Hope to see more p2p application platforms in the future, including ones that might potentially run in a browser (via WebRTC) - if you know of others, please comment here.
The creator here. Thanks for pointing out the lack of documentation here. At the moment, the security is RSA for the handshake and AES for the data once a connection is established. The security at the moment has obvious problems, so don't use it where your life depends on it. I have a plan to switch to using telehash for the com layer instead of my own hand rolled protocol. In the meantime, I invite any security experts to help improve what I have. The first obvious improvement is to sign messages. So please help if you can.
Very cool, and I love your project. I've read your blog and your approach is very admirable and I love the extensible approach you've taken.
If you're still considering protocols, I'd consider the TextSecure V2 protocol. The documentation isn't crazy in-depth, but it's a really neat protocol that offers forwards and future security.
It's definitely worth looking into - TextSecure's Axolotl is best-in-class for dealing with text messaging or other scenarios with occasional one-shots.
If you want another, simpler transport that works better for more connected scenarios, like this one, ask trevp who did that: he has a very promising-looking one in the design phase.
If I can give any advice: security doesn't make a good afterthought, especially when encryption was the first word you mentioned. It's a foundational feature; treat it as one. Pick primitives that make the best, most solid foundations you can get, and do your best to make sure you can rely on them. As for the rest, extensibility needs careful thought: it can be easy to extend yourself into vulnerabilities.
Best of luck. You have an interesting project. I might keep an eye on it.
Thanks! Yes, this is great advice. security should not be an afterthought and it certainly has not been here. Also, I did not post this on HN, so those were not my words.
There are some aspects to security that I took that extend to the code. It is written using design by contract, where if a contract fails, the program quits immediately. Security should extend beyond the protocol.
As I mentioned previously, long term I won't be using a handrolled protocol, which has obvious problems. This software is alpha and I hope to migrate before 1.0
I was looking into making a similar application a while ago and was really interested in OTR. Not only does it provide encryption and authentication, it also provides deniability. Have you guys looked into using it? If you have and rejected it, what were the reasons?
OTR is definately an inspiration here. I need to add the HMAC signing and key ratcheting. When I started there was no good OTR implementation that I could find.I was also concerned with performance. I am looking to use telehash now. What is your opinion of telehash vs stock OTR?
I wasn't too familiar with telehash until you mentioned it. I read the docs and it looks like it's a pretty complete framework whereas OTR is more of a handshake to establish a secure channel. If you're only using telehash to secure a channel it seems like overkill. If you use its peer resolution and asynchronous messaging features it seems pretty nice.
libotr is a very good implementation of OTR (in c) [1]. I don't think performance would be a big issue on modern hardware. OTR does offer future deniability in case one of the parties gets compromised. I didn't see the same guaranty in telehash (I might have missed it).
I think they are both fine platforms but I'm far from being an expert. For anyone who is interested in the documentation I was referring to: telehash [2] and OTR [3].
I'm hacking around on a distributed version control project, and I think I've found a cool solution to this problem.
I've created a github gist with my public key and a signature. Now people can see that gist and verify that the keyholder posted the signature via my github account. People can fork the gist and put their own signature in. Now I can easily list the forks of my gist and get a list of public keys that are cryptographically linked to certain github accounts.
Some people never visit the HN home page, but do visit https://news.ycombinator.com/show, so (since this post would seem to qualify for /show) I suggest you get it on there.
This is an awesome idea! I had been thinking last week about how to build a distributed package manager, and a platform for running scripts attached to the package was an idea for later. So neat to see a distributed app platform, but odd how similar ideas seem to pop up at the same time.
I often feel there are no original ideas. What influenced me to make firestr was various things. The work of Alan Kay is a a big influence on me. I need real version control in Firestr and have been thinking to integrate git behind the scenes, or something similar. You are welcome to help!
Hi, the creator here. The locators are NOT federated. This is by design if you want to have a completely private network. Also, I haven't had time to implement federation. If this is something that interests you, you can help implement it if you want. The locator is less than 300 lines of code, so it should be easy to understand. My long term plan is to use a protocol like telehash instead of my own hand rolled one. However, you can have as many locators in your client as you want. So this way, you can have redundancy.
On Android you could accomplish this, but iOS has some fairly inane restrictions around running any type of VM. It's enforced somewhat arbitrarily, but it lets Apple yank any VM or app-hosting type thing on their whim. It was originally put into place to keep Adobe Flash and Air off iOS.
I also disagree that you always need mobile for everything. This seems geared toward communicating and collaborating, so yes mobile would be a must for mass adoption. But if it's geared toward devs or professional work that's not necessarily true.
There's one based on IPFS and blockchain that's a distributed video sharing app, like Youtube: https://github.com/eris-ltd/2gather
And there are some other decentralized / alternative Internet projects listed here (including Firestr): https://github.com/redecentralize/alternative-internet/blob/...