5 ms·

This is exciting - I'm looking forward to it. I've been nerding out a bit playing with Matrix/Riot and Urbit - there's a lot of exciting stuff happening in thi

This is exciting - I'm looking forward to it. I've been nerding out a bit playing with Matrix/Riot and Urbit - there's a lot of exciting stuff happening in this space. If you like what Matrix is doing consider paying $10/month for your own server via Modular.im (https://modular.im/ https://modular.im/). It supports the Matrix devs and you get your own high performance federated server to use on the network. Their automation makes it extremely easy to spin up your host so you don't have to manage anything yourself. The default server they run has a lot of traffic so having your own is a better experience, and it helps further decentralize the network (and you control your own server). I'm excited to try out p2p, thanks Arathorn for being so responsive in the comments on HN. After Keybase sold out users to Zoom my friend in China and I switched to Matrix/Riot. While the default Matrix server is blocked there if he doesn't use a VPN we can still communicate on others (for now). One question for Arathorn re: > "Hooking up E2E Encryption APIs in Dendrite (not that it buys us much in a pure P2P world)" Doesn't this still matter if the internet traffic itself is tapped? If I'm understanding this correctly we'll still want E2E for things like deep packet inspection in China (or bulk collection by western governments).

core-questions 6y ago
How is the new Urbit stuff, since you mention it? Is it usable for a casual but interested user?
- fossuser 6y ago
  Depends on how 'casual', it's definitely usable and works - but there's still some effort required to figure things out. I've found the docs are generally pretty good and the community is helpful so if you're interested in playing with it it's worth it.
  - omnimus 6y ago
    What is Urbit for? I mean i never understood whats it's real use. From what i've read i imagine it as some new stack that replaces networking and servers but then i found out that you have to buy namespaces that are finite? Why?
    - dpc_pw 6y ago
      So when you blacklist a troll, they can't just create a new account for free.
      - hahahahahka 6y ago
        sounds perfect for state sponsored troll armies, who have way more money/btc/eth than any of us.
        setr 6y ago
        That's true for anything where difficulty is measured by a continuous function -- that is, everything is easiest for a state sponsored anything, good or bad, unless it can't be done at all. You're really just saying states have more resources than individuals... which is true almost by definition (they aggregate individuals within their realm)
        ace_of_spades 6y ago
        But the underlying point of the comment still stands. Just making account creation more costly doesn‘t stop spam... it just makes it more expensive. Same for all other legal activities which are then also more expensive. Thus, it‘s not a perfect solution (if at all).
        infogulch 6y ago
        > making account creation more costly doesn‘t stop spam... it just makes it more expensive But that's the only thing that has ever been effective against spam. Spam exists because the marginal cost of spamming is 0. This puts a floor on the marginal cost of spamming; if it costs at least this much to spam, then only spammers that make back that much will exist, which eliminates most spammers.
        hahahahahka 6y ago
        not true. in a truly organic network, where you actually know the graph back to you, it is very difficult for a state actor. ironically, facebook is in a position that is perfect for this, and they go out of their way to not see it. ...I guess because being able to block content based on dislikes by your immediate friends would make it too hard to expose you to all the sponsored posts.
- voltagex_ 6y ago
  Looks like it's still relying on Ethereum, which IMO is irresponsible from a climate change / energy use point of view.
  - drdeca 6y ago
    Do you think that ethereum won’t move to PoS soon? (I haven’t looked into the design, can’t comment on whether the construction seems sound to me)
    - Legogris 6y ago
      In short: PoS migration of Ethereum is in progress and will happen in stages. "Stage 0", which doesn't have any practical effects for smart contracts, is expected Soon (tm) (a few months probably). It'll most likely be a couple of years until the transition is done so that smart contracts like Urbit can/will run under PoS.
    - Groxx 6y ago
      Ethereum has been moving to PoS soon for a couple years. It's still the intent, but PoS is effectively still unsolved. It's not just "can it decide blocks", it needs to have the right balance of incentives to be self-sustaining, or it destroys itself.
      - ddrdrck_ 6y ago
        What makes you say that PoS is "unsolved " ? Did you hear about Cosmos for example ? Their mainnet is running for more than one year without any issue.
Arathorn 6y ago
> > "Hooking up E2E Encryption APIs in Dendrite (not that it buys us much in a pure P2P world)" > Doesn't this still matter if the internet traffic itself is tapped? If I'm understanding this correctly we'll still want E2E for things like deep packet inspection in China (or bulk collection by western governments). If TLS has been compromised between your nodes, then yes - E2EE would give another level of protection; security in depth. I guess it depends on whether you believe your government has the ability to compromise transport layer security between arbitrary peers on the network. For pure P2P Matrix, there might be some compromise where one uses the E2E keys and key verification to secure the transport layer security (thus giving you E2EE if there is no server in between, but without all the complexity of a cryptographic ratchet). This might give you best of both worlds - but the second you start accumulating data on a server somewhere you'd be back wanting proper E2EE.
- fossuser 6y ago
  Thanks - I remember reading about the issues Tor had operating in China and the sophistication of the government's deep packet inspection. I think TLS is not secure in China, I think I read that the government controls the CAs and MiTMs all traffic.
- swiley 6y ago
  TLS isn’t everything, you might not trust the server operator. In fact you probably shouldn’t if you’re sending a PM.
  - Arathorn 6y ago
    This is asking about P2P Matrix, where typically there isn’t a server involved. The transport layer security runs between the peers, effectively providing a form of end to end encryption if there are no nodes in the middle.
MayeulC 6y ago
Re your question -- it depends: if the network ends up being based on Yggdrasil, as the blog post suggests it could, "IP addresses" are public keys, and packets are encrypted to that destination (which could be a NATing router, though). So, it gives you some guarantees about encryption, that might or might not be redundant (and for some use-cases, better safe than sorry).
ashleysmithgpu 6y ago
I was interested in a server, but the website does not mention how much storage or any details at all really. Anyone happen to know where to find that info?
- Arathorn 6y ago
  matrix.org is the website for the non-profit foundation that looks after the overall project. https://matrix.org/hosting https://matrix.org/hosting lists hosting providers, of which https://modular.im https://modular.im is run by the core team and directly funds development of Matrix. There aren't hard storage limitations on Modular currently.

