Entropy Project Closes Up Shop

k0fcc writes "In a disappointing move to privacy enthusiasts, the Entropy Project's creator has released a statement that the project is shutting down. Entropy was a very popular, and some say faster, alternative to Freenet which supported a number of different cryptographic protocols. The creator alluded to the possibility that the project could continue if a new owner could be found."

Comments

Ironic

[Chairboy]

Does anyone else find it ironic that a project named 'Entropy' has come apart?

Re:Ironic

[fermion]

That's not irony. That is what happened.

Re:Ironic

[Barto]

Considering irony is "incongruity between what might be expected and what actually occurs", ironic would be a project named Entropy staying together. A project named Entropy coming apart perfectly congruous IMHO. So there.

Re:Ironic

[xmas2003]

From my reading of the second law of thermodynamics, it sounds to me like this the eventual long-term result anyway as they will reach their maximum state of entropy ...

Re:Ironic

[mrbarkeeper]

No, we don't.

http://en.wikipedia.org/wiki/Irony

Re:Ironic

[hawkeyeMI]

I think perhaps the word is 'apropos'.

Re:Ironic

[BCoates]

Perhaps people are so used to software being promoted as exactly the opposite of what it actually is, that a program doing what its name implies is a surprise.

Re:Ironic

[aminorex]

Wow. It's amazing that anyone at Princeton could publish such a facile definition of irony, when their university press is putting out stuff like this!

Re:Ironic

[EvilAlien]

Ya, isn't it ironic, don't you think?

Re:Ironic

[Bios_Hakr]

Like rain on your wedding day?

Or maybe even a free ride if you've already paid?

that was fun...

[elykyllek]

Considering I just got this installed, configured and working 5 minutes ago.. this is great news...

GNUnet

[Anonymous Coward]

There's still GNUnet!

GNUnet is a framework for secure peer-to-peer networking that does not use any centralized or otherwise trusted services. A first service implemented on top of the networking layer allows anonymous censorship-resistant file-sharing. GNUnet uses a simple, excess-based economic model to allocate resources. Peers in GNUnet monitor each others behavior with respect to resource usage; peers that contribute to the network are rewarded with better service.

Re:GNUnet

[throwaway18]

GNUnet is written in C. One buffer overflow exploit could compromise the whole network. It needs expert review beofre the claim of being secure has any meaning.

Re:GNUnet

[cutecub]

Um, I don't mean to be snarky, but my experience has been that GNUNet is even less friendly and less popular than either Entropy or Freenet.

It still has the feel of a research project and the fact that it defines itself as a framework rather than an application means that 99.9% of their potential audience won't be able to figure it out or use it. (Could your Mother download, compile and install gnunet-gtk?)

With that said, the project is really interesting.

But in its current state, its not ready for prime-time... or even late-night viewing.... Maybe CSPAN.

Re:GNUnet

[eldacan]

Could your Mother download, compile and install gnunet-gtk?

apt-get install gnunet-gtk, or your prefered graphical package manager :)

Re:GNUnet

[NoMoreNicksLeft]

What if the project defines itself as a network, rather than a framework, or even a file-sharing application?

What if its not much different than installing a virtual ethernet adapter, or if all your experience setting your computer up for TCP/IP counts for something on it?

What if you get to use all your current internet apps, rather than scratching around for keyhashes of some file that is pieced together all over the network?

What if only one guy can snitch on you, and he's somewhere in South Korea?

Maybe not ready for prime-time, but I think I have the late-night viewing nailed. Way past CSPAN.

Re:GNUnet

[Mind Booster Noori]

Um, I don't mean to be snarky, but my experience has been that GNUNet is even less friendly and less popular than either Entropy or Freenet.

It still has the feel of a research project

Well, GNUnet is well versioned, like most of GNU apps, and it's intended to be friendly, popular and without "the feel of a research project" when a version 1.0 comes out. We're still at version 0.6.2b, version 0.6.3 is expected to be released in August... So yes, there's lot's of work to do until v1.0 is out.

self as a framework rather than an application means that 99.9% of their potential audience won't be able to figure it out or use it.

I don't understand why do you say that a framework is harder to use then an application (or whatever you intended to say): GNUnet is a framework, which means you don't really want to "use" GNUnet, you want to use one application that runs over GNUnet (like gnunet-gtk for file-sharing, or gnunet-chat for chat, or those browser apps, e-mail-apps and such who are built over GNUnet).

