5 ms·

BitTorrent secures and open-sources DHT bootstrap server

106 points by zodo123 13y ago

steeve 13y ago
Question for the HN crowd: how does one can use DHT/trackerless to not only distribute files, but updates to them too? Sort of like an ever continuing magnet link if you will?
- aroch 13y ago
  BTSync is the obvious "Duh!" answer. Since its UDP traffic, controlled by DHT (so long as you disable their central tracker in your conf) and updates on the fly. What I wind up doing (since I don't trust BTsync) is using inotify to watch the sync directory + mktorrent to create a new torrent on file change + pypush to push the new .torrent to various servers
  - steeve 13y ago
    Yeah but then you end up changing the info hash, and thus your magnet is changed. What I'm trying to do is to basically embed the magnet link in my program and sort of having it self check itself for updates. It that makes sense :)
    - fredsted 13y ago
      Correct me if I'm wrong, but isn't the magnet link a hash of the files? Then it would not be possible to change the files without changing the link.
      - steeve 13y ago
        it is exactly that, unfortunately...
    - dvanduzer 13y ago
      Whether it's helpful for any current efforts using BT infrastructure, there's been a lot of work on this problem since Van Jacobsen sketched the outlines a few years ago: http://named-data.net/ http://named-data.net/
- revelation 13y ago
  Well in theory you can store data for anything in a DHT, not only an infohash. So you could have your program query the DHT for the key "MySoftware-Latest" and store under that key the infohash for the latest version. I don't know how much flexibility there is in popular DHT implementations as to what you can store for a given key, and you will need a server of yours to continuously refresh the data and keep it alive in the DHT.
ritonlajoie 13y ago
A little bit off topic, but I tried to get a developer API key for Bittorrent Sync, and never heard of them. Same thing for Bittorrent Live. Has anyone been successful in getting those ? Also, with the twitch flop (quality of the website, lags, 60 sec delay, PR problems) why don't we hear more about the Live service ?
unsignedint 13y ago
I applied for BTSync API and ended up in my inbox that same night. You may want to ping them in their forum if you aren't receiving one...
- unsignedint 13y ago
  This was meant to be in response to the earlier comment by ritonlajoie. Sorry about confusion posting this on its own...
nly 13y ago
I'm always amazed the BitTorrent DHT infrastructure has been working so well for so long: Real-World Sybil Attacks in BitTorrent Mainline DHT: http://www.cs.helsinki.fi/u/lxwang/publications/security.pdf http://www.cs.helsinki.fi/u/lxwang/publications/security.pdf Crawling BitTorrent DHTs for Fun and Proﬁt: https://jhalderm.com/pub/papers/dht-woot10.pdf https://jhalderm.com/pub/papers/dht-woot10.pdf Proﬁling a Million User DHT: http://www.michaelpiatek.com/papers/dht_imc_falkner.pdf http://www.michaelpiatek.com/papers/dht_imc_falkner.pdf Lying To The Neighbours - Nasty effects with tracker-less BitTorrent: http://events.ccc.de/congress/2010/Fahrplan/events/4210.en.html http://events.ccc.de/congress/2010/Fahrplan/events/4210.en.h...
- oakwhiz 13y ago
  Re: the last link >In the Kademlia adaption for Bittorrent a peer's address (NodeID) is to be generated randomly, or more appropriate: arbitrarily. Because randomness isn't verifiable, an implementation can advertise itself with popular NodeIDs or even change them on a per-packet basis. At the end of the slides they suggest sha1(ip+port) as a possible fix. This would increase the barrier-to-entry of a Sybil attack to the point where an attacker needs to be able to spoof IP addresses or connections. However, I believe that a sufficiently motivated and financially equipped attacker may already exist who would still be able to attack this scheme. Perhaps an alternative to sha1(ip+port) could be some form of cryptographic signature scheme, where the NodeID is a public key or hash of a public key, and a node is only considered "real" if it is at least able to sign responses with the private key that corresponds with the NodeID. Maybe operators of nodes should be allowed to tweak some kind of setting that controls how paranoid the node should be of Sybil attacks. Maybe it would be possible to include some kind of hashcash or Bitcoin scheme to make Sybil attacks more costly. There has to be some way of requiring an attacker to expend considerable computation power.
  - jamii 13y ago
    sha1(ip+port) is tricky in the presence of NAT, since different peers may see your packets as coming from different ip+port pairs.

