Slashdot Mirror
Nullsoft's Waste: Encrypted, Distributed, Mesh Net
Myriad writes "Nullsoft, makers of the venerable Winamp MP3 player, released today a secure, distributed mesh-like networking protocal and platform called Waste. This v1.0 beta release uses RSA (key based) and Blowfish encryption for security, and features Instant Messanging and group chat, along with file browsing, searching, and transfer. Waste has been released under the GPL, with source and binaries available here."
Didn't they make Gnutella too?
AOL Time Warner (IIRC, owners of the second biggest recording company, not to mention one of the major recording studios) owns Nullsoft, which releases a program that the RIAA and MPAA will undoubtedly call a tool whose sole purpose is to illicitly distribute copyrighted works....
A cliche regarding:
...comes to mind.
Makes you wonder how long it will be until protocols/network designs are attacked on the same basis as the product derived from them. ie p2p/filesharing.
Considering nullsoft, might be a risky move.
Going through the documentation, I found this:
From here
Note: It might be worth implementing WASTE using a subset of SSL, to avoid any concern of flaws in this protocol. Feedback is gladly accepted on any potential weaknesses of the negotiation. We have spent a decent amount of time analyzing this, and although we have found a few things that are not ideal (i.e. if you know public keys from a network, you can sniff some traffic and do an offline dictionary attack on the network name/ID), but overall it seems decent. The current implementation probably needs work, too.
Which suggests to me that it isn't worth rushing out and developing application with *just* yet, until further reviews have occured (and the protocol has matured/evolved).
Man watching 6 MSCE's around a sun box, looks alot like the opening scene's of 2001:space odyssey...
I read the article and immediately got excited. I downloaded all of the software and had it all setup and working within a few minutes. As of right now I'm living in an apartment and have no practical use, but on Monday I'm moving into my dorm room to start my summer class (bleh!) Anyway, I think this is so wonderful! I've been thinking about a secure network computing solution for my three computers when I'm at school. I have my server, workstation, and my laptop that I'd like to tie all together. The leading choice was vpn, but after playing around with this, I do think that running on my server and having the three of them connect to it, and maybe a few of my friends computers on campus, we can create a very nice, effective, small, and secure lan. Then again, after five minutes I haven't decided if the whole reinventing of the wheel is worth it. I'll probably try it out, and setup a vpn server too, and see which I like more.
--fetch daddy's blue fright wig, i must be handsome when i release my rage
while you can. Remember what happened when they first released Gnutella? If I recall, AOL forced them to pull it within hours (though it was already completely reverse-engineered almost immediately afterward).
Designed for small groups of people (up to 50)
It allows easy colloboration across firewalls, and only one user inside the firewall is required to allow all users inside access to the mesh.
Each link is encrypted, but each message is decrypted and re-encrypted at each hop of the mesh, so you have to trust all of the nodes. It's also very hard to drop a node onc it is trusted, as each node shares public keys around to make sure all nodes have all public keys. Initial connection to the mesh requires manual key exchange. PITA, but moderatley secure.
All network traffic is encrypted, it will flood each mesh link with a minimum amount of bandwidth to foil traffic analysis.
That's W A S T E, not 'Waste'.
You're right. But you have to remember that, by the brief look of it I got, makes PGP-style stuff a lot easier. And what do most people use IM's for anyway? To chat to their friends? You bet. It wouldn't take long to develop a web of trust of, say, your entire school or workplace. But you're also right, it won't gain wide acceptance unless there's easy way to connect to the "network".. I just opened the "Network status" dialog, and what do I type in? Nothing right now, until I can get someone else to load it up.
I think this is meaningful, as it is an ad-hoc way of creating aa VPN. Also it would probably be faster if a few of the nodes have fast connections. If your friends don't see a reason behind this, then maybe it is not meant for your circle of friends. About the anonymous issue, note that Freenet already exists and works to handle that problem. This is meant to address a completely different issue
Resolved that: Gnutella aside, this technology is really a direct shot at Groove Networks, the company founded by Ray Ozzie of Lotus Notes fame to sell P2P-derived technology to small and large business.
Discuss.
If you don't pretend to be anyone, are you?
The next time you want to have a chat with a friend, but you don't exactly want the contents bouncing all over the internet in plaintext, this looks like the perfect application. Reminds me somewhat of a program called SIMP, which is a minimalistic Blowfish-ized IM program.
"BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
Thanks for the link!
