7 ms·

Spork: Peer-to-peer socket magic in the air

156 points by pcr910303 5y ago

notum 5y ago
Looks cool and simple to use, now can someone please explain to me why this matters? What centralized system does Spork remedy? It bypasses DNS? Is there any sort of discovery and/or replication and/or redundancy?
- pfraze 5y ago
  The goal is to create an Internet of home servers. You want to have your own NAS or rpi you deploy apps on. The p2p turns those devices into a network
red0point 5y ago
This is very cool, but it seems extraordinarily cumbersome to pass on the generated super long string to another computer or mobile device.
- OJFord 5y ago
  I'm not sure about 'extraordinarily cumbersome', just copy-paste through Slack or whatever? Surely most use cases are between people, not just between (one person's) devices? An improvement could be to reversibly derive a few random words ('what 3 words' style) from the public key I suppose - so that it can be easily shared over a voice call, or to make it easier for the same person to enter on another device.
  - KennyBlanken 5y ago
    There's a (mostly) serverless file transfer tool whose name escapes me at the moment that uses this method to exchange the actual keys for the secure transfer...but it works there because the connection is only available for initiation, for that specific host and port, for a pretty limited period of time. The key is also one-use. In this case the 'server' is up for an extended period of time, presumably, and the public key is both the address and authentication (unless you turn on requiring a specific key on the initiator, I think? I only glanced at the docs.) With enough nodes you'd end up with multiple nodes having the same words (divide the possible keyspace by the possible combination of words and you'll get a very large number), and also you'd be at significant risk of people finding nodes just by banging away trying to connect to different 3-word addresses. I agree that the tool seems to be intended for same-party use.
    - pfraze 5y ago
      Magic Wormhole is probably what you’re thinking of. The live handshake requirement is definitely a limiting factor on that approach, but probably still worth doing. Other options would be QR codes and registry services. The protocol team is looking at using the ristretto algorithms to derive “subdomains” which would reduce the amount of key sharing a fair bit
    - criddell 5y ago
      Are you talking about AirDrop?
- gauchojs 5y ago
  Yeah - this could work for more people if they had a small app that opened "Spork urls" spork://whattzzuu5drxwdwi6xbijjf7yt56l5adzht7j7kjvfped7amova
KennyBlanken 5y ago
> Spork is all about creating forward and reverse proxies between traditional sockets and p2p sockets. > Sockets are identified by a public key and connect using a Distributed Hash Table (DHT). Connections are end-to-end encrypted using the NOISE framework. Okay, sounds like pretty neat. Is anyone aware of whether Spork is undergoing any sort of formal review? NOISE appears to be popular and well-reviewed, but Spork uses noise-peer, a two-contributor project. Spork itself is one-contributor. So...neat sounding, but I'm not using it for anything remotely sensitive until it sees more eyeballs. Hopefully a bunch of HNers can help with that.
- dandanua 5y ago
  > Spork is a part of the Atek Cloud mission to self-host our lives. We're channeling the deep magics of the Hypercore Protocol. Atek and Spork were built by the same people behind Beaker Browser The guys behind Hypercore Protocol and Beaker Browser are building a lot of interesting p2p tools. I suggest starting here [1] if you want to understand their stack deeper. [1] https://hypercore-protocol.org/ https://hypercore-protocol.org/
  - KennyBlanken 5y ago
    My understanding of the stack is irrelevant - there's no way in hell I will ever be qualified to evaluate it. I want to see respected, trusted members of the cryptography community say at least that noise-peer implements NOISE in a secure, proper manner and that spork doesn't weaken or improperly use NOISE. With just two people working on noise-peer and one person working on spork, I don't trust it further than I can throw it. Very cool stuff though. Wish the project well and will be excited to see where it goes.
MayeulC 5y ago
See also: yggdrasil/cjdns/hyperbora that also provide p2p routing in a mesh network (without DHT), but also map public keys to an unused chunk of IPv6. IPFS p2p is more similar to that project, with a DHT, though I am not sure about encryption. To me, this is the future. I wish we had a set of APIs to allow connecting to a public key instead of an IP adress... however that requires reinventing most of the network stack (subnets, etc). That could be a base for IPv7. As a bonus, this could run on top of IPv4 or IPv6. Creating ephemeral, E2EE addresses has a lot of nice properties: you can roam with the same address (making it easy to move a server around, even behind cellular internet). Browsers could use a different key for each site. Sites could use that as a session identifier to authenticate against.
- adminscoffee 5y ago
  kind of a weird idea but routers have names, i always wondered if there was some way we can use this as addresses to give a position of sorts, that way, nearby host can direct traffic towards a location. like a pass off, idk if i am explaining it right
- brendoncarroll 5y ago
