Hacker News Reader

> > "Hooking up E2E Encryption APIs in Dendrite (not that it buys us much in a pure P2P world)"

> Doesn't this still matter if the internet traffic itself is tapped? If I'm understanding this correctly we'll still want E2E for things like deep packet inspection in China (or bulk collection by western governments).

If TLS has been compromised between your nodes, then yes - E2EE would give another level of protection; security in depth. I guess it depends on whether you believe your government has the ability to compromise transport layer security between arbitrary peers on the network.

For pure P2P Matrix, there might be some compromise where one uses the E2E keys and key verification to secure the transport layer security (thus giving you E2EE if there is no server in between, but without all the complexity of a cryptographic ratchet). This might give you best of both worlds - but the second you start accumulating data on a server somewhere you'd be back wanting proper E2EE.

Thanks - I remember reading about the issues Tor had operating in China and the sophistication of the government's deep packet inspection. I think TLS is not secure in China, I think I read that the government controls the CAs and MiTMs all traffic.

TLS isn’t everything, you might not trust the server operator. In fact you probably shouldn’t if you’re sending a PM.

This is asking about P2P Matrix, where typically there isn’t a server involved. The transport layer security runs between the peers, effectively providing a form of end to end encryption if there are no nodes in the middle.

Re your question -- it depends: if the network ends up being based on Yggdrasil, as the blog post suggests it could, "IP addresses" are public keys, and packets are encrypted to that destination (which could be a NATing router, though).

So, it gives you some guarantees about encryption, that might or might not be redundant (and for some use-cases, better safe than sorry).

How is the new Urbit stuff, since you mention it? Is it usable for a casual but interested user?

Depends on how 'casual', it's definitely usable and works - but there's still some effort required to figure things out.

I've found the docs are generally pretty good and the community is helpful so if you're interested in playing with it it's worth it.

What is Urbit for? I mean i never understood whats it's real use. From what i've read i imagine it as some new stack that replaces networking and servers but then i found out that you have to buy namespaces that are finite? Why?

So when you blacklist a troll, they can't just create a new account for free.

sounds perfect for state sponsored troll armies, who have way more money/btc/eth than any of us.

That's true for anything where difficulty is measured by a continuous function -- that is, everything is easiest for a state sponsored anything, good or bad, unless it can't be done at all. You're really just saying states have more resources than individuals... which is true almost by definition (they aggregate individuals within their realm)

But the underlying point of the comment still stands. Just making account creation more costly doesn‘t stop spam... it just makes it more expensive. Same for all other legal activities which are then also more expensive. Thus, it‘s not a perfect solution (if at all).

> making account creation more costly doesn‘t stop spam... it just makes it more expensive

But that's the only thing that has ever been effective against spam. Spam exists because the marginal cost of spamming is 0. This puts a floor on the marginal cost of spamming; if it costs at least this much to spam, then only spammers that make back that much will exist, which eliminates most spammers.

not true. in a truly organic network, where you actually know the graph back to you, it is very difficult for a state actor.

ironically, facebook is in a position that is perfect for this, and they go out of their way to not see it. ...I guess because being able to block content based on dislikes by your immediate friends would make it too hard to expose you to all the sponsored posts.

In that case.. it's difficult for anyone. It's still not any better for a state actor versus anyone else -- you've just upped the difficulty so high that it even includes state actors.

That is, (I believe) it is not possible to construct a nefarious deed that is harder for a state actor than an individual to execute. It is only possible to construct scenarios that are hard enough that both state actors and individuals cannot execute it.

A state can do anything a group can do, and a group can do anything an individual can do. They're supersets of one-another, in terms of capability and resource.

There is no "sounds perfect for a state-sponsored" anything -- everything is perfect for a state-sponsored entity, unless it cannot be done at all (because who has greater capability than a state? Other than a coalition of states, or even further, galactic nation-states)

>not true. in a truly organic network, where you actually know the graph back to you, it is very difficult for a state actor.

An entity with sufficient resources & time can probably defeat this -- the main thing is to generate more "accounts" or whatever;

need proof of id? Sufficiently good counterfeits.

need DNA proof? rob of a morgue.

users police themselves? make sufficiently "attractive"/fake accounts and add randomly until you get added by enough people, and then their friends, and then spam until you get blocked and do it again);

and hide them sufficiently well, faster than the governing entity(ies) can identify and remove them.

Sounds perfect for my galactic nation-state.

I actually don't think it's that hard to grasp, but people often don't explain it very clearly.

It's a from the ground up design for a serverless p2p 'overlay' operating system.

Overlay just means that you run an Urbit VM on top of a mac/linux OS and people can write applications for your Urbit VM. Your Urbit VM communicates with other Urbit VMs in such a way that the application design is p2p by default so the complexity of this is hidden from the user. This means in the future someone can start up their urbit node (which will just look like another application) and use the apps in it without needing any central servers.

Right now the main app in their release is chat, they also have a link aggregator app too.

The reason for the finite user IDs is because the founder believed that one reason for service centralization on the existing internet was the spam problem. When IDs are free people can make tons of them and spam others, complex algorithms via centralized services are required to fight this which leads to a client/server model and a handful of enormous corporations powering the services.

