Firestr: encrypted P2P chat and Lua application platform | Hacker News Reader

Firestr: encrypted P2P chat and Lua application platform

mempko.com

100 pointsakkartik37 comments

Hope to see more p2p application platforms in the future, including ones that might potentially run in a browser (via WebRTC) - if you know of others, please comment here.

There's one based on IPFS and blockchain that's a distributed video sharing app, like Youtube: https://github.com/eris-ltd/2gather

And there are some other decentralized / alternative Internet projects listed here (including Firestr): https://github.com/redecentralize/alternative-internet/blob/...

webtorrent is one that pops in my head.

ZDc6YWRkcmVzczIyOnVkcDovLzEwLjE4MS42LjEyOjY1ODAyOmlkMzY6OTFmYjMw Y2QtYzQzNS00ZmE2LWE3NjEtMWQxZmVkYTFhODg4NDpuYW1lMTM6bWVtcGtvLWxh cHRvcDQ6cGtleTgwMDotLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLQpNSUlDSWpB TkJna3Foa2lHOXcwQkFRRUZBQU9DQWc4QU1JSUNDZ0tDQWdFQXhRenlzNUF6bXM1 T050YVY4Z0x2Ck40NVNjZHNRU3lrK1R4NVFoQURUUG1ldWo1ajAwRnNwUFBuMWRE Y1c5OUU0ZGNhcnRWU0o0NUNKcmFidFJwdGQKTXFqTmtadXZHZWFzK05pNmV0YmNl UXN6RncwZzQ5RFlKQitaSm9ybEMvSXpMQjdSREJ1cnNIMUhGeW1CNjBiTwpma1Bo QmR0ZE9aNG5xdklYYy9TeXhwNldaM0RQZGtUWVFKVXBheklaL2c5VFlaQ25uT0FX TXR5KzhzbUtOUFJaCjdrcXFJeTk3U0R6MStLZzJacEUwMnBPTlZ5YkpYRjV5am5C Um1jZ0pDaFZvd2JkY3BlUDMxTXlRRHRRbUU0MVYKQ3gyVDhwWTI3SHc1b2d0VmNi TXBkYkdvMW5HNWY5SjB2Z1ZwVWEyd2V2VWM1aC9McUNmczdaQk1wRWFzOWF6LwpS b0RPZS9FUFNKQlg5aGZkejlVdVFxRmVXcTFsay96QmVBNFJYYklNTFFHV3h6LzB5 amw0S1FHSDl1U255UHdSCmNBRG9hd1FhRWF4NGhQMUpxWDgrckM1RGl0bTUwSGpO dExvSWJBVkxndEYwbkNTVWhQVk5Kd0c4a0FNMzVxUUsKN1RGdldCWldsSTFEZ2hj V1VaRGhOakVMNkJoWlF6eU1HWEhPdTRadDNqYVVZcXJ3RVBMMldBN0xFZVI1SVNW cwpBajM1R0t2bEl5K1pveFp4UGRaMUJjL3BzSElURFUzSWlNR1Z0YTZMaFNvU3BP bEEyaS9UKy9JeVVydHZ6K01oCitnQnpBVWxGQnZrU0Z3TjA2a2llenNGK25HYjRN L1Fkalk5N3RudG85QTJDK0k0N2lzcUcvVFM4eVM5d3N3Y20KbG1QZE11YkpyNW1G L2ovT0JQc0RxREVDQXdFQUFRPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCjsx NTptZW1wa28uY29tOjgwODA=

For those curious, here's what the above message is base64 decoded:

    d7:address24:udp://192.168.0.100:60602:id36:8158a718-a69b-4551-afc6-a5d42d1651854
    :name9:fannytown4:pkey800:    
    -----BEGIN PUBLIC KEY-----    
    <key gibberish>    
    -----END PUBLIC KEY-----
    ;15:mempko.com:8080

Posted wrong one. Here is correct one.

