5 ms·

Freenet Project's Statement on the recent Freedom Hosting bust

93 points by Sami_Lehtinen 13y ago

unknownian 13y ago
Too bad it's written in Java.
- boromi 13y ago
  how is this relevant to anything?
  - antihero 13y ago
    Despite what people say, I still don't think that Java has shaken the image of being bloated and slow and requiring a heavy VM and loads of RAM.
    - arpstick 13y ago
      Freenet by nature is an insane resource hog, that doesn't make the JVM look any better.
    - alexwright 13y ago
      I really like when I goto download some new app and see that there is a simple executable .jar I can get. They are still bloated and slow though.. just so happens that we have workstations with i7s and 32GB of RAM. We finally caught up to where Java is reasonable, yay!
    - lucian1900 13y ago
      That's largely because the JVM still uses tons of memory and takes forever to boot.
    - aclevernickname 13y ago
      Currently running Freenet/Tor/I2P on a VM (KVM) with 1.5GB RAM allocated it. according to htop, java (Freenet and I2P) is using 985MB. Tor is using approximately 40MB. The day someone takes up a rewrite of Freenet in C/C++ is the day I send money to the project.
- zxcdw 13y ago
  Agreed. Not the language itself, but the way the runtime operates. One simply does not build reliable and fundamental abstractions over non-optimal enough abstractions and expect things to work long-term.
  - tomjen3 13y ago
    All the abstractions you build will eventually go over x86 bytecode instructions. And those aren't pretty, let me tell you. The truth is that there is nothing important wrong with Java, and everything important wrong with Java programmers, which casues people like you to say things like that.
    - eatmyshorts 13y ago
      I guess you aren't aware of the dozens of 0-day exploits to the JVM that were released last year? Since Oracle took over, Java's security model is looking like Swiss cheese, Oracle's responsiveness to security flaws has been slow, and the fixes have introduced even more security flaws. See here ( http://java-0day.com/ http://java-0day.com/ ) for some examples.
      - tomjen3 13y ago
        I am away against attacks against the java applet executor, not against Java itself.
        eatmyshorts 13y ago
        The problems weren't with the Java Applet executor. They were with the JVM. Java WebStart and the JVM security model are the two places where most of the 0-day exploits came. Neither of these have anything to do with applets.
    - zxcdw 13y ago
      What are these magical "x86 bytecode instructions"? That phrasing itself means nothing. Are you sure you know what you are talking about? I personally object by principle anything which is non-optimal by design because it means that everything built atop has to carry the penalties of the non-optimal design. Everyone suffers from the tradeoffs.
- simgidacav 13y ago
  To be honest, this was the first thing I said when I saw the installing instruction. Today's JVM are probably the fastest abstraction layer available, but still the programming language is not that beautiful.
- fulafel 13y ago
  While Java may not be sexy nowadays, it's still tons better suited for the task at hand than Tor's choice of unsafe C.
  - unknownian 13y ago
    People aren't always willing to sacrifice performance, ease of use, and beauty of software for the sake of using some secure web browser.
    - jlgaddis 13y ago
      Although, as a Tor user, I sacrifice all of those each and every time I use Tor.
      - unknownian 13y ago
        Tor is a C/C++ wrapper around Firefox. This is a Java Internet browser.
        eatmyshorts 13y ago
        What do you mean when you say that Firefox is "a Java Internet browser"? Firefox wasn't written in Java. Java code only runs in Firefox through the use of the Java plugin, just like any other browser.
        unknownian 13y ago
        I meant to say Freenet is a Java browser, not Firefox.
bcoates 13y ago
I'm a fan of Freenet, but it has some core (and extremely longstanding!) usability issues that Tor has proven are unforced errors. The restrictions on JavaScript is the biggest one. The complete inability to run server-side code in a trusted context makes JS more necessary on Freenet than the HTTP web; it's absense makes developing a useful Freenet site extremely difficult. It causes interesting Freenet projects to be deployed as local applications (which necessitates auto-update to be practical). This represents an absolute trust of unknown service providers and is vastly worse than running untrusted JavaScript. It also makes maintaining parallel Freenet and HTTP sites impractical in practice (when only reader-side anonymity is needed), something Tor got right the first time. Secondly, Freenet's JavaScript exclusion relies entirely on filtering code that's specific to Freenet and thus not anywhere near as battle-hardened as browser JS engines. You don't need a Chrome zero-day to circumvent Freenet's reader anonymity, you just need to find an edge case in its filtering code against the moving target of a self-updating browser. Freenet's core feature of anonymous distributed hosting (as opposed to just Tor's distributed proxying and Bittorrent's bandwidth sharing) is still a relevant technological frontier that's long overdue to see the light of day, but that's not going to happen until it stops tilting at windmills on some of the crazier technical decisions. Edit: While I'm complaining, I'm unclear on the real-world threat model that the friend-to-friend Darknet is supposed to protect against. Proving out that globally routable friend networks a la "The Crying of Lot 49" actually function is neat scientific accomplishment but it does nothing but help the Global Passive Attacker and probably makes things easier for more mundane threats too.
northwest 13y ago
> Freenet is a distributed data storage network designed to prevent censorship, provide anonymity and be hard to block. A very similar solution offering this is http://retroshare.sourceforge.net/ http://retroshare.sourceforge.net/ You get decentralized/p2p encrypted VOIP/chat/messaging/file sharing (written in C++). General intro for "darknet" solutions: https://en.wikipedia.org/wiki/Darknet_%28file_sharing%29 https://en.wikipedia.org/wiki/Darknet_%28file_sharing%29
- Sami_Lehtinen 13y ago
  RetroShare isn't similar to Freenet at all. Please read design & white papers completely for both projects. What I really like about Freenet & GNUnet is the build in distributed efficient caching of data. So even small sites won't go down when there's a global rush.
- simgidacav 13y ago
  This Retroshare btw looks interesting! --- but why on the earth the Fedora installation links me to Open-suse RPMs? :D
- aclevernickname 13y ago
  Retroshare is currently the best example of Zawinski's Law[1] one could ask for; We needed a p2p/f2f daemon we could run voip/chat/messaging/file sharing on top of. Instead, we're given this bloated hunk of 1998's software design policies that tries to do everything for us, but do all of it poorly. [1] http://catb.org/jargon/html/Z/Zawinskis-Law.html http://catb.org/jargon/html/Z/Zawinskis-Law.html
stefantalpalaru 13y ago
They are comparing static sites on Freenet with dynamic hidden services on Tor. Sure, hosting many hidden services with the same provider was dumb, but we're talking apples and oranges here.

