6 ms·

I have to ask since your site says it (http://opensource.appleseedproject.org/ http://opensource.appleseedproject.org/): how is the software maintaining the pri

by mdasen 16y ago

I have to ask since your site says it (http://opensource.appleseedproject.org/ http://opensource.appleseedproject.org/): how is the software maintaining the privacy and security of my data? The reason I ask is that I don't see how that's possible. Here's an example. Let's say that I'm on MySeed and you're on Applebook. We friend each other and, lovely, now my posts get aggregated to your feed and your posts get aggregated to my feed. Life is good. Then Applebook turns evil and decides that it's going to make all posts open (they have the source code and the data). Well, now I no longer have privacy. Heck, let's say I post something and it gets aggregated to your feed. Then I delete it. Does Applebook then delete it? There's no real way to force a deletion. And I realize that anyone who saw it could have just done a copy/paste and saved the post, but it's different when it's happening automatically. The only way I could see this working is through public key encryption. When we friend each other, I get your public key and you get mine. You can then make your postings available encrypted with my public key and when I get them I can decrypt them with my private key. BUT I must not store my private key with MySeed since then MySeed could decrypt your posts and you no longer have privacy. Right now, browsers don't have support for encryption like this where part of a web page will be encrypted not by the server, but in the data storage. But even that has problems. It means that if you're friends with 500 people, 500 copies of any status message you post have to be encrypted and stored separately for each of those 500 people. Considering the scaling issues that Facebook has to contend with, I think adding a step where everything people post gets encrypted and stored N times (N being the number of friends you have) would be troublesome. Heck, what about pictures? It's one thing to encrypt and store a short 140byte status 500 times. It's another to do that for an 80k photo. tl;dr: If we're friends and you're on another service, what stops your service from aggregating my postings and then making them public to the world against my wishes?

