8 ms·

Oppressive governments must be thankful to all BigTechs able to consolidate userbase and services around a handful of apps. It makes it really easy to switch th

Oppressive governments must be thankful to all BigTechs able to consolidate userbase and services around a handful of apps. It makes it really easy to switch things on/off when needed. The original purpose of the Internet as being a resilient p2p network for the people has been completely defeated in some nations.

Abekkus 4y ago
Building a resilient p2p service on the internet doesn't just require not using big name SaaS, it means building that service to not need the WebCAs or even DNS, two core services that are anything but p2p. I honestly don't know of any applications that require neither.
- planede 4y ago
  Jami and Tox should mostly qualify, I believe. The hard part is bootstrapping the discovery network, I don't know if there is a true p2p way for that.
  - ugjka 4y ago
    You have to make a connection to something to get anywhere, that's how the net works
- marcosdumay 4y ago
  You can distribute DNS data over any transport, p2p or not. Ans with DNSSEC, you can trust the contents you get from any transport. Are you concerned with countries forcefully removing entries? Because there are a lot of other country TLDs where you can add your entries if you want.
  - tptacek 4y ago
    Virtually everyone relies on ISP DNS servers, which can trivially bypass DNSSEC (DNSSEC collapses down to a single bit in the header on the last hop from server to stub resolver). If all you're trying to do is resist DNS censorship, you can get almost everything you need from using an out-of-country name and DoH, which is universally available, very much unlike DNSSEC.
    - marcosdumay 4y ago
      DNS without DNSSEC is pretty much vulnerable to the kind of censorship that won't even let you know you are being censored... Any name system without something equivalent to DNSSEC is. With DNSSEC it is still vulnerable, but only to the kinds that you will know you are being censored, so you can try to get it from another country or another channel. If your ISP denies DNSSEC for you, you already know you are being attacked, and can get it through some other channel. DoH is a cool channel, just make sure it has DNSSEC.
      - akerl_ 4y ago
        For the vast majority of DNSSEC-enabled end user systems, the user's device is not doing its own DNSSEC validations. It's using a DNSSEC-enabled resolver and trusting the bit set on the DNS query response where the recursive resolver says "yup, I confirm that DNSSEC is good here". Given that these resolvers are generally provided by the user's ISP, if the ISP wants to lie about DNSSEC, they can just fudge the results and set that bit to "yup, we're good". The only way around this is for local systems to do their own recursive resolution, which isn't the default configuration on any OS or distribution that I'm aware of.
        marcosdumay 4y ago
        Honestly, this is something I shouldn't have to say. But getting a DNS response with a flag saying "yep, trust me, it's valid" is not DNSSEC. What is it with DNSSEC that people have to pollute discussions saying that stupid stuff that isn't DNSSEC isn't secure?
        akerl_ 4y ago
        Are there any operating systems or distributions that actually ship with DNSSEC validation via local recursive resolution? The reason I'm describing local stub resolvers that check the dnssec bit of their upstream recursive resolver is because that's how DNSSEC is implemented in every OS/distro I'm aware of. So that configuration is what actually matters when we talk about users being protected (or not) by DNSSEC.
- Melatonic 4y ago
  Wouldnt any service that could be used by just manually entering IP addresses be workable? No DNS involved.
matheusmoreira 4y ago
Yeah. People love the convenience of Big Tech and never think about the abuses their enable. Even if someone built a perfectly resilient uncensorable mesh network and E2E encrypted messaging service, what is the point if nobody uses it?
throwaway894345 4y ago
It's not like ordinary people were running their own mail servers or other p2p tech in the pre-Big-Tech days, nor would it have been considerably harder for the government to disrupt email traffic than it is for them to block Facebook/etc. This isn't a pro-Big-Tech or pro-centralization message, only that we never actually lived in a golden age of ubiquitous decentralized communication that was robust against state actor censorship.
- mylons 4y ago
  this just sounds like whataboutism and is skirting the issue. there is an enormous amount of censorship power within BigTech right now. given the “value” their core businesses provide, which is funded by manipulating your attention to get ad impressions, they should be broken up. why does facebook get to run whatsapp when it’s an ad business?
KptMarchewa 4y ago
You drastically underestimate power that those oppressive governments have in real world that some fancy decentralized solution would solve. They just take down the internet.
- adventured 4y ago
  > They just take down the internet. Or kill a lot of people if they rebel. Which is what Iran did just before the pandemic, and which the media only briefly covered. They machine-gunned people in the streets by the thousands and the West barely batted an eye. It was as bad as Tiananmen Square in 1989, but you'd never know it going by the media coverage then or since.
  - KptMarchewa 4y ago
    The only way to win is the point when police and army joins your side. That's only how those are won. Of course, Iran has parallel structures with IRGC specifically made for those situation.
mercy_dude 4y ago
That includes our own government in US. If you have not noticed, there has been a constant pestering from Congress to censor big tech and “severe consequences” otherwise. And not to say the clear as daylight funding they provide to people in power as part of the lobbying effort. Oh and the same people in media and big tech then decide what is misinformation and not.
pyinstallwoes 4y ago
Not really that distributed given that everything is controlled by 'hubs/isps' which are within arms reach for any government within their borders. The internet was built for fail-over to maintain communicatoin during a nuclear event. The internet is less concerned about being a p2p network, which it clearly is not. A totally ad-hoc p2p network would be interesting, and more resiliant in some ways and lossy in others. It probably makes sense to entertain such a model. They aren't mutually exclusive. Totally agree with you though. It's a big problem with the _increased amount of centralization_ in traffic flow / routing. That and BGP is wack.
- rodolphoarruda 4y ago
  To me, the idea of shutting down Internet via ISPs or international backbones is similar to blowing up your own house with TNT when a robber breaks into it. You stop the robbery, but your family pays the price as well. Shutting down the Internet will disrupt not only people's communications but also systems' communications at various levels, including the systems of interest of the oppressive, of his/her family or political allies. It would be so much easier and safer to the group in power to just "maneuver" bigtech instead. I remember when Facebook's general manager in the country I live was arrested[1], then blackmailed, to provide authorities means for them to access WhatsApp messages without confiscating the actual phones. Fast forward today, they are confiscating phones whenever they feel like reading private messages from anyone[2]. I liked how other folks reacted to my original comment posting their technical view. I didn't know DNS was such a weak link and a clear point of failure to the Internet. I wonder if protocols like BitTorrent could survive DNS restrictions, allowing people to communicate via shared text files thrown within a folder. My guess is that since it has survived the copyright crisis back then, it could be used for other crisis as well. Frankly, I'm just suspecting. [1] https://jornaldebrasilia.com.br/noticias/brasil/executivo-do-facebook-no-brasil-foi-preso-por-nao-quebrar-sigilo-do-whatsapp/ https://jornaldebrasilia.com.br/noticias/brasil/executivo-do... [2] https://jc.ne10.uol.com.br/colunas/jamildo/2022/08/15065135-empresarios-apoiadores-de-bolsonaro-levam-notificacao-da-justica-por-causa-de-grupo-no-whatsapp-entenda.html https://jc.ne10.uol.com.br/colunas/jamildo/2022/08/15065135-...