  > To me, this is the future. I wish we had a set of APIs to allow connecting to a public key instead of an IP address INET256 is working on exactly that. It's a set of APIs for connecting to addresses derived from public keys. https://github.com/inet256/inet256 https://github.com/inet256/inet256
  - MayeulC 5y ago
    Thanks for mentioning this, it's the first time I hear about that project, and will definitely have a look!
- neilalexander 5y ago
  > you can roam with the same address (making it easy to move a server around, even behind cellular internet) In particular, Yggdrasil's mobility performance is far better than anything provided by the likes of BATMAN-Adv, Babel etc, making it ideal for roaming users and ad-hoc/mesh networks. https://yggdrasil-network.github.io/assets/images/latest/mobility2.png https://yggdrasil-network.github.io/assets/images/latest/mob...
supermatt 5y ago
Any comments on hyperswarm vs libp2p (ipfs)? Why would I choose one over the other.
- pfraze 5y ago
  Libp2p is technically a framework so you could probably integrate hyperswarm into it. Hyperswarm’s new release has gotten some really focused effort to improve the DHT success rate. That’s the part I’m most interested to see play out
Tepix 5y ago
So is there a tool that makes it easy to look up the IP address(es) behind a public key? If not it should be trivial to code it, right?
ianopolous 5y ago
This is similar to p2p streams in IPFS. We've been using these in Peergos for 3 years now via the p2p http proxy in IPFS (which we contributed). It is a glorious model. The client, in our case Peergos, sends normal http requests to a localhost proxy URL that includes the target public key and voila! We wrote it up after developing it here: https://peergos.org/posts/dev-update https://peergos.org/posts/dev-update The underlying streams use TLS 1.3 as the transport encryption. And we've just written a super minimal ipfs replacement (for ourselves) which includes this: https://github.com/peergos/ipfs-nucleus/ https://github.com/peergos/ipfs-nucleus/
pfraze 5y ago
Hey all, I’m the author of spork. Just want to give credit to the Hypercore Protocol team as they’re responsible for 99% of this tool. They’re going to be speaking at NodeConf on Wednesday so check that out if you’re interested [1] 1. https://www.nodeconfremote.com/#workshops/how-to-build-p2p-applications-for-fun-and-profit https://www.nodeconfremote.com/#workshops/how-to-build-p2p-a...
- pfraze 5y ago
  A couple fun things I haven't documented yet. We were able to spork an SSH session using password auth. (That one went from Texas to Virginia via Starlink.) Some folks on the discord sporked a Minecraft game. Quake didn't spork, probably because it uses UDP which doesn't spork yet. We're going to keep adding fun/useful features, including a public gateway service so folks can make use of spork without people having to install the client first.
- metadaemon 5y ago
  How did you find the implementation of the Noise protocol to be? I've looked at it in the past as an alternative to SSL.
  - pfraze 5y ago
    This is where I have to again point to the Hypercore Protocol team, as they're the ones that implemented it. I bet you could ask in the #hyperswarm channel of their discord https://chat.hypercore-protocol.org/ https://chat.hypercore-protocol.org/
api 5y ago
One question that always comes up for me with DHT backed systems is resistance to DOS attacks. Making any P2P system resistant to DOS/DDOS is brutally difficult, but DHTs have always seemed especially vulnerable to a sophisticated attacker. A hybrid sybil/DDOS attack seems like it could down the network easily. The Internet is a dark forest. Anything that gets popular will be attacked. The fact that it does not have a single owner may reduce the chances of ransom as a motive, but it doesn't reduce the chances of all attacker profiles including just "griefing."
rytill 5y ago
Are there configurable reliability settings, or is it TCP-only?
marcodiego 5y ago
This is good but, in terms of requiring special software on both sides, it is no better than tor which allows you to expose a service even behind NAT. Anyone knows a similar service which do not needs special software on the client side?
- pfraze 5y ago
  Yeah that's a basic problem of the approach. I'm going to create a public gateway service for spork (similar to IPFS gateways). You lose the end-to-end encryption by using a gateway, but then only the serving user needs to have spork installed. I figure that can help with asymmetric adoption. Long-term, the Hyperswarm & Hypercore stacks will need to have whatever apps/browser-extensions available, and then the featureset will hopefully be compelling enough to make them worth an install. Spork isn't the end-point.
exporectomy 5y ago
I'm confused how the client/local proxy finds the rest of the distributed hash table to do its lookup in. Are there some fixed conventional internet addresses it can start from or something?
- Donckele 5y ago
  Had the same questions. The homepage and demo don’t explain in layman’s words how this works. How does the hash get generated and how does it find the target from the hash? Are there servers online that do this?
  - exporectomy 5y ago
    As for how the hashing works, that's more an implementation detail, isn't it? How it finds the target is what the DHT tech does. But I have to say the home page and example was incredibly clear! For such an abstract thing, it was truly about as perfect at communicating what it is as I could imagine!

