Re: [tor-talk] Facebook brute forcing hidden services

tigrutigru＠gmail.com

2 Nov 2014 2 Nov '14

1:17 a.m.

I've been to FSCONS today session: "Blurry line between private service and public infrastructure" covering a problem with decentralised, federated services and platforms which can be used as an alternative to FB. There are many (Diaspora, Frendica, GNU social etc) , but use incompatible protocols, making it hard for users to choose, and fragmenting the community, making it look weak and small. Another problem is that most of them don't have client API's and do have a sorry-looking interface. However, if those platforms would be compatible and talk to each other - in a session it was called "The Federation", this problem of fragmentation and poor user database is solved. So far is the most promising solution I heard which can help to get people of Facebook hook, or at least use it when absolutely necessary, not to post your entire life on it. Most "evil" services we use, just need a decent easy to use functional alternative. In the actual lecture the federation of decentralised social networks is described from the 28th minute https://m.youtube.com/watch?v=R_uvYp3fog4

...

On 1 Nov 2014, at 17:00, cypherpunks-request@cpunks.org wrote:

Re: [tor-talk] Facebook brute forcing hidden services

Attachments:

attachment.html (text/html — 2.4 KB)

Show replies by date

rysiek

2 Nov 2 Nov

9:33 a.m.

New subject: [tor-talk] Facebook brute forcing hidden services

Dnia niedziela, 2 listopada 2014 02:17:50 tigrutigru@gmail.com pisze:

...

I've been to FSCONS today session: "Blurry line between private service and public infrastructure" covering a problem with decentralised, federated services and platforms which can be used as an alternative to FB.

Well hullo tharr. :)

...

There are many (Diaspora, Frendica, GNU social etc) , but use incompatible protocols, making it hard for users to choose, and fragmenting the community, making it look weak and small.

Well, Diaspora, Friendica and Red are already talking to each other with a common protocol; Friendica and StatusNet/GNU Social are also compatible. So The Federation (as was proposed to name the common network-of-social-networs) is already based on 4 different networks; others are finally starting to think about getting on the interoperability bandwagon. Compare and contrast to what was going on 2 years ago: http://lists.w3.org/Archives/Public/public-fedsocweb/2013May/0058.html Tl;dr of that thread is "not invented here, impossiburu, we won't bother". Methinks we've done some progress.

...

Another problem is that most of them don't have client API's and do have a sorry-looking interface.

Well, Diaspora's interface is really fine these days. Friendica needs a lot of love; Red I don't personally know. Lack of client API is a huge problem, though. Here's a nice poll about what users want/need: https://joindiaspora.com/posts/4304242 Client API wins hands down.

...

However, if those platforms would be compatible and talk to each other - in a session it was called "The Federation", this problem of fragmentation and poor user database is solved.

Well, as I said, Diaspora, Friendica, Red and GNU Social are already talking with each other with common protocols.

...

So far is the most promising solution I heard which can help to get people of Facebook hook, or at least use it when absolutely necessary, not to post your entire life on it.

Thanks; I was just describing what was happening on the libre side of social networking.

...

Most "evil" services we use, just need a decent easy to use functional alternative.

That's the crux, right after getting a common protocol implemented across different federated social networks. Also consider: http://rys.io/en/88

...

In the actual lecture the federation of decentralised social networks is described from the 28th minute https://m.youtube.com/watch?v=R_uvYp3fog4

And here are the slides: http://rys.io/static/Blurry-line-between-private-service-and-public-infrastr... http://rys.io/static/Blurry-line-between-private-service-and-public-infrastr... Also, please join us at The Federation Assembly at #31C3: https://events.ccc.de/congress/2014/wiki/Assembly:The_Federation -- Pozdr rysiek

rysiek

10:30 a.m.

New subject: [tor-talk] Facebook brute forcing hidden services

Also, my previous talk (at #30C3) about social network monopolies is here: http://media.ccc.de/browse/congress/2013/30C3_-_5319_-_en_-_saal_g_-_2013122... Slides: http://rys.io/static/technomonopolies-30c3.odp I need to write both up so they are not only on video, I guess. -- Pozdr rysiek

edhelas

11:19 a.m.

