6 ms·

Teapotnet – Private social network for file sharing and streaming

69 points by kseistrup 13y ago

f_salmon 13y ago
And there's http://retroshare.sourceforge.net/ http://retroshare.sourceforge.net/ - 100% decentralized/p2p (no central server) - (public key) encrypted - open-source - does: file sharing, "emailing", chat, VoIP, forums, etc.
- ekianjo 13y ago
  It has tons of dependencies though.
- hnha 13y ago
  it is impossible to setup and use without deciphering thirdparty guides. and even then it is awkward and painful to use. I wish they would restart with a useable GUI and highly limited but well working feature set.
  - f_salmon 13y ago
    I'm very surprised by your comment. I'm using it on Ubuntu, my family is still on Macs but uses it too. Everybody without the slightest issue. Install was as easy as any other program (Ubuntu and Mac). True, the UI could be more polished, but it's the tech behind that's interesting when you're interested in privacy.
runn1ng 13y ago
Very high buzzword/sentence ratio. How is this conceptually different than, say, RetroShare? edit: also, you keep comparing to DropBox, however, I can't find the crucial info - are the data saved somewhere outside the computer or not? If not, why the comparisons with DropBox?
- hnha 13y ago
  from a quick glance it looks much much better on the usability than retroshare. I wish they would detail their security model though.
- 300bps 13y ago
  I set up Retroshare on my home server and sent details to a dozen coworkers and friends (all in IT) that had previously used IRC / ftp for similar purposes. Not a single one decided to use it after varying degrees of trying it.
  - runn1ng 13y ago
    Yes, retroshare has unusable and confusing GUI, that's why I wrote "conceptually" :)
mknits 13y ago
"Bitdefender Free antivirus has detected a malware on this page". Also Peerblock bloked access to this website.
httpteapot 13y ago
Does it implement RFC 2324? https://tools.ietf.org/html/rfc2324 https://tools.ietf.org/html/rfc2324
- alupo 13y ago
  You would only get error 418 I'm a teapot. For obvious reasons !
lawl 13y ago
>Each friend-to-friend connection is identified by their usernames and a shared secret. Showstopper. I wanted to ASK how this beats retroshare. But without asymmertic keys you're kinda fd. >On session establishment, temporary salted authentication and encryption keys are derived from the shared secret by each peer. The current implementation uses PBKDF2-HMAC-SHA512 (10000 iterations) for key derivation. Please describe in more detail. Form what I read it highly depends in a really good implementation here to provide perfect forward secrecy. >where secret exchange is made on our servers. Then a code is sent to both you and your friend so that your Teapotnet instance can fetch the secret through HTTPS. Why don't you just do (authenticated) diffie hellman? Then your Server wouldn't need to know the key. Sorry but just Form those few sentences i have to assume your crypto is shit and cant be trusted. I'm mobile right now so i didn't look at the source. After that I also probably won't. Edit: german autocorrect while typing english is REALLY annoying. Sorry for all the typos. Edit2: What The fuck? Why are there own sha512 and AES implementations? Use openssl! For nie i'd strongly advise Tod avoid until someone more skilled than me has reviewed this. But für crypto Reilly seems horrible.
- tga_d 13y ago
  Yeah, this looks like exactly the type of software you avoid if you actually need cryptographic security. Non-library versions of cryptographic primitives is a serious WTF, that stuff is abstracted for a reason.
- 300bps 13y ago
  You sure sound angry over a quick review of a new open source project done on your mobile phone.
- bren2013 13y ago
  What I've seen so far isn't a complete waste, but I'm still reviewing since I have nothing better to do this morning. So far I've looked at how a crypto-secure schared secret is established with the "original method." It works just as you would expect. The author even made an attempt to ensure that different pairs of peers using the same input wouldn't generate the same secret by xoring the two usernames together. Of course, collisions are easy to generate and I don't see that the tracker's domain is included anywhere, but no serious attacks come to mind through this vector. I'm not going to bother looking at the Facebook or email methods because the security there reduces to how much you trust your email provider or Facebook. I'll keep updating you guys if anyone cares.
harunurhan 13y ago
Give permisson someone to download data on my computer. Simple as that. I don't understand why they compare themselves to DropBox and Google Drive. Furthermore this helps software/game/music/film... piracy.
- Malician 13y ago
  Frankly, if I imagine a good piece of software for transferring legitimate files, with appropriate privacy/security and a good featureset, it would also be excellent for piracy.
grishma 13y ago
font for questions in your faq page is straining to the eye and impossible to read, you might want to fix that
re1ser 13y ago
Crashes for me upon startup: http://i.imgur.com/OzPT0yA.png http://i.imgur.com/OzPT0yA.png Win7 x64
primitivesuave 13y ago
It seems like nowadays all of these services are trying to one-up each other on privacy and promises of good intention. My parents couldn't care less about their online privacy - they were storing their files by emailing them one-by-one as attachments. Anything is better than that system, so Dropbox really did wonders. This solution is hardly a Dropbox-killer, because its not made for the 99% of people who use email attachments to save their files. I saw an ad for a product Western Digital is coming out with in this realm: http://www.pcmag.com/article2/0,2817,2424967,00.asp http://www.pcmag.com/article2/0,2817,2424967,00.asp the "My Cloud" product itself is apparently total crap, but the idea will certainly be refined to serve a purpose similar to that of teapot. That is, glorified network file access.
infocollector 13y ago
Another private social network (not for file streaming though - there is some media sharing) : http://bit.ly/blibonline http://bit.ly/blibonline
Nux 13y ago
A demo or some screenshots might be nice.
- kseistrup 13y ago
  This is pretty much what the web interface looks like ⌘ http://teapotnet.org/img/screenshot_tpn_total.png http://teapotnet.org/img/screenshot_tpn_total.png
  - Nux 13y ago
    Nice. Screenshots should most definitely be posted somewhere accessible on your web site, they make a big difference.

