Slashdot Mirror
Nullsoft's Waste: Encrypted, Distributed, Mesh Net
Myriad writes "Nullsoft, makers of the venerable Winamp MP3 player, released today a secure, distributed mesh-like networking protocal and platform called Waste. This v1.0 beta release uses RSA (key based) and Blowfish encryption for security, and features Instant Messanging and group chat, along with file browsing, searching, and transfer. Waste has been released under the GPL, with source and binaries available here."
Happy to see the spirit of Free Software continues thrive. We've been seeing too many proprietary offerings of late. I'm glad that Nullsoft is "with the program". This is a great idea, and they deserve our support.
Designed for small groups of people (up to 50)
It allows easy colloboration across firewalls, and only one user inside the firewall is required to allow all users inside access to the mesh.
Each link is encrypted, but each message is decrypted and re-encrypted at each hop of the mesh, so you have to trust all of the nodes. It's also very hard to drop a node onc it is trusted, as each node shares public keys around to make sure all nodes have all public keys. Initial connection to the mesh requires manual key exchange. PITA, but moderatley secure.
All network traffic is encrypted, it will flood each mesh link with a minimum amount of bandwidth to foil traffic analysis.
That's W A S T E, not 'Waste'.
oops now i realise it is for small secure/private networks - sounds good for VNC type stuff.
Well, the Windows version has the GPL in the 'Accept/Don't accept' stage of installing the app, if that means anything to you.
Yes, Nullsoft originally created Gnutella then parent company AOL forced them to stop development, but the cat was out of the back and code was leaked/reverse engineered.
Winamp 2.9 is the latest release of the Winamp 2.x codebase, which takes most of the good ideas that went into Winamp 3 and codes them back to an API free of excessive abstraction. It's been out for weeks, if not months. Check your facts before posting.
If you don't pretend to be anyone, are you?
uhh, waste is for small workgroups only ..
it's not about p2p file sharing, rather it's a colaborative tool.sure, you could use to to share illegal stuff, but it's really no different in that respect to email, icq, whatever.
nostrils
/joeyo
2^5
Quoting from the source:
Indeed, here is the original slashdot story. Of course AOL quickly ended development at nullsoft, it lived on after the protocol had been reverse engineered and others picked up where nullsoft left off.
As a matter of fact, Gnutella has nothing to do with Nutella, except for the similar name.
As you already pointed out in your links, Nutella is a chocalate spread. It is a FOOD item.
Gnutella is a SOFTWARE item. It is used for P2P (point-to-point) networking. Usually, Gnutella is used to distribute music, although it can be used to distribute any files.
I hope this comment has been helpful in clearing the matter.
Firstly, the WA2 group backported the two major features of WA3 (video support and the media library) to WA2 and released it as WA 2.9. Development continues on a hybrid tree under the working title WA5 (2 + 3 == 5).
Secondly, not everyone shares your idea of "what they need to do". Winamp is a nice media player, but nevertheless just a media player; to many people, a protocol that facilitates cryptographically secure collaboration is infinitely more useful.
Thirdly, I'm not clear on what obligation you think Nullsoft owes you even when they're on company time, but I wouldn't be surprised if WASTE was written in spare time--you know, for fun.
Try searching on 'GNU General Public License' Einstein.
-Malakai
A Dragon Lives in my Garage
WASTE is a software product and protocol that enables secure distributed communication for small (on the order of 10-50 nodes) trusted groups of users.
WASTE is designed to enable small companies and small teams within larger companies to easily communicate and collaborate in a secure and efficient fashion, independent of physical network topology.
Some bits of information about WASTE:
RedHat has apt-get support, although not out of the box.
http://shrike.freshrpms.net/rpm.html?id=393
Don't worry DebianTroll, I will try Debian soon... I have heard many great things about it. My modem connection only achieves 50.6 kbps maximum. I will try to get a copy of Debian 3.0r1 at the next Melbourne Linux User Group meeting.
http://www.mlug.org.au/
Mike
Looks like you not only have to trade public keys with your friend, but somebody needs to have WASTE on a public IP with port 1337 open.
If your not scared of Beta software, there's an IRC client that supports encryption for queries and even channel messages. You do have to share your key with whom ever you want to be able to read your messages however.
