6 ms·

Trsst: Proposed distributed secure blog platform for the open web

42 points by sinak 13y ago

lukifer 13y ago
I love this idea. A few questions about implementation: - What is the central source of truth for names/identities? - I assume the primary consuming client will be a web browser. Will content be decrypted client-side in the browser, or is one's server node implied to be trusted? The latter could be a security risk. - Are there any constraints on message sizes, and can files be attached? If messages are limited in the blogchain, can they be "stitched together" for longer posts?
liamzebedee 13y ago
Ever since Bitcoin and PRISM became 'mainstream' so to speak, I feel as if the renaissance period of P2P/decentralized communications has been kicked off. This last couple of months I have seen so many projects for decentralized and secure communications, but they all are individual in their own little communities, and it's sad to see such a fragmented space. Now, to comment on the actual project. It seems here that we have another person attempting another decentralized project with a vision but no planning. It can be done, as somewhat shown by Tox [1] which was started off a /g/ thread on 4chan, but I'm not liking it so far. Generally you either start with some innovative ideas and get people to help you develop them, or you develop something and get people to help test it. Nonetheless, I wish the author the best, as we have similar goals. On this note I'd like to end with a plug for my project [2], which is somewhat similar to Trsst but uses a P2P publish-subscribe overlay for distributing messages (it's more of an experiment than a product). [1] - http://tox.im http://tox.im [2] - http://bitweav.org http://bitweav.org
- hijackson 13y ago
  what Nancy explained I am shocked that some people able to earn $4332 in one month on the internet. did you see this…………...http://www.jobs34.com http://www.jobs34.com
  - rhythmvs 13y ago
    SPAM
- venomsnake 13y ago
  It is hard to kick off because for various reasons a lot of end user communication is done on devices locked to various vendors and with software that is "curated" all while the net neutrality has taken a beating in recent years.
- mike-cardwell 13y ago
  I feel like people keep trying to build distributed applications from the ground up, rather than building distributed infrastructure that applications can be built on top of and share. Well, the systems are being developed (cjdns/namecoin etc), but I haven't found any yet that I look at and think, wow yeah, that's usable and could work at Internet scale, I can see that installed and in use on my mums computer. If I'm building an application to allow two people to chat with each other in a p2p fashion, I shouldn't have to worry about how the two chatters will be able to find each other and set up a secure connection. I should just be able to call some OS level API to specify, "try to establish a connection with Person x to use with chat service Y" Basically, we need a way for hosts/people to find each other on the Internet and to exchange keys securely. If/once we have that it will be natural and easy to build any sort of p2p application.
  - amirmc 13y ago
    I'm working on this along with others. Essentially, it's the infrastructure needed to build secure, distributed applications and deals with the problems of identity, connectivity and sync. It needs to be open-source with a permissive licence, otherwise it becomes just another silo. My view is that once the infrastructure is working, we need to start with the core applications of mail, contacts and calendars. Ultimately we can create a platform with something like a distributed app store that makes it easy to use the infrastructure and get it out to end-users. I'm putting together a website that describes the pieces but if you want to know more before then, please send me an email (see profile).
  - dtby 13y ago
    I'm dead on arrival on HN, but I have built this (complete with the concept of "personas") as part of my project to revive USENET.
  - mike-cardwell 13y ago
    dtby: Your comment is hidden as you're account is "dead". I realise you already know this. I would be interested in seeing what you've built... Contact details are in my profile, or you can reply here again.
  - 13y ago
- ds9 13y ago
  Thanks for your efforts. Others are working on similar projects. I'm not sure whether this applies to liamzebedee's concepts (haven't read enough yet) but may apply to the trsst scheme: I just want to point out that there are really three problems to be solved: (a) prevent unintended parties from reading messages - this is handled as well as can be (as far as we know in the present state of things) by strong encryption. It also requires avoidance of reliance on third parties such as CAs. (b) correct identification of intended interlocutors - I believe the CA system, and any central-"authority" system, are worse than useless for this. The only alternative that has a realistic chance at the objectives is a "web of trust" based on side channels, individual judgments about who's who and who's controlling their own keys correctly, and watching keys and behavior of parties for consistency over time. (c) obscuring who's talking to whom. If Alice publishes something on trsst, encrypted for Bob, it may be unreadable by anyone but Bob (assuming 'a' and 'b' are sound) - but if the adversary Nancy has extensive, sophisticated powers throughout the network, then Nancy may be able to track the posting of the message to Alice and the reading of the message to Bob. Then Nancy can track them down and coerce their secret keys, trojan their PCs, or "disappear" them (not in USA, you say? wait for it). If I'm reading this correctly it handles (a) and (b) to some degree but I'm not sure it addresses (c).
unicornporn 13y ago
Related: https://tent.io/ https://tent.io/ https://tent.is/ https://tent.is/
raamdev 13y ago
Like others here, I love this idea; a similar concept has been bouncing around in my head over the past few months in light of NSA-related news. But the thing I keep coming back to in my head is, "how do we get people who know nothing about encryption, or even care that much about being monitored, to use more secure channels?" When I saw the title of this thread, my first thought was, "how could we build something that allows people to run WordPress--already open-source and used by millions--on a distributed secure network?" How could we make 'distributed and secure' easy and stupid-simple for anyone who already knows how to install and use WordPress (or any other open-source software for that matter)? I feel like we're trying to build things from scratch when building better wheels is more practical for the masses who already have vehicles they're comfortable driving. [Edit: FYI, the video on the Kickstarter page makes trsst sound a lot more like a 'social media platform' than a 'blog platform'.]
- ds9 13y ago
  The usability question is crucial for secure comms on a NSA-infested internet - it must be "easy" for non-technical people, but such as to not obscure anything, nor impair configurability, for more astute users. But usability is a posterior issue. The first thing is to get the principles right, then usability can be applied by putting on the right interfaces. And I don't think there is any consensus about a good design yet. See my reply on another comment about the design of this system.
ctz 13y ago
We develop organically: first, we get it working; then we get it working right. The approach to writing security software which launched a thousand defcon talks.