New subject: [tor-talk] Facebook brute forcing hidden services

I can resume this fragmentation issue by a simple sentence that I'm saying more and more these days : "If you have a problem, do not write an API, write a protocol". The social federation protocol is already here : it's XMPP. And yes it can support everything a social network has to offer (feeds, subscriptions, profiles, contact list…). There is already millions of users on the XMPP network, and you can easily find several clients on all the plateforms for it. I'm working since 2008 on the Movim project (https://movim.eu/), to build a full, good looking, "decentralized" (federated) and open source social network on XMPP. And believe me, yes it's possible. I like the link that the guy made in the presentation with Firefox. Why Firefox surpassed IE ? Because they just choose to implement the W3C standards and try to improve it (and they offer some nice features too). Diaspora, GNU Social, Friendica are not trying to do that, they create their own "proprietary" protocol to talk between each other and after that face the same issues than all the others network : "Hey, we are not compatibles ! Lets create an API and the other networks will be compatible with us". So keep calm and implement XMPP ;) Tim On dim., nov. 2, 2014 at 2:17 , tigrutigru@gmail.com wrote:

...

I've been to FSCONS today session: "Blurry line between private service and public infrastructure" covering a problem with decentralised, federated services and platforms which can be used as an alternative to FB.

There are many (Diaspora, Frendica, GNU social etc) , but use incompatible protocols, making it hard for users to choose, and fragmenting the community, making it look weak and small. Another problem is that most of them don't have client API's and do have a sorry-looking interface.

However, if those platforms would be compatible and talk to each other - in a session it was called "The Federation", this problem of fragmentation and poor user database is solved.

So far is the most promising solution I heard which can help to get people of Facebook hook, or at least use it when absolutely necessary, not to post your entire life on it.

Most "evil" services we use, just need a decent easy to use functional alternative.

In the actual lecture the federation of decentralised social networks is described from the 28th minute https://m.youtube.com/watch?v=R_uvYp3fog4

On 1 Nov 2014, at 17:00, cypherpunks-request@cpunks.org wrote:

...
Re: [tor-talk] Facebook brute forcing hidden services

rysiek

11:53 a.m.

New subject: [tor-talk] Facebook brute forcing hidden services

Dnia niedziela, 2 listopada 2014 12:19:24 edhelas pisze:

...

The social federation protocol is already here : it's XMPP. And yes it can support everything a social network has to offer (feeds, subscriptions, profiles, contact list…). There is already millions of users on the XMPP network, and you can easily find several clients on all the plateforms for it.

I'm working since 2008 on the Movim project (https://movim.eu/),

So, I'm having a painful flashback from: http://lists.w3.org/Archives/Public/public-fedsocweb/2013May/0058.html And my answer to this is: whatever floats your boat. The biggest problem right now is the network effect and fragmentation, XMPP crowd (are you compatible with BuddyCloud, for example?) does not seem to help out in this department, so I'm going to promote The Federation, because it already has the userbase and it already federates between several networks. I have no particular preference of a particular protocol. The Federation already federates, and that's what counds. Please, let's not repeat the discussion I just linked, though. -- Pozdr rysiek

rysiek

1:37 p.m.

New subject: [tor-talk] Facebook brute forcing hidden services

Hi, okay, fuck that, I'm going to dive in, because the level of FUD is strong in this one. Dnia niedziela, 2 listopada 2014 12:19:24 edhelas pisze:

...

I can resume this fragmentation issue by a simple sentence that I'm saying more and more these days : "If you have a problem, do not write an API, write a protocol".

Sure: https://xkcd.com/927/ I don't understand why we need over9000 different, incompatible federated social web protocols. It would seem to me we need *ONE* with several *GOOD* implementations.

...

The social federation protocol is already here : it's XMPP. And yes it can support everything a social network has to offer (feeds, subscriptions, profiles, contact list…). There is already millions of users on the XMPP network, and you can easily find several clients on all the plateforms for it.

