7 ms·
Veilid is an open-source, P2P, mobile-first, networked application framework
- r721 3y agoNews stories: https://www.theregister.com/2023/08/12/veilid_privacy_data/ https://www.theregister.com/2023/08/12/veilid_privacy_data/ https://www.washingtonpost.com/technology/2023/08/02/encryption-dead-cow-cult-apps-def-con/ https://www.washingtonpost.com/technology/2023/08/02/encrypt...
- say_it_as_it_is 3y agoI've never seen an open source project survive hosting on gitlab. It is on its own island.
- ngc6677 3y agoMaybe sadly true, the social network effect. But through distribution (packages etc.), that can be very untrue, and anyways people who really want to meaningfully contribute will find their ways (and probably understand the benefits of free/open-software).
- prmoustache 3y agoThere are comparatively a lot less than github but they do exist. Some examples of successful project using gitlab.com: Wireshark, QEMU, Inkscape, F-Droid, Aurora, Commento, Kicad, Remmina, tortoise-git...
- hosh 3y agoHopefully, Veilid can help solve the “on its own little island” effect of a decentralized platform.
- nateb2022 3y agoAlso notable is that this isn't based on a blockchain.
- ugjka 3y agoI'm curious how this will deal with carrier grade firewalls and NATs. I can't run torrent client on my phone for this reason and I have hard time seeing how anything P2P is going to work on user hostile ISPs
- quaintdev 3y agoProbably the way syncthing deals with NAT. I actually suggested Syncthing team to implement something like this few months back but they were not interested.
- raybb 3y agoDo you gave a link to the suggestion? (If it's public)
- weld 3y agoIt can use another node that it knows about for hole punching. Some info here: https://veilid.com/framework/networking/ https://veilid.com/framework/networking/
- cryo 3y agoThe choice of Cap'n Proto seems odd to me https://veilid.com/framework/rpc https://veilid.com/framework/rpc It is an interesting project, but I'm sceptical. Veilid appears to be focused on their implementation in Rust, not so much as reference implementation but as the thing itself. I was hoping for a W3C like definition of a standard, not "bound" to their implementation or Cap'n Proto.
- deleted 3y ago[deleted]
- nextaccountic 3y agoCap'n'proto is very well designed and actually has multiple implementations. It also helps writing bindings for all kinds of languages that may want to call Veilid APIs. I don't think that defining yet another serialization format would buy anything.
- summm 3y agoTrue. On the other hand, gnunet tried the standards-based approach with binary specifications, as of yet with basically no adoption. One main problem I see that is very hard to integrate any other language or framework. If veilid now goes for trivially generatable language bindings, maybe they have more luck and this is what's needed to get something like this off the ground?
- doctorpangloss 3y agoTo me, the choice of Cap’n Proto means the developer looked at a colossal number of RPC frameworks in order to understand why Cap’n Proto is the best of them. While these things are subjective and also I cannot predict the future (ie actual adoption), it makes sense that being really opinionated and seemingly unorthodox is side by side to innovating.
- khimaros 3y agoslides: https://veilid.com/Launch-Slides-Veilid.pdf https://veilid.com/Launch-Slides-Veilid.pdf source code: https://gitlab.com/veilid https://gitlab.com/veilid
- oh_you 3y ago[dead]
- kreetx 3y agoHow do theyvdeal with bad actors and data integrity? Is it TOFU and then rely on signing?
- ngc6677 3y agoAny API accessible easily from Javascript client side? The trend seems going towards web-browser local-first applications. So an application on the client side, once was loaded the site's domain delivering the code, can work offline without network access, and synchronize later with its "associated peers/nodes/servers" (if they decide to). Though wasm exists, it would be nice to be able to have a "high level API" so any user (not just technical) can become part of the federated protocol, and contribute to its rich content.
- brunoqc 3y agothere seem to be a json api: https://gitlab.com/veilid/python-demo/-/blob/103ae2211b452f149f6f3acd1871bb16a4c4e0d8/veilid_demo/chat.py#L149 https://gitlab.com/veilid/python-demo/-/blob/103ae2211b452f1...
- api 3y agoI saw this talk at DEFCON. It seems to combine ideas from IPFS, BitTorrent magnet links, Tor, and things like scuttlebutt. There was a very strong focus on privacy including for metadata. The biggest weaknesses I saw were around DOS attack resistance, which I did not see addressed. There were good approaches for privacy and security but what if someone with resources (botnet or money) wants to just burn the network down? Completely pure P2P systems are hard to protect against Sybil attacks whose goal is simply to degrade service. Just launch a ton of bots, have them act normal for a while, then have them start being tar pits or misbehaving in ways that are carefully designed to maximize errors and latency. Then have them randomly pretend to be normal for a while, toggling good/evil to blend in as much as possible. Combined with strong privacy how do you identify and remove these? The alternative is to design a protocol so bulletproof that there is no viable DOS attack, or use tokenization to impose a high cost on such attacks. Of course the latter leads down the road to all the toxic craziness of the cryptocurrency ecosystem. Add a token and now you have a vector for pump and dump schemes even if you didn’t intend it as that. I can think of many reasons someone might launch such an attack from troll wars all the way to nation states trying to kill comm vectors for espionage or uprisings. All protocols really have to be designed as if your client is the defense department and they will be used in a war zone… because the Internet is a war zone.
- Aerbil313 3y ago> Completely pure P2P systems are hard to protect against Sybil attacks I’m happy to report that P2P systems resistant to all kinds of attacks are implemented already. There are many, many solutions in many OS projects. See the technicalities of I2P or Freenet 2023. Safe P2P is possible, although hella hard to get right.