42 points by sinak 13y ago

I love this idea. A few questions about implementation: - What is the central source of truth for names/identities? - I assume the primary consuming client will be a web browser. Will content be decrypted client-side in the browser, or is one's server node implied to be trusted? The latter could be a security risk. - Are there any constraints on message sizes, and can files be attached? If messages are limited in the blogchain, can they be "stitched together" for longer posts?

liamzebedee 13y ago

Ever since Bitcoin and PRISM became 'mainstream' so to speak, I feel as if the renaissance period of P2P/decentralized communications has been kicked off. This last couple of months I have seen so many projects for decentralized and secure communications, but they all are individual in their own little communities, and it's sad to see such a fragmented space. Now, to comment on the actual project. It seems here that we have another person attempting another decentralized project with a vision but no planning. It can be done, as somewhat shown by Tox [1] which was started off a /g/ thread on 4chan, but I'm not liking it so far. Generally you either start with some innovative ideas and get people to help you develop them, or you develop something and get people to help test it. Nonetheless, I wish the author the best, as we have similar goals. On this note I'd like to end with a plug for my project [2], which is somewhat similar to Trsst but uses a P2P publish-subscribe overlay for distributing messages (it's more of an experiment than a product). [1] - http://tox.im http://tox.im [2] - http://bitweav.org http://bitweav.org