69 points by kseistrup 13y ago

And there's http://retroshare.sourceforge.net/ http://retroshare.sourceforge.net/ - 100% decentralized/p2p (no central server) - (public key) encrypted - open-source - does: file sharing, "emailing", chat, VoIP, forums, etc.

ekianjo 13y ago
It has tons of dependencies though.
hnha 13y ago
it is impossible to setup and use without deciphering thirdparty guides. and even then it is awkward and painful to use. I wish they would restart with a useable GUI and highly limited but well working feature set.
- f_salmon 13y ago
  I'm very surprised by your comment. I'm using it on Ubuntu, my family is still on Macs but uses it too. Everybody without the slightest issue. Install was as easy as any other program (Ubuntu and Mac). True, the UI could be more polished, but it's the tech behind that's interesting when you're interested in privacy.

runn1ng 13y ago

Very high buzzword/sentence ratio. How is this conceptually different than, say, RetroShare? edit: also, you keep comparing to DropBox, however, I can't find the crucial info - are the data saved somewhere outside the computer or not? If not, why the comparisons with DropBox?

hnha 13y ago
from a quick glance it looks much much better on the usability than retroshare. I wish they would detail their security model though.
300bps 13y ago
I set up Retroshare on my home server and sent details to a dozen coworkers and friends (all in IT) that had previously used IRC / ftp for similar purposes. Not a single one decided to use it after varying degrees of trying it.
- runn1ng 13y ago
  Yes, retroshare has unusable and confusing GUI, that's why I wrote "conceptually" :)

mknits 13y ago

"Bitdefender Free antivirus has detected a malware on this page". Also Peerblock bloked access to this website.

httpteapot 13y ago

Does it implement RFC 2324? https://tools.ietf.org/html/rfc2324 https://tools.ietf.org/html/rfc2324

alupo 13y ago
You would only get error 418 I'm a teapot. For obvious reasons !