It's KVirc 3 over at www.kvirc.net.
It's primarily writen for KDE/Linux but they also have a pre-compiled Win32 stand-alone.
__________________________________
Free your mind - Flush your toilet
the code wasn't "leaked" or "reverse engineered" the code was released under the GPL on nullsofts website at the same time as the executable.. exactly the same way as this program has been handled.
They most likely knew aol wouldn't like gnutella at all.
Eh, yes it does. Otherwise I'd have a lot more connections open while talking to people than just the one single connection to AOL's server. Hence the 'direct connect' button, which then DOES establish a direct connection to the server. Also, ICQ now uses modified versions of the AIM protocol(s) anyway (or at least, can run on them), so all ICQ traffic prolly goes through the servers too.
I bet the other networks are the same. MSN, Yahoo, etc. Direct connections are a bit slower to start up, and a bit more of a security risk, since you now know the other person's IP address.
As much as I love Jabber, that's simply not true. Jabber has no widely implemented encryption between all links, and file transfer is not exactly its strong side.
Someone is wrong on the Internet!
Oh darn. Looks like they used some homebrew crap for their bignum stuff.
Common LibTomMath is like a billion times faster [not to mention very well tested]....
Plug plug plug!
http://math.libtomcrypt.org
Tom
Someday, I'll have a real sig.
i'm going to bite my tongue about "leeches" and actually help a bit here.
:) good luck!
reading the docs, it becomes apparent that in order to connect to other people, you need to know their public key, and vice versa. i'm paraphrasing, but that's essentially it
Dammit, I meant to post that anonymously!
Well there is a whole network, silcnet, that builds upon irc but makes it safe. It not that far away from 1.0. http://www.silcnet.org/
So, if you are a jabber client developer or intend to become one, see this article for a proposed handling of Open PGP -type encryption.
Code is Speech. No to Censorship.
You need at least one other client running somewhere.
You both need to enter each other's public key into your client to get started. This step shows that you "trust" one another.
Anyone else who wants to join your "network" must also enter one of your existing network members' public key into their client and have that existing member enter the new user's public key into *their* client. This step automatically makes the new person "trusted" by all the other members of the network - the important part is that you don't have to explicitly swap public keys with EVERYONE - just with one member of the network. The client does the rest once you connect to the network - see below.
Now, to get started and initially connect to someone's machine, enter their hostname or IP address (not their "username") into the "Network" window. This primes your client - it will then discover all it needs to know about the other members of the network, since by default, each client will be broadcasting discovery information (usernames, hostnames, public keys).
The "Browser" window shows all the users in the network, but currently ONLY if they are sharing one or more files. So, get each person who joins the network to share at least a test file so that they will always appear in everyone's "Browser" window.
Right-click on any names in the browser window to start interacting with them.
HTH
1337 = l337 = leet = elite
Somewhat commonly used to refer to something as good; as in:
"l337, this WASTE thing does exactly what I want"
This is just plain wrong. The source was never available, leaked or otherwise.
The protocol was reverse engineered, with a little assistance on IRC from deadbeef.
SecureIM only do encryption. There is NO way with SecureIM to be sure that you are talking to the right person.
It would be very easy for some network admin to do a man in the middle attack by intercepting all the trafic between you and your buddy (with the initial key exchange) without you knowing anything about it.
Having a false sense of security is worse that knowing that your communication is NOT secure.
A better way, would be to use PGP to enrypt your communication with your buddy. At least, if your are confident you obtained your buddy real public key, you know you are talking to the right person.
Alright, I think I'm figuring this out. Lack of documentation is something of a hinderance here... It really boils down to there not being any kind of initial configuration system on the server side, so you do all the keygen and profile creation on windows and copy stuff back and forth. Ugly. But, I guess it *is* alpha (though maybe it should be 0.1 rather than 1.0...)
It's compiled (I just made the changes shown elsewhere in this thread). Start up the windows version, create a private/public key pair (using a *server* passphrase, as this will be moved to the server). Oh, also copy the profile (default.pr0) from the windows box to the wastesrv folder, modifying and deleting stuff as appropriate within the file (like I deleted my nickname, etc.)
