Hacker News Reader

Comment by jackcosgrove | Hacker News Reader

I too dream of a decentralized internet and especially decentralized cloud resources, but I can't find a way around the question of how you securely host a database on some random person's idle computer/"spot instance". If that data is compromised, who do you sue? The random person who has no assets?

Data security ultimately depends on secure physical access to the hosting hardware. Not everything can or should be put in a public database, so you need physical security. Cloud providers provide physical security plus trustworthiness due to their reputations, as well as deep pockets to sue if something goes wrong.

Most industries end up with only a few competing firms. Why would cloud computing be different? I'm open to solutions on data security.

View on HN

I think it's very possible to decentralize databases. Not to sound like I'm jumping off the deep end... What if each set of decentralized data was verified by each user on... a block chain. Using a proof of work/stake model that each existing copy verified each new copy or propagated update. If the hashes didn't match with the greater pool then data would be considered corrupt and ignored. Even cooler is people could simply fork their data sets and create a new blockchain for their project. Truly free data.

I'm iffy on the cryptos but it's appearing less and less of a solution looking for a problem and more a solution for many problems dealing with decentralization.

For an interesting existing solution sans blockchain check out [gundb](https://gun.eco/).

Multiple clients sync to/from a server. Server syncs with other servers. Part of the sync with clients is a list of all servers so clients can cycle servers until sync succeeds. Eventual consistency. I'm doing this with a small dataset now.

That solves consistency but does not secure the data against a malicious node.

Data is encrypted (or not) by the client. The server is a zero-knowledge sync service.

I have an open source client that does client side encryption. I hope that once released people will use it, or ideas from it, to create their own clients.

This is what you're looking for:

https://developer.holochain.org/

1. Data Redundancy

2. Encryption

You need to decrypt the data somewhere, which requires holding the key in memory. What's to prevent a nefarious node in the distributed cloud from extracting your key?

I could see a solution where every user has their own key, served by a securely hosted (non-distributed) server, and decrypting the data client side, but that doesn't cover all cases where you might need to aggregate or share data across users.

Only some workloads make sense to offload on such a network. For example I could see it working as a DYI render-farm. I guess the algorithm could be creative in which pixels to give each node so that they don't reveal the source data based on one corrupt node.

Reply on news.ycombinator.com