ZDc6YWRkcmVzczIzOnVkcDovLzE5Mi4xNjguMS43Mzo2MjcyMjppZDM2OjkxZmIz MGNkLWM0MzUtNGZhNi1hNzYxLTFkMWZlZGExYTg4ODQ6bmFtZTEzOm1lbXBrby1s YXB0b3A0OnBrZXk4MDA6LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQ0lq QU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQ0FnRUF4UXp5czVBem1z NU9OdGFWOGdMdgpONDVTY2RzUVN5aytUeDVRaEFEVFBtZXVqNWowMEZzcFBQbjFk RGNXOTlFNGRjYXJ0VlNKNDVDSnJhYnRScHRkCk1xak5rWnV2R2VhcytOaTZldGJj ZVFzekZ3MGc0OURZSkIrWkpvcmxDL0l6TEI3UkRCdXJzSDFIRnltQjYwYk8KZmtQ aEJkdGRPWjRucXZJWGMvU3l4cDZXWjNEUGRrVFlRSlVwYXpJWi9nOVRZWkNubk9B V010eSs4c21LTlBSWgo3a3FxSXk5N1NEejErS2cyWnBFMDJwT05WeWJKWEY1eWpu QlJtY2dKQ2hWb3diZGNwZVAzMU15UUR0UW1FNDFWCkN4MlQ4cFkyN0h3NW9ndFZj Yk1wZGJHbzFuRzVmOUowdmdWcFVhMndldlVjNWgvTHFDZnM3WkJNcEVhczlhei8K Um9ET2UvRVBTSkJYOWhmZHo5VXVRcUZlV3ExbGsvekJlQTRSWGJJTUxRR1d4ei8w eWpsNEtRR0g5dVNueVB3UgpjQURvYXdRYUVheDRoUDFKcVg4K3JDNURpdG01MEhq TnRMb0liQVZMZ3RGMG5DU1VoUFZOSndHOGtBTTM1cVFLCjdURnZXQlpXbEkxRGdo Y1dVWkRoTmpFTDZCaFpRenlNR1hIT3U0WnQzamFVWXFyd0VQTDJXQTdMRWVSNUlT VnMKQWozNUdLdmxJeStab3haeFBkWjFCYy9wc0hJVERVM0lpTUdWdGE2TGhTb1Nw T2xBMmkvVCsvSXlVcnR2eitNaAorZ0J6QVVsRkJ2a1NGd04wNmtpZXpzRituR2I0 TS9RZGpZOTd0bnRvOUEyQytJNDdpc3FHL1RTOHlTOXdzd2NtCmxtUGRNdWJKcjVt Ri9qL09CUHNEcURFQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo7 MTU6bWVtcGtvLmNvbTo4MDgw

Wonder what they mean by encrypted.. haven't been able to find much in the docs.

"Secure: Fire★ encrypts your connection, so the only people who see what you're working on are those you want to."

It says that the connection is encrypted, which sounds like SSL/TLS?

The creator here. Thanks for pointing out the lack of documentation here. At the moment, the security is RSA for the handshake and AES for the data once a connection is established. The security at the moment has obvious problems, so don't use it where your life depends on it. I have a plan to switch to using telehash for the com layer instead of my own hand rolled protocol. In the meantime, I invite any security experts to help improve what I have. The first obvious improvement is to sign messages. So please help if you can.

Very cool, and I love your project. I've read your blog and your approach is very admirable and I love the extensible approach you've taken.

If you're still considering protocols, I'd consider the TextSecure V2 protocol. The documentation isn't crazy in-depth, but it's a really neat protocol that offers forwards and future security.

https://github.com/WhisperSystems/TextSecure/wiki/ProtocolV2

Thanks, I will look into it. My design internally should allow for multiple protocols.

It's definitely worth looking into - TextSecure's Axolotl is best-in-class for dealing with text messaging or other scenarios with occasional one-shots.

If you want another, simpler transport that works better for more connected scenarios, like this one, ask trevp who did that: he has a very promising-looking one in the design phase.

If I can give any advice: security doesn't make a good afterthought, especially when encryption was the first word you mentioned. It's a foundational feature; treat it as one. Pick primitives that make the best, most solid foundations you can get, and do your best to make sure you can rely on them. As for the rest, extensibility needs careful thought: it can be easy to extend yourself into vulnerabilities.

Best of luck. You have an interesting project. I might keep an eye on it.

Thanks! Yes, this is great advice. security should not be an afterthought and it certainly has not been here. Also, I did not post this on HN, so those were not my words.

There are some aspects to security that I took that extend to the code. It is written using design by contract, where if a contract fails, the program quits immediately. Security should extend beyond the protocol.

As I mentioned previously, long term I won't be using a handrolled protocol, which has obvious problems. This software is alpha and I hope to migrate before 1.0

I was looking into making a similar application a while ago and was really interested in OTR. Not only does it provide encryption and authentication, it also provides deniability. Have you guys looked into using it? If you have and rejected it, what were the reasons?

