4 ms·

Before I start trusting random people running mesh nodes to provide me with internet service, I’ll need to see a clear demonstration of some kind of defensive p

Before I start trusting random people running mesh nodes to provide me with internet service, I’ll need to see a clear demonstration of some kind of defensive posture for trusting traffic in such a situation. After all, I think some lessons have been taught by free, open wi-fi offered by cafes. Is SSL/TLS enough? Probably not for less technical people who can be socially engineered into trusting a malicious root CA because they just want internet. Is TOR worth anything? Oh, I still feel like it’s pretty laughable that exit nodes operate on an honor system of not snooping on plain-text traffic. From where does one summon the mental gymnastics necessary to go along with that? I’m not sure why I should just feel comfortable about letting any peer’s node handle my traffic. Feels like a handy-wavey “Brad & Chad” brogrammer move.

ejanus 9y ago
I think http://altheamesh.com http://altheamesh.com answers your concern as related to security. It uses wireguard,vpn, establish tunnels for packet flow .
- tritium 9y ago
  VPN services still put us on the run, so to speak. As an optional, externalized behavior, those who choose to employ VPN tunneling will enjoy an additional layer that buys them some time, for some of their activity. But if one were trying to suggest that “it’s time to put mesh networks in play as this newer model, to assert greater control” then I’d like to see a technology that solves certain problems, instead of the same technology as ever, with all it’s existing, known problems, except now distributed and peer-oriented. I want to see the real problems solved, before I give everything away to peers. Otherwise unsophisticated peers can cause problems for me, just like an ISP. The difference being, most peers will be unprepared to exploit each other for a short amount of time, but then, as utilization saturates, and expertise grows, we’re back to square one.
- fernly 9y ago
  Thank you for posting that. Unlike the top-linked article and the LibreMesh docs, the Althea site does a pretty good job of communicating what it intends to provide, making the useful distinction between user nodes, intermediate nodes, and gateway nodes and their different responsibilities. I'm dubious about the effectiveness of their plan to use escrowed cryptocoins to pay for bandwidth, but I was intrigued enough to sign up for email updates.
Moeg 9y ago
Do you know your isp? How about everyone else providing you the access to online content? I for one find no difference between random people and.. Random corporate people. Neither can/should be trusted, ever, this is why we have cryptographic means of keeping our business between us and the content provider, no one in between should be able to provide you with false content. Sadly this isn't perfect, but this technical challenge must be strived towards, no law can ever protect you as effectively as a good technical implementation.
- tritium 9y ago
  The difference between random corporate people and random people is slim, and usually little more than the incentive of the paycheck as a token to turn a blind eye, and focus on a limited abstract task that lacks a value greater than the total potential paycheck offered, when the fruits of the task are taken in isolation. Depending on the organization, a business may or may not adhere to this sort of practice. And yes, it’s still people mystery meat, behind the veil of nearly any business.
zAy0LfpBZLC8mAC 9y ago
> After all, I think some lessons have been taught by free, open wi-fi offered by cafes. One lesson: Use TLS. > Is SSL/TLS enough? Probably not for less technical people who can be socially engineered into trusting a malicious root CA because they just want internet. Is super-secure-network enough? Probably not for less technical people who can be socially engineered into installing malware. > Is TOR worth anything? Oh, I still feel like it’s pretty laughable that exit nodes operate on an honor system of not snooping on plain-text traffic. What else would you suggest? > From where does one summon the mental gymnastics necessary to go along with that? From where does one summon the mental gymnastics necessary to come up with the idea that it would be Tor's job to prevent you from communicating however you want?
- tritium 9y ago
  I see that you have your own opinions, and that you’re emotionally invested in them. The basic premise of your argument is that this is the best we can do for now, so that should be acceptable. Not unlike claiming “If you can’t create a painting better than The Mona Lisa yourself, you just have to admit that it’s your favorite painting.” My mind hasn’t been changed, especially by mere flak that lacks constructive arguments. People may disagree with me freely, but that doesn’t fix the holes I’ve pointed out in existing technology that mesh networks still leave open.
  - zAy0LfpBZLC8mAC 9y ago
    Your are shifting the burden of proof. It's not my job to refute unsubstantiated claims of yours, and failure to do so does not constitute a validation of your claims. You said that, for example, Tor could do things much better, but you didn't put forth any argument as to why you think that/how that could be done. I am not claiming that it's impossible, I am simply rejecting your unsubstantiated claim, and in particular your unsubstantiated criticism of the Tor project. Also, I strongly suspect that any ideas you have in mind have been considered and rejected by the Tor project for very good reasons ... but you'll have to show your actual ideas before I actually know. Also, it's a useless argument to posit an end user who is willing to do anything they are told by an untrusted third party as a useful threat model. There is nothing that will protect against that, and that includes established ISPs.