I'm working since 2008 on the Movim project (https://movim.eu/), to build a full, good looking, "decentralized" (federated) and open source social network on XMPP. And believe me, yes it's possible.

I won't discuss that. I will however point out that "possible" is not enough.

...

I like the link that the guy made in the presentation with Firefox. Why Firefox surpassed IE ? Because they just choose to implement the W3C standards and try to improve it (and they offer some nice features too).

Absolutely.

...

Diaspora, GNU Social, Friendica are not trying to do that, they create their own "proprietary" protocol

Oh, wow. Do you even understand the words that you use? I mean, "proprietary"? It's documented, the code is open, the protocol has at least two FLOSS implementations. Seriously, what were you trying to achieve here?

...

to talk between each other and after that face the same issues than all the others network : "Hey, we are not compatibles ! Lets create an API and the other networks will be compatible with us".

No. They created a protocol that other networks implement. For example Friendica implements GNU Social's protocol, Diaspora's protocol and their own (documented, opensourced) protocol. Red similarily. Reading a bit on it would be a good idea.

...

So keep calm and implement XMPP ;)

No. Come to The Federation assembly at #31C3, get involved in a more meaningful way than calling open protocols "proprietary" just because you don't know them, and try working with quite a few projects that already cooperate and federate with common *protocols* (not APIs). The question is not "which protocol is better", because while we bikeshed on this question, people are still sitting on Failbroke and Shitter, instead of moving out of these walled gardens. The question is: "how can we *cooperate* to get people on the libre, federated side of social networks". 1.5 year ago I submitted to all the fedsocnet devs a simple question, here's the link again: http://lists.w3.org/Archives/Public/public-fedsocweb/2013May/0058.html The answer was: "impossiburu, we won't, not invented here, my protocol is better than yours". So instead of trying to herd those cats, I am grabbing the opportunity arising from the fact that we already have The Federation. Let's expand it and build upon it, eh? Shouting "XMPP! XMPP!" is not helping. -- Pozdr rysiek

edhelas

6:10 p.m.

New subject: [tor-talk] Facebook brute forcing hidden services

On dim., nov. 2, 2014 at 2:37 , rysiek wrote:

...

Hi,

okay, fuck that, I'm going to dive in, because the level of FUD is strong in this one.

Well, thanks :)

...

Dnia niedziela, 2 listopada 2014 12:19:24 edhelas pisze:

...
I can resume this fragmentation issue by a simple sentence that I'm saying more and more these days : "If you have a problem, do not write an API, write a protocol".

Sure: https://xkcd.com/927/

I don't understand why we need over9000 different, incompatible federated social web protocols. It would seem to me we need *ONE* with several *GOOD* implementations.

...
The social federation protocol is already here : it's XMPP. And yes it can support everything a social network has to offer (feeds, subscriptions, profiles, contact list…). There is already millions of users on the XMPP network, and you can easily find several clients on all the plateforms for it.

I'm working since 2008 on the Movim project (https://movim.eu/), to build a full, good looking, "decentralized" (federated) and open source social network on XMPP. And believe me, yes it's possible.

I won't discuss that. I will however point out that "possible" is not enough.

It's possible to push it forward and try to not reinvent the wheel again and again by creating a new protocol.

...

...
I like the link that the guy made in the presentation with Firefox. Why Firefox surpassed IE ? Because they just choose to implement the W3C standards and try to improve it (and they offer some nice features too).

Absolutely.

...
Diaspora, GNU Social, Friendica are not trying to do that, they create their own "proprietary" protocol

Oh, wow. Do you even understand the words that you use? I mean, "proprietary"? It's documented, the code is open, the protocol has at least two FLOSS implementations. Seriously, what were you trying to achieve here?

Ok, the term "proprietary" was a little strong. Of course the sourcecode of theses projects is open. But can you give me any serious documentations (more than a Wiki or some ML links) that can help me to implement properly the Diaspora/Friendica/GNU Social protocols like RFC, IETF stuffs ? A protocol have to be stable in the time, most of theses project just create their own protocol from their need. The Diaspora protocol was re-written already one time (which totally broke the Friendica compatibility at this time), the guys from Status.net moved to Pump.io…

...