:-)
On their site I found a program called Beep. It makes noises on keyboard/mouse input
http://www.nullsoft.com/free/nbeep
It gets annoying after a while, but it is 'cute' enough to impress my girlfriend. And that matters as much as keeping my RedHat system up2date. LOL
Yes, Nullsoft originally created Gnutella then parent company AOL forced them to stop development, but the cat was out of the back and code was leaked/reverse engineered.
Winamp 2.9 is the latest release of the Winamp 2.x codebase, which takes most of the good ideas that went into Winamp 3 and codes them back to an API free of excessive abstraction. It's been out for weeks, if not months. Check your facts before posting.
If you don't pretend to be anyone, are you?
as long as it has those uber-bitchin' skins, i'm in.
well, it's nothing one behind the ear wouldn't cure
Quoting from the source:
The problem that we have here is that this network is NOT for piracy and therefore a lot of slashdot readers cannot see the use for it. Think instead of people working together - a workgroup as it where. For example why pay rental fees on an office when you can have a virtual one using tools such as this? Now I am not sure how great this tool is for that right not (I'm guessing - first release - not very) but I am sure it will come if people start using it.
Firstly, the WA2 group backported the two major features of WA3 (video support and the media library) to WA2 and released it as WA 2.9. Development continues on a hybrid tree under the working title WA5 (2 + 3 == 5).
Secondly, not everyone shares your idea of "what they need to do". Winamp is a nice media player, but nevertheless just a media player; to many people, a protocol that facilitates cryptographically secure collaboration is infinitely more useful.
Thirdly, I'm not clear on what obligation you think Nullsoft owes you even when they're on company time, but I wouldn't be surprised if WASTE was written in spare time--you know, for fun.
Listen port
;-)
Listening on port 1337
Somehow I think this is a very well chosen port...
coffee | nose > keyboard ©
Did nullsoft do this to thumb its nose at Aol? It was released May 28th 4 years after Aol paid a nice sum to buy Nullsoft.
Try searching on 'GNU General Public License' Einstein.
-Malakai
A Dragon Lives in my Garage
In "The Crying of Lot 49", which is a nice short fast spacy read, there's a plot thread about competing mail services and a conspiracy that conducts its private communications in a way that, if you refer to the name of the product as "waste" rather than "W A S T E", indicates you're clearly not part of their group. There are also email systems called "Trystero" for similar reasons, and it makes looking at post office boxes in Scandinavia quite silly even without sampling the local agricultural products.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
put on your conspiracy hats...
Think of it this way, these guys know probably better than anyone else NOT on the AOL IM team, just how much of IM conversations are monitored, logged, mined for information, media metrics...etc.
Not to mention, they work in that environment, they prolly want to be able to say "god damn, our executive VP is a bitch" and not have some network engineer provide a log documenting that conversation later.
Yeah, i wish it scalled, but wtf, its opensource. Go make it scale. For now, 10-50 is plenty for most groups of online friends.
Personally, I'd loved to see technology like Pastry get hacked into it.
-malakai
-Malakai
A Dragon Lives in my Garage
How many minutes before we can see the first Linux port (it works under W$, FreeBSD and MacOS X) ?
theefer
...owns Nullsoft, (as already mentioned by leviramsy) but an interesting theory had been presented to me, suggesting that AOL Time Warner has for some time been planning to trump Apple's iTunes store. Maybe they are planning to power such a service with peer networking? I have never beleived this personally because AOL Time Warner would just as soon want to have everyone surfing from the same servers anyhow, and a decentralized system would only tax their bandwidth more. Maybe...maybe they will release such a service that utilizes both p2p transfers in combination with traditional server-to-client transfers, and maybe use it as an advertising platform for AOL, giving AOL users better functionality, or maybe even restricting server-to-client transfers to AOL users once the service becomes popular. Does anyone else think this idea is bogus? I find it hard to beleive, but I can't figure out how else Nullsoft could be /allowed/ to create this new service.
---
WE AWAIT SILENT TRISTERO'S EMPIRE.
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
I'm suprised no one has mentioned the obvious. This is a terrible blow to the RIAA and the all the people who have been trying to sue filesharers into oblivion.
There are two uses I see for this:
There are going to be groups of people dedicated to one theme, for example, Horror Movies, or Horror Movies with mutant bees, sharing all their Horror Movies, you will need a certain ammount of Horror Movie Uploads for Downloads and noone will ever be to know you had Queen Bee 1-3.
