Why Freenet is Complicated (or not)

JohnBE writes "'This article is primarily a friendly rebuttal to Steven Hazel's CodeCon 2002 talk entitled "libfreenet: a case study in horrors incomprehensible to the mind of man, and other secure protocol design mistakes". Hazel presents the Freenet protocol as an overly complicated, self designed crypto layer. In fact, though somewhat complicated, literally every step in the protocol was carefully thought out to resist certain attacks and to increase certain properties desirable for Freenet operators and the network as a whole.' Interesting in light of Peek-a-booty, this article covers many of the issues involved with creating a anonymous P2P system."

Comments

A little honesty is refreshing sometimes

[Tri0de]

(from the article) ...
Some perceived minor irritations may arise due to the implementation of Freenet in Java. Java is not like C, so some porting issues are bound to arise. Porting is hard sometimes.

Re:A little honesty is refreshing sometimes

[grammar nazi]

In paragraph specifically mentions that the security model is overly complicated. For comparison...

Microsoft's argument for a long time was that Java's security model was overly complicated. ASP, by contrast, had a simplified security model. Either an ASP executes scripts locally, or it doesn't. Thus ASP does have a simple security model.

Now... which security model will be suitable for your projects? Which security model is potentially better for the client browsers?

I am extremely familiar with freenet and I can tell you that the current security model is very *robust* yet I feel that it is very streamlined. By contrast, napster's security model was simple. So Mr. MP3 Pirate, which security model would you prefer? Do you want to continue to enjoy music or would you rather get nasty letters from the MPAA/RIAA and get your cablemodem shut off.

An Overview of Freenet

[jACL]

Here's a quick overview of Freenet, if you need to get up to speed.

Re:I could have sworn I read this verbatim before

[Salamander]

It was posted on infoAnarchy before it was published on kuro5hin (1:15am EST vs. 2:25am EST). It might have been posted elsewhere, or sent via email. Someone's sure going out of their way to get publicity.

Kuro5hin artical as well.

[autopr0n]

This was also posted to another scoop site, kuro5hin :)

For those of you who care, Ian Clark also commented on the story himself(1 2 3 4 5)

No kidding.

[autopr0n]

Its just so wrong for that scgmille to copy so blatently from that poorscgmile guy. er. wait...

Re:Freenet is not perfect!

[JohnBE]

I agree with you in respective of the "fuck you" attitude of the developers, that is their perogative, but I think it is counter productive to one of their goals which is widespread acceptance.

I really beleive that good documentation coupled with good code is the reason that some projects prosper and others fail. Maybe they have the balance right, the system is ludicrously easy for Windows users now. On the plus side:

They have a Wiki system on their homepage which allows you to add to the documentation easily (had this been available 6 months ago I would have)

The code is nearing a stable level (Datastore bug gone)

Usefull non-Pr0n applications are been developed such as Frost.

Re:Java sucks and I'll prove it.

[_underSCORE]

Why do I feel the need to defend java on slashdot? Here I go again:

Java is slower than C, yet less powerful than C++.

Yeah, that's a testable statement. Most of java's use is network-bound programming, where pure speed isn't an issue, but it's excellent networking library is a benefit. No one is coding an OS in java.Add to this the fact that java 1.4 is on part (except for GUIs) with C++, and you have no speed issue.

Java is portible but so is C#, C, C++.
Java is binary portable which is a huge advantage. I can take compiled code from one architecture, and run it on another. Do that in C or C++. Hell, you can't even run a complete C# program in solaris now, so much for the common run time.

Java currently doesnt seem to be a match for C#

Is that why C# is an almost exact syntatic copy of java? Is that why the architectures and security models are almost the same? Which language has more users now? Which actually has deployed code running in production?

Java is ok, but i have yet to see a successful project written in java.

Have you heard of Tomcat? That's a moderately successful java project. Also, many real businesses use java on the web layers. I guess those don't count as 'successful projects', but they should count for something. The fact that there are relatively few java projects has more to do with the open source community being stand-offish regarding java, and not with language faults.Just posted on slashdot a couple of weeks ago: Root Node Live, which is a java project (brought to you by konspire) helps people trade jam-band music.

Re:I agree

[bnenning]

C would have been the language of choice simply because more people know C than java, porting would have been faster.

It's much easier to write network applications in Java than C, and cross-platform compatibility is far better. Performance is another matter, but apparently they would rather make it work first and then make it work faster, which is entirely reasonable.

While I konw C, i dont know java.

There's your problem :) I know both, and in my opinion Java is a much better choice for what Freenet is trying to do.

Re:Freenet is not complicated

[jon_c]

I can't really comment on mojonation as last time i checked they didn't have any real documenation on how it actually worked, but Gnutella is way simpler then Freenet.

I wrote a gnutella client in one night, when gnutella first hit the net people had already figured out the protocol and we're writing clients for it within days. There are only about 5 different commands in Gnutella, i have no idea how many freenet is. But i have attempted to understand more then just a high level concept and found the details to be confusing as all hell.

anyway,

-Jon

Re:GnuPG???

[LinuxHam]

The purpose of GPG is either to encrypt data specifically for one person, certify exactly who created/encrypted said data, or both. Freenet was designed to encrypt data for anyone while guaranteeing anonymity of the submitter.

Yes, you could use GPG to encrypt with a symmetric key and just not sign it, but you'd still need to build an infrastructure around it. Freenet wants "plausible deniability" for the hosting server, making it impossible for anyone to decrypt the data as its stored on the disk. A symmetric key with GPG would be immediately decryptable.

Re:Java sucks and I'll prove it.

[wurp]

Java is ok, but i have yet to see a successful project written in java.

Wow, rarely have I seen such a ridiculous statement. J2EE is incredibly widely used for internet businesses of all kinds. In this time of declining job options for programmers, java (well, J2EE, anyway) programmers are still somewhat in demand.

I have worked on many successful java projects. Xtra Online, Marconi Communications, and PDX, are just a few of the companies at which I have worked on successful java projects.

Business software is generally about reliability. Computers are easily fast enough to do any kind of business calculation blindingly fast in virtually any language, and Java is fairly speedy. Java has great reliability (no buffer overflows, no uninitialized pointers, no stack overflows, no doubly-deleted pointers, etc, etc).

If you think java is too slow for business applications, the game we are working on over at http://www.cosmgame.com is all in java. I get 50-100 frames per second in full screen 3d mode, all running under java. I shit you not. We will be showing it at the Game Developer's Conference in San Francisco March 20-23rd at Sun's booth.

Virtually no business application has anything vaguely close to the kind of performance requirements we have, and we run just fine.

See you at the GDC! ;)