156 points by pcr910303 5y ago

Looks cool and simple to use, now can someone please explain to me why this matters? What centralized system does Spork remedy? It bypasses DNS? Is there any sort of discovery and/or replication and/or redundancy?

pfraze 5y ago
The goal is to create an Internet of home servers. You want to have your own NAS or rpi you deploy apps on. The p2p turns those devices into a network

red0point 5y ago

This is very cool, but it seems extraordinarily cumbersome to pass on the generated super long string to another computer or mobile device.

OJFord 5y ago
I'm not sure about 'extraordinarily cumbersome', just copy-paste through Slack or whatever? Surely most use cases are between people, not just between (one person's) devices? An improvement could be to reversibly derive a few random words ('what 3 words' style) from the public key I suppose - so that it can be easily shared over a voice call, or to make it easier for the same person to enter on another device.
- KennyBlanken 5y ago
  There's a (mostly) serverless file transfer tool whose name escapes me at the moment that uses this method to exchange the actual keys for the secure transfer...but it works there because the connection is only available for initiation, for that specific host and port, for a pretty limited period of time. The key is also one-use. In this case the 'server' is up for an extended period of time, presumably, and the public key is both the address and authentication (unless you turn on requiring a specific key on the initiator, I think? I only glanced at the docs.) With enough nodes you'd end up with multiple nodes having the same words (divide the possible keyspace by the possible combination of words and you'll get a very large number), and also you'd be at significant risk of people finding nodes just by banging away trying to connect to different 3-word addresses. I agree that the tool seems to be intended for same-party use.
  - pfraze 5y ago
    Magic Wormhole is probably what you’re thinking of. The live handshake requirement is definitely a limiting factor on that approach, but probably still worth doing. Other options would be QR codes and registry services. The protocol team is looking at using the ristretto algorithms to derive “subdomains” which would reduce the amount of key sharing a fair bit
  - criddell 5y ago
    Are you talking about AirDrop?
gauchojs 5y ago
Yeah - this could work for more people if they had a small app that opened "Spork urls" spork://whattzzuu5drxwdwi6xbijjf7yt56l5adzht7j7kjvfped7amova

KennyBlanken 5y ago

> Spork is all about creating forward and reverse proxies between traditional sockets and p2p sockets. > Sockets are identified by a public key and connect using a Distributed Hash Table (DHT). Connections are end-to-end encrypted using the NOISE framework. Okay, sounds like pretty neat. Is anyone aware of whether Spork is undergoing any sort of formal review? NOISE appears to be popular and well-reviewed, but Spork uses noise-peer, a two-contributor project. Spork itself is one-contributor. So...neat sounding, but I'm not using it for anything remotely sensitive until it sees more eyeballs. Hopefully a bunch of HNers can help with that.

dandanua 5y ago
> Spork is a part of the Atek Cloud mission to self-host our lives. We're channeling the deep magics of the Hypercore Protocol. Atek and Spork were built by the same people behind Beaker Browser The guys behind Hypercore Protocol and Beaker Browser are building a lot of interesting p2p tools. I suggest starting here [1] if you want to understand their stack deeper. [1] https://hypercore-protocol.org/ https://hypercore-protocol.org/
- KennyBlanken 5y ago
  My understanding of the stack is irrelevant - there's no way in hell I will ever be qualified to evaluate it. I want to see respected, trusted members of the cryptography community say at least that noise-peer implements NOISE in a secure, proper manner and that spork doesn't weaken or improperly use NOISE. With just two people working on noise-peer and one person working on spork, I don't trust it further than I can throw it. Very cool stuff though. Wish the project well and will be excited to see where it goes.

MayeulC 5y ago

See also: yggdrasil/cjdns/hyperbora that also provide p2p routing in a mesh network (without DHT), but also map public keys to an unused chunk of IPv6. IPFS p2p is more similar to that project, with a DHT, though I am not sure about encryption. To me, this is the future. I wish we had a set of APIs to allow connecting to a public key instead of an IP adress... however that requires reinventing most of the network stack (subnets, etc). That could be a base for IPv7. As a bonus, this could run on top of IPv4 or IPv6. Creating ephemeral, E2EE addresses has a lot of nice properties: you can roam with the same address (making it easy to move a server around, even behind cellular internet). Browsers could use a different key for each site. Sites could use that as a session identifier to authenticate against.