lawl 13y ago

>Each friend-to-friend connection is identified by their usernames and a shared secret. Showstopper. I wanted to ASK how this beats retroshare. But without asymmertic keys you're kinda fd. >On session establishment, temporary salted authentication and encryption keys are derived from the shared secret by each peer. The current implementation uses PBKDF2-HMAC-SHA512 (10000 iterations) for key derivation. Please describe in more detail. Form what I read it highly depends in a really good implementation here to provide perfect forward secrecy. >where secret exchange is made on our servers. Then a code is sent to both you and your friend so that your Teapotnet instance can fetch the secret through HTTPS. Why don't you just do (authenticated) diffie hellman? Then your Server wouldn't need to know the key. Sorry but just Form those few sentences i have to assume your crypto is shit and cant be trusted. I'm mobile right now so i didn't look at the source. After that I also probably won't. Edit: german autocorrect while typing english is REALLY annoying. Sorry for all the typos. Edit2: What The fuck? Why are there own sha512 and AES implementations? Use openssl! For nie i'd strongly advise Tod avoid until someone more skilled than me has reviewed this. But für crypto Reilly seems horrible.

tga_d 13y ago
Yeah, this looks like exactly the type of software you avoid if you actually need cryptographic security. Non-library versions of cryptographic primitives is a serious WTF, that stuff is abstracted for a reason.
300bps 13y ago
You sure sound angry over a quick review of a new open source project done on your mobile phone.
bren2013 13y ago
What I've seen so far isn't a complete waste, but I'm still reviewing since I have nothing better to do this morning. So far I've looked at how a crypto-secure schared secret is established with the "original method." It works just as you would expect. The author even made an attempt to ensure that different pairs of peers using the same input wouldn't generate the same secret by xoring the two usernames together. Of course, collisions are easy to generate and I don't see that the tracker's domain is included anywhere, but no serious attacks come to mind through this vector. I'm not going to bother looking at the Facebook or email methods because the security there reduces to how much you trust your email provider or Facebook. I'll keep updating you guys if anyone cares.

harunurhan 13y ago

Give permisson someone to download data on my computer. Simple as that. I don't understand why they compare themselves to DropBox and Google Drive. Furthermore this helps software/game/music/film... piracy.

Malician 13y ago
Frankly, if I imagine a good piece of software for transferring legitimate files, with appropriate privacy/security and a good featureset, it would also be excellent for piracy.

grishma 13y ago

font for questions in your faq page is straining to the eye and impossible to read, you might want to fix that

re1ser 13y ago

Crashes for me upon startup: http://i.imgur.com/OzPT0yA.png http://i.imgur.com/OzPT0yA.png Win7 x64

primitivesuave 13y ago

It seems like nowadays all of these services are trying to one-up each other on privacy and promises of good intention. My parents couldn't care less about their online privacy - they were storing their files by emailing them one-by-one as attachments. Anything is better than that system, so Dropbox really did wonders. This solution is hardly a Dropbox-killer, because its not made for the 99% of people who use email attachments to save their files. I saw an ad for a product Western Digital is coming out with in this realm: http://www.pcmag.com/article2/0,2817,2424967,00.asp http://www.pcmag.com/article2/0,2817,2424967,00.asp the "My Cloud" product itself is apparently total crap, but the idea will certainly be refined to serve a purpose similar to that of teapot. That is, glorified network file access.

infocollector 13y ago

Another private social network (not for file streaming though - there is some media sharing) : http://bit.ly/blibonline http://bit.ly/blibonline

Nux 13y ago

A demo or some screenshots might be nice.

kseistrup 13y ago
This is pretty much what the web interface looks like ⌘ http://teapotnet.org/img/screenshot_tpn_total.png http://teapotnet.org/img/screenshot_tpn_total.png
- Nux 13y ago
  Nice. Screenshots should most definitely be posted somewhere accessible on your web site, they make a big difference.