5 ms·

I'm building a distributed network, called Aether, that allows people to create and participate in reddit-like forums anonymously. It's fully encrypted. Take a

I'm building a distributed network, called Aether, that allows people to create and participate in reddit-like forums anonymously. It's fully encrypted. Take a look at http://www.getaether.net http://www.getaether.net It's cool because: * It's anonymous. The posts jump from one node to another with no author information except a nickname. They cannot be traced back to the origin. * It's encrypted with TLS_RSA_WITH_AES_256_CBC_SHA cipher suite using 2048bit RSA keys. The connections most likely cannot be eavesdropped. * It gives people an unfiltered, unmodified feed of information directly from the sources, with no intervention or censorship. * It's unmoderated, so there is nobody that's deciding what you should and should not see. You can block people, however. Every client has a threshold of blocks for each node after which it stops showing that node to the user. * Zero infrastructure. This is a tool that can be used to either experience / exercise full free speech here in the west, or can be used for more essential two-way mass communication purposes where other venues are blocked, banned or self-censoring.

wfn 13y ago
The thing that you're working on falls within the area of 'truly relevant and important [to our times, etc.] software', IMO. Very nice and interesting indeed. I didn't notice any mention of an adversary model, do you have one? (cf. e.g. http://tor.stackexchange.com/questions/27/how-does-tors-threat-model-differ-from-i2ps-threat-model/277#277 http://tor.stackexchange.com/questions/27/how-does-tors-thre...) How transport-agnostic is the system aiming to be? Could it be used in combination with Tor/I2P/etc. (as an underlying transport/anonymization mechanism)? (cf. http://syndie.de/ http://syndie.de/) Overall, this is very interesting indeed.
- rolleiflex 13y ago
  Adversary model is pretty simple: If you have a computer that's not compromised (your keys are not copied, there is no keylogger), you should be anonymous at the point you post. A global passive adversary would be able to pinpoint the origin of posts if they had access to the wire-level data if posts were sent in cleartext, but all the connections are encrypted with TLS, so that's impossible. With no physical access, Aether should be pretty much unbreakable (I hope I won't have to eat this later) barring external vectors (keyloggers, rootkits etc). If they have access to your computer, there are two possibilities, depending on your settings. If you have left locally flagging own posts as such enabled (the default setting), it will identify the posts you have created. But if you explicitly disabled that option, even that does not incriminate you: your node is just another node that might have been touched by that post. The reason I have that 'own post' flag is that it is the only way I can show or notify the user about the replies he / she receives. This is kind of an important ability, otherwise I wouldn't have even given the option to flag. It's a tradeoff between user experience and security: I am trying to protect proper citizens from eavesdropping, but I'm not interested in protecting criminals in case of computer seizure. The only reason I have protections against that kind of threat also is the possibility of people in less fortunate countries (where bar for seizure is low) getting their computers seized because of their exercise of free speech. For the transport: so long as you have an IP address that the remote node can contact you back, it will work. It does not matter if it's Tor, I2P or whatever. Granted, I did not try actually doing this yet, but there is no reason it should not work.
  - wfn 13y ago
    Thanks for your kind reply. Adversary model makes sense. I think security/privacy folk like reading up on them for a given project they might be curious about, perhaps consider putting this on the site? > A global passive adversary would be able to pinpoint the origin of posts if they had access to the wire-level data if posts were sent in cleartext, but all the connections are encrypted with TLS, so that's impossible. How about timing correlation attacks, etc.? (Basically, all the attack vectors Tor people should be afraid of?) Do the posts have timestamps attached to them? If yes, wouldn't a GPA (or, for that matter, a local ISP) be able to correlate certain node activity with posts? > If you have left locally flagging own posts as such enabled (the default setting), it will identify the posts you have created. But if you explicitly disabled that option, even that does not incriminate you: your node is just another node that might have been touched by that post. This seems like a very nice feature / piece of design, cool. > The reason I have that 'own post' flag is that it is the only way I can show or notify the user about the replies he / she receives. Have you considered abstracting this to 'subscribe to this post/thread and be notified of any replies' functionality? (anyone could subscribe to posts, then (presumably with read access / however it works.)) > The only reason I have protections against that kind of threat also is the possibility of people in less fortunate countries (where bar for seizure is low) getting their computers seized because of their exercise of free speech. As far as I'm aware, there are indeed instances when people get their equipment seized, and upon detection of sensitive (to the regime/power/$thing) data, bad things may happen. That's why Tor is very careful about what it writes to disk, etc. Overall, thanks for your work, I'll try and follow the news and maybe take a look at the code. Good luck!
    - rolleiflex 13y ago