OTR is definately an inspiration here. I need to add the HMAC signing and key ratcheting. When I started there was no good OTR implementation that I could find.I was also concerned with performance. I am looking to use telehash now. What is your opinion of telehash vs stock OTR?

I wasn't too familiar with telehash until you mentioned it. I read the docs and it looks like it's a pretty complete framework whereas OTR is more of a handshake to establish a secure channel. If you're only using telehash to secure a channel it seems like overkill. If you use its peer resolution and asynchronous messaging features it seems pretty nice.

libotr is a very good implementation of OTR (in c) [1]. I don't think performance would be a big issue on modern hardware. OTR does offer future deniability in case one of the parties gets compromised. I didn't see the same guaranty in telehash (I might have missed it).

I think they are both fine platforms but I'm far from being an expert. For anyone who is interested in the documentation I was referring to: telehash [2] and OTR [3].

[1]https://otr.cypherpunks.ca/index.php#downloads [2]https://github.com/telehash/telehash.org/blob/master/v3/spec... [3]https://otr.cypherpunks.ca/Protocol-v3-4.0.0.html

I updated the README to mention the encryption used in the WARNING section.

I'm on the 8056c2e21cae4b10 network. Edit: not sure it matters... I think it finds various paths.

I just created one:

ZDc6YWRkcmVzczI0OnVkcDovLzEwLjE4MS4xNC4yMjk6NjA2MDI6aWQzNjo5NDBh NTVmYS1jOTM0LTRkYTItOTBjNS02NTVlY2QyZWQwYjY0Om5hbWUxNDphZGFtLmll cnltZW5rbzQ6cGtleTgwMDotLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLQpNSUlD SWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQWc4QU1JSUNDZ0tDQWdFQXY3YStvc3RP UHIrTUo0bno1Um5KCjZTWTkrWDJNaVBTRkVmbEFDcFJLaWIyMyt4T0hJNDlaYXBk WThmQTAyV2NUVlVjdzBmNmpvL0sySSthNFd0V3cKeWFmNVRDY1lEdjVLaW5RNU9N UU1wc2xrMkxxTFRmRGt2M3AzT3p2NDBFUEExNFRUb09ha3VkQTNyZTdxMDVvdgpF clF2dnlQVkc4YzZQbHM1NjFmZ2ZoUlk2M0dJL2ZTUiszSzA1TThvTFkvb0ZDZ1Bp UDQydVVkbW5BMGdEZjU0CnV2STg4c1V6d3hhbE5jU2p4U0swTGpHWjUrQ1FpSzRm TU5xbk9reW0rT3VQbUpSakdDMTBLZWEwWkdqVmdLSGMKT3FSTUJhNWxiZ25zS3R4 WVM0aDdTRnp6Ym1GZG8zNUN6M29OSHQxYmtPc3RtblNwa0RhWUlyUC83Z2tnUEps dQpSSzlMWFA5dzBQNlRPQlVOVCtUWnhxTzdibHNMb2g3SHU0WmxyeTZSS1RPWk9B ZnFNOU9ZbVpIbFlIUU1CLzJYCjZCaVNhK3Q0MUYrek5YYURPSUYyemh4bm1EcHBn M0lWOGlxL0dBUGs2a1BSdjJtZ0szYWd5Z2NhQlhPdE13VDMKWnhCRWNacklpSjhu STE5YTZoVW9jQUNPanNEOGFCRW5Yb2U5c3MyN01PZ282Y0lHLzV1Z2RrUzBwMXlF UnJCVgpRcXJZR09iM0hUakQ3SkdMOUczbFJ1a0JmQWhucHZHSm5yWE1BRzh3OGdi QmtKZVRIcTV1eWNBdkhBaERmNkR4CkZIM1hPWHdaZENlVThxeGRMMjQxblNJaFMr WCtaU3lrQk51cENKUlhkQm9CemlBVHFvdVFEdjJTSlRTZDBRQ1kKRVN4Mk9iUlBX V2lDbzFQQTFnd2V5cUVDQXdFQUFRPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0t CjsxNTptZW1wa28uY29tOjgwODA=

And huge blocks of text like this is the reason why this needs some DNS equivalent.

Totally. These huge blocks are a short term compromise.

I'm hacking around on a distributed version control project, and I think I've found a cool solution to this problem.

I've created a github gist with my public key and a signature. Now people can see that gist and verify that the keyholder posted the signature via my github account. People can fork the gist and put their own signature in. Now I can easily list the forks of my gist and get a list of public keys that are cryptographically linked to certain github accounts.

Haha, cool hack! link to the gist?

