Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

app.radicle.xyz

Post reply on HN
Print view View original

61–70 of 299 posts

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#61

Post by cloudhead »

mariusor wrote: post #54
cloudhead wrote: post #26

Earlier quoted context omitted.

While Git is designed in some way for peer-to-peer interactions, there is no deployment of it that works that way. All deployments use the client-server model because Git lacks functionality to be deployed as-is in a peer-to-peer network. For one, it has no way of verifying that the repository you downloaded after a `git clone` is the one you asked for, which means you need to clone from a trusted source (ie. a known…

> it has no way of verifying that the repository you downloaded after a `git clone` is the one you asked for Respectfully disagree here. A repository is a(or multiple) chain(s) of commits, if each commit is signed, you know exactly that the clone you got is the one you asked for. You're right that nobody exposes a UI around this feature, but the capability is there if anyone would have any workflows that require to p…

Here's the problem: how do you know that the commit signers are the current maintainers of the repo?

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#62

Post by wokwokwok »

zlatan_todoric wrote: post #44
wokwokwok wrote: post #40

Earlier quoted context omitted.

I read the documentation and this stands out to me: > Radicle repositories, which can be either public or private, can accommodate diverse content including source code, documentation, and arbitrary data sets. If this is, basically, a peer-to-peer file sharing application, what part of the protocol handles dealing with abuse? Otherwise, how is this different from the previous generation of file sharing applications (…

you can choose which nodes you follow and which nodes you block - you can even decide that you will seed particular repos and not the entire node. (P.S. I am working at Radicle)

How would you know which nodes to block?

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#63

Post by cloudhead »

saurik wrote: post #57
cloudhead wrote: post #56

Earlier quoted context omitted.

I don't think there's anything "special" here. You have the same problem currently where finding the canonical location of a repository is done via some out-of-band social network or website. On GitHub, you also can look at the stars to give you extra confidence, and on Radicle the equivalent is the seed count for a given repository.

Then why does the documentation say this is "important"? GitHub certainly does not have a notice anywhere saying "it's important to only publish repositories you own or are a maintainer of" (...well, I guess it could be buried deep in some user guide I never read, lol).

I think it's currently more likely to happen on Radicle given there is no search or discovery functionality, and repositories exist on a flat hierarchy, ie. they are not namespaced by user/org name, so harder to distinguish if they share the same name and description.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#64

Post by mythhabit »

bawolff wrote: post #42
cloudhead wrote: post #28

Earlier quoted context omitted.

I haven't seen the term misused very often - the way it is defined in Radicle and most other peeer-to-peer systems is how Wikipedia defines it[0]; specifically this part: "Peers are equally privileged, equipotent participants in the network". So a peer to peer system is one where all participants are "equally privileged in the network". This usually means they all run the same software as well. [0]: https://en.wikipe…

I mean, that definition doesn't fit with supernodes ("seed" nodes in your design) but that is a nitpick. I guess im mostly just wondering what are the properties you are trying to accomplish. Like there is talk of publicly seeding repositories that are self-certifying, but also using noise protocol for encryption, so what is the security model? Who are you trying to keep stuff secret from? It is all very confusing wh…

All nodes can still have equal privilege. Data must originate from somewhere, that is a seed node. And supernode is, or at least was when I studied CS, basically just a more connected node. That said, I agree, a project like this could do with a more formal and structured definition of goals.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#65

Post by cloudhead »

kosolam wrote: post #39
cloudhead wrote: post #34

Earlier quoted context omitted.

In the long term, this is intended as an alternative to collaboration platforms like GitHub and GitLab for people/organizations who want full control of their data and user experience, without compromising on the social aspect of these platforms. The first three paragraphs of the guide has a longer motivation: https://docs.radicle.xyz/guides/user

Feedback: consider adapting the docs for mobile view Feedback 2: a short tldr about the short term use cases would be great :-)

Yes, working on it!

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#67

Post by ianopolous »

cloudhead wrote: post #55
ianopolous wrote: post #51

Earlier quoted context omitted.

How do you handle the SHA1 breaks in an untrusted p2p setting?

If you mean collision attacks, this shouldn't be a problem with Git, since it uses Hardened SHA-1. Eventually, when Git fully migrates to SHA-2, we will offer that option as well. > Is Hardened SHA-1 vulnerable? > No, SHA-1 hardened with counter-cryptanalysis (see ‘how do I detect the attack’) will detect cryptanalytic collision attacks. In that case it adjusts the SHA-1 computation to result in a safe hash. This mea…

So you use hardened sha1 in radicle? It would be great to see this in the docs.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#68

Post by posix86 »

saurik wrote: post #53

From their documentation: > It’s important to only publish repositories you own or are a maintainer of, and to communicate with the other maintainers so that they don’t initialize redundant repository identities. Based on my experience with people taking my code and shoving it onto GitHub--as well as separately in my demoralizing general experience of putting random little "please for the love of all that is holy don…

Isn't the github way of doing things: You add a copyright notice to your code, identifying your repository as the source, and changing the copyright is illegal? That would be applicable to this as well.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#69

Post by gsaslis »

wokwokwok wrote: post #62
zlatan_todoric wrote: post #44

Earlier quoted context omitted.

you can choose which nodes you follow and which nodes you block - you can even decide that you will seed particular repos and not the entire node. (P.S. I am working at Radicle)

How would you know which nodes to block?

Any node with "problematic" behaviour can be blocked.

But please note that you can also choose a "block everyone, follow just the good ones" (i.e. a selective) seeding policy [1]).

[1] - https://docs.radicle.xyz/guides/seeder#a-selective-seeding-p...

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#70

Post by bsenftner »

cloudhead wrote: post #63
saurik wrote: post #57

Earlier quoted context omitted.

Then why does the documentation say this is "important"? GitHub certainly does not have a notice anywhere saying "it's important to only publish repositories you own or are a maintainer of" (...well, I guess it could be buried deep in some user guide I never read, lol).

I think it's currently more likely to happen on Radicle given there is no search or discovery functionality, and repositories exist on a flat hierarchy, ie. they are not namespaced by user/org name, so harder to distinguish if they share the same name and description.

Why are those items not included? Being able to browse one org/developer's repos is a very useful indicator when investigating a new unknown repo/project/org/person, trying to determine if the risk of time investment is worth the effort.
Post reply on HN