Hacker News Reader

Comment by fiatjaf | Hacker News Reader

Since no one is complaining: I find Syncthing too complicated to set up. You must create a folder, then get a number for a computer (which you end up writing in a pastepad or something like that because the two computers don't communicate), then go to the other computer and place the number in, then do the same for the second computer to the first.

Repeat it for 5 or 6 machines.

If any machine is switched what do you do? Start over again establishing the link with all other machines.

View on HN

This is the price you have to pay for a (secure) decentralised system, but syncthing tries to help where it can. E.g. you can set a syncthing instance as an 'introducer', so you only have to establish a connection to this device to get offered connections to all others devices. You still need to authorise these introductions on the devices, but you do not need to type in the crypto verification strings.

That's how I do it. My use case is a large number of nodes (>200) need read-only access to data I provide from my node. So my node is set as "introducer" and gives the host list to everyone joining the swarm.

This is the price you have to pay for a (secure) decentralised system, but syncthing tries to help where it can.

In general, Resilio Sync's 'key per folder' model seems to work better. I can give a key to other people and they can join the swarm without extra work on either sides. Also, it has a logical extension to encrypted-only peers: they get a derived key that can be used to sync in the swarm, but cannot decrypt the data.

If there was a stable open source program using Resilio Sync's sharing model, I would switch in a heartbeat. (There is Librevault, but it still seems to be mostly in development.)

Where can I read about the swarm capability? I'm searching for something like how BTSync worked, but I don't see how Syncthing does this. It seems like one to one sharing, per: https://forum.syncthing.net/t/can-i-use-synthing-to-distribu...

Yeah, the only problem is you can never "un-give" a key, which means you either have to rebuild your cluster under a different key (having to re-give key to everyone else apart from that one guy you want to kick out), or deal with the person having access to the data forever.

Indeed, with the standard folders you cannot do this. With the identity-based sharing, you can remove someone from a folder. The identity-based sharing model has some downsides (no support for encrypted read-only peers), but does support user management.

If the data is encrypted using a session key and then the session key encrypted with a master key and stored with the data (concat them together) then it can. You can't revoke access to the data they've already got, of course, but as changes/additions are made they lose the ability to decrypt the new data because you've used a new session and master key.

Arq uses this method when encrypting blobs.

The model has been considered for Syncthing many times, but it boils down to the fact that:

1) There's no way to revoke access, and 2) Once the secret is out, it's out: you have to scrap it and start again from scratch.

What is the problem with that?

You can always close the folder and start a new one.

I think the "introducer" feature is supposed to simplify this process, but I don't understand it.

Once you established a connection to the 'introducer', it will introduce your device to all other devices it knows and vice versa. You still need to authorise these introductions on the devices, but no typing/copying of crypto strings.

The mobile app can read a qrcode from the screen of the laptop/desktop. My setup is laptop, phone, tablet. Phone and tablet are master for their own pictures, screenshots, downloads, contacts. The laptop is master for everything else, keepassx included. I don't share anything over Google and Dropbox.

I came to wander if there was market demand for some kind of "Syncthing Admin" that would centralize this process for corporative users, and provide other kinds of features (commands from "Syncthing Admin" could be transmitted through Syncthing itself!).

You can make a machine an introducer so any things that are added on that machine are added to all the others on your network, also it has qr codes so adding to an android phone is very easy. its gonna be the same with any other p2p sync client. I think its even the same for resillo.

Just set one up as the introducer, makes it much easier.

Also, you get auto-complete in the field where you select the id, so you don't actually have to type it in …

Once you've added machine A to machine B, you should see a prompt on machine A to add machine B.

So yes, it's a bit painful (and is the price you pay for the level of security you get), but it's not quite as bad as you make out.

Reply on news.ycombinator.com