93 points by Sami_Lehtinen 13y ago

unknownian 13y ago

Too bad it's written in Java.

boromi 13y ago
how is this relevant to anything?
- antihero 13y ago
  Despite what people say, I still don't think that Java has shaken the image of being bloated and slow and requiring a heavy VM and loads of RAM.
  - arpstick 13y ago
    Freenet by nature is an insane resource hog, that doesn't make the JVM look any better.
  - alexwright 13y ago
    I really like when I goto download some new app and see that there is a simple executable .jar I can get. They are still bloated and slow though.. just so happens that we have workstations with i7s and 32GB of RAM. We finally caught up to where Java is reasonable, yay!
  - lucian1900 13y ago
    That's largely because the JVM still uses tons of memory and takes forever to boot.
  - aclevernickname 13y ago
    Currently running Freenet/Tor/I2P on a VM (KVM) with 1.5GB RAM allocated it. according to htop, java (Freenet and I2P) is using 985MB. Tor is using approximately 40MB. The day someone takes up a rewrite of Freenet in C/C++ is the day I send money to the project.
zxcdw 13y ago
Agreed. Not the language itself, but the way the runtime operates. One simply does not build reliable and fundamental abstractions over non-optimal enough abstractions and expect things to work long-term.
- tomjen3 13y ago
  All the abstractions you build will eventually go over x86 bytecode instructions. And those aren't pretty, let me tell you. The truth is that there is nothing important wrong with Java, and everything important wrong with Java programmers, which casues people like you to say things like that.
  - eatmyshorts 13y ago
    I guess you aren't aware of the dozens of 0-day exploits to the JVM that were released last year? Since Oracle took over, Java's security model is looking like Swiss cheese, Oracle's responsiveness to security flaws has been slow, and the fixes have introduced even more security flaws. See here ( http://java-0day.com/ http://java-0day.com/ ) for some examples.
    - tomjen3 13y ago
      I am away against attacks against the java applet executor, not against Java itself.
      - eatmyshorts 13y ago
        The problems weren't with the Java Applet executor. They were with the JVM. Java WebStart and the JVM security model are the two places where most of the 0-day exploits came. Neither of these have anything to do with applets.
  - zxcdw 13y ago
    What are these magical "x86 bytecode instructions"? That phrasing itself means nothing. Are you sure you know what you are talking about? I personally object by principle anything which is non-optimal by design because it means that everything built atop has to carry the penalties of the non-optimal design. Everyone suffers from the tradeoffs.
simgidacav 13y ago
To be honest, this was the first thing I said when I saw the installing instruction. Today's JVM are probably the fastest abstraction layer available, but still the programming language is not that beautiful.
fulafel 13y ago
While Java may not be sexy nowadays, it's still tons better suited for the task at hand than Tor's choice of unsafe C.
- unknownian 13y ago
  People aren't always willing to sacrifice performance, ease of use, and beauty of software for the sake of using some secure web browser.
  - jlgaddis 13y ago
    Although, as a Tor user, I sacrifice all of those each and every time I use Tor.
    - unknownian 13y ago
      Tor is a C/C++ wrapper around Firefox. This is a Java Internet browser.
      - eatmyshorts 13y ago
        What do you mean when you say that Firefox is "a Java Internet browser"? Firefox wasn't written in Java. Java code only runs in Firefox through the use of the Java plugin, just like any other browser.
        unknownian 13y ago
        I meant to say Freenet is a Java browser, not Firefox.