Export the private key to a file. Move that file to "default.pr4" in the wasteserv folder. Copy the public key to the clipboard, paste that into a file called "default.pr3" in the wasteserv folder (I changed the nick on that line to "server").
Go back to your windows client, and create a *new* private/public key pair, then copy that public key, via the clipboard, to the default.pr3 file, leaving your nick intact.
Copy the public key for the server to the windows client, importing it via the preferences panel. (this was the public half of the first key pair you created, which is now the server key).
Hit the network button, enter your server's IP in the drop-down field at the top, hit connect, and, maybe, it'll work. Maybe.
'course, I'm the only person on my server, so I'm not seeing anything. Gotta get someone else to try this too.
Hope this helps....
Yes, here's a little background on gnutella and the protocol.
I remember watching on Dateline a couple years back about a murder trial, and apparently one of the major pieces of eveidence was a saved AIM conversation. They got one the AOL execs to testify that there was no way of verifying if it was a real transcript because AOL doesnt keep logs.
I think theres an sf project do do AIM sniffing though, but still, AOL doesnt log your conversations.
And what's wrong with that? You're exchanging your public keys.
From the Waste setup guide:
8. At this point you should copy your public key to the clipboard using the button labeled "Copy my public key to the clipboard" and then paste it into an email/IM/whatever to give it to the person(s) you wish to connect to.
9. You should also acquire the PUBLIC key of the person(s) you wish to connect to via some means, and then click the "Import public keys..." button in order to import their PUBLIC keys. Once you import their PUBLIC keys, there should be a message in the setup wizard telling you how many keys are loaded total.
Also, this is technology that might be very useful to AOL. AIM's big drawback is that it's not very secure, and really shouldn't be used for sensitive corporate communication. (Though the engineers at my last employer used it anyway.) AOL could persuade people that are already using AIM for free to upgrade to WASTE in order to secure their communications. Not to mention the other features.
We Await Silent Trystero's Empire!
yeah, the root of this is a #define for socklen_t in the non-win32 code (which is already typedef'd in system headers). my solution was to put a #ifdef POSIX around the define.
You can be an atheist and still not want to succumb to some weird cross-over sheep disease -- AC
my server's public keyserver name is entheal.com (you may have guessed from the public key
You can be an atheist and still not want to succumb to some weird cross-over sheep disease -- AC
Also Irssi and ircII have IDEA patches and they work really well too, been using them for year or two now.
- Raynet --> .
I threw up a forum for people who would like to list their public nodes here
Str8Dog
using System.Darkside; public
This code actually does work, with this patch you are able to both transfer files, connect, and chat.
The tricky thing is to set up the server properly.
The easiest way is like someone else pointed out to make a new profile in waste, (copy your own default.pr* files out of the way first).
Then, add your public SERVER key to your public-key list in the windows-client. And add your public-windows-client-key to the list of keys of the server.. (default.pr3).
Dont forget to NOT use a network name ( or make sure they are the same in your default.pr0 files).
If you want to join my server contact me on icq: 706826, or see http://waste.mjoelkbar.net/ which will be online soon.
Wrong url:
http://grazzy.mjoelkbar.net/waste/
Actually, Justin IS in the credits for Winamp3.
He is listed under "Additional programming" which is the third set of credits.
I guess AOL found out again...
AOL must not like W A S T E either. it's been pulled and there's no trace of it on the nullsoft site. hope someone mirrored it...
while perusing the winamp forums, I found a mirror:
waste installer
waste source
You'll have to register for the WinAmp forums first.
Not sure if the poster hacked/altered them first, but at least something appears to be there. I was unable to grab the installer earlier, but I did grab the .zip for the sources earlier. The .zip I grabbed earlier and the .zip posted in said forum match according to the cmp command.
I'm gonna build from the sources myself rather than run the posted .EXE.
The URL provided is 404.
Looks like they did it again, got AOL Time Warner scrambling and they pulled the plug. (Same thing happened with Gnutella, remember?)
Waste is here
Contents of the file are as follows;
This will be up until it's not. Enjoy! :)
--Pete (peteg [at] sifnt dot net)I've put up another mirror here.