5 ms·

I really wish they would open source the software. I'm using it in my local network for some unimportant data and it works fine, but I wouldn't trust it with an

by ch0wn 13y ago

I really wish they would open source the software. I'm using it in my local network for some unimportant data and it works fine, but I wouldn't trust it with anything remotely important unless I can see the source.

doctoboggan 13y ago
Yes I agree. I am hoping someone reverse engineers the sync protocol so we could build an open source client. But like I mentioned in the article I am using this to replace a closed source cloud solution I was previously using so it is a step in the right direction.
- TheCraiggers 13y ago
  The particulars of the BT protocol are beyond me, but I thought it would already do a compare between the copy you had and the one on the external server, and only send the relevant bytes to bring everything up to sync again. Between that and a "compare timestamps to figure out the newest file" I wouldn't think it would be that hard to re-create? What am I missing here?
  - Osiris 13y ago
    BitTorrent creates a hashes of your file. The file is broken down into certain size chunks and hashes taken of each chunk. If you already have a piece with a given hash, you won't download it. If a hash differs, it'll be transmitted. The receiver verifies the hash. If it fails it re-requests that piece. I assume the sync protocol works the same. It hashes the file, checks if any chunks have changed, sends the hash meta-data to the recipient, who then requests and pieces that have changed.
    - dman 13y ago
      What about hash collisions?
      - tokenizerrr 13y ago
        SHA-2 has no collisions found as of yet [1]. The collision attacks on md5 required a lot of junk data, so not sure how much of a problem that would be. [1]: https://en.wikipedia.org/wiki/SHA-2#Comparison_of_SHA_functions https://en.wikipedia.org/wiki/SHA-2#Comparison_of_SHA_functi...
- seunosewa 13y ago
  Writing a new protocol with an open source reference implementation will probably be a better idea, because: 1) Reverse-engineering isn't clean and can be circumvented. 2) BTsync has not reached a point where it can't be beaten by a competing protocol.
  - danielsiders 13y ago
    We're actively developing an open source Dropbox type app that's powered by Tent (https://tent.io https://tent.io).
    - rohamg 13y ago
      you should have a landing page with an email sign up form that you can link people to.
  - bascule 13y ago
    Tahoe-LAFS is a mature project of this nature: https://tahoe-lafs.org/ https://tahoe-lafs.org/ I am writing a similar project which is fairly immature: https://github.com/cryptosphere/cryptosphere https://github.com/cryptosphere/cryptosphere
paraxisi 13y ago
Steve Gibson of GRC/Security Now has mentioned (if I remember correctly,) that the protocol/spec will be published, or at least shared with people who have an interest.
- jlund 13y ago
  That's better than nothing, I suppose, but unless the source is open it's still impossible to trust the proprietary binary.
  - chongli 13y ago
    impossible to trust the proprietary binary If the protocol is published properly you won't have to: people will write their own free software implementations.
  - cenhyperion 13y ago
    If the spec is published it should be a lot easier to build an open source client.
sk3w 13y ago
Take a look at git-annex. It's not quite an apples-to-apples comparison with btsync, but I find that it meets my needs quite well.
- jlgreco 13y ago
  I'm using git-annex-assistant right now and while it is really nice and promises to replace dropbox for me, it would still use a lot more loving. There seem to be some weird states that you can easily get it into (I've had issues with the files syncing properly but the webapp claiming that the syncing was failing (or rather, that item is colored red, has an "!", and doesn't say anything else), it does not handle very large numbers of small files well (something git by itself does well),and a few other assorted problems).
  - mlinksva 13y ago
    Looks like the developer is going to be giving it more loving full time for the next year -- https://campaign.joeyh.name/ https://campaign.joeyh.name/ almost funded.
    - jlgreco 13y ago
      Yup! Joey is dedicated as hell which makes me really optimistic about the future of git annex.
jimmaswell 13y ago
Then how would you know they were using the same source in their binaries?
- icebraining 13y ago
  Why use their binaries? I rather have Debian compile mine.
stinos 13y ago
Are you implying you actually investigate every piece of code you are running right now? I doubt it. And to do it properly you'd also have to review all hundreds of thousand of lines of code needed to build and run this source else you'll never know if there's a backdoor somewhere. Oh man, and what about your bios? God knows what lowleve packet sniffer is setup in there :] Just kidding. Partly.

by ch0wn 13y ago

doctoboggan 13y ago

Yes I agree. I am hoping someone reverse engineers the sync protocol so we could build an open source client. But like I mentioned in the article I am using this to replace a closed source cloud solution I was previously using so it is a step in the right direction.