hijackson 13y ago
what Nancy explained I am shocked that some people able to earn $4332 in one month on the internet. did you see this…………...http://www.jobs34.com http://www.jobs34.com
- rhythmvs 13y ago
  SPAM
venomsnake 13y ago
It is hard to kick off because for various reasons a lot of end user communication is done on devices locked to various vendors and with software that is "curated" all while the net neutrality has taken a beating in recent years.
mike-cardwell 13y ago
I feel like people keep trying to build distributed applications from the ground up, rather than building distributed infrastructure that applications can be built on top of and share. Well, the systems are being developed (cjdns/namecoin etc), but I haven't found any yet that I look at and think, wow yeah, that's usable and could work at Internet scale, I can see that installed and in use on my mums computer. If I'm building an application to allow two people to chat with each other in a p2p fashion, I shouldn't have to worry about how the two chatters will be able to find each other and set up a secure connection. I should just be able to call some OS level API to specify, "try to establish a connection with Person x to use with chat service Y" Basically, we need a way for hosts/people to find each other on the Internet and to exchange keys securely. If/once we have that it will be natural and easy to build any sort of p2p application.
- amirmc 13y ago
  I'm working on this along with others. Essentially, it's the infrastructure needed to build secure, distributed applications and deals with the problems of identity, connectivity and sync. It needs to be open-source with a permissive licence, otherwise it becomes just another silo. My view is that once the infrastructure is working, we need to start with the core applications of mail, contacts and calendars. Ultimately we can create a platform with something like a distributed app store that makes it easy to use the infrastructure and get it out to end-users. I'm putting together a website that describes the pieces but if you want to know more before then, please send me an email (see profile).
- dtby 13y ago
  I'm dead on arrival on HN, but I have built this (complete with the concept of "personas") as part of my project to revive USENET.
- mike-cardwell 13y ago
  dtby: Your comment is hidden as you're account is "dead". I realise you already know this. I would be interested in seeing what you've built... Contact details are in my profile, or you can reply here again.
- 13y ago
ds9 13y ago
Thanks for your efforts. Others are working on similar projects. I'm not sure whether this applies to liamzebedee's concepts (haven't read enough yet) but may apply to the trsst scheme: I just want to point out that there are really three problems to be solved: (a) prevent unintended parties from reading messages - this is handled as well as can be (as far as we know in the present state of things) by strong encryption. It also requires avoidance of reliance on third parties such as CAs. (b) correct identification of intended interlocutors - I believe the CA system, and any central-"authority" system, are worse than useless for this. The only alternative that has a realistic chance at the objectives is a "web of trust" based on side channels, individual judgments about who's who and who's controlling their own keys correctly, and watching keys and behavior of parties for consistency over time. (c) obscuring who's talking to whom. If Alice publishes something on trsst, encrypted for Bob, it may be unreadable by anyone but Bob (assuming 'a' and 'b' are sound) - but if the adversary Nancy has extensive, sophisticated powers throughout the network, then Nancy may be able to track the posting of the message to Alice and the reading of the message to Bob. Then Nancy can track them down and coerce their secret keys, trojan their PCs, or "disappear" them (not in USA, you say? wait for it). If I'm reading this correctly it handles (a) and (b) to some degree but I'm not sure it addresses (c).

unicornporn 13y ago

Related: https://tent.io/ https://tent.io/ https://tent.is/ https://tent.is/

raamdev 13y ago

Like others here, I love this idea; a similar concept has been bouncing around in my head over the past few months in light of NSA-related news. But the thing I keep coming back to in my head is, "how do we get people who know nothing about encryption, or even care that much about being monitored, to use more secure channels?" When I saw the title of this thread, my first thought was, "how could we build something that allows people to run WordPress--already open-source and used by millions--on a distributed secure network?" How could we make 'distributed and secure' easy and stupid-simple for anyone who already knows how to install and use WordPress (or any other open-source software for that matter)? I feel like we're trying to build things from scratch when building better wheels is more practical for the masses who already have vehicles they're comfortable driving. [Edit: FYI, the video on the Kickstarter page makes trsst sound a lot more like a 'social media platform' than a 'blog platform'.]

ds9 13y ago
The usability question is crucial for secure comms on a NSA-infested internet - it must be "easy" for non-technical people, but such as to not obscure anything, nor impair configurability, for more astute users. But usability is a posterior issue. The first thing is to get the principles right, then usability can be applied by putting on the right interfaces. And I don't think there is any consensus about a good design yet. See my reply on another comment about the design of this system.

ctz 13y ago

We develop organically: first, we get it working; then we get it working right. The approach to writing security software which launched a thousand defcon talks.