adminscoffee 5y ago
kind of a weird idea but routers have names, i always wondered if there was some way we can use this as addresses to give a position of sorts, that way, nearby host can direct traffic towards a location. like a pass off, idk if i am explaining it right
brendoncarroll 5y ago
> To me, this is the future. I wish we had a set of APIs to allow connecting to a public key instead of an IP address INET256 is working on exactly that. It's a set of APIs for connecting to addresses derived from public keys. https://github.com/inet256/inet256 https://github.com/inet256/inet256
- MayeulC 5y ago
  Thanks for mentioning this, it's the first time I hear about that project, and will definitely have a look!
neilalexander 5y ago
> you can roam with the same address (making it easy to move a server around, even behind cellular internet) In particular, Yggdrasil's mobility performance is far better than anything provided by the likes of BATMAN-Adv, Babel etc, making it ideal for roaming users and ad-hoc/mesh networks. https://yggdrasil-network.github.io/assets/images/latest/mobility2.png https://yggdrasil-network.github.io/assets/images/latest/mob...

supermatt 5y ago

Any comments on hyperswarm vs libp2p (ipfs)? Why would I choose one over the other.

pfraze 5y ago
Libp2p is technically a framework so you could probably integrate hyperswarm into it. Hyperswarm’s new release has gotten some really focused effort to improve the DHT success rate. That’s the part I’m most interested to see play out

Tepix 5y ago

So is there a tool that makes it easy to look up the IP address(es) behind a public key? If not it should be trivial to code it, right?

ianopolous 5y ago

This is similar to p2p streams in IPFS. We've been using these in Peergos for 3 years now via the p2p http proxy in IPFS (which we contributed). It is a glorious model. The client, in our case Peergos, sends normal http requests to a localhost proxy URL that includes the target public key and voila! We wrote it up after developing it here: https://peergos.org/posts/dev-update https://peergos.org/posts/dev-update The underlying streams use TLS 1.3 as the transport encryption. And we've just written a super minimal ipfs replacement (for ourselves) which includes this: https://github.com/peergos/ipfs-nucleus/ https://github.com/peergos/ipfs-nucleus/

pfraze 5y ago

Hey all, I’m the author of spork. Just want to give credit to the Hypercore Protocol team as they’re responsible for 99% of this tool. They’re going to be speaking at NodeConf on Wednesday so check that out if you’re interested [1] 1. https://www.nodeconfremote.com/#workshops/how-to-build-p2p-applications-for-fun-and-profit https://www.nodeconfremote.com/#workshops/how-to-build-p2p-a...

pfraze 5y ago
A couple fun things I haven't documented yet. We were able to spork an SSH session using password auth. (That one went from Texas to Virginia via Starlink.) Some folks on the discord sporked a Minecraft game. Quake didn't spork, probably because it uses UDP which doesn't spork yet. We're going to keep adding fun/useful features, including a public gateway service so folks can make use of spork without people having to install the client first.
metadaemon 5y ago
How did you find the implementation of the Noise protocol to be? I've looked at it in the past as an alternative to SSL.
- pfraze 5y ago
  This is where I have to again point to the Hypercore Protocol team, as they're the ones that implemented it. I bet you could ask in the #hyperswarm channel of their discord https://chat.hypercore-protocol.org/ https://chat.hypercore-protocol.org/

api 5y ago

One question that always comes up for me with DHT backed systems is resistance to DOS attacks. Making any P2P system resistant to DOS/DDOS is brutally difficult, but DHTs have always seemed especially vulnerable to a sophisticated attacker. A hybrid sybil/DDOS attack seems like it could down the network easily. The Internet is a dark forest. Anything that gets popular will be attacked. The fact that it does not have a single owner may reduce the chances of ransom as a motive, but it doesn't reduce the chances of all attacker profiles including just "griefing."

rytill 5y ago

Are there configurable reliability settings, or is it TCP-only?

marcodiego 5y ago

This is good but, in terms of requiring special software on both sides, it is no better than tor which allows you to expose a service even behind NAT. Anyone knows a similar service which do not needs special software on the client side?

pfraze 5y ago
Yeah that's a basic problem of the approach. I'm going to create a public gateway service for spork (similar to IPFS gateways). You lose the end-to-end encryption by using a gateway, but then only the serving user needs to have spork installed. I figure that can help with asymmetric adoption. Long-term, the Hyperswarm & Hypercore stacks will need to have whatever apps/browser-extensions available, and then the featureset will hopefully be compelling enough to make them worth an install. Spork isn't the end-point.

exporectomy 5y ago

I'm confused how the client/local proxy finds the rest of the distributed hash table to do its lookup in. Are there some fixed conventional internet addresses it can start from or something?

Donckele 5y ago
Had the same questions. The homepage and demo don’t explain in layman’s words how this works. How does the hash get generated and how does it find the target from the hash? Are there servers online that do this?
- exporectomy 5y ago
  As for how the hashing works, that's more an implementation detail, isn't it? How it finds the target is what the DHT tech does. But I have to say the home page and example was incredibly clear! For such an abstract thing, it was truly about as perfect at communicating what it is as I could imagine!