      > Adversary model makes sense. I think security/privacy folk like reading up on them for a given project they might be curious about, perhaps consider putting this on the site? I probably should put this out, yes. I'm the only person to have ever worked on Aether, I'm the architect, the builder, the designer and the coder (lately trying to be also the cheerleader, too) so I have a long list of stuff to do at all times! Currently I'm working on getting Windows version to work (it's working, I just need to make it work without asking administrator privileges), then I need to have some stability improvements on synchronization process—there are some subtle bugs and sync process sometimes gets stuck at indeterminate intervals, so I absolutely have no idea what's going on. I need to test for this. The app recovers from such errors, but it shouldn't happen in the first place. I'll eventually come up to start writing blog posts. > Have you considered abstracting this to 'subscribe to this post/thread and be notified of any replies' functionality? (anyone could subscribe to posts, then (presumably with read access / however it works.)) This might be a little bit too much for large threads, but it might be a good surrogate for missing reply notification functionality. Thanks for the encouragement, I would love to hear what you think after you used it!
scottlilly 13y ago
I was thinking about doing something similar. One of the things I wanted to incorporate was an reputation ability (beyond just blocking). It would be similar to a referral engine in Netflix or Amazon. So, I'm user A. I mark user B as a high-value poster. User B marks user C as a high-value poster. When I run across a post by user C, I see they have a good reputation. If many people I ranked as high-value, also ranked user C as high-value, then I see user C as having a very high reputation. The same, in reverse, for low-value posters.
- meemoo 13y ago
  Are there any link voting sites on the public web that have tried this? I'd love it if YouTube comments worked like this. Why don't they?
  - tprice7 13y ago
    I made a site a while ago that acts this way. Basically when a person vouches for another person or post it creates a metaphorical one-way electrical resistor from the person to the other person or post. Then it ranks posts by connecting you to one end of a battery and all posts to the other end of the battery and ranking posts by how much current flows through them. It is at thoughtocean.com. Pretty dead now though.
- rolleiflex 13y ago
  This is cool, but you're making assumptions about information that is outside of your immediate connections. This could work in a network where one could trust that all the information one receives from immediate connections about others is true, but that is not the case. In your case, user B could mark everybody as a high value poster, and it be successful in diverting your attention. This causes problems even in the core stack, I cannot believe what a node B will say about at what IP address node C is. A malicious node B could overwrite everybody's node information to one single IP address to create a massive DDoS. So the solution I found is that there are separate degrees of trust for derived and produced information. If you receive something over the network about a third party, that's derived information, which might not essentially be true. But if you have connected to that node personally, that's produced information, and no derived information can overwrite that.
616c 13y ago
Very interesting stuff. What are your thoughts on the I2P darknet, the Syndicate system, and why are they inadequate in your opinion?
- rolleiflex 13y ago
  I do appreciate their existence, but Aether is something different: it requires no configuration, and it tries to do one thing, and do it well. This is not a darknet. There is only two things you can do in Aether, to read and to write text. This is an intentional restriction that shapes all the design decisions. This is closer to BitTorrent than Tor.
  - 616c 13y ago
    Very cool. I guess I need to invest time in this. Why must people keep producing such cool work and consuming my time. :-)
frank_boyd 13y ago
You get this kind of forums with http://retroshare.sourceforge.net/ http://retroshare.sourceforge.net/ - it's a part of the "encrypted and distributed communication suite". Quickly growing community.
- rolleiflex 13y ago
  This is cool. One difference is that I am not making any assumptions about your peers being your friends. Aether is designed to face you with strangers.
kolev 13y ago
Unfortunately, it does not work on Mavericks. The screens are totally messed up, past 3rd steps, you cannot read anything in the forms.
- rolleiflex 13y ago
  I'm aware of this, unfortunately. This is a bug in Qt's Webkit. The font rendering on Mac OS changed in Mavericks, and it apparently does not work well with versions of Webkit prior to Mavericks release. I have to wait until this issue gets resolved. Here's the issue, if you want to take a look: https://bugreports.qt-project.org/browse/QTBUG-34332 https://bugreports.qt-project.org/browse/QTBUG-34332
  - kolev 13y ago
    It looks great so far. Will patiently wait for a fix!
    - rolleiflex 13y ago
      Thanks! If there is no motion from Qt's side till this Friday, I will release a no-webfonts version that fixes most of the glitches. The bug only happens when webfonts are used.
jreed91 13y ago
Couldn't get your site to load on my ipad, constantly crashes safari.
- rolleiflex 13y ago
  Sorry to hear that. Your iPad is running out of memory because of retina imagery, my iPad 3 works fine. I'll change it to serve non-retina assets to mobile devices, thanks for the notification.
  - jreed91 13y ago
    I figured it was the retina imagery, dang iPad mini and its lack of RAM