core-questions 6y ago

How is the new Urbit stuff, since you mention it? Is it usable for a casual but interested user?

fossuser 6y ago
Depends on how 'casual', it's definitely usable and works - but there's still some effort required to figure things out. I've found the docs are generally pretty good and the community is helpful so if you're interested in playing with it it's worth it.
- omnimus 6y ago
  What is Urbit for? I mean i never understood whats it's real use. From what i've read i imagine it as some new stack that replaces networking and servers but then i found out that you have to buy namespaces that are finite? Why?
  - dpc_pw 6y ago
    So when you blacklist a troll, they can't just create a new account for free.
    - hahahahahka 6y ago
      sounds perfect for state sponsored troll armies, who have way more money/btc/eth than any of us.
      - setr 6y ago
        That's true for anything where difficulty is measured by a continuous function -- that is, everything is easiest for a state sponsored anything, good or bad, unless it can't be done at all. You're really just saying states have more resources than individuals... which is true almost by definition (they aggregate individuals within their realm)
        ace_of_spades 6y ago
        But the underlying point of the comment still stands. Just making account creation more costly doesn‘t stop spam... it just makes it more expensive. Same for all other legal activities which are then also more expensive. Thus, it‘s not a perfect solution (if at all).
        infogulch 6y ago
        > making account creation more costly doesn‘t stop spam... it just makes it more expensive But that's the only thing that has ever been effective against spam. Spam exists because the marginal cost of spamming is 0. This puts a floor on the marginal cost of spamming; if it costs at least this much to spam, then only spammers that make back that much will exist, which eliminates most spammers.
        hahahahahka 6y ago
        not true. in a truly organic network, where you actually know the graph back to you, it is very difficult for a state actor. ironically, facebook is in a position that is perfect for this, and they go out of their way to not see it. ...I guess because being able to block content based on dislikes by your immediate friends would make it too hard to expose you to all the sponsored posts.
voltagex_ 6y ago
Looks like it's still relying on Ethereum, which IMO is irresponsible from a climate change / energy use point of view.
- drdeca 6y ago
  Do you think that ethereum won’t move to PoS soon? (I haven’t looked into the design, can’t comment on whether the construction seems sound to me)
  - Legogris 6y ago
    In short: PoS migration of Ethereum is in progress and will happen in stages. "Stage 0", which doesn't have any practical effects for smart contracts, is expected Soon (tm) (a few months probably). It'll most likely be a couple of years until the transition is done so that smart contracts like Urbit can/will run under PoS.
  - Groxx 6y ago
    Ethereum has been moving to PoS soon for a couple years. It's still the intent, but PoS is effectively still unsolved. It's not just "can it decide blocks", it needs to have the right balance of incentives to be self-sustaining, or it destroys itself.
    - ddrdrck_ 6y ago
      What makes you say that PoS is "unsolved " ? Did you hear about Cosmos for example ? Their mainnet is running for more than one year without any issue.

Arathorn 6y ago

> > "Hooking up E2E Encryption APIs in Dendrite (not that it buys us much in a pure P2P world)" > Doesn't this still matter if the internet traffic itself is tapped? If I'm understanding this correctly we'll still want E2E for things like deep packet inspection in China (or bulk collection by western governments). If TLS has been compromised between your nodes, then yes - E2EE would give another level of protection; security in depth. I guess it depends on whether you believe your government has the ability to compromise transport layer security between arbitrary peers on the network. For pure P2P Matrix, there might be some compromise where one uses the E2E keys and key verification to secure the transport layer security (thus giving you E2EE if there is no server in between, but without all the complexity of a cryptographic ratchet). This might give you best of both worlds - but the second you start accumulating data on a server somewhere you'd be back wanting proper E2EE.

fossuser 6y ago
Thanks - I remember reading about the issues Tor had operating in China and the sophistication of the government's deep packet inspection. I think TLS is not secure in China, I think I read that the government controls the CAs and MiTMs all traffic.
swiley 6y ago
TLS isn’t everything, you might not trust the server operator. In fact you probably shouldn’t if you’re sending a PM.
- Arathorn 6y ago
  This is asking about P2P Matrix, where typically there isn’t a server involved. The transport layer security runs between the peers, effectively providing a form of end to end encryption if there are no nodes in the middle.

MayeulC 6y ago

Re your question -- it depends: if the network ends up being based on Yggdrasil, as the blog post suggests it could, "IP addresses" are public keys, and packets are encrypted to that destination (which could be a NATing router, though). So, it gives you some guarantees about encryption, that might or might not be redundant (and for some use-cases, better safe than sorry).

ashleysmithgpu 6y ago

I was interested in a server, but the website does not mention how much storage or any details at all really. Anyone happen to know where to find that info?

Arathorn 6y ago
matrix.org is the website for the non-profit foundation that looks after the overall project. https://matrix.org/hosting https://matrix.org/hosting lists hosting providers, of which https://modular.im https://modular.im is run by the core team and directly funds development of Matrix. There aren't hard storage limitations on Modular currently.