Patchwork – Decentralized messaging and sharing app built on Secure Scuttlebutt • Hacker News Board

Re: Patchwork – Decentralized messaging and sharing app built on Secure Scuttlebutt

#61

Post by Rhapso » Thu, Feb 01, 2018, 7:53 PM UTC

happynaut wrote: post #46

Rhapso wrote: post #18

Earlier quoted context omitted.

Thanks, I really like the core ideas of ssb but the nodejs implementation and lack of a security review give me a lot of professional reservations. I'm inclined to fork and use a more off the shelf method of securing p2p connections. The practice of binding a "secure" web-server to localhost is also a bit [dubious]( https://security.stackexchange.com/questions/86773/how-secur... ).

What's your reservations about it being implemented in nodejs? It's not my favourite technology stack either (I much prefer scala / haskell), but it hasn't deterred me from using it or contributing to the project. I wonder if a security review is something that can be funded through the open collective that is being set up ( https://opencollective.com/secure-scuttlebutt-consortium ) or some other funding source. By t…

I have issues with js as a language but those are not security issues. My security-related issues are with the nodejs package infrastructure.

https://www.csoonline.com/article/3214624/security/malicious... The sprawling dependencies alongside potential security/breaking issues are huge. It is a large and vulnerable attack surface.

Re: Patchwork – Decentralized messaging and sharing app built on Secure Scuttlebutt

#62

Post by hardfire » Fri, Feb 02, 2018, 4:22 AM UTC

masukomi wrote: post #57

tomcooks wrote: post #40

Earlier quoted context omitted.

Mixed feelings about these writings. All great for the vibes, but _personally_ I'd rather read tutorials on how to get it running easily on an old solar powered raspberry pi, or how to install it on my dad's phone. The introductory video [0] to Scuttlebutt is an excellent example of concise, hands down, brief explanation on why this software is important (vibes + useful). Tutorials and brief explanation change the fu…

forgot to mention. There's a post with instructions [1] for setting up scuttlebutt on a Raspberry Pi Pirate box. I'd link you to it on the web but the user has chosen not to have their posts shown on our public gateways, but if you join the network you can just throw this in the search field and you'll see all the details. [1] %DI98y9SukdIcd0RW5mp9MRc0mxHziGLP/+PNUu59pO8=.sha256

Awesome! I've been using patchwork for some days and was always curious how to navigate to these ssb:// link i see thrown in places. You just throw it in the search field and you'll see all the details! top!

Re: Patchwork – Decentralized messaging and sharing app built on Secure Scuttlebutt

#63

Post by mike-cardwell » Fri, Feb 02, 2018, 9:26 PM UTC

happynaut wrote: post #45

mike-cardwell wrote: post #44

Earlier quoted context omitted.

Well. I will definitely be setting this up then. Thanks for the pointers.

Awesome :). Let me know if you need a hand with any of the setup.

Well. I created a gathering. The UI gives me no indication of who can see it; if it's public or private. The UI gives me no indication of how I can "invite" people to it so they can see it (if it's even private).

The UI could do with some work.

Re: Patchwork – Decentralized messaging and sharing app built on Secure Scuttlebutt

#64

Post by happynaut » Sat, Feb 03, 2018, 4:43 PM UTC

mike-cardwell wrote: post #63

happynaut wrote: post #45

Earlier quoted context omitted.

Awesome :). Let me know if you need a hand with any of the setup.

Well. I created a gathering. The UI gives me no indication of who can see it; if it's public or private. The UI gives me no indication of how I can "invite" people to it so they can see it (if it's even private). The UI could do with some work.

You could create an issue on the patchwork github issues page (https://github.com/ssbc/patchwork/issues) outlining the changes you'd like to see, if you like :).

And / or start a thread in #new-people on scuttlebutt.

Re: Patchwork – Decentralized messaging and sharing app built on Secure Scuttlebutt

#65

Post by happynaut » Sat, Feb 03, 2018, 4:44 PM UTC

Rhapso wrote: post #61

happynaut wrote: post #46

Earlier quoted context omitted.

What's your reservations about it being implemented in nodejs? It's not my favourite technology stack either (I much prefer scala / haskell), but it hasn't deterred me from using it or contributing to the project. I wonder if a security review is something that can be funded through the open collective that is being set up ( https://opencollective.com/secure-scuttlebutt-consortium ) or some other funding source. By t…

I have issues with js as a language but those are not security issues. My security-related issues are with the nodejs package infrastructure. https://www.csoonline.com/article/3214624/security/malicious... The sprawling dependencies alongside potential security/breaking issues are huge. It is a large and vulnerable attack surface.

Fair play!