This is a solid idea. Here's me:

ZDc6YWRkcmVzczIyOnVkcDovLzE5Mi4xNjguMS44OjYwNjAyOmlkMzY6ZWRiZmI5 OTgtOWExZi00MGIwLTkxZjctZDVkNzM4ZmQwNGY2NDpuYW1lNTphdG1hbjQ6cGtl eTgwMDotLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLQpNSUlDSWpBTkJna3Foa2lH OXcwQkFRRUZBQU9DQWc4QU1JSUNDZ0tDQWdFQTEzZ3FZU3JNSFlOQUNoVGY4N2Q5 CitGam96eEJnalBpT09QcnFuNHllNjdSdGl2aFlBWURCeGYxMi9YUjIzZGxPSG9i dkJ4aGZBc0pxVVJVZ0lTMmcKSlJzajZGWWRFZGd5YnFoME5EbzRnNXQrRi9qYk1Z bFF5eWtITWNCSGw4RmRjcWZhNllrenR0K2xBSFNYdnppbwovNWluQnZEUDJuYW1I TW11WC9Pb0hIZzRHQ0NkSjdGSi9NSWlIa2ZPV0h0bVEzdTJYdmNDWEd4MXptVjJS OGR5CmovU0RkNDNqdytsTCtOZTZRMENWaVZ1VFdKRTZHM2RQTEY4Y202eHg5SWl5 c1Q4cHlnaXdVYTc0Q3pscDFpWTcKVldvR0ZRY0RQYzZPTSszUHovZ0gvTkpGUlVE bUJMdWNJd3JmUkJFY3h4b0FxRS9od0p1enZZR0QvNGdlL3YwVAo3Z1lLOW9QMG0w WVdPa1RpRGgwQkQ0R0xXMkE5Q3h3UnRMRlpWWDBPZVN5S2paTXVXWTVCV3ZOaktz QnZONHdQCnFWR09HLzRXallDR3RBQUkvaFV3S3ZPZmRyWlVQcVV6SGQyZWU4ZjFt MGkwckloWElYODFwWDl0a3Bpd0dRMUoKSW1HMlZkK3NJUzFCd0MyekJYbkpuOWx2 MUdicE5nZDZMTUFsa1hTZFJSZXlDQ21tM2o2b3BpckJpaVlieW1sRgpuVlRVR0FW QVVlblZOMThkZzNsditXUmwvdmRSdFV2L0luUmxCVDEvaWUrb3QrblJ6LzJSV292 YXY3T2Z4VjlUCk10MjBRMkRRTkJWYzJxazVzWHVKdklTcWQ3Y0xiWXFwcUFROG5Q dG9kelFJTUJkSnNta2ErU0Y0eVhFeVV3S2IKbVdZT0VGKzExbFRJUDh4OEJ0dHNE Uk1DQXdFQUFRPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCjsxNTptZW1wa28u Y29tOjgwODA=

Let's play!

ZDc6YWRkcmVzczI0OnVkcDovLzE5Mi4xNjguMS4yMzU6NjA2MDI6aWQzNjozZmM3 OGI0YS00OWVhLTQ0NzAtOWVhMy0yNmRmZjgxNmMxNWM0Om5hbWU2Om1hamphbTQ6 cGtleTgwMDotLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLQpNSUlDSWpBTkJna3Fo a2lHOXcwQkFRRUZBQU9DQWc4QU1JSUNDZ0tDQWdFQXBubHRnQmpuaWpTOW1qUVp6 WmdOCnZ4eFl5MVpzUUVVNjdzUS9GS09hZTZGb3dPUW9QMWJYMFR1NDR1NUhjbVNV eXJ4SmU2YmlMUnp1RUlpRVNsZysKcExaQkZpNUxEVjQ4MjB5ZTlRWHNNWDg1Q1pM TTROK1RHRm0vMHpiamVXTGVpWUJrK2tyRklrWU1DSEwwWkFKNwp0UTV2MDQyUnNw NW1ZdmVRYUdaOTd2Sy9vNDgwd0tDazNhVFphWUFqVkovZHdDbDBOdkZBWDZhZkFl Vm51ZEtXCitaUmVMU3NZaXFJVHlkUDk3NHFQT2RSTEwvMVRuSDlNWmpzaXFEOVY3 QjViUk9qUExFWG9lSzA2VDdlNEdoV3EKclozam9sM0psSkEvK2gwbG5vQkUxUVJi eG9ubVM1US9QSnllUjVOS2MwTkoxd3VHaHl5UHRNRThxaENRUkhYTApCR3hxa01W Q05CRXNmK2xQSTFQMEYrTzVybjZ5SWRjdnNneXV1TXVmRE4xREV3bHZwQi9uWTFC VkhDYkEvdDVxCjVic0M1YlV3RGFvNzc1SWtpdXBKR3duYWc2cWhsZ2o4dmNycTA1 aHdXU01ta2FrR2s4NzRaRU90cDN5QmJKUTAKRXJQekxNSWw0TnRWUU1vNGNVNTVQ OHNVVWs1ejRNMnZMLzBoTGVQZjl0bXZVQjdIU1RCemxDSkxsbkdVMkNaNQpyd1RO ZFpBNlJUS2RHR2M4TjdaekxvRXVuVDZyREJZR2VqM2g1aXFuYm1vOWo0d0FmREVt ajJiT29HRnA1L2kzClh4Ynh0cnJCY3l1d0M2eUFpQUJQOTZMSDdhOFpCNHFTNjdq NWdrZlBaQUNhWXc0dkdSa3BhSUszZUM0UXBrTUoKS3U3akpZTEYrMnpUOEt2Nk9P TWp6ZE1DQXdFQUFRPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCjsxNTptZW1w a28uY29tOjgwODA=