michaelchisari 16y ago
First off, your feed won't provide a full copy of your data, just a summary and a link. Other protocols may not work that way, though, but that's how Appleseed's protocol works. If access is rescinded, that user loses access to view that data. If I post a journal update or a photo, and it shows up in your feed, and then I restrict access to it, if your feed doesn't properly delete the entry, then you can still see the summary or the thumbnail, but clicking on it results in an access denied error. Well, let's focus on your premise: This is all based on a node turning evil. That's a very big problem, and one not easily solved. There is a basic issue here, in that users, when they trust other users, they also, on some level, trust the that user's community (node). I'm open to suggestions on how to mitigate that. With social networking, there is always a level of trust that has to be human-based, not tech-based. But tools can be used to help humans determine trust. Appleseed has node control, which means that administrators can "block" whole nodes if they're behaving badly. This usually means spam, but it can also mean if a node is acting in bad faith (ie, it's revealed that AppleBook is selling non-local user data), or if they're abusing the protocol. That can act as a certain type of social "shunning" on a node-to-node basis. Admins can also "trust" nodes, which means you inherit their block list. This means, theoretically, if a node goes bad, and some nodes realize this, it'll propagate through the Appleseed network until that node is isolated. I think there are other approaches, and some we haven't thought up yet, but one thing I'm most interested in is social pressure, and how it can easily be applied to bad nodes. I think encryption is interesting, but I think we'll actually have to move into the browser space in order to have a reasonable UX.
- mayank 16y ago
  > This usually means spam, but it can also mean if a node is acting in bad faith (ie, it's revealed that AppleBook is selling non-local user data), or if they're abusing the protocol. That can act as a certain type of social "shunning" on a node-to-node basis. There are interesting, open theoretical computer science questions that determine how effective such an approach can be, and how susceptible it is to attack. Without a theoretical understanding of how your reputation system works, how do you propose to solve the spam and "evil" problem? In other words, if we invest heavily (time and money) in this, how do we know that it won't eventually be overrun by spam after being mastered by a clever (or lucky) hacker? If you haven't already, you should check out: http://en.wikipedia.org/wiki/Byzantine_fault_tolerance http://en.wikipedia.org/wiki/Byzantine_fault_tolerance -- the Byzantine agreement problem, which deals with a distributed system agreeing on a global decision (substitute "failure" with "evil"). These are not trivial problems to solve, and if you intend on scaling, I hope you have good solutions to them. Distributed systems are notoriously hard to understand and maintain; it sounds very nice to propose a new distributed system, but it's hard for a hacker to accept your solution until I have some theoretical assurance about its security model.
  - michaelchisari 16y ago
    I'll remind you that what you're addressing here is the protocol, which is not dependent on Appleseed. Appleseed is the platform, and is basically protocol agnostic. There are a lot of projects working together on a common protocol, including people from the W3C, and we're all aware of these issues. Appleseed is doing it's part to create a flexible framework that is easily administered and updated, so that nodes within the network can be moved to a new protocol when exploits are found. But this is in no way a problem that Appleseed will be solving alone.
- mdasen 16y ago
  Wonderful. The Diaspora group had been promising end-to-end encryption without seeming to know the problem. The remaining question I have is: while the feed provides a link/summary, what's preventing a node from following that link and then caching/storing that data? You've come up with a nice way of propagating block lists and kudos for addressing the problem. However, with Facebook, I only have to worry about Facebook behaving badly. I don't have to worry about multiple companies and different bad behavior. Plus, sometimes bad behavior can become public much later. Let's say that I operate Applebook. I'm running a nice Appleseed server that has some users. I decide to start storing the data from other nodes. Maybe I'm even doing it for practical reasons like performance or as a service to my users. Then 5 years down the line, my fortunes take a turn for the worse. I decide to go evil! Sure, maybe the second I turn evil it gets propagated out fast and I can't get access to any future data. However, I still have all that past data! And this is a concern with Facebook as well. They could turn evil some day and betray us all. However, it's one company to worry about rather than dozens or more. -- Also, as an aside, sometimes the summaries might contain the information people want deleted. If you have a 140 character status update Twitter-style, there isn't much of a summary to be made. Right now, we're used to being allowed to remove things from social networks. Unlike email, it's communication that we can take back. Wall posts, status updates, photos, etc. can be deleted. If I email you a photo, it's always there for you. In some ways, a distributed social network is more like email. Once you've sent it out to your friends, it can't really be taken back. That's very different from Facebook. With Facebook, users expect to be able to remove content at any time and it's inaccessible to other users (unless they decided to copy/paste or save it in another way). The question is: how many people would prefer this more email-like system? The advantage is that one wouldn't be beholden to a central service like Facebook or Twitter. Users have been skittish about privacy anytime Facebook changes something. How much of that is posturing and how much of it is users who would discontinue using it if they thought they couldn't remove things from the view of others?
joe_the_user 16y ago
I don't think you'll get that kind of security in this space-time continuum... If you send an open message to X, you just aren't going to keep X from sharing that message with others. -- There no real way around this. It's essentially the "problem" that DRM aimed to "solve". Thankfully, it couldn't. Only share things that are appropriate for a given friend or group of friends. This applies on Facebook or anywhere.
- bad_user 16y ago
  Then why bother with a Facebook alternative?
  - joe_the_user 16y ago
    Good question. Reasons for a Facebook alternative: * While counting on your friends to not share your data is going to be dicey regardless, at least your data is not automatically going to be sold. * Facebook changes it's interface and terms of service at it's discretion. You should be in charge of any changes to a sharing process. * Facebook has the stated aim of forcing everyone on the net to use a single identity. This is a rather Orwellian position that we should avoid (goes with the problem of FB changing their interface and terms of service whenever they wish).
    - bad_user 16y ago
      Yes, I've been reading the other comments, and a distributed network would have some advantages, but also disadvantages, a strong analogy being email and smtp. About the FB identity, that's also very attractive to developers, and Appleseed should solve it somehow: if a website uses FB for user logins it gets almost-instant sign-up, user photo, user name, email (if requested) and access to a whole list of friends. That's a pretty powerful incentive for websites to get integrated with Facebook.
      - joe_the_user 16y ago
        Well, One scheme would involve a system to merge multiple email and Facebook accounts into a single meta-view. I'll be making an announcement when the time is right...
beza1e1 16y ago
For example, clipperz en-/decrypts in the browser and not on the server.
- joe_the_user 16y ago
  Ah but while the browser may be running client side, it hardly seems like the piece of software I'd want to trust to do my encryption given that it is designed with many hooks to allow servers to do stuff. "sure, don't trust me, do it on your own machine. I'll even give you the software..."
mnutt 16y ago
I was thinking of a similar thing the other day. Could one make an easy-enough-to-use public-key encrypted social network? One of the ways that sites often scale is denormalization, so if they're generating each person's activity feed anyway there's no storage overhead. And I'm pretty sure that pgp encryption performance is measured in MB/s, so as javascript performance catches up the encryption time will be less of an issue. Obviously even if everything is encrypted on the client side, what's to stop the server from sending down a broken javascript encryption mechanism, or javascript to send your messages in the clear? I don't think there's a good solution to this, but you could make some (optional) browser plugins to monitor outgoing requests, and that might be enough to keep server operators honest. Even if someone overcame all of that, there are still a lot of features that just can't be built without the server having access to the data. But it's interesting to think about.
joe_the_user 16y ago
Actually, For distributing information to a group, you'd only need a single group private key, which you would send to each member using their public key. After that, you just encrypt the message with the group's public key. If you want to kick someone out, you'd just start a new group in similar manner but excluding the someone you wanted to kick out. In this way, your group messages would only have to be encrypted once. Each person would have a different group public key so there wouldn't be much more to it than this. But all this is kind of overkill. You reasonably expect webmail provider will give you privacy right now just as reasonably you expect a locked door will keep your stuff safe even though a determined person can break either of those protections. (and as said earlier, no magic technology is going to keep your friends from making stuff public)