wfn 13y ago

The thing that you're working on falls within the area of 'truly relevant and important [to our times, etc.] software', IMO. Very nice and interesting indeed. I didn't notice any mention of an adversary model, do you have one? (cf. e.g. http://tor.stackexchange.com/questions/27/how-does-tors-threat-model-differ-from-i2ps-threat-model/277#277 http://tor.stackexchange.com/questions/27/how-does-tors-thre...) How transport-agnostic is the system aiming to be? Could it be used in combination with Tor/I2P/etc. (as an underlying transport/anonymization mechanism)? (cf. http://syndie.de/ http://syndie.de/) Overall, this is very interesting indeed.

rolleiflex 13y ago
Adversary model is pretty simple: If you have a computer that's not compromised (your keys are not copied, there is no keylogger), you should be anonymous at the point you post. A global passive adversary would be able to pinpoint the origin of posts if they had access to the wire-level data if posts were sent in cleartext, but all the connections are encrypted with TLS, so that's impossible. With no physical access, Aether should be pretty much unbreakable (I hope I won't have to eat this later) barring external vectors (keyloggers, rootkits etc). If they have access to your computer, there are two possibilities, depending on your settings. If you have left locally flagging own posts as such enabled (the default setting), it will identify the posts you have created. But if you explicitly disabled that option, even that does not incriminate you: your node is just another node that might have been touched by that post. The reason I have that 'own post' flag is that it is the only way I can show or notify the user about the replies he / she receives. This is kind of an important ability, otherwise I wouldn't have even given the option to flag. It's a tradeoff between user experience and security: I am trying to protect proper citizens from eavesdropping, but I'm not interested in protecting criminals in case of computer seizure. The only reason I have protections against that kind of threat also is the possibility of people in less fortunate countries (where bar for seizure is low) getting their computers seized because of their exercise of free speech. For the transport: so long as you have an IP address that the remote node can contact you back, it will work. It does not matter if it's Tor, I2P or whatever. Granted, I did not try actually doing this yet, but there is no reason it should not work.
- wfn 13y ago
  Thanks for your kind reply. Adversary model makes sense. I think security/privacy folk like reading up on them for a given project they might be curious about, perhaps consider putting this on the site? > A global passive adversary would be able to pinpoint the origin of posts if they had access to the wire-level data if posts were sent in cleartext, but all the connections are encrypted with TLS, so that's impossible. How about timing correlation attacks, etc.? (Basically, all the attack vectors Tor people should be afraid of?) Do the posts have timestamps attached to them? If yes, wouldn't a GPA (or, for that matter, a local ISP) be able to correlate certain node activity with posts? > If you have left locally flagging own posts as such enabled (the default setting), it will identify the posts you have created. But if you explicitly disabled that option, even that does not incriminate you: your node is just another node that might have been touched by that post. This seems like a very nice feature / piece of design, cool. > The reason I have that 'own post' flag is that it is the only way I can show or notify the user about the replies he / she receives. Have you considered abstracting this to 'subscribe to this post/thread and be notified of any replies' functionality? (anyone could subscribe to posts, then (presumably with read access / however it works.)) > The only reason I have protections against that kind of threat also is the possibility of people in less fortunate countries (where bar for seizure is low) getting their computers seized because of their exercise of free speech. As far as I'm aware, there are indeed instances when people get their equipment seized, and upon detection of sensitive (to the regime/power/$thing) data, bad things may happen. That's why Tor is very careful about what it writes to disk, etc. Overall, thanks for your work, I'll try and follow the news and maybe take a look at the code. Good luck!
  - rolleiflex 13y ago
    > Adversary model makes sense. I think security/privacy folk like reading up on them for a given project they might be curious about, perhaps consider putting this on the site? I probably should put this out, yes. I'm the only person to have ever worked on Aether, I'm the architect, the builder, the designer and the coder (lately trying to be also the cheerleader, too) so I have a long list of stuff to do at all times! Currently I'm working on getting Windows version to work (it's working, I just need to make it work without asking administrator privileges), then I need to have some stability improvements on synchronization process—there are some subtle bugs and sync process sometimes gets stuck at indeterminate intervals, so I absolutely have no idea what's going on. I need to test for this. The app recovers from such errors, but it shouldn't happen in the first place. I'll eventually come up to start writing blog posts. > Have you considered abstracting this to 'subscribe to this post/thread and be notified of any replies' functionality? (anyone could subscribe to posts, then (presumably with read access / however it works.)) This might be a little bit too much for large threads, but it might be a good surrogate for missing reply notification functionality. Thanks for the encouragement, I would love to hear what you think after you used it!