Abekkus 4y ago

Building a resilient p2p service on the internet doesn't just require not using big name SaaS, it means building that service to not need the WebCAs or even DNS, two core services that are anything but p2p. I honestly don't know of any applications that require neither.

planede 4y ago
Jami and Tox should mostly qualify, I believe. The hard part is bootstrapping the discovery network, I don't know if there is a true p2p way for that.
- ugjka 4y ago
  You have to make a connection to something to get anywhere, that's how the net works
marcosdumay 4y ago
You can distribute DNS data over any transport, p2p or not. Ans with DNSSEC, you can trust the contents you get from any transport. Are you concerned with countries forcefully removing entries? Because there are a lot of other country TLDs where you can add your entries if you want.
- tptacek 4y ago
  Virtually everyone relies on ISP DNS servers, which can trivially bypass DNSSEC (DNSSEC collapses down to a single bit in the header on the last hop from server to stub resolver). If all you're trying to do is resist DNS censorship, you can get almost everything you need from using an out-of-country name and DoH, which is universally available, very much unlike DNSSEC.
  - marcosdumay 4y ago
    DNS without DNSSEC is pretty much vulnerable to the kind of censorship that won't even let you know you are being censored... Any name system without something equivalent to DNSSEC is. With DNSSEC it is still vulnerable, but only to the kinds that you will know you are being censored, so you can try to get it from another country or another channel. If your ISP denies DNSSEC for you, you already know you are being attacked, and can get it through some other channel. DoH is a cool channel, just make sure it has DNSSEC.
    - akerl_ 4y ago
      For the vast majority of DNSSEC-enabled end user systems, the user's device is not doing its own DNSSEC validations. It's using a DNSSEC-enabled resolver and trusting the bit set on the DNS query response where the recursive resolver says "yup, I confirm that DNSSEC is good here". Given that these resolvers are generally provided by the user's ISP, if the ISP wants to lie about DNSSEC, they can just fudge the results and set that bit to "yup, we're good". The only way around this is for local systems to do their own recursive resolution, which isn't the default configuration on any OS or distribution that I'm aware of.
      - marcosdumay 4y ago
        Honestly, this is something I shouldn't have to say. But getting a DNS response with a flag saying "yep, trust me, it's valid" is not DNSSEC. What is it with DNSSEC that people have to pollute discussions saying that stupid stuff that isn't DNSSEC isn't secure?
        akerl_ 4y ago
        Are there any operating systems or distributions that actually ship with DNSSEC validation via local recursive resolution? The reason I'm describing local stub resolvers that check the dnssec bit of their upstream recursive resolver is because that's how DNSSEC is implemented in every OS/distro I'm aware of. So that configuration is what actually matters when we talk about users being protected (or not) by DNSSEC.
Melatonic 4y ago
Wouldnt any service that could be used by just manually entering IP addresses be workable? No DNS involved.