...
to talk between each other and after that face the same issues than all the others network : "Hey, we are not compatibles ! Lets create an API and the other networks will be compatible with us".

No. They created a protocol that other networks implement. For example Friendica implements GNU Social's protocol, Diaspora's protocol and their own (documented, opensourced) protocol. Red similarily.

No, they wrote their own protocol for their own project, and someone just try to implement it to try to be compatible. But it's a one way work, the guys from Diaspora will not adapt their protocol to help the guys from Friendica/GNU Social/whatever.

...

Reading a bit on it would be a good idea.

...
So keep calm and implement XMPP ;)

No. Come to The Federation assembly at #31C3, get involved in a more meaningful way than calling open protocols "proprietary" just because you don't know them, and try working with quite a few projects that already cooperate and federate with common *protocols* (not APIs).

The question is not "which protocol is better", because while we bikeshed on this question, people are still sitting on Failbroke and Shitter, instead of moving out of these walled gardens.

The question is: "how can we *cooperate* to get people on the libre, federated side of social networks". 1.5 year ago I submitted to all the fedsocnet devs a simple question, here's the link again: http://lists.w3.org/Archives/Public/public-fedsocweb/2013May/0058.html

The answer was: "impossiburu, we won't, not invented here, my protocol is better than yours". So instead of trying to herd those cats, I am grabbing the opportunity arising from the fact that we already have The Federation. Let's expand it and build upon it, eh?

What is your plan with The Federation ? To build a project to help all theses project to talk each others and find a way to "standardize" the communications between them to be compatible with eachothers ? Then you will define some basic schema of authentication/packet format (JSON/HTML/XML…)/global architecture… In the end it will looks like this : https://xkcd.com/927/ If your aim is to ask theses project to have a public API to share stuffs between their different servers, well good luck.

...

Shouting "XMPP! XMPP!" is not helping.

No, but I prefer to contribute and improve a 15 years old protocol, with millions of users and hundred of implementations, managed by a strong Fundation that works with the IETF than on a 4 yo protocol implented by ~2 project where all the documentation you can find on it is here https://wiki.diasporafoundation.org/Federation_protocol_overview.

...

-- Pozdr rysiek

rysiek

6:35 p.m.

New subject: [tor-talk] Facebook brute forcing hidden services

Dnia niedziela, 2 listopada 2014 19:10:46 piszesz:

...

...
okay, fuck that, I'm going to dive in, because the level of FUD is strong in this one.

Well, thanks :)

Always a pleasure.

...

...
The question is not "which protocol is better", because while we bikeshed on this question, people are still sitting on Failbroke and Shitter, instead of moving out of these walled gardens.

The question is: "how can we *cooperate* to get people on the libre, federated side of social networks". 1.5 year ago I submitted to all the fedsocnet devs a simple question, here's the link again: http://lists.w3.org/Archives/Public/public-fedsocweb/2013May/0058.html

The answer was: "impossiburu, we won't, not invented here, my protocol is better than yours". So instead of trying to herd those cats, I am grabbing the opportunity arising from the fact that we already have The Federation. Let's expand it and build upon it, eh?

What is your plan with The Federation ? To build a project to help all theses project to talk each others and find a way to "standardize" the communications between them to be compatible with eachothers ?

No. To have a single name for these few federated social networks that already federate with each other. So that instead of saying "do you have a Diaspora/Friendica/Red/GNU Social account?" one can say "do you have a The Federation account?" Because this will: - make it easier for the normal users to join ("just choose any of these, they're compatible") - make it more interesting for developers of other free federated social networks to get compatible with The Federation ("it's not a single project, a few of them got together already, why not join the happy bunch") And in the end it's all about this: http://en.wikipedia.org/wiki/Network_effect Each of these projects in itself is too small to get users' attention; together they have much more chance of that.

...

