Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Upspin – Another option for file sharing

security.googleblog.com

Post reply on HN
Print view View original

61–70 of 170 posts

Re: Upspin – Another option for file sharing

#61

Post by zzzcpan »

electriclove wrote: post #43

Overview that explains the problem this is meant to solve: https://upspin.io/doc/overview.md

"This “information silo” model we have migrated to over the last few years makes sense for the service providers but penalizes the users"

Well, there were many discussions about this topic. Ultimately non-tech users have to use the software that somebody has to make, market, maintain, etc., so for most users upspin model simply pushes service providers from web browsers to apps where service providers are still very much in control, not users.

I think only protocols could give some control to the users for the longest time. They could enable competition among implementations essentially preventing implementations from taking roads that punish users. They would have to find different and user respecting ways to make money. But even then a big corporation with too much money could monopolize the whole market, "extend" protocols and drive all of the user respecting competition out of business or make them play by their rules. And we are back at square one, thinking about taking back control. Something in software has to change very profoundly to change this, like making software that doesn't need maintenance or at least needs so little of it that anyone could afford to do it for their entire life.

Re: Upspin – Another option for file sharing

#62

Post by eximius »

sjs382 wrote: post #57
rakoo wrote: post #20

Earlier quoted context omitted.

big difference: Keybase hosts everything, all your data is belong to Keybase. In upspin only your public key is centralized; the data can be anywhere. Actually if you read the design document it sounds like they want you to provide some wrapper server to access, say, your photos on Google Photos through the Upspin protocol. Your photos would stay there, but authentication would be centralized on Upspin.

Keybase files are encrypted though, right? So if you provide your own PK, they can't read your files.

This was my understanding as well. Keybase goes further in that they do not have access to the file metadata either (only size, not even count - though by their own admission they could probably reverse engineer count if they tried hard).

Re: Upspin – Another option for file sharing

#63

Post by pfraze »

enneff wrote: post #58
sytelus wrote: post #55

Can this enable following scenario: I've a 10 GB file I want to share with the world. But my bandwidth is usual cable modem and I certainly can't take on 100,000 simultaneous download. Does protocol in Upspin enable peer-to-peer file sharing so I can share large files with the world while still on limited bandwidth?

In Upspin you typically store your files in a remote server somewhere on the net (our default implementation uses Google Cloud Storage as its storage backend), which is something you need to pay for. The solution to the problem you describe is BitTorrent.

Dat just put out a desktop application. unlike BT it supports mutable archives.

https://datproject.org

Re: Upspin – Another option for file sharing

#64

Post by mundo »

inconshreveable wrote: post #19

Seems to be very much in the space of kbfs and IPFS. For the folks who are building this: can you compare and contrast this to both kbfs and IPFS? Why have you chosen to start another project in an already crowded space instead of contributing to either of those projects? They are both open source and much further along in development . . .

I think KBFS is a sort of an add-on to Keybase, which is really quite different from this. Keybase's whole schtick is identity and key management. How do share a file with a stranger without exchanging emails? What happens when you lose the email you signed up with? How do you share keys between your devices without trusting a for-profit company's keystore? Keybase solves those for you, and IMHO is quite novel and useful.

Upspin is a separate thing that focuses entirely on how files should be stored and identified, and (AFAICT) does nothing new regarding identity management. Which is unfortunate, because that seems like the more urgent problem right now.

Re: Upspin – Another option for file sharing

#66

Post by bb88 »

ipm42 wrote: post #60

> If one wants to post a Facebook picture on one’s Twitter feed, one does that by downloading the data from Facebook and then uploading it to Twitter. Shouldn’t it be possible to have the image flow directly from Facebook to Twitter? How does my upspin file "ann@example.com/pub/hello.jpg" solve the problem here? I would have a single source for my image to share but still no way to describe an image hosted by FB as a…

Nor would Twitter know what to do with an upspin file.

The problem seems to be distributing the content, not the naming of it.

Edited to add: Ideally that's what the URL is for, it should be possible to get the URL of the image on FB and post it to twitter, since both speak DNS/HTTP.

Re: Upspin – Another option for file sharing

#67

Post by thinkloop »

enneff wrote: post #21
inconshreveable wrote: post #19

Seems to be very much in the space of kbfs and IPFS. For the folks who are building this: can you compare and contrast this to both kbfs and IPFS? Why have you chosen to start another project in an already crowded space instead of contributing to either of those projects? They are both open source and much further along in development . . .

We are aware of kbfs, ipfs, and several other systems. There are many trade-offs one can make in this space, and I think Upspin's set of tradeoffs is somewhat unique. One reason we started this project instead of contributing to others is that it's not clear that the trade-offs made by extant systems are really working for users, at a fundamental level. Maybe Upspin's will, maybe they won't. We'll see. We wrote a bit…

Does upspin have a known "set of tradeoffs [that are] somewhat unique" or does the community need to flesh them out? High-level bullets would be nice.

Re: Upspin – Another option for file sharing

#68

Post by wwwigham »

eximius wrote: post #62
sjs382 wrote: post #57

Earlier quoted context omitted.

Keybase files are encrypted though, right? So if you provide your own PK, they can't read your files.

This was my understanding as well. Keybase goes further in that they do not have access to the file metadata either (only size, not even count - though by their own admission they could probably reverse engineer count if they tried hard).

You don't even register a single root PK with them anymore - you end up with a network of device-specifc and paper keys in their current security model. IMO, their current client is the most nontechnical-user friendly security app I've ever had the privilege to use.

Re: Upspin – Another option for file sharing

#69

Post by remir »

alexcroox wrote: post #28

> Our target audience is personal users, families, or groups of friends. Although Upspin might have application in enterprise environments, we think that focusing on the consumer case enables easy-to-understand and easy-to-use sharing. This definitely does not look "easy to use" unless the target audience of families only includes families where all have technical backgrounds. If I gave anyone in my family that list…

Public key, private key, etc... Yeah, next to Facebook, Dropbox, GDrive, etc, it won't be easy to convince grandma, "Jenny the hairdresser" and "Joe Sixpack" to use this thing.

Re: Upspin – Another option for file sharing

#70

Post by skybrian »

It's a bit unclear how email-based identifiers should work when publishing long-lived, public files.

In particular, which email address should you use? Will the general public learn your email address? What about people who want to post publicly and keep their email addresses private?

What happens if you switch email providers?

Also, there is there any provision for actually making public files available via https? How would that work?

For the moment, using your github username feels safer, since they are public from the beginning, intended to be permanent, and detached from your email addresses. A Twitter account is another intentionally-public userid that's not tied to anything else.

Post reply on HN