On 16/10/15 07:36, Florent Daigniere wrote: > I do not think that "our users" are genuinely interested in publishing > anything anymore. Back when the project started, there wasn't > Wikipedia, Blogger, facebook nor twitter... And those who are (the > copyright infringement brigade, ...) we're not ready/willing to > support. The fact that Wikipedia exists continues to amaze me and provide some tiny beacon of hope... However the wider picture is bleak. > I do not think that Freenet provides the security guarantees one would > require to face a "state level" adversary. I do think that implying > otherwise is deceitful (but I also acknowledge that it's what marketing > is about and that it's necessary to raise funds). > > I'm not convinced that Darknet (as currently implemented) even works. > > All in all, I think that we're still looking for our audience, a decade > and a half in the making... and that's only problematic because we have > chosen it to be. > > I've always seen Freenet as an interesting (open) research problem and > a way to learn, nothing more.
On 16/10/15 13:12, dean wrote: > On 10/16/15 22:02, Florent Daigniere wrote: >> On Fri, 2015-10-16 at 21:38 +1000, dean wrote: >>> On 10/16/15 20:09, Florent Daigniere wrote: >>>> If the aim of the project is to protect (Chinese, ...) dissidents >>>> we >>>> have to account for their threat model. >>> Why cant freenet have more than one aim? Darknet for the more extreme >>> threats? >> It can but we need to be honest about which aims are achievable and >> which ones aren't. And exactly what is your goal if it is not to protect against state-level actors? If the state isn't part of your threat model then you're a fool. If they are, you're stuffed. To elaborate: Intelligence agencies, police, major corporations, politicians and very rich individuals all have - legally or not, depending on the whim of politicians - access to state level intelligence resources. Even democratic governments engage in economic espionage and surveillance of their political opponents. For example, the UK's Special Branch's purpose is to spy on anyone the home secretary deems a threat to the establishment (according to a former home secretary). That recently included climate activists, for example. And most democracies engage in some form of censorship - increasingly including threatening political speech. Furthermore, the intelligence agencies do not regard us as irrelevant. We know the police have tools for dealing with Freenet, and we know the NSA has commissioned contract work against Freenet, and spent internal effort on Tor. Their objective is not targeted surveillance of known terrorists, but drag-net surveillance of everyone all the time, so they can data mine for the interesting bits. People who use better tools to try to protect their privacy are more likely to have it invaded more intrusively since they probably have something to hide. People who search for Freenet, or Tor, or who read the Linux Journal (backdoors perhaps?), are watched more closely than people who don't. And they apparently have no rules at all: They compromise closed source and presumably open source security software, globally (not merely for a specific target), merely to make it easier to watch everyone. This contradicts their defensive mission, as those bugs will be found by others. That makes the whole field of computer security highly dubious. At the extreme end they are prepared to hack developers' computers, insert human operatives and presumably resort to traditional blackmail and bribery. And they have near unlimited resources. Nobody can stand up to a determined state level actor. In the early days of a new technology it inevitably appears to subvert established power structures. But that's only because they haven't caught on yet. In the corporate world it works out through new markets resulting in new monopolies, who eventually act exactly the same as the old ones did. In the espionage world it's more a matter of government catching on to new possibilities. On a more technical level, a determined government can, for only a modest cost (which can be passed on to the consumer), block Freenet, even with pure darknet and transport plugins. In the early days, there was some hope as it was unclear what traffic flow analysis would cost. Nowadays we know it's pretty cheap (although there may be some overblocking). It is likely that this will happen in the UK over the next year - for both Freenet and Tor. Physical darknets don't help here because you need long links (geographically as well as topologically), and those are easily detected and always owned by somebody (or illegal, slow, expensive unsustainable volunteer efforts etc). However, given a sufficiently neutral Internet (an increasingly naive assumption), Freenet could still provide some interesting properties: - Censorship resistance. - Distributed hosting. - Stronger privacy than Tor (not now, but with a big darknet and maybe tunnels). That makes it at least an interesting research project. The catch is: - There are a lot of hard research problems because of it being fully distributed. - There is no obvious source of significant funding. - It is not clear that darknet actually works (swapping may or may not scale and may or may not be secure against DoS). - Building a big darknet will be hard if not impossible socially. - There is measurable collateral damage, which is part of the reason it's so hard to build a big darknet. - If we achieve moderate success we will either be legally blocked, legally DoS'ed by agencies, compromised by dirty tricks, or at the absolute best, provide a false sense of security to people who really do need to use Freenet. Actually nobody needs to use Freenet. Chinese dissidents can't use it because it's blocked - or will be. Whistleblowers should assume they will be sacrificing their entire lifestyle - which makes it difficult if they just want to blog about lethal stupidity at their workplace. Which makes us either hopeless idealists who misunderstood the nature of power and technology some time around 1999 ... or mad (computer) scientists who don't care about the real harm they do while tilting at (real but unattainable) windmills. In any case I will stick around long enough for my university project, which will involve making Freenet simulations more efficient and using that to show that The Patch is evil, and hopefully test improved load management algorithms. > What about trustees? Its more about trust than how well you get along > with someone. No, it's not. One of the interesting things about darknet is that you *DON'T* need to ultimately trust your friends for them to be better than opennet peers. On opennet, the bad guys choose you. On darknet, you choose your friends. If there is a major problem with people attacking their direct peers there are things we can do about that, such as tunnels, but it's a massive improvement on opennet regardless. The problem is, you need long links as well as short links - both in terms of locations and physical proximity. A wifi link across the street is presumably a "short" link in some sense. Also, a state level actor could prohibit such things - it depends on how determined they are.
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Devl mailing list Devl@freenetproject.org https://emu.freenetproject.org/cgi-bin/mailman/listinfo/devl