matheusmoreira 4y ago

Yeah. People love the convenience of Big Tech and never think about the abuses their enable. Even if someone built a perfectly resilient uncensorable mesh network and E2E encrypted messaging service, what is the point if nobody uses it?

throwaway894345 4y ago

It's not like ordinary people were running their own mail servers or other p2p tech in the pre-Big-Tech days, nor would it have been considerably harder for the government to disrupt email traffic than it is for them to block Facebook/etc. This isn't a pro-Big-Tech or pro-centralization message, only that we never actually lived in a golden age of ubiquitous decentralized communication that was robust against state actor censorship.

mylons 4y ago
this just sounds like whataboutism and is skirting the issue. there is an enormous amount of censorship power within BigTech right now. given the “value” their core businesses provide, which is funded by manipulating your attention to get ad impressions, they should be broken up. why does facebook get to run whatsapp when it’s an ad business?

KptMarchewa 4y ago

You drastically underestimate power that those oppressive governments have in real world that some fancy decentralized solution would solve. They just take down the internet.

adventured 4y ago
> They just take down the internet. Or kill a lot of people if they rebel. Which is what Iran did just before the pandemic, and which the media only briefly covered. They machine-gunned people in the streets by the thousands and the West barely batted an eye. It was as bad as Tiananmen Square in 1989, but you'd never know it going by the media coverage then or since.
- KptMarchewa 4y ago
  The only way to win is the point when police and army joins your side. That's only how those are won. Of course, Iran has parallel structures with IRGC specifically made for those situation.

mercy_dude 4y ago

That includes our own government in US. If you have not noticed, there has been a constant pestering from Congress to censor big tech and “severe consequences” otherwise. And not to say the clear as daylight funding they provide to people in power as part of the lobbying effort. Oh and the same people in media and big tech then decide what is misinformation and not.

pyinstallwoes 4y ago

Not really that distributed given that everything is controlled by 'hubs/isps' which are within arms reach for any government within their borders. The internet was built for fail-over to maintain communicatoin during a nuclear event. The internet is less concerned about being a p2p network, which it clearly is not. A totally ad-hoc p2p network would be interesting, and more resiliant in some ways and lossy in others. It probably makes sense to entertain such a model. They aren't mutually exclusive. Totally agree with you though. It's a big problem with the _increased amount of centralization_ in traffic flow / routing. That and BGP is wack.

rodolphoarruda 4y ago
To me, the idea of shutting down Internet via ISPs or international backbones is similar to blowing up your own house with TNT when a robber breaks into it. You stop the robbery, but your family pays the price as well. Shutting down the Internet will disrupt not only people's communications but also systems' communications at various levels, including the systems of interest of the oppressive, of his/her family or political allies. It would be so much easier and safer to the group in power to just "maneuver" bigtech instead. I remember when Facebook's general manager in the country I live was arrested[1], then blackmailed, to provide authorities means for them to access WhatsApp messages without confiscating the actual phones. Fast forward today, they are confiscating phones whenever they feel like reading private messages from anyone[2]. I liked how other folks reacted to my original comment posting their technical view. I didn't know DNS was such a weak link and a clear point of failure to the Internet. I wonder if protocols like BitTorrent could survive DNS restrictions, allowing people to communicate via shared text files thrown within a folder. My guess is that since it has survived the copyright crisis back then, it could be used for other crisis as well. Frankly, I'm just suspecting. [1] https://jornaldebrasilia.com.br/noticias/brasil/executivo-do-facebook-no-brasil-foi-preso-por-nao-quebrar-sigilo-do-whatsapp/ https://jornaldebrasilia.com.br/noticias/brasil/executivo-do... [2] https://jc.ne10.uol.com.br/colunas/jamildo/2022/08/15065135-empresarios-apoiadores-de-bolsonaro-levam-notificacao-da-justica-por-causa-de-grupo-no-whatsapp-entenda.html https://jc.ne10.uol.com.br/colunas/jamildo/2022/08/15065135-...