- api 3y agoCould these projects actually withstand a really smart adversary with huge resources or are they simply not big enough to get attacked like that? Think nation states, organized crime, or groups of black hats with huge botnets and a desire to take down a platform to silence someone on it.
- Semaphor 3y agoAlso discussed 8 days ago as "Cult of the Dead Cow wants to save internet privacy with new encryption protocol, 82 comments: https://news.ycombinator.com/item?id=37018404 https://news.ycombinator.com/item?id=37018404
- sp332 3y agoIt wasn't launched yet, and there were very few details then. Now there's a slide deck and code.
- dTal 3y agoSome code. "You can get the code for Veilid Chat at https://gitlab.com/veilid/veilidchat https://gitlab.com/veilid/veilidchat" Visiting that link gives me a GitLab signup page. Not a good onboarding experience for someone who cares about security and privacy. Perplexed I return to the original page and spot the offhanded mention: "If you want to try out this proof of concept, please stay tuned for details on how to gain access." This doesn't bode well, if they're reluctant to release even their own proof of concept.
- bartvk 3y agoIt says on the linked page that it's a "mobile-first framework" but what is mobile-first about it? I'm having trouble finding Swift or Kotlin code. Or do they mean something else?
- brunoqc 3y agoDoes flutter bindings work?
- kstrauser 3y agoThe key here is that it’s designed to deal with flaky and changing network connections, CGNAT, and small devices running on batteries. It also runs great on big servers with public IPs! But you can use it on your phone without turning your phone into a hand warmer.
- dboreham 3y agoCan anyone access the demo example repo linked from this page? : https://veilid.com/chat/ https://veilid.com/chat/ (points to : https://veilid.com/chat/ https://veilid.com/chat/)
- soitgoes511 3y agoI haven't been able to. I attempted to yesterday also with no luck. Their site mentions availability after recovering from DEF CON or something to that affect.
- kstrauser 3y agoNailed it. There’s a laundry list of stuff to be done, but lots of people are either still traveling or hibernating after a very hectic few weeks!
- omani 3y agoWhy reinvent the wheel? We already have NKN [N]ew [K]ind of [N]etwork. (nkn.org)
- generalizations 3y agoDo we have any metrics on the network performance? I have a project that might have use for this, but it depends on pushing a lot of data around.
- kstrauser 3y agoNot yet. It’s also slower today than it will be as the node count increases. I mean, today there’s a fair chance that 2 nodes in California may talk through a node in Australia.
- NayamAmarshe 3y agoI just find it strange that they only have a Discord server for communication.
- kstrauser 3y agoWe’d love to self-host on our own app! Some day. :) Matrix would be another good option today, but DEF CON was already using Discord for official communications, so this is one less app for people to install.
- SubGenius 3y agoI'm building a publicly-accessible matrix app [0] that might be of interest to you, and anyone else looking to self-host a discord + discussions alternative. It's still early days, but I'll probably do a Show HN at some point. [0] https://shpong.com https://shpong.com
- kstrauser 3y agoVery cool!
- deleted 3y ago[deleted]
- some_random 3y agoMy view of CDC is that it's a long dead hacker clique resurrected by industry grifters, but I'd love for that to be proven incorrect on that. My biggest question is how the shift from techno-libertarianism to techno-anarchism with techno-dictatorship-of-the-prolotariat characteristics in the general space the CDC occupies will affect development. If successful, all kinds of unsavory actors will be using it, from child predators to terrorists to actual nazis, and worst of all, annoying right wingers. Do they have the values and strength of their views to keep serving those people or do they start eroding the security and privacy guarantees to kick them off?
- kstrauser 3y agoThat’s goofy. I’m not a cDc member, but I was online and actively building networks and network apps on the early public Internet before most people. I’m not thrilled that RWNJs are using some of the things my friends and I helped make, but that’s better than a world where someone can dictate that they’re not allowed to. Today I run a Mastodon server. Neo-Nazis can deploy their own, too. Again, I wish they wouldn’t, but it’s not as bad as a central authority with enough power to lock them out. I hope neo-Nazis hate Veilid and want nothing to do with it. I’m also not interested in a network with central controls strong enough that any one group could keep another group out altogether.
- some_random 3y agoI'd love it if they stayed out of Veilid too, but if Veilid succeeds they will not. The needs of pro-democracy, pro-human rights protesters are very similar to the needs of hate groups, it sucks but it's true.
- kstrauser 3y agoIt is, and that’s kind of my point. Vile people will use good things, too. I’m not willing to forego having nice things just because people I loathe might also like them.
- 3y ago
- pthatcherg 3y agoIt's shame it looks like web clients won't be able to connect to each other p2p. If it supported the use of ICE+DTLS+SCTP or even ICE+QUIC, then it web clients could join in. Or am I missing something in the docs?
- kstrauser 3y agoThe intent is definitely for web clients to be full, equal participants with P2P connectivity.
- nullc 3y agoNo comparison with freenet? DHT's are normally very vulnerable to DOS attack, and the known techniques to harden them tend to hurt other properties yet I don't see any details on how DOS is mitigated even to the level freenet does (and freenet's mitigations are expensive indeed). Probably no anonymous file storage system can really go without a discussion regarding strict liability for the possession of some kinds of unlawful content. (E.g. Freenet makes an effort so that the operator of a node storing a piece of data won't have the ability to decode it themselves.) Probably any modern system of this type ought to consider the ability for attackers to intentionally store illegal data in order to defame the system and users of the system and force them to shut down as a relevant attack in their attack model. Odd to see no (at least) ephemeral PQ crypto for a protocol being developed now or a rational for why its missing. Perhaps PQ for the data at rest is too costly but it doesn't seem likely that it would be too costly for the P2P communications.
- reedriley 3y agoDoes Veilid have any plans for forward secrecy at a core protocol level or as an extension of some sort?