Some people never visit the HN home page, but do visit https://news.ycombinator.com/show, so (since this post would seem to qualify for /show) I suggest you get it on there.

ZDc6YWRkcmVzczI0OnVkcDovLzE5Mi4xNjguMi4yNTE6NjEwNzI6aWQzNjoxMTQ5 NGY2YS1mNjAxLTQ5ZDYtYjk2Mi1kZDI5MjAxNjdlYWU0Om5hbWUxMTp3aGljaGZh d2tlczQ6cGtleTgwMDotLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLQpNSUlDSWpB TkJna3Foa2lHOXcwQkFRRUZBQU9DQWc4QU1JSUNDZ0tDQWdFQTVwV1BCMVcwaDdl MkV5SnNaV0JqCmo4blcvU1Bhd3dXS09DZGloS09uWTYzZGdGZUtpL1ZMbGptZGhG V09NUkZmMjJDMlB5bFJrbG9SUkNlNXFaOGkKOVRFQUdFaGozUkJRdURURkVneEN5 eGE3bjlXK0xWb3hQQmpINHV4VXREYjlBREw5Z1Uzcld1WCt5eG5aZkVySApyVHgv WFpSd2pwaGVqamN6dGVtVmZKOGFsajVzNFR1NFFLWU5ZRUk5YnQwelJVdnJ6S3pT QjVnNHZkeGpRU05yClROQmp3dHpWcHlVV3FwZUY3UGFnd1BMdHltVCtRcG9MWEFa OGttbXN1Q2E1Zko3S2g3SFdENzc4dkgzRTEwQWgKSk5xdGdyanpLb3hGR0Y5d2tM RnJwVXpyd05GVFkyOWlHOHRCNkhNWTJLT2haVkNzRUJSRlpjYjM4SElTYVgzbQp0 dE9pbGZ4QmdYM0ZxMEwwZ0l0Y1BQZElTR3pwN3dtQkZvREFLUDRLbXNEYTh4dHpK OFA1dFUrakhWV2ZPMWhBCmhrR1owWWJlb3d1NTB5ekhHZUhxQ1RjZ0MwdVNnVDNV c0IxZ3FwbWNQM0g0M1FIZUhJZEpibGRLTzA4YjRrVjYKWnFmVlJ1cE1YNTdBZVcv bmQzci9CZ3NCRXRrUVI4bVVHVnNBTzFCNDhjRTRhVzdKNEx6enlQQkNTSGdaVGR2 NgpsRWg5c3MrcXRTUC9ZTzJmMUhnUVMwWTd0a2hQM08vYXhKTkV6TmJYMHczd2Ny MlFIRjlOK2tCdDg3c2lUd1ZxCk5WZ2o5Q1RreWszS3hGN1gxTTVQQk9va2txK3ZX UDJ1N2pHKzFxWnNqempNbExzdkdjaE1CZ015T1lrZ2R0bjgKMUMvb01Gc2ZuQm92 amhDbnBjTUduVHNDQXdFQUFRPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCjsx NTptZW1wa28uY29tOjgwODA=