Then you will define some basic schema of authentication/packet format (JSON/HTML/XML…)/global architecture… In the end it will looks like this : https://xkcd.com/927/

Nobody needs nor wants to define nor create any new protocols. The protocols are already there: that's what Diaspora, Friendica, Red and GNU Social use to talk to each other. The ONLY aim of calling it with a collective name is to make it seen as a single, huge, federated-and-federating distributed social network. And to get the ball rolling on more social networks joining-in and federating.

...

If your aim is to ask theses project to have a public API to share stuffs between their different servers, well good luck.

They already do. They implement each others' protocols. Nobody has to do anything there. I have a Diaspora account and have added friends from Friendica and Red servers. But thanks anyway.

...

...
Shouting "XMPP! XMPP!" is not helping.

No, but I prefer to contribute and improve a 15 years old protocol, with millions of users and hundred of implementations, managed by a strong Fundation that works with the IETF than on a 4 yo protocol implented by ~2 project where all the documentation you can find on it is here https://wiki.diasporafoundation.org/Federation_protocol_overview.

"I guess I'll leave that one until you answer Meredith" would be one answer. "I prefer to contribute and improve a ~40 years old protocol with billions of users and thousands of implementations (...)" and direct you to e-mail (which allows you to share photos and info with your friends, after all), would be another, admittedly snarky. "So how is JID/Jingle client and server implementation work going", would be yet another. "You're very welcome to join The Federation, if you'd like; the easiest way to do this would be to either help The Federation projects implement your protocol, or implement one of their protocols in your software; in return you'll get a huge bunch of active users to federate with, and the user- perceived value of your network would rise" is the one I'm going with, however. Also, Diaspora is implementing an XMPP-based chat functionality these days (should be released soon). So, there's also that. -- Pozdr rysiek

odinn

7:46 p.m.

New subject: [tor-talk] Facebook brute forcing hidden services

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 "Why Not Both?" ;-) edhelas wrote:

...

On dim., nov. 2, 2014 at 2:37 , rysiek wrote:

...
Hi,

okay, fuck that, I'm going to dive in, because the level of FUD is strong in this one.

Well, thanks :)

...
Dnia niedziela, 2 listopada 2014 12:19:24 edhelas pisze:

...
I can resume this fragmentation issue by a simple sentence that I'm saying more and more these days : "If you have a problem, do not write an API, write a protocol".

Sure: https://xkcd.com/927/

I don't understand why we need over9000 different, incompatible federated social web protocols. It would seem to me we need *ONE* with several *GOOD* implementations.

...
The social federation protocol is already here : it's XMPP. And yes it can support everything a social network has to offer (feeds, subscriptions, profiles, contact list…). There is already millions of users on the XMPP network, and you can easily find several clients on all the plateforms for it.

I'm working since 2008 on the Movim project (https://movim.eu/), to build a full, good looking, "decentralized" (federated) and open source social network on XMPP. And believe me, yes it's possible.

I won't discuss that. I will however point out that "possible" is not enough.

It's possible to push it forward and try to not reinvent the wheel again and again by creating a new protocol.

...
...
I like the link that the guy made in the presentation with Firefox. Why Firefox surpassed IE ? Because they just choose to implement the W3C standards and try to improve it (and they offer some nice features too).

Absolutely.

...
Diaspora, GNU Social, Friendica are not trying to do that, they create their own "proprietary" protocol

Oh, wow. Do you even understand the words that you use? I mean, "proprietary"? It's documented, the code is open, the protocol has at least two FLOSS implementations. Seriously, what were you trying to achieve here?

Ok, the term "proprietary" was a little strong. Of course the sourcecode of theses projects is open. But can you give me any serious documentations (more than a Wiki or some ML links) that can help me to implement properly the Diaspora/Friendica/GNU Social protocols like RFC, IETF stuffs ?

A protocol have to be stable in the time, most of theses project just create their own protocol from their need. The Diaspora protocol was re-written already one time (which totally broke the Friendica compatibility at this time), the guys from Status.net moved to Pump.io…

...
...
to talk between each other and after that face the same issues than all the others network : "Hey, we are not compatibles ! Lets create an API and the other networks will be compatible with us".

