3 ms·

GitTorrent: A Decentralized GitHub (2015)

75 points by ddtaylor 4y ago

feross 4y ago
GitTorrent was an awesome effort and a super clever use of WebTorrent: https://webtorrent.io/ https://webtorrent.io/
- sitkack 4y ago
  Came to post the same thing. I feel like this is the sleeper ground breaking tech that everyone will have claimed to used first. The Velvet Underground of Web4.
avgcorrection 4y ago
I love that Git is distributed in the sense that all copies are equal. But I think the current Github, Bitbucket etc. status quo is okay. Not optimal but it works most of the time.
0x6c6f6c 4y ago
How well does the scenario scale in this sense that there could be hash collisions across the number of projects available on GitHub? Or was it simplified in its search for a SHA hash only? I would imagine some hash collisions between all repositories in GitHub exist at this point.
- rektide 4y ago
  Git is now using SHA256, so there is quite very close to zero risk. Trying to intentionally create a SHA1 collision is also going to be "quite difficult" for the foreseeable future.
  - glandium 4y ago
    > Git is now using SHA256 Not by default, and I don't think it's officially stable yet (but I haven't checked the status in a while). I'm not even sure github supports SHA256 repos.
    - rektide 4y ago
      Thanks, seems right. Someone asked github in a discussion 18 months ago[1], and they said soon, but there's still no sign of progress, no issues to track, no indication soon really was in the pipeline. [1] https://github.community/t/support-for-sha-256-hashes/157493/6 https://github.community/t/support-for-sha-256-hashes/157493...
- jwilk 4y ago
  FWIW, Git (since v2.13) uses an SHA-1 implementation that detects known collision attacks.
nyolfen 4y ago
for a more recent relevant project, see radicle: https://radicle.xyz/ https://radicle.xyz/
- Fnoord 4y ago
  Seems this project jumped on the cryptocyrrency bandwagon (a dealbreaker for me).
paulryanrogers 4y ago
IDK. Such Bitcoin operarios probably aren't $0.08 anymore, and have unpleasant externalities. And not sure I want all my repos public. Also could be some MITM attacks in there somewhere.
- rektide 4y ago
  I'm generally opposed to bitcoin, but this is one place where it'd make sense that you'd want to store up to 80 bytes globally. Current transaction costs seem to be ~$1.75. The whole identity thing was really more of a suggestion than final tool in GitTorrent. Chris Ball also has done some work more recently with Keybase, but not in connection to GitTorrent and Keybase post Zoom is dead, but that sort of solution would probably fit. Certificate Transparency is popular. Alas, projects like Google Keyserver went archived: that'd be a great way to publish a key & validate it across time. I don't believe there's any creative MITM attacks on BitTorrent we have to worry about. The content has to hash out. In general I dislike this form of post, where there's a scattershot litany of non-backed up complaints & concerns, a big blast of naysaying. I don't think anyone is compelled to fully accept, but immediately polarizing yourself against something so heavily, so quickly, & not admitting some possibility: it's a existentially risky doubt-monster of humanity's, this pervading doubt. Please try to show some balance, some recognition of upsides, share a little bit that you think positivity might be possible.
ashton314 4y ago
I really like what’s happening with SourceHut[^1]; that aims to make a lighter-weight, very self-hostable forge. How many of the problems that these decentralized systems aim to solve could be in large part mitigated by more self hosting? For sure, there are some technically desirable aspects of decentralization: higher resilience to data loss, etc. but the problems of centralized, closed-source, freedom-destroying services can be affected quite a bit by running your own $service. [1]: https://sr.ht/ https://sr.ht/

75 points by ddtaylor 4y ago

feross 4y ago

GitTorrent was an awesome effort and a super clever use of WebTorrent: https://webtorrent.io/ https://webtorrent.io/

sitkack 4y ago
Came to post the same thing. I feel like this is the sleeper ground breaking tech that everyone will have claimed to used first. The Velvet Underground of Web4.

avgcorrection 4y ago

I love that Git is distributed in the sense that all copies are equal. But I think the current Github, Bitbucket etc. status quo is okay. Not optimal but it works most of the time.

0x6c6f6c 4y ago

How well does the scenario scale in this sense that there could be hash collisions across the number of projects available on GitHub? Or was it simplified in its search for a SHA hash only? I would imagine some hash collisions between all repositories in GitHub exist at this point.

rektide 4y ago
Git is now using SHA256, so there is quite very close to zero risk. Trying to intentionally create a SHA1 collision is also going to be "quite difficult" for the foreseeable future.
- glandium 4y ago
  > Git is now using SHA256 Not by default, and I don't think it's officially stable yet (but I haven't checked the status in a while). I'm not even sure github supports SHA256 repos.
  - rektide 4y ago
    Thanks, seems right. Someone asked github in a discussion 18 months ago[1], and they said soon, but there's still no sign of progress, no issues to track, no indication soon really was in the pipeline. [1] https://github.community/t/support-for-sha-256-hashes/157493/6 https://github.community/t/support-for-sha-256-hashes/157493...
jwilk 4y ago
FWIW, Git (since v2.13) uses an SHA-1 implementation that detects known collision attacks.

nyolfen 4y ago

for a more recent relevant project, see radicle: https://radicle.xyz/ https://radicle.xyz/

Fnoord 4y ago
Seems this project jumped on the cryptocyrrency bandwagon (a dealbreaker for me).

paulryanrogers 4y ago

IDK. Such Bitcoin operarios probably aren't $0.08 anymore, and have unpleasant externalities. And not sure I want all my repos public. Also could be some MITM attacks in there somewhere.

rektide 4y ago
I'm generally opposed to bitcoin, but this is one place where it'd make sense that you'd want to store up to 80 bytes globally. Current transaction costs seem to be ~$1.75. The whole identity thing was really more of a suggestion than final tool in GitTorrent. Chris Ball also has done some work more recently with Keybase, but not in connection to GitTorrent and Keybase post Zoom is dead, but that sort of solution would probably fit. Certificate Transparency is popular. Alas, projects like Google Keyserver went archived: that'd be a great way to publish a key & validate it across time. I don't believe there's any creative MITM attacks on BitTorrent we have to worry about. The content has to hash out. In general I dislike this form of post, where there's a scattershot litany of non-backed up complaints & concerns, a big blast of naysaying. I don't think anyone is compelled to fully accept, but immediately polarizing yourself against something so heavily, so quickly, & not admitting some possibility: it's a existentially risky doubt-monster of humanity's, this pervading doubt. Please try to show some balance, some recognition of upsides, share a little bit that you think positivity might be possible.

ashton314 4y ago

I really like what’s happening with SourceHut[^1]; that aims to make a lighter-weight, very self-hostable forge. How many of the problems that these decentralized systems aim to solve could be in large part mitigated by more self hosting? For sure, there are some technically desirable aspects of decentralization: higher resilience to data loss, etc. but the problems of centralized, closed-source, freedom-destroying services can be affected quite a bit by running your own $service. [1]: https://sr.ht/ https://sr.ht/