TheCraiggers 13y ago
The particulars of the BT protocol are beyond me, but I thought it would already do a compare between the copy you had and the one on the external server, and only send the relevant bytes to bring everything up to sync again. Between that and a "compare timestamps to figure out the newest file" I wouldn't think it would be that hard to re-create? What am I missing here?
- Osiris 13y ago
  BitTorrent creates a hashes of your file. The file is broken down into certain size chunks and hashes taken of each chunk. If you already have a piece with a given hash, you won't download it. If a hash differs, it'll be transmitted. The receiver verifies the hash. If it fails it re-requests that piece. I assume the sync protocol works the same. It hashes the file, checks if any chunks have changed, sends the hash meta-data to the recipient, who then requests and pieces that have changed.
  - dman 13y ago
    What about hash collisions?
    - tokenizerrr 13y ago
      SHA-2 has no collisions found as of yet [1]. The collision attacks on md5 required a lot of junk data, so not sure how much of a problem that would be. [1]: https://en.wikipedia.org/wiki/SHA-2#Comparison_of_SHA_functions https://en.wikipedia.org/wiki/SHA-2#Comparison_of_SHA_functi...
seunosewa 13y ago
Writing a new protocol with an open source reference implementation will probably be a better idea, because: 1) Reverse-engineering isn't clean and can be circumvented. 2) BTsync has not reached a point where it can't be beaten by a competing protocol.
- danielsiders 13y ago
  We're actively developing an open source Dropbox type app that's powered by Tent (https://tent.io https://tent.io).
  - rohamg 13y ago
    you should have a landing page with an email sign up form that you can link people to.
- bascule 13y ago
  Tahoe-LAFS is a mature project of this nature: https://tahoe-lafs.org/ https://tahoe-lafs.org/ I am writing a similar project which is fairly immature: https://github.com/cryptosphere/cryptosphere https://github.com/cryptosphere/cryptosphere

paraxisi 13y ago

Steve Gibson of GRC/Security Now has mentioned (if I remember correctly,) that the protocol/spec will be published, or at least shared with people who have an interest.

jlund 13y ago
That's better than nothing, I suppose, but unless the source is open it's still impossible to trust the proprietary binary.
- chongli 13y ago
  impossible to trust the proprietary binary If the protocol is published properly you won't have to: people will write their own free software implementations.
- cenhyperion 13y ago
  If the spec is published it should be a lot easier to build an open source client.

sk3w 13y ago

Take a look at git-annex. It's not quite an apples-to-apples comparison with btsync, but I find that it meets my needs quite well.

jlgreco 13y ago
I'm using git-annex-assistant right now and while it is really nice and promises to replace dropbox for me, it would still use a lot more loving. There seem to be some weird states that you can easily get it into (I've had issues with the files syncing properly but the webapp claiming that the syncing was failing (or rather, that item is colored red, has an "!", and doesn't say anything else), it does not handle very large numbers of small files well (something git by itself does well),and a few other assorted problems).
- mlinksva 13y ago
  Looks like the developer is going to be giving it more loving full time for the next year -- https://campaign.joeyh.name/ https://campaign.joeyh.name/ almost funded.
  - jlgreco 13y ago
    Yup! Joey is dedicated as hell which makes me really optimistic about the future of git annex.

jimmaswell 13y ago

Then how would you know they were using the same source in their binaries?

icebraining 13y ago
Why use their binaries? I rather have Debian compile mine.

stinos 13y ago

Are you implying you actually investigate every piece of code you are running right now? I doubt it. And to do it properly you'd also have to review all hundreds of thousand of lines of code needed to build and run this source else you'll never know if there's a backdoor somewhere. Oh man, and what about your bios? God knows what lowleve packet sniffer is setup in there :] Just kidding. Partly.