scottlilly 13y ago

I was thinking about doing something similar. One of the things I wanted to incorporate was an reputation ability (beyond just blocking). It would be similar to a referral engine in Netflix or Amazon. So, I'm user A. I mark user B as a high-value poster. User B marks user C as a high-value poster. When I run across a post by user C, I see they have a good reputation. If many people I ranked as high-value, also ranked user C as high-value, then I see user C as having a very high reputation. The same, in reverse, for low-value posters.

meemoo 13y ago
Are there any link voting sites on the public web that have tried this? I'd love it if YouTube comments worked like this. Why don't they?
- tprice7 13y ago
  I made a site a while ago that acts this way. Basically when a person vouches for another person or post it creates a metaphorical one-way electrical resistor from the person to the other person or post. Then it ranks posts by connecting you to one end of a battery and all posts to the other end of the battery and ranking posts by how much current flows through them. It is at thoughtocean.com. Pretty dead now though.
rolleiflex 13y ago
This is cool, but you're making assumptions about information that is outside of your immediate connections. This could work in a network where one could trust that all the information one receives from immediate connections about others is true, but that is not the case. In your case, user B could mark everybody as a high value poster, and it be successful in diverting your attention. This causes problems even in the core stack, I cannot believe what a node B will say about at what IP address node C is. A malicious node B could overwrite everybody's node information to one single IP address to create a massive DDoS. So the solution I found is that there are separate degrees of trust for derived and produced information. If you receive something over the network about a third party, that's derived information, which might not essentially be true. But if you have connected to that node personally, that's produced information, and no derived information can overwrite that.

616c 13y ago

Very interesting stuff. What are your thoughts on the I2P darknet, the Syndicate system, and why are they inadequate in your opinion?

rolleiflex 13y ago
I do appreciate their existence, but Aether is something different: it requires no configuration, and it tries to do one thing, and do it well. This is not a darknet. There is only two things you can do in Aether, to read and to write text. This is an intentional restriction that shapes all the design decisions. This is closer to BitTorrent than Tor.
- 616c 13y ago
  Very cool. I guess I need to invest time in this. Why must people keep producing such cool work and consuming my time. :-)

frank_boyd 13y ago

You get this kind of forums with http://retroshare.sourceforge.net/ http://retroshare.sourceforge.net/ - it's a part of the "encrypted and distributed communication suite". Quickly growing community.

rolleiflex 13y ago
This is cool. One difference is that I am not making any assumptions about your peers being your friends. Aether is designed to face you with strangers.

kolev 13y ago

Unfortunately, it does not work on Mavericks. The screens are totally messed up, past 3rd steps, you cannot read anything in the forms.

rolleiflex 13y ago
I'm aware of this, unfortunately. This is a bug in Qt's Webkit. The font rendering on Mac OS changed in Mavericks, and it apparently does not work well with versions of Webkit prior to Mavericks release. I have to wait until this issue gets resolved. Here's the issue, if you want to take a look: https://bugreports.qt-project.org/browse/QTBUG-34332 https://bugreports.qt-project.org/browse/QTBUG-34332
- kolev 13y ago
  It looks great so far. Will patiently wait for a fix!
  - rolleiflex 13y ago
    Thanks! If there is no motion from Qt's side till this Friday, I will release a no-webfonts version that fixes most of the glitches. The bug only happens when webfonts are used.

jreed91 13y ago

Couldn't get your site to load on my ipad, constantly crashes safari.

rolleiflex 13y ago
Sorry to hear that. Your iPad is running out of memory because of retina imagery, my iPad 3 works fine. I'll change it to serve non-retina assets to mobile devices, thanks for the notification.
- jreed91 13y ago
  I figured it was the retina imagery, dang iPad mini and its lack of RAM