5 ms·

Are there plans to implement the ssb protocol in a language other than JS?

by Rhapso 9y ago

happynaut 9y ago
There's someone working on a rust implementation at the moment. I can't find a link to the repository just now, but there's plenty of threads on it if you search 'rust' at the top right of patchwork (after installing and adding a pub.) I'll find the repo and reply to this thread when I'm home later :) There were some previous efforts towards a Go implementation, but I'm not sure how far along they got: https://github.com/maackle/ssb-igo https://github.com/maackle/ssb-igo By the way, there's some beautiful protocol docs for scuttlebutt here: https://ssbc.github.io/scuttlebutt-protocol-guide/ https://ssbc.github.io/scuttlebutt-protocol-guide/ =]
- hardfire 9y ago
  just noticed that the go implementation you linked to [https://github.com/maackle/ssb-igo https://github.com/maackle/ssb-igo] is actually "the game of Go on ssb"
  - happynaut 9y ago
    Haha, woops! I meant https://github.com/andyleap/go-ssb https://github.com/andyleap/go-ssb I guess it was muscle memory since I was looking at the ssb-igo repo earlier.
    - maackle 9y ago
      A great game, a programming language, and the 49th most common word in the English language walk into a bar...
- Rhapso 9y ago
  Thanks, I really like the core ideas of ssb but the nodejs implementation and lack of a security review give me a lot of professional reservations. I'm inclined to fork and use a more off the shelf method of securing p2p connections. The practice of binding a "secure" web-server to localhost is also a bit [dubious](https://security.stackexchange.com/questions/86773/how-secure-is-binding-to-localhost-in-order-to-prevent-remote-connections https://security.stackexchange.com/questions/86773/how-secur...).
  - happynaut 9y ago
    What's your reservations about it being implemented in nodejs? It's not my favourite technology stack either (I much prefer scala / haskell), but it hasn't deterred me from using it or contributing to the project. I wonder if a security review is something that can be funded through the open collective that is being set up (https://opencollective.com/secure-scuttlebutt-consortium https://opencollective.com/secure-scuttlebutt-consortium ) or some other funding source. By the way, the repositories that I mentioned earlier for the Rust implementation of the protocol in progress are mostly here: https://github.com/AljoschaMeyer?tab=repositories https://github.com/AljoschaMeyer?tab=repositories
    - Rhapso 9y ago
      I have issues with js as a language but those are not security issues. My security-related issues are with the nodejs package infrastructure. https://www.csoonline.com/article/3214624/security/malicious-code-in-the-node-js-npm-registry-shakes-open-source-trust-model.html https://www.csoonline.com/article/3214624/security/malicious... The sprawling dependencies alongside potential security/breaking issues are huge. It is a large and vulnerable attack surface.
      - happynaut 9y ago
        Fair play!
_pferreir_ 9y ago
I actually started working on a Python implementation last year. I have a fully working implementation of the Secret Handshake protocol: https://github.com/pferreir/pysecrethandshake https://github.com/pferreir/pysecrethandshake I've also implemented packet-stream on top of it (and intend to produce a proof of concept client at some point): https://github.com/pferreir/pyssb https://github.com/pferreir/pyssb My time got diverted into other things, but if someone wants to help out, feel free to contact me on SSB (ub|k) or Twitter (@pferreir).
whimful 9y ago
Some of the code you might be interested is _in_ scuttlebutt, as in there's a git implementation that lives in this p2p database / network. It's called git-ssb, and it has a github like interface. https://github.com/clehner/git-ssb https://github.com/clehner/git-ssb Here's a window into this p2p land : https://git.scuttlebot.io/ https://git.scuttlebot.io/ go gentle on it, it's a little server Welcome to the cloud proper
- masukomi 9y ago
  there's also hosting of node modules over ssb :)
masukomi 9y ago
in addition to the already mentioned Rust implementation that's currently being worked on, i believe someone has already gotten some of the core functionality working in Red http://www.red-lang.org/ http://www.red-lang.org/

Are there plans to implement the ssb protocol in a language other than JS?

by Rhapso 9y ago

Are there plans to implement the ssb protocol in a language other than JS?