bcoates 13y ago

I'm a fan of Freenet, but it has some core (and extremely longstanding!) usability issues that Tor has proven are unforced errors. The restrictions on JavaScript is the biggest one. The complete inability to run server-side code in a trusted context makes JS more necessary on Freenet than the HTTP web; it's absense makes developing a useful Freenet site extremely difficult. It causes interesting Freenet projects to be deployed as local applications (which necessitates auto-update to be practical). This represents an absolute trust of unknown service providers and is vastly worse than running untrusted JavaScript. It also makes maintaining parallel Freenet and HTTP sites impractical in practice (when only reader-side anonymity is needed), something Tor got right the first time. Secondly, Freenet's JavaScript exclusion relies entirely on filtering code that's specific to Freenet and thus not anywhere near as battle-hardened as browser JS engines. You don't need a Chrome zero-day to circumvent Freenet's reader anonymity, you just need to find an edge case in its filtering code against the moving target of a self-updating browser. Freenet's core feature of anonymous distributed hosting (as opposed to just Tor's distributed proxying and Bittorrent's bandwidth sharing) is still a relevant technological frontier that's long overdue to see the light of day, but that's not going to happen until it stops tilting at windmills on some of the crazier technical decisions. Edit: While I'm complaining, I'm unclear on the real-world threat model that the friend-to-friend Darknet is supposed to protect against. Proving out that globally routable friend networks a la "The Crying of Lot 49" actually function is neat scientific accomplishment but it does nothing but help the Global Passive Attacker and probably makes things easier for more mundane threats too.

northwest 13y ago

> Freenet is a distributed data storage network designed to prevent censorship, provide anonymity and be hard to block. A very similar solution offering this is http://retroshare.sourceforge.net/ http://retroshare.sourceforge.net/ You get decentralized/p2p encrypted VOIP/chat/messaging/file sharing (written in C++). General intro for "darknet" solutions: https://en.wikipedia.org/wiki/Darknet_%28file_sharing%29 https://en.wikipedia.org/wiki/Darknet_%28file_sharing%29

Sami_Lehtinen 13y ago
RetroShare isn't similar to Freenet at all. Please read design & white papers completely for both projects. What I really like about Freenet & GNUnet is the build in distributed efficient caching of data. So even small sites won't go down when there's a global rush.
simgidacav 13y ago
This Retroshare btw looks interesting! --- but why on the earth the Fedora installation links me to Open-suse RPMs? :D
aclevernickname 13y ago
Retroshare is currently the best example of Zawinski's Law[1] one could ask for; We needed a p2p/f2f daemon we could run voip/chat/messaging/file sharing on top of. Instead, we're given this bloated hunk of 1998's software design policies that tries to do everything for us, but do all of it poorly. [1] http://catb.org/jargon/html/Z/Zawinskis-Law.html http://catb.org/jargon/html/Z/Zawinskis-Law.html

stefantalpalaru 13y ago

They are comparing static sites on Freenet with dynamic hidden services on Tor. Sure, hosting many hidden services with the same provider was dumb, but we're talking apples and oranges here.