ZDc6YWRkcmVzczI0OnVkcDovLzE5Mi4xNjguMC4xMDA6NjA2MDI6aWQzNjo4MTU4 YTcxOC1hNjliLTQ1NTEtYWZjNi1hNWQ0MmQxNjUxODU0Om5hbWU5OmZhbm55dG93 bjQ6cGtleTgwMDotLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLQpNSUlDSWpBTkJn a3Foa2lHOXcwQkFRRUZBQU9DQWc4QU1JSUNDZ0tDQWdFQW43YnZQS2NxYWhHcGN3 VmRiVmdoCnFLYW92N2M5R0ZZbHVOcmZCTytXaTB4TFEzRVlDUHR1UCtkaW9uaDBC em92MEdRa2EyK2RzcjlqQWp4RnVUbXMKTVBUR21ucndUZVFUNzJuNEUwSFlyblRp ZUpHcWFScmNGREV3MThlYmVudHVwZ1paaVd6d2xuYXdPL2xJRWF5OQpUZVQxZVVI OTBTZzE3b2MvTjRTbVFWUEpZL1JRNFpSQkYxekRBVXZMbGlKTTBBNlY0dFBaTjVN TzJLV0NWU2o4CjVHemFRRzlucEZ4YkZHU0VkSERSNmljOXR2Y0l3cWR1QmY4QVZL NG9aUFErNjc2QmhCRW1lSmtjOGlKZUlpdlQKWElTcUpTY0ZLNWRHSktSQUI2Z0VH RDFGZEw2d3ExUjlPUEgrZnQ2Z3B3bjV3QlV1Z2dMaEdFVWx2M3QyZW1UMgprUEZK eVQ1VkZXTjFhUElvd0hXckJ3cEdkdGVNOU1DbS90NDVtZUd0Z2JFL21IQVo2b0dB Y3FFdUw0bkhOaXFJClRzaWcwR1daajc4ZUE1d3ZyUkNhRGpVSTJOUXcvTExjc0c1 ZGJ1ZWpUZVFJMERvT1NQSHRkcHVVY3VyV0ExWjIKZkUzVERmOU9ybXJ3bHJycnJK NkI4MFJPMU5LbmIzaDlEZjJDZVVraVA2dFBsSncvUkl0KzA1c2pwcmlNb0FxaAo3 UWdEVVZ4dlIzWGFjYnlhVlRmR3hOMVVXWnBjSThzclR0dGFJaW1YYUUrRm8yWStm a0FDMmMzREJpSGRHUXlZClBBeUpUZEMyYk4zOW1YWFUvSkwzNnkxem82VlJrbHRO WDJYUzl1ZXhEd3Y2N1VLZGVKYk8wOWdkQUwzYTNtc1UKb1RvYk5LdEp4UWdPSUpv MU42NnZ6TU1DQXdFQUFRPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCjsxNTpt ZW1wa28uY29tOjgwODA=

This is an awesome idea! I had been thinking last week about how to build a distributed package manager, and a platform for running scripts attached to the package was an idea for later. So neat to see a distributed app platform, but odd how similar ideas seem to pop up at the same time.

I often feel there are no original ideas. What influenced me to make firestr was various things. The work of Alan Kay is a a big influence on me. I need real version control in Firestr and have been thinking to integrate git behind the scenes, or something similar. You are welcome to help!

Also in this space: https://github.com/ricochet-im/ricochet - seems to have some pretty notable people involved.

So are the locators federated somehow or are they isolated islands?

Hi, the creator here. The locators are NOT federated. This is by design if you want to have a completely private network. Also, I haven't had time to implement federation. If this is something that interests you, you can help implement it if you want. The locator is less than 300 lines of code, so it should be easy to understand. My long term plan is to use a protocol like telehash instead of my own hand rolled one. However, you can have as many locators in your client as you want. So this way, you can have redundancy.

It looks somehow promissing in concepts but I am afraid all such a platform needs a clear mobile story today..

On Android you could accomplish this, but iOS has some fairly inane restrictions around running any type of VM. It's enforced somewhat arbitrarily, but it lets Apple yank any VM or app-hosting type thing on their whim. It was originally put into place to keep Adobe Flash and Air off iOS.

I also disagree that you always need mobile for everything. This seems geared toward communicating and collaborating, so yes mobile would be a must for mass adoption. But if it's geared toward devs or professional work that's not necessarily true.

This is very interesting. Great work!

Could someone post screenshots? (OS X if possible, but any platform would do)

If you scroll down on the main website, http://firestr.com, you can see some screenshots. Animated gifs actually.

Wow! I did not realize there was more on the website. Thanks!

Reply on news.ycombinator.com