by mdasen 16y ago

michaelchisari 16y ago

First off, your feed won't provide a full copy of your data, just a summary and a link. Other protocols may not work that way, though, but that's how Appleseed's protocol works. If access is rescinded, that user loses access to view that data. If I post a journal update or a photo, and it shows up in your feed, and then I restrict access to it, if your feed doesn't properly delete the entry, then you can still see the summary or the thumbnail, but clicking on it results in an access denied error. Well, let's focus on your premise: This is all based on a node turning evil. That's a very big problem, and one not easily solved. There is a basic issue here, in that users, when they trust other users, they also, on some level, trust the that user's community (node). I'm open to suggestions on how to mitigate that. With social networking, there is always a level of trust that has to be human-based, not tech-based. But tools can be used to help humans determine trust. Appleseed has node control, which means that administrators can "block" whole nodes if they're behaving badly. This usually means spam, but it can also mean if a node is acting in bad faith (ie, it's revealed that AppleBook is selling non-local user data), or if they're abusing the protocol. That can act as a certain type of social "shunning" on a node-to-node basis. Admins can also "trust" nodes, which means you inherit their block list. This means, theoretically, if a node goes bad, and some nodes realize this, it'll propagate through the Appleseed network until that node is isolated. I think there are other approaches, and some we haven't thought up yet, but one thing I'm most interested in is social pressure, and how it can easily be applied to bad nodes. I think encryption is interesting, but I think we'll actually have to move into the browser space in order to have a reasonable UX.

mayank 16y ago
> This usually means spam, but it can also mean if a node is acting in bad faith (ie, it's revealed that AppleBook is selling non-local user data), or if they're abusing the protocol. That can act as a certain type of social "shunning" on a node-to-node basis. There are interesting, open theoretical computer science questions that determine how effective such an approach can be, and how susceptible it is to attack. Without a theoretical understanding of how your reputation system works, how do you propose to solve the spam and "evil" problem? In other words, if we invest heavily (time and money) in this, how do we know that it won't eventually be overrun by spam after being mastered by a clever (or lucky) hacker? If you haven't already, you should check out: http://en.wikipedia.org/wiki/Byzantine_fault_tolerance http://en.wikipedia.org/wiki/Byzantine_fault_tolerance -- the Byzantine agreement problem, which deals with a distributed system agreeing on a global decision (substitute "failure" with "evil"). These are not trivial problems to solve, and if you intend on scaling, I hope you have good solutions to them. Distributed systems are notoriously hard to understand and maintain; it sounds very nice to propose a new distributed system, but it's hard for a hacker to accept your solution until I have some theoretical assurance about its security model.
- michaelchisari 16y ago
  I'll remind you that what you're addressing here is the protocol, which is not dependent on Appleseed. Appleseed is the platform, and is basically protocol agnostic. There are a lot of projects working together on a common protocol, including people from the W3C, and we're all aware of these issues. Appleseed is doing it's part to create a flexible framework that is easily administered and updated, so that nodes within the network can be moved to a new protocol when exploits are found. But this is in no way a problem that Appleseed will be solving alone.
mdasen 16y ago
Wonderful. The Diaspora group had been promising end-to-end encryption without seeming to know the problem. The remaining question I have is: while the feed provides a link/summary, what's preventing a node from following that link and then caching/storing that data? You've come up with a nice way of propagating block lists and kudos for addressing the problem. However, with Facebook, I only have to worry about Facebook behaving badly. I don't have to worry about multiple companies and different bad behavior. Plus, sometimes bad behavior can become public much later. Let's say that I operate Applebook. I'm running a nice Appleseed server that has some users. I decide to start storing the data from other nodes. Maybe I'm even doing it for practical reasons like performance or as a service to my users. Then 5 years down the line, my fortunes take a turn for the worse. I decide to go evil! Sure, maybe the second I turn evil it gets propagated out fast and I can't get access to any future data. However, I still have all that past data! And this is a concern with Facebook as well. They could turn evil some day and betray us all. However, it's one company to worry about rather than dozens or more. -- Also, as an aside, sometimes the summaries might contain the information people want deleted. If you have a 140 character status update Twitter-style, there isn't much of a summary to be made. Right now, we're used to being allowed to remove things from social networks. Unlike email, it's communication that we can take back. Wall posts, status updates, photos, etc. can be deleted. If I email you a photo, it's always there for you. In some ways, a distributed social network is more like email. Once you've sent it out to your friends, it can't really be taken back. That's very different from Facebook. With Facebook, users expect to be able to remove content at any time and it's inaccessible to other users (unless they decided to copy/paste or save it in another way). The question is: how many people would prefer this more email-like system? The advantage is that one wouldn't be beholden to a central service like Facebook or Twitter. Users have been skittish about privacy anytime Facebook changes something. How much of that is posturing and how much of it is users who would discontinue using it if they thought they couldn't remove things from the view of others?

