point...(sorry for the long post) "homomorphic encryption, which is not performant enough" It is fast enough on a per viewer basis, and in a DHT downloading the database doesn't mean it was all encrypted w/ one key. Each user encrypts his data as needed, or common groups of users encrypt data for each other with each others keys. "If I make any mistakes on the database security" This is why encryption is the…

Thank you for the thoughtful responses! I am still getting my head around some of this, so I love hearing solutions I have not thought of. "common groups of users encrypt data for each other with each others keys" I agree, but I think this can quickly lead to massive multiplication of data without careful cryptographic gymnastics. It puts more pressure on the application devs to do it right or more pressure on the ne…

You can also change any sensitive data you have. Also, the distributed/open web should not be one without moderation, just without mandated moderation. If I wrote a distributed social network, I would allow the user to choose a moderated "room"/"group" if he wished. This can facilitate deletion of items, but in many distributed systems, they are never deleted anyways. Be it a mostly immutable DHT or the "right to be forgotten" or whatever it is, in decentralized systems you cannot tell people what to do with data you put out there, you can only encrypt it. IMO, we'll still need the public auditable web for acts requiring responsibility for security failures. Users cannot be trusted with their own security nor can they be trusted to determine a bad actor from a good one.

MaidSafe is fully distributed. Each user is a node (i.e. "vault" or "persona" or whatever the proper name is).

Re: Locking the Web Open: A Call for a Distributed Web

#37

Post by nekopa »

omouse wrote: post #31
heywire wrote: post #25

Earlier quoted context omitted.

Am I the only one who is scared to even try things like Freenet and Tor, for the risk that someone will somehow transmit illegal content across my connection? I'm not talking about content piracy, but the types of things that I don't even want to type for fear of having the terms associated with my username.

First...IANAL (I Am Not A Lawyer) You aren't the only one, but with Freenet it's fully encrypted. Let's say you had a Freenet Silk Road application. You won't know it's a Silk Road web page that's being saved along with images of marijuana to your computer unless you go through an indexer/search site and even then you still won't know that those bits of data are stored specifically on your machine. So in order for th…

Not talking about the legal aspects, but, (and I really, really hate to bring up the "think about the children!" argument here) what about if I am unknowingly helping people who create and share child porn?

It doesn't matter (to me) if I am on the hook for it or not, I just don't know (ethically?) how I would feel if I knew that was going on via my PC. Drugs I don't give a shit about, and I hate how the "think about the children" people screw our rights to privacy, but still...

Honest open question.

Edit: PS, I want you guys to keep doing what you're doing. I completely believe in an open free web, and I want to play my part... I hate the idea of the open web turning into a bunch of mini AOLs... Which is where we seem to be heading at the moment.

Re: Locking the Web Open: A Call for a Distributed Web

#38

Post by molsongolden »

lsjroberts wrote: post #3
wwwtyro wrote: post #2

I'm all for this, and consider it to be inevitable in the long run. In the short term, however, it seems like the major hurdle will be getting one of these projects into the mainstream: for the most part, the web already does what most people want it to do, and those people aren't going to be bothered to install a new web browser so that they can do things they're already doing. Especially if it lacks the features, p…

You may be interested in https://ind.ie/about/vision/

https://indiewebcamp.com/ is a bit more interesting and open.

Re: Locking the Web Open: A Call for a Distributed Web

#39

Post by nekopa »

Titanous wrote: post #23

I really wish that the Internet Archive would provide bulk access to the Wayback Machine dataset. It would allow for a lot of interesting experimentation and research.

Is that even possible? I don't know the latest size of the IA, but it must be ridiculously huge by now, (1 billion pages a week added) bandwidth cost would be massive.

Maybe they could offer a mail-us-a-multi-petabyte-hdd service... Returned a few weeks later full of data :)

Re: Locking the Web Open: A Call for a Distributed Web

#40

Post by granos »

omouse wrote: post #31
heywire wrote: post #25

Earlier quoted context omitted.

Am I the only one who is scared to even try things like Freenet and Tor, for the risk that someone will somehow transmit illegal content across my connection? I'm not talking about content piracy, but the types of things that I don't even want to type for fear of having the terms associated with my username.

First...IANAL (I Am Not A Lawyer) You aren't the only one, but with Freenet it's fully encrypted. Let's say you had a Freenet Silk Road application. You won't know it's a Silk Road web page that's being saved along with images of marijuana to your computer unless you go through an indexer/search site and even then you still won't know that those bits of data are stored specifically on your machine. So in order for th…

It's important to note that most of the horror stories involving Tor nodes are related to "exit" nodes. These are the nodes that bridge the open internet with the Tor network. As such, you can see what traffic is traveling through them much more easily.

It's not recommended to run exit nodes if you don't know what you are doing and have a fair bit of resources (time/money) to spend on it. Without exit nodes Tor doesn't work, but they are risky to run because you can be held liable for the content traversing the machine.

Post reply on HN