106 points by zodo123 13y ago

Question for the HN crowd: how does one can use DHT/trackerless to not only distribute files, but updates to them too? Sort of like an ever continuing magnet link if you will?

aroch 13y ago
BTSync is the obvious "Duh!" answer. Since its UDP traffic, controlled by DHT (so long as you disable their central tracker in your conf) and updates on the fly. What I wind up doing (since I don't trust BTsync) is using inotify to watch the sync directory + mktorrent to create a new torrent on file change + pypush to push the new .torrent to various servers
- steeve 13y ago
  Yeah but then you end up changing the info hash, and thus your magnet is changed. What I'm trying to do is to basically embed the magnet link in my program and sort of having it self check itself for updates. It that makes sense :)
  - fredsted 13y ago
    Correct me if I'm wrong, but isn't the magnet link a hash of the files? Then it would not be possible to change the files without changing the link.
    - steeve 13y ago
      it is exactly that, unfortunately...
  - dvanduzer 13y ago
    Whether it's helpful for any current efforts using BT infrastructure, there's been a lot of work on this problem since Van Jacobsen sketched the outlines a few years ago: http://named-data.net/ http://named-data.net/
revelation 13y ago
Well in theory you can store data for anything in a DHT, not only an infohash. So you could have your program query the DHT for the key "MySoftware-Latest" and store under that key the infohash for the latest version. I don't know how much flexibility there is in popular DHT implementations as to what you can store for a given key, and you will need a server of yours to continuously refresh the data and keep it alive in the DHT.

ritonlajoie 13y ago

A little bit off topic, but I tried to get a developer API key for Bittorrent Sync, and never heard of them. Same thing for Bittorrent Live. Has anyone been successful in getting those ? Also, with the twitch flop (quality of the website, lags, 60 sec delay, PR problems) why don't we hear more about the Live service ?

unsignedint 13y ago

I applied for BTSync API and ended up in my inbox that same night. You may want to ping them in their forum if you aren't receiving one...

unsignedint 13y ago
This was meant to be in response to the earlier comment by ritonlajoie. Sorry about confusion posting this on its own...

nly 13y ago

I'm always amazed the BitTorrent DHT infrastructure has been working so well for so long: Real-World Sybil Attacks in BitTorrent Mainline DHT: http://www.cs.helsinki.fi/u/lxwang/publications/security.pdf http://www.cs.helsinki.fi/u/lxwang/publications/security.pdf Crawling BitTorrent DHTs for Fun and Proﬁt: https://jhalderm.com/pub/papers/dht-woot10.pdf https://jhalderm.com/pub/papers/dht-woot10.pdf Proﬁling a Million User DHT: http://www.michaelpiatek.com/papers/dht_imc_falkner.pdf http://www.michaelpiatek.com/papers/dht_imc_falkner.pdf Lying To The Neighbours - Nasty effects with tracker-less BitTorrent: http://events.ccc.de/congress/2010/Fahrplan/events/4210.en.html http://events.ccc.de/congress/2010/Fahrplan/events/4210.en.h...

oakwhiz 13y ago
Re: the last link >In the Kademlia adaption for Bittorrent a peer's address (NodeID) is to be generated randomly, or more appropriate: arbitrarily. Because randomness isn't verifiable, an implementation can advertise itself with popular NodeIDs or even change them on a per-packet basis. At the end of the slides they suggest sha1(ip+port) as a possible fix. This would increase the barrier-to-entry of a Sybil attack to the point where an attacker needs to be able to spoof IP addresses or connections. However, I believe that a sufficiently motivated and financially equipped attacker may already exist who would still be able to attack this scheme. Perhaps an alternative to sha1(ip+port) could be some form of cryptographic signature scheme, where the NodeID is a public key or hash of a public key, and a node is only considered "real" if it is at least able to sign responses with the private key that corresponds with the NodeID. Maybe operators of nodes should be allowed to tweak some kind of setting that controls how paranoid the node should be of Sybil attacks. Maybe it would be possible to include some kind of hashcash or Bitcoin scheme to make Sybil attacks more costly. There has to be some way of requiring an attacker to expend considerable computation power.
- jamii 13y ago
  sha1(ip+port) is tricky in the presence of NAT, since different peers may see your packets as coming from different ip+port pairs.