3 ms·

FWIW, Linux distributions are decentralized without any modern tech. It is all secured via signed checksum files you can download from hundreds of geographicall

FWIW, Linux distributions are decentralized without any modern tech. It is all secured via signed checksum files you can download from hundreds of geographically-distributed independent sources. There is no dependence on any single protocol or technology, because it's just copied files. Anything that can copy files can spread the distribution. This makes them future-proof, backwards-compatible, and flexible enough to work in any situation. You can cache files, proxy connections, use any storage mechanism, any transfer method. The packaging tools support multiple transport protocols. Works offline and online. You can install a Linux distribution today the same way you did 30 years ago, from the same sources, even though the underlying servers and software have been replaced.

giantrobot 5y ago
No. Clearly old things are bad. Only new things are good. Everything but be ridiculously complicated and extremely fragile. Reliability is bad! /s The Linux distro model is awesome. It would be more awesome with reproducible builds but it's still awesome as-is. Not only can Linux distros easily distribute their software but even mix and match packages between different mediums and have completely consistent systems with the same level of security. Even better is anyone can freely set up a distro mirror and anyone using it can trust it the same as they trust an "official" mirror.
pabs3 5y ago
It would still be good to have Linux distros on IPFS too though.
boramalper 5y ago
> It is all secured via signed checksum files you can download from hundreds of geographically-distributed independent sources. It's not permissionless though, or put differently, discoverability is the problem. You can set up your own mirror, and through cryptographic protocols the authenticity of the data you are distributing can be verified all well, but you need the distro maintainers to manually add you to their list of announced mirrors before any traffic hits your servers. The point of BitTorrent, IPFS, Dat, etc is that they create a network of participants that does not need anyone to add them (nor, consequently, their permission) to start contributing. This also reduces the administrative burden of course, and provides load-balancing as well since the content is now distributed not in file-units but block-units (~ 16 KiB).
- throwaway984393 5y ago
  Seems like a bad idea. First, BitTorret is unreliable and slow, whereas a single transport server is very fast and reliable, and mirroring makes it both globally redundant and verifiable. Second, protocols that build in all features (discovery, transport, verification) are less flexible and more centralized than decoupling into different protocols. Third, when random participants can contribute anything, you get a bunch of malware (look at every app store). Linux distributions' app repositories don't have any malware. Fourth, you don't need a distro maintainer to do anything at all if you want someone to download your app from your own repo. You just serve your public key and put your files online somewhere. Anyone can download the key, add the repo, and install the packages. You can even put them on GitHub, GitLab, etc.
  - boramalper 5y ago
    > First, BitTorret is unreliable and slow, whereas a single transport server is very fast and reliable, and mirroring makes it both globally redundant and verifiable. BitTorrent has higher latencies indeed but also much higher bandwidth. I am not sure what you mean by "reliable". > Second, protocols that build in all features (discovery, transport, verification) are less flexible and more centralized than decoupling into different protocols. I agree in theory, but I haven't seen any alternatives in practise that works here and now---I am happy to be proven wrong. > Third, when random participants can contribute anything, you get a bunch of malware (look at every app store). Random people being able to share content is one thing (which is not to different from saying "random people can open TCP sockets!"), random people being able to participate in helping spread your content (which you protect with your cryptographic primitives) is whole another. > Fourth, you don't need a distro maintainer to do anything at all if you want someone to download your app from your own repo. You just serve your public key and put your files online somewhere. Anyone can download the key, add the repo, and install the packages. You can even put them on GitHub, GitLab, etc. Again, you are missing the point: discoverability of mirrors in a permissionless system where participants can join and leave any time. I am not saying BitTorrent nailed it on its first try either (they simply spun up trackers), but DHT is more or less a solved problem that works reasonably well today.

giantrobot 5y ago

No. Clearly old things are bad. Only new things are good. Everything but be ridiculously complicated and extremely fragile. Reliability is bad! /s The Linux distro model is awesome. It would be more awesome with reproducible builds but it's still awesome as-is. Not only can Linux distros easily distribute their software but even mix and match packages between different mediums and have completely consistent systems with the same level of security. Even better is anyone can freely set up a distro mirror and anyone using it can trust it the same as they trust an "official" mirror.

pabs3 5y ago

It would still be good to have Linux distros on IPFS too though.

boramalper 5y ago

> It is all secured via signed checksum files you can download from hundreds of geographically-distributed independent sources. It's not permissionless though, or put differently, discoverability is the problem. You can set up your own mirror, and through cryptographic protocols the authenticity of the data you are distributing can be verified all well, but you need the distro maintainers to manually add you to their list of announced mirrors before any traffic hits your servers. The point of BitTorrent, IPFS, Dat, etc is that they create a network of participants that does not need anyone to add them (nor, consequently, their permission) to start contributing. This also reduces the administrative burden of course, and provides load-balancing as well since the content is now distributed not in file-units but block-units (~ 16 KiB).

throwaway984393 5y ago
Seems like a bad idea. First, BitTorret is unreliable and slow, whereas a single transport server is very fast and reliable, and mirroring makes it both globally redundant and verifiable. Second, protocols that build in all features (discovery, transport, verification) are less flexible and more centralized than decoupling into different protocols. Third, when random participants can contribute anything, you get a bunch of malware (look at every app store). Linux distributions' app repositories don't have any malware. Fourth, you don't need a distro maintainer to do anything at all if you want someone to download your app from your own repo. You just serve your public key and put your files online somewhere. Anyone can download the key, add the repo, and install the packages. You can even put them on GitHub, GitLab, etc.
- boramalper 5y ago
  > First, BitTorret is unreliable and slow, whereas a single transport server is very fast and reliable, and mirroring makes it both globally redundant and verifiable. BitTorrent has higher latencies indeed but also much higher bandwidth. I am not sure what you mean by "reliable". > Second, protocols that build in all features (discovery, transport, verification) are less flexible and more centralized than decoupling into different protocols. I agree in theory, but I haven't seen any alternatives in practise that works here and now---I am happy to be proven wrong. > Third, when random participants can contribute anything, you get a bunch of malware (look at every app store). Random people being able to share content is one thing (which is not to different from saying "random people can open TCP sockets!"), random people being able to participate in helping spread your content (which you protect with your cryptographic primitives) is whole another. > Fourth, you don't need a distro maintainer to do anything at all if you want someone to download your app from your own repo. You just serve your public key and put your files online somewhere. Anyone can download the key, add the repo, and install the packages. You can even put them on GitHub, GitLab, etc. Again, you are missing the point: discoverability of mirrors in a permissionless system where participants can join and leave any time. I am not saying BitTorrent nailed it on its first try either (they simply spun up trackers), but DHT is more or less a solved problem that works reasonably well today.