ejanus 9y ago

I think http://altheamesh.com http://altheamesh.com answers your concern as related to security. It uses wireguard,vpn, establish tunnels for packet flow .

tritium 9y ago
VPN services still put us on the run, so to speak. As an optional, externalized behavior, those who choose to employ VPN tunneling will enjoy an additional layer that buys them some time, for some of their activity. But if one were trying to suggest that “it’s time to put mesh networks in play as this newer model, to assert greater control” then I’d like to see a technology that solves certain problems, instead of the same technology as ever, with all it’s existing, known problems, except now distributed and peer-oriented. I want to see the real problems solved, before I give everything away to peers. Otherwise unsophisticated peers can cause problems for me, just like an ISP. The difference being, most peers will be unprepared to exploit each other for a short amount of time, but then, as utilization saturates, and expertise grows, we’re back to square one.
fernly 9y ago
Thank you for posting that. Unlike the top-linked article and the LibreMesh docs, the Althea site does a pretty good job of communicating what it intends to provide, making the useful distinction between user nodes, intermediate nodes, and gateway nodes and their different responsibilities. I'm dubious about the effectiveness of their plan to use escrowed cryptocoins to pay for bandwidth, but I was intrigued enough to sign up for email updates.

Moeg 9y ago

Do you know your isp? How about everyone else providing you the access to online content? I for one find no difference between random people and.. Random corporate people. Neither can/should be trusted, ever, this is why we have cryptographic means of keeping our business between us and the content provider, no one in between should be able to provide you with false content. Sadly this isn't perfect, but this technical challenge must be strived towards, no law can ever protect you as effectively as a good technical implementation.

tritium 9y ago
The difference between random corporate people and random people is slim, and usually little more than the incentive of the paycheck as a token to turn a blind eye, and focus on a limited abstract task that lacks a value greater than the total potential paycheck offered, when the fruits of the task are taken in isolation. Depending on the organization, a business may or may not adhere to this sort of practice. And yes, it’s still people mystery meat, behind the veil of nearly any business.

zAy0LfpBZLC8mAC 9y ago

> After all, I think some lessons have been taught by free, open wi-fi offered by cafes. One lesson: Use TLS. > Is SSL/TLS enough? Probably not for less technical people who can be socially engineered into trusting a malicious root CA because they just want internet. Is super-secure-network enough? Probably not for less technical people who can be socially engineered into installing malware. > Is TOR worth anything? Oh, I still feel like it’s pretty laughable that exit nodes operate on an honor system of not snooping on plain-text traffic. What else would you suggest? > From where does one summon the mental gymnastics necessary to go along with that? From where does one summon the mental gymnastics necessary to come up with the idea that it would be Tor's job to prevent you from communicating however you want?

tritium 9y ago
I see that you have your own opinions, and that you’re emotionally invested in them. The basic premise of your argument is that this is the best we can do for now, so that should be acceptable. Not unlike claiming “If you can’t create a painting better than The Mona Lisa yourself, you just have to admit that it’s your favorite painting.” My mind hasn’t been changed, especially by mere flak that lacks constructive arguments. People may disagree with me freely, but that doesn’t fix the holes I’ve pointed out in existing technology that mesh networks still leave open.
- zAy0LfpBZLC8mAC 9y ago
  Your are shifting the burden of proof. It's not my job to refute unsubstantiated claims of yours, and failure to do so does not constitute a validation of your claims. You said that, for example, Tor could do things much better, but you didn't put forth any argument as to why you think that/how that could be done. I am not claiming that it's impossible, I am simply rejecting your unsubstantiated claim, and in particular your unsubstantiated criticism of the Tor project. Also, I strongly suspect that any ideas you have in mind have been considered and rejected by the Tor project for very good reasons ... but you'll have to show your actual ideas before I actually know. Also, it's a useless argument to posit an end user who is willing to do anything they are told by an untrusted third party as a useful threat model. There is nothing that will protect against that, and that includes established ISPs.