If you replace Horror with new release you get lots of small miniDonkeys, many interconnected and unstoppable.
I'm convinced this is a revolution in filesharing because it solves the two biggest Problems filesharing has, crappy downloads and getting sued.
The downloads will be of really good quality beacause you will be sharing with friends of people you know from chatting and if the put crap in their upload directory they won't be one of your cirle of friends much longer.
Getting sued is obvious, noone will be able to tell what you are doing (the might be able to guess that all those people on cable are not running a vpn yet) as just your circle of friends know. There is still the possibility that one of your friends is a traitor but i would call that a rare chance.
Looks like you not only have to trade public keys with your friend, but somebody needs to have WASTE on a public IP with port 1337 open.
If your not scared of Beta software, there's an IRC client that supports encryption for queries and even channel messages. You do have to share your key with whom ever you want to be able to read your messages however.
It's KVirc 3 over at www.kvirc.net.
It's primarily writen for KDE/Linux but they also have a pre-compiled Win32 stand-alone.
__________________________________
Free your mind - Flush your toilet
Beleive it or not, but they're not trying to sell it. You only need marketing if you plan on selling it.
Paul Anderson
"I drank WHAT?!" -- Socrates
I goofed, and grepped for "gpl". "gnu" would have been a better grep term.
However, there's still the rsa directory, which contains stuff not compatible with GPL. (Which puzzles me...since waste is GPL'ed, why didn't they use gmp for the math, or whatever gpg uses?)
To the MPAA, 50 nodes running on a fast network means there are really 300 wicked infidel filetraders!!!!
liqbase
Eh, yes it does. Otherwise I'd have a lot more connections open while talking to people than just the one single connection to AOL's server. Hence the 'direct connect' button, which then DOES establish a direct connection to the server. Also, ICQ now uses modified versions of the AIM protocol(s) anyway (or at least, can run on them), so all ICQ traffic prolly goes through the servers too.
I bet the other networks are the same. MSN, Yahoo, etc. Direct connections are a bit slower to start up, and a bit more of a security risk, since you now know the other person's IP address.
Is it called wasted ?
As much as I love Jabber, that's simply not true. Jabber has no widely implemented encryption between all links, and file transfer is not exactly its strong side.
Someone is wrong on the Internet!
I think hundreds or thousands of coders thought of this shit, especially when Napster got shutdown.
I personally came across it when removing a section of my P2P anti hacking designed for Diablo 1 to be secure even without a central server.
Interestingly enough, I was going to call my Gnutella: Dumpster
Which is cool they're naming their software: Waste
Lets see how it turns out
God spoke to me
WASTE is something that is indeed very useful for small company or teams (especially dispersed teams) in larger organizations. In many places one or another IM system is being used to communicate with team members. Over ICQ or AOL contracts and employment conditions are discussed, remarks about contractors and clients are passed etc. That is a huge security leak if you look at it from a certain prospective, especially for some profiles of companies like small consulting firms with employees regularly using clients networks. WASTE is a simple to use and free method of closing that leak.
I know at least two small companies that should adopt WASTE immediately and I would advise them to do so. One is a PR company with 2-10 people offices around Europe, where ICQ is frequently used as a discussion medium. Other is a small consulting company. Someone eavesdropping on their ICQ chats could seriously damage both of them.
Oh darn. Looks like they used some homebrew crap for their bignum stuff.
Common LibTomMath is like a billion times faster [not to mention very well tested]....
Plug plug plug!
http://math.libtomcrypt.org
Tom
Someday, I'll have a real sig.
You need to have friends, dude! :-)
zWhat would an EWOULDBLOCK block, if an EWOULDBLOCK could block would? -- me
The software looks great and installed like a dream but How can I test it?
How can I point it at a node that will allow me to try it out? I ask this because what if someone is on the internet and needs to connect to me network. How do I point them to my network?
You say things that offend me and I can deal with it. Can you?
i'm going to bite my tongue about "leeches" and actually help a bit here.
:) good luck!
reading the docs, it becomes apparent that in order to connect to other people, you need to know their public key, and vice versa. i'm paraphrasing, but that's essentially it
Dammit, I meant to post that anonymously!
"Initial connection to the mesh requires manual key exchange. PITA, but moderatley secure."
IIRC, key exchange is where most encryption schemes fall down. If this ever takes off I'd guess 99% of users will trade keys over plain ol unencrypted SMTP.