No. They created a protocol that other networks implement. For example Friendica implements GNU Social's protocol, Diaspora's protocol and their own (documented, opensourced) protocol. Red similarily.

No, they wrote their own protocol for their own project, and someone just try to implement it to try to be compatible. But it's a one way work, the guys from Diaspora will not adapt their protocol to help the guys from Friendica/GNU Social/whatever.

...
Reading a bit on it would be a good idea.

...
So keep calm and implement XMPP ;)

No. Come to The Federation assembly at #31C3, get involved in a more meaningful way than calling open protocols "proprietary" just because you don't know them, and try working with quite a few projects that already cooperate and federate with common *protocols* (not APIs).

The question is not "which protocol is better", because while we bikeshed on this question, people are still sitting on Failbroke and Shitter, instead of moving out of these walled gardens.

The question is: "how can we *cooperate* to get people on the libre, federated side of social networks". 1.5 year ago I submitted to all the fedsocnet devs a simple question, here's the link again: http://lists.w3.org/Archives/Public/public-fedsocweb/2013May/0058.html

The answer was: "impossiburu, we won't, not invented here, my protocol is

...
better than yours". So instead of trying to herd those cats, I am grabbing the opportunity arising from the fact that we already have The Federation. Let's expand it and build upon it, eh?

What is your plan with The Federation ? To build a project to help all theses project to talk each others and find a way to "standardize" the communications between them to be compatible with eachothers ?

Then you will define some basic schema of authentication/packet format (JSON/HTML/XML…)/global architecture… In the end it will looks like this : https://xkcd.com/927/

If your aim is to ask theses project to have a public API to share stuffs between their different servers, well good luck.

...
Shouting "XMPP! XMPP!" is not helping.

No, but I prefer to contribute and improve a 15 years old protocol, with millions of users and hundred of implementations, managed by a strong Fundation that works with the IETF than on a 4 yo protocol implented by ~2 project where all the documentation you can find on it is here https://wiki.diasporafoundation.org/Federation_protocol_overview.

...
-- Pozdr rysiek

- -- http://abis.io ~ "a protocol concept to enable decentralization and expansion of a giving economy, and a new social good" https://keybase.io/odinn -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJUVooxAAoJEGxwq/inSG8C2UYH/iHIaDFFyj3dwAXRFsLotmRy M7TfDItF0CVNkSRLXfpBytt6RXMLgQnF9G8cd9SbVTdCWzP1kM3QO/aLWbw42SYj MCSM0vXtiheY12cgwoGbrMainCC9ovyoY7gS09ch1NMjTp8xZJVfOL4ZBOzAdoQB XRjWy1egPWv6hn6AtW1kSV0s0bbwyeBZ5oYE5kJkYIGg/eYqHkyHGyqrjk6JbMCa pvxBzli/h4Z3BtRtpfV17FRcWZ6LRhjZWbPy5yNHLyZmte+huWq5xTIa+DnOrc5D AoVXnIlpL60aVBXxH15lS90jNsEdvzG6jsmJ2D+Q7JbVkAaCnU6aS+xwYrBLuRc= =PvkC -----END PGP SIGNATURE-----

Meredith L. Patterson

5:46 p.m.

New subject: [tor-talk] Facebook brute forcing hidden services

On Sun, Nov 02, 2014 at 12:19:24PM +0100, edhelas wrote:

...

I'm working since 2008 on the Movim project (https://movim.eu/), to build a full, good looking, "decentralized" (federated) and open source social network on XMPP. And believe me, yes it's possible. [...] So keep calm and implement XMPP ;)

So, I already run my own XMPP server. And https://pod.movim.eu/ wants me to give *it* my account credentials for infrastructure that I run? Who came up with this auth scheme? --mlp

3609

Age (days ago)

3609

Last active (days ago)

List overview

Download

9 comments

5 participants

participants (5)

edhelas
Meredith L. Patterson
odinn
rysiek
tigrutigru＠gmail.com