joe_the_user 16y ago

I don't think you'll get that kind of security in this space-time continuum... If you send an open message to X, you just aren't going to keep X from sharing that message with others. -- There no real way around this. It's essentially the "problem" that DRM aimed to "solve". Thankfully, it couldn't. Only share things that are appropriate for a given friend or group of friends. This applies on Facebook or anywhere.

bad_user 16y ago
Then why bother with a Facebook alternative?
- joe_the_user 16y ago
  Good question. Reasons for a Facebook alternative: * While counting on your friends to not share your data is going to be dicey regardless, at least your data is not automatically going to be sold. * Facebook changes it's interface and terms of service at it's discretion. You should be in charge of any changes to a sharing process. * Facebook has the stated aim of forcing everyone on the net to use a single identity. This is a rather Orwellian position that we should avoid (goes with the problem of FB changing their interface and terms of service whenever they wish).
  - bad_user 16y ago
    Yes, I've been reading the other comments, and a distributed network would have some advantages, but also disadvantages, a strong analogy being email and smtp. About the FB identity, that's also very attractive to developers, and Appleseed should solve it somehow: if a website uses FB for user logins it gets almost-instant sign-up, user photo, user name, email (if requested) and access to a whole list of friends. That's a pretty powerful incentive for websites to get integrated with Facebook.
    - joe_the_user 16y ago
      Well, One scheme would involve a system to merge multiple email and Facebook accounts into a single meta-view. I'll be making an announcement when the time is right...

beza1e1 16y ago

For example, clipperz en-/decrypts in the browser and not on the server.

joe_the_user 16y ago
Ah but while the browser may be running client side, it hardly seems like the piece of software I'd want to trust to do my encryption given that it is designed with many hooks to allow servers to do stuff. "sure, don't trust me, do it on your own machine. I'll even give you the software..."

mnutt 16y ago

I was thinking of a similar thing the other day. Could one make an easy-enough-to-use public-key encrypted social network? One of the ways that sites often scale is denormalization, so if they're generating each person's activity feed anyway there's no storage overhead. And I'm pretty sure that pgp encryption performance is measured in MB/s, so as javascript performance catches up the encryption time will be less of an issue. Obviously even if everything is encrypted on the client side, what's to stop the server from sending down a broken javascript encryption mechanism, or javascript to send your messages in the clear? I don't think there's a good solution to this, but you could make some (optional) browser plugins to monitor outgoing requests, and that might be enough to keep server operators honest. Even if someone overcame all of that, there are still a lot of features that just can't be built without the server having access to the data. But it's interesting to think about.

joe_the_user 16y ago

Actually, For distributing information to a group, you'd only need a single group private key, which you would send to each member using their public key. After that, you just encrypt the message with the group's public key. If you want to kick someone out, you'd just start a new group in similar manner but excluding the someone you wanted to kick out. In this way, your group messages would only have to be encrypted once. Each person would have a different group public key so there wouldn't be much more to it than this. But all this is kind of overkill. You reasonably expect webmail provider will give you privacy right now just as reasonably you expect a locked door will keep your stuff safe even though a determined person can break either of those protections. (and as said earlier, no magic technology is going to keep your friends from making stuff public)