There's someone working on a rust implementation at the moment. I can't find a link to the repository just now, but there's plenty of threads on it if you search 'rust' at the top right of patchwork (after installing and adding a pub.) I'll find the repo and reply to this thread when I'm home later :) There were some previous efforts towards a Go implementation, but I'm not sure how far along they got: https://github.com/maackle/ssb-igo https://github.com/maackle/ssb-igo By the way, there's some beautiful protocol docs for scuttlebutt here: https://ssbc.github.io/scuttlebutt-protocol-guide/ https://ssbc.github.io/scuttlebutt-protocol-guide/ =]

hardfire 9y ago
just noticed that the go implementation you linked to [https://github.com/maackle/ssb-igo https://github.com/maackle/ssb-igo] is actually "the game of Go on ssb"
- happynaut 9y ago
  Haha, woops! I meant https://github.com/andyleap/go-ssb https://github.com/andyleap/go-ssb I guess it was muscle memory since I was looking at the ssb-igo repo earlier.
  - maackle 9y ago
    A great game, a programming language, and the 49th most common word in the English language walk into a bar...
Rhapso 9y ago
Thanks, I really like the core ideas of ssb but the nodejs implementation and lack of a security review give me a lot of professional reservations. I'm inclined to fork and use a more off the shelf method of securing p2p connections. The practice of binding a "secure" web-server to localhost is also a bit [dubious](https://security.stackexchange.com/questions/86773/how-secure-is-binding-to-localhost-in-order-to-prevent-remote-connections https://security.stackexchange.com/questions/86773/how-secur...).
- happynaut 9y ago
  What's your reservations about it being implemented in nodejs? It's not my favourite technology stack either (I much prefer scala / haskell), but it hasn't deterred me from using it or contributing to the project. I wonder if a security review is something that can be funded through the open collective that is being set up (https://opencollective.com/secure-scuttlebutt-consortium https://opencollective.com/secure-scuttlebutt-consortium ) or some other funding source. By the way, the repositories that I mentioned earlier for the Rust implementation of the protocol in progress are mostly here: https://github.com/AljoschaMeyer?tab=repositories https://github.com/AljoschaMeyer?tab=repositories
  - Rhapso 9y ago
    I have issues with js as a language but those are not security issues. My security-related issues are with the nodejs package infrastructure. https://www.csoonline.com/article/3214624/security/malicious-code-in-the-node-js-npm-registry-shakes-open-source-trust-model.html https://www.csoonline.com/article/3214624/security/malicious... The sprawling dependencies alongside potential security/breaking issues are huge. It is a large and vulnerable attack surface.
    - happynaut 9y ago
      Fair play!

_pferreir_ 9y ago

I actually started working on a Python implementation last year. I have a fully working implementation of the Secret Handshake protocol: https://github.com/pferreir/pysecrethandshake https://github.com/pferreir/pysecrethandshake I've also implemented packet-stream on top of it (and intend to produce a proof of concept client at some point): https://github.com/pferreir/pyssb https://github.com/pferreir/pyssb My time got diverted into other things, but if someone wants to help out, feel free to contact me on SSB (ub|k) or Twitter (@pferreir).

whimful 9y ago

Some of the code you might be interested is _in_ scuttlebutt, as in there's a git implementation that lives in this p2p database / network. It's called git-ssb, and it has a github like interface. https://github.com/clehner/git-ssb https://github.com/clehner/git-ssb Here's a window into this p2p land : https://git.scuttlebot.io/ https://git.scuttlebot.io/ go gentle on it, it's a little server Welcome to the cloud proper

masukomi 9y ago
there's also hosting of node modules over ssb :)

masukomi 9y ago

in addition to the already mentioned Rust implementation that's currently being worked on, i believe someone has already gotten some of the core functionality working in Red http://www.red-lang.org/ http://www.red-lang.org/