Hacker News Reader

Comment by lukeman | Hacker News Reader

You got my hopes up that we'd finally be able to audit Bittorent Sync.

lol I was hoping for that too. A great piece of software but a waste since it can't be trusted for anything secure. To make it worse, this news just adds more fuel to the fire. How can you trust them with security if they can't even remember to add a basic authentication to their Admin Panel?

I've got it syncing EncFS encrypted directories - which in the broad view doesn't help - I've got un-audited code running with my user privs, which _claims_ to "not do anything evil" without being (easily) verified.

At least it does mean I've got some extra encrypted-on-the-wire and encrypted-at-rest data floating around - I strongly suspect BTSync's SHA256 encrypted wire protocol moving AES encrypted EncFS files means that data is secure against the NSA's ubiquitous surveillance programs - the cleartext of those files won't be showing up in XKeyscore in response to bored or curious NSA (or Boos-Hamilton) staff. (While acknowledging that if the NSA becomes interested in _me_ specifically (or probably interested enough in any of my social network) - my privacy will be easily and wantonly violated. And I'm actually _mostly_ OK with that.)

This was my very first thought, as well.

Perhaps there should be a kickstarter for an open source bittorrent sync clone?

The hope is more that the protocol will be published once it's stable and then FLOSS implementations can spring up. The protocol is clearly still in flux, as some versions of the client have had backwards-incompatible changes.

Reply on news.ycombinator.com