Nice summary though - this really does look interesting.
No, I did not read the f***ing article!
Well there is a whole network, silcnet, that builds upon irc but makes it safe. It not that far away from 1.0. http://www.silcnet.org/
. "I waste you when I get home"
. "Have you been wasted today?"
. "Be right there... just let me waste someone..."
and so on and so forth...
\m/
So, if you are a jabber client developer or intend to become one, see this article for a proposed handling of Open PGP -type encryption.
Code is Speech. No to Censorship.
--- Often in error; never in doubt!
Also, this is technology that might be very useful to AOL. AIM's big drawback is that it's not very secure, and really shouldn't be used for sensitive corporate communication. (Though the engineers at my last employer used it anyway.) AOL could persuade people that are already using AIM for free to upgrade to WASTE in order to secure their communications. Not to mention the other features.
We Await Silent Trystero's Empire!
yeah, the root of this is a #define for socklen_t in the non-win32 code (which is already typedef'd in system headers). my solution was to put a #ifdef POSIX around the define.
You can be an atheist and still not want to succumb to some weird cross-over sheep disease -- AC
my server's public keyserver name is entheal.com (you may have guessed from the public key
You can be an atheist and still not want to succumb to some weird cross-over sheep disease -- AC
While on the surface, this might seem like a reinvention of IP tunnelling and VPN's, there are a couple of important features bundled in that set it apart:
1. It turns each node into a router. While you can establish a VPN with other tool kits, you still have to enable and configure the routing manually.
2. It's entirely user-land - it's a standalone program that a user can plop on their machine and be on their way.
The best part about it is that you can get through firewalls. The worst part about it is that you can get through firewalls.
Most people are pretty polar in their opinions of firewalls, with most of those people seeing them a fascist mechanism to control what they can see. In some (perhaps most) cases, that can be true. However, firewalls are much more than that: They can (and often are) used to protect YOU, the clueless end-user, from the other bad people on the Internet.
After I clear out counters on firewall rules, it's not uncommon to see 10-20 (sometimes more) incoming attacks within 5 seconds.
So, this will be great for letting people browse the web from work. On the other hand, it will expose them to propagation of worms and attacks which would have otherwise been caught by the firewall.
Is this a good program? Overall, I think that it's a good thing that NullSoft created it. We simply need to realize that with all of the benefits it brings, it will also bring a few negatvies with it.
steve
Oh, you're not stuck, you're just unable to let go of the onion rings.
Also Irssi and ircII have IDEA patches and they work really well too, been using them for year or two now.
- Raynet --> .
I threw up a forum for people who would like to list their public nodes here
Str8Dog
using System.Darkside; public
Probably the same company that made the PIMP (and afterwards the SuperPIMP) install system...
.ASS archive, similar to a tarball. No, I'm not kidding. Check it out.
And let's not forget the program packass.exe, which creates a big
Buncha hooligans.
Ah! I love this book! I about jumped out of my seat as soon as I saw the trumpet icon :) ...but isn't it supposed to be a muted trumpet?
Nevertheless, it's a great name choice....
I guess AOL found out again...
AOL must not like W A S T E either. it's been pulled and there's no trace of it on the nullsoft site. hope someone mirrored it...
while perusing the winamp forums, I found a mirror:
waste installer
waste source
You'll have to register for the WinAmp forums first.
Not sure if the poster hacked/altered them first, but at least something appears to be there. I was unable to grab the installer earlier, but I did grab the .zip for the sources earlier. The .zip I grabbed earlier and the .zip posted in said forum match according to the cmp command.
I'm gonna build from the sources myself rather than run the posted .EXE.
The URL provided is 404.
Looks like they did it again, got AOL Time Warner scrambling and they pulled the plug. (Same thing happened with Gnutella, remember?)
Waste is here
Contents of the file are as follows;
This will be up until it's not. Enjoy! :)
--Pete (peteg [at] sifnt dot net)I've put up another mirror here.
The other fun part was that, the day after the Gnutella debacle, they managed to sneak in a mention of Nutella (and a picture of it!) into their "Ask Nullsoft" section. I wonder if they'll do something similar with WASTE?
Coincidentally, see also this lecture on this history of Gnutella (warning: PDF), or its handy Google HTML-ized version.
Jouster
Both the Download Page and the Security Page aren't accessible.
This bring the question of whether WASTE have been removed from nullsoft.com, or not?
Muchas Gracias, Señor Edward Snowden !