When you have a small cost on the ID you make it economically infeasible to spam people, you also make it easier to stop IDs from abusing the network (and other people). It’s also a way to incentivize people to run infrastructure nodes in the network.

The other interesting details are that it's written in its own functional language on top of its own functional like assembly. This has benefits around correctness that I don't totally understand - but the idea is if you were to redesign a modern computing system from first principles taking everything learned over the last 50 years how would you do it?

Regular users are never going to run their own linux servers to host their own applications on the modern internet, but regular users might use an application that is p2p by default and does the things they want. This leads to a better decentralized model at the application level that is not ad supported.

Ultimately it's out of the box private servers that you can run locally and easily share data between securely, without the need for a centralized company in the middle.

The project makes me think of Alan Kay when he talks about big ideas and 'having the chops' to implement them. It's crazy to throw away most of modern computing and build a functional OS from scratch in a radical kind of way, it's crazy for the product to have made progress since something like 2002 (picked up a lot when they got funding more recently) rather than fizzling out or being vaporware. I'm amazed that they have real software shipping that works, but they do. It's a project driven by a clear vision of how computing can be better than it is, which I think is an exciting thing.

and how does one urbit vm finds other urbits vm to establish the p2p?

I mean i've always been a skeptical about it...

1. Is feels pretty elite. Exactly what you mention - some new language that is pure and beautiful and not burdened by those dirty systems of the past (thats how i felt when they were discribing it).

2. The elitism i guess makes sense because it's core philosophy of the original author. The fact the original author is prick doesn't make the project bad but there is lot of ideology tied to it. It then makes sense then that part of the solution is buying finite namespaces. The richest have the most power because they are the most capable...

3. There is just huge contradiction in secure private p2p system funded primarily by Thiel. So it's Palantir money. Now I don't want to say that it's not secure. Quite the opposite i am pretty sure it is highly secure and verifyable.

But it feels like it's aiming to be the closed off gatekeeped part of the internet for rich and powerful that is secure and not spied by companies. While the rest of us gets the regular data mined, survailence network... regular internet.

I think initial skepticism is reasonable, big ideas and bullshit often sound similar at first and require more investigation. An ambitious project can still sometimes be real though, not everything has to turn out to be Magic Leap. In Urbit's case the docs are really good you can find out a lot if you want to.

1. I don't think elite is the goal, it's more about first principles and being free to rethink things. Obviously high risk and in most outcomes would lead to failure, but they've made progress for years and have now proven they can actually ship. I don't think big complex goals are impossible, just hard.

2. I don't think the politics of the original author matter that much.

3. I don't agree with Thiel's politics. That said, Thiel has a pretty good track record for picking things that end up really successful because others pre-judge and misvalue them. I think he's good at taking the contrarian view and really thinking it through, looking for blind spots or generalized assumptions (that may be correct most of the time, but not all the time) that lead the community to undervalue things. I think his political views are both contrarian and wrong, but his VC success is often because he is contrarian and right.

As far as closed off and gatekeeped - the IDs are cheap (free to $10ish), and I believe their spam explanation for the existence of them. You can spin up a free 'comet' ID to play with things without needing to buy an ID at all. I'd argue the modern internet is what's closed off and feudal with large companies running our applications and requiring us to give them our data in order to interact with each other. Sure you don't technically need to do this (I created r/hnblogs and I want people to run their own websites), but the reality is most users won't do this, so how default applications work on the network matters. Right now they work almost entirely on a large company server/client model.

The 'galaxy' and 'star' urbit nodes are basically governance and infrastructure nodes, they allow a network consensus to determine changes that might have to happen to the network over time. They also incentivize people to operate portions of the network for other users (IDs can move between stars freely). A lot of this when compared to flaws in existing internet infrastructure comes out ahead to me - or at least not worse. (CAs, ISPs, etc.).

Looks like it's still relying on Ethereum, which IMO is irresponsible from a climate change / energy use point of view.

Do you think that ethereum won’t move to PoS soon? (I haven’t looked into the design, can’t comment on whether the construction seems sound to me)

In short: PoS migration of Ethereum is in progress and will happen in stages. "Stage 0", which doesn't have any practical effects for smart contracts, is expected Soon (tm) (a few months probably).

It'll most likely be a couple of years until the transition is done so that smart contracts like Urbit can/will run under PoS.

Ethereum has been moving to PoS soon for a couple years.

It's still the intent, but PoS is effectively still unsolved. It's not just "can it decide blocks", it needs to have the right balance of incentives to be self-sustaining, or it destroys itself.

What makes you say that PoS is "unsolved " ? Did you hear about Cosmos for example ? Their mainnet is running for more than one year without any issue.

I was interested in a server, but the website does not mention how much storage or any details at all really. Anyone happen to know where to find that info?

matrix.org is the website for the non-profit foundation that looks after the overall project. https://matrix.org/hosting lists hosting providers, of which https://modular.im is run by the core team and directly funds development of Matrix. There aren't hard storage limitations on Modular currently.