2 ms·

Wait wait, syyncthing joins you into a cloud and sends your data to/through random people? Why would anyone trust that, over paying Apple or DropBox to send yo

Wait wait, syyncthing joins you into a cloud and sends your data to/through random people? Why would anyone trust that, over paying Apple or DropBox to send your data only to Amazon S3? How long before "oops, for years anyone who joins the Syncthing mesh has been able to request your data and nobody noticed until now"?

yjftsjthsd-h 5y ago
No? Syncthing syncs your data to other instances of syncthing that you authorize, in a p2p mesh.
- jodrellblank 5y ago
  It joins you into a thing which connects all users of SyncThing. I said "cloud", you said "p2p mesh" the blog said "a fully operational node of Syncthing". No real difference there. From the syncthing website "Private. None of your data is ever stored anywhere else other than on your computers". From their open protocol page "Relay is a service which relays data between two devices which are not able to connect to each other directly otherwise." How can they claim "None of your data is ever stored anywhere else" if any relay node could save your data as it's transferred through them? Fine it's "Encrypted. All communication is secured using TLS". But we know that TLS encryption can be flawed (see deprecation of TLS1.3), and we know it can be implemented poorly (see OpenSSL vulnerabilities) and we know metadata and protocol analysis is a thing (analysing how much syncs to/from each node, how often, etc). What does "Authenticated. Every device is identified by a strong cryptographic certificate." mean if you don't have to setup a certificate authority or buy a verified SSL certificate or use LetsEncrypt or generate a public/private keypair? Would you recognise your SyncThing certificate if you saw it? How well do you know the SyncThing protocol? Do you know someone in a far away country cannot find a flaw in the implementation which allows them to sync to your device, or insert themselves as a relay node?
  - yjftsjthsd-h 5y ago
    The relays are only used if your devices can't see each other directly; over a LAN, and in many WAN cases, it won't even be used, and if you really care you can just disable it. And bluntly, if someone had a TLS break that could work after the fact on recorded data, syncthing is the least of our worries. > (see deprecation of TLS1.3) The what now? > What does "Authenticated. Every device is identified by a strong cryptographic certificate." mean if you don't have to setup a certificate authority or buy a verified SSL certificate or use LetsEncrypt or generate a public/private keypair? Would you recognise your SyncThing certificate if you saw it? It is a public/private keypair, and if you're doing the initial setup over an untrusted network, yes you should copy-paste the fingerprint and email it to yourself or whatever. > How well do you know the SyncThing protocol? Do you know someone in a far away country cannot find a flaw in the implementation which allows them to sync to your device, or insert themselves as a relay node? How well do you know the dropbox/icloud/gdrive/whatever protocol? Do you know that somewhat in a far away country cannot find a flaw in the implementation which allows them to sync to your device, or insert themselves as a relay node? Also, inserting themselves as a relay would not be a security break, since "Anyone can run a relay server, and it will automatically join the relay pool and be available to Syncthing users. The current list of relays can be found at https://relays.syncthing.net/ https://relays.syncthing.net/." (https://docs.syncthing.net/users/strelaysrv.html https://docs.syncthing.net/users/strelaysrv.html)

yjftsjthsd-h 5y ago

No? Syncthing syncs your data to other instances of syncthing that you authorize, in a p2p mesh.

jodrellblank 5y ago
It joins you into a thing which connects all users of SyncThing. I said "cloud", you said "p2p mesh" the blog said "a fully operational node of Syncthing". No real difference there. From the syncthing website "Private. None of your data is ever stored anywhere else other than on your computers". From their open protocol page "Relay is a service which relays data between two devices which are not able to connect to each other directly otherwise." How can they claim "None of your data is ever stored anywhere else" if any relay node could save your data as it's transferred through them? Fine it's "Encrypted. All communication is secured using TLS". But we know that TLS encryption can be flawed (see deprecation of TLS1.3), and we know it can be implemented poorly (see OpenSSL vulnerabilities) and we know metadata and protocol analysis is a thing (analysing how much syncs to/from each node, how often, etc). What does "Authenticated. Every device is identified by a strong cryptographic certificate." mean if you don't have to setup a certificate authority or buy a verified SSL certificate or use LetsEncrypt or generate a public/private keypair? Would you recognise your SyncThing certificate if you saw it? How well do you know the SyncThing protocol? Do you know someone in a far away country cannot find a flaw in the implementation which allows them to sync to your device, or insert themselves as a relay node?
- yjftsjthsd-h 5y ago
  The relays are only used if your devices can't see each other directly; over a LAN, and in many WAN cases, it won't even be used, and if you really care you can just disable it. And bluntly, if someone had a TLS break that could work after the fact on recorded data, syncthing is the least of our worries. > (see deprecation of TLS1.3) The what now? > What does "Authenticated. Every device is identified by a strong cryptographic certificate." mean if you don't have to setup a certificate authority or buy a verified SSL certificate or use LetsEncrypt or generate a public/private keypair? Would you recognise your SyncThing certificate if you saw it? It is a public/private keypair, and if you're doing the initial setup over an untrusted network, yes you should copy-paste the fingerprint and email it to yourself or whatever. > How well do you know the SyncThing protocol? Do you know someone in a far away country cannot find a flaw in the implementation which allows them to sync to your device, or insert themselves as a relay node? How well do you know the dropbox/icloud/gdrive/whatever protocol? Do you know that somewhat in a far away country cannot find a flaw in the implementation which allows them to sync to your device, or insert themselves as a relay node? Also, inserting themselves as a relay would not be a security break, since "Anyone can run a relay server, and it will automatically join the relay pool and be available to Syncthing users. The current list of relays can be found at https://relays.syncthing.net/ https://relays.syncthing.net/." (https://docs.syncthing.net/users/strelaysrv.html https://docs.syncthing.net/users/strelaysrv.html)