Could your Mother download, compile and install gnunet-gtk?

My mother doesn't know how to turn on a computer, but GNUnet is as easy to install as any other application: just use the package for the system you use (like apt-get install gnunet on Debian, as someone said).

Re:GNUnet

[Mind Booster Noori]

I generally agree with your post, but feel the urge to comment some statements:

What if the project defines itself as a network, rather than a framework, or even a file-sharing application?

GNUnet is not a network: it is a framework, and the people using it are building a network of GNUnet nodes.
GNUnet is not a file-sharing application, it is a framework that, having the AFS protocol, creates a way of people writting and using file-sharing applications that run over GNUnet (as gnunet-gtk).

What if its not much different than installing a virtual ethernet adapter, or if all your experience setting your computer up for TCP/IP counts for something on it?

That was close, but not quite the case. GNUnet implements a protocol (like TCP) that can be run over TCP, UDP and SMTP. Peers communicate with each other via GNUnet Core or AFS messages (that run over the already spoken TCP, UDP or SMTP), and GNUnet applications communicate with the node using GNUnet Core, AFS or TestBed messages over TCP. More info on that here.

Re:GNUnet

[NoMoreNicksLeft]

GNUnet might use AFS, Metanet uses IPv4/IPv6. Call it what you want, framework, architecture, blahblahblah, most of us have used the internet since '95 or even before that for a lucky few. The reason that it changed the world is because it was an incredible improvement over the primitive facilities that the average BBS offered. I'm sure people will quibble about the details of the improvement, but none can deny it. Why would you want to go back to file-sharing as the primary means of communication?

Re:GNUnet

[digitaltraveller]

Linux is written in C. One buffer overflow exploit could compromise the whole network. It needs expert review before the claim of being secure has any meaning.

Does that sound silly? You can say that about any network program. In practice, things keep humming along because of diversity {versions, codebases}, etc. For example, browsing the GNUnet site I see a Java GNUnet port. No need to worry about stack smashing attacks there. Just the 100 or so other vulnerabilities (eg. race conditions) that make software insecure...

Erm

[Reality Master 101]

I don't mean to be snarky, but "very" popular? Does Freenet itself qualify as "popular", much less "very popular"? Does /anyone/ semi-normal (i.e., not a techno-geek, or a rights-geek) use Freenet, and if they do, has anything significant ever been published on it?

Freenet seems to me to be one of those ivory tower projects that has little relation to the real world. Proof? No search engine, and very little chance of ever having one. How the hell can it ever be useful? [/rm101 resists making a dig about their choice to implement in Java]

Re:Erm

[xanadu-xtroot.com]

Just to answer your question, I can honestly say that I've never used Freenet. The passing will go un-noticed.

Can't we get some more fun articles here? People building a bar out of an old VAX? People building beer chillers with Rocket Engines? Does it have to be all this lame-ish stuff that's been on the front page a for a few weeks now?

Re:Erm

[hawkeyeMI]

I'm something of a techno/rights geek and I tried Freenet last year.

Unfortunately it's pretty much useless, so I don't use it anymore.

Re:Erm

[Neophytus]

Just to bite the Java troll, may I cite the example of Azureus as an example of a Java program done right(tm). Runs fast, is responsive and doesn't use the godawful swing toolkit (it uses SWT instead).

Re:Erm

[r00zky]

don't you see that a search engine would inherently destroy privacy? at least in the current way Freenet is implemented...

if you have an idea for a search-engine in a (still) anonymous network you're free to submit it.

For now spider-generated indexes will have to suffice.

Re:Erm

[Jeff DeMaagd]

Can you clarify how a spider generated index doesn't destroy privacy, while a search engine does? Aren't they simply one step away from each other in terms of their "dangers"?

Re:Erm

[TRACK-YOUR-POSITION]

Bittorrent doesn't have a built in search engine, but it's probably the most mainstream (if one considers appearance of legitimacy rather than strict popularity) of all the P2P protocols/clients.

I don't think it has to do with being ivory tower--it's just that anonymity comes with a bandwidth/convenience cost, and at this time most people don't consider it worth paying. As computer resources increase, or political reality changes, anonymity might start to grow in relative importance.

Re:Erm

[r00zky]

In a webpage search engine you send a description of the content you're searching for to a server, this server now knows what you were searching for.

In a p2p network search you send your search to your peers, but, in Freenet's case the peers only index the contents by key number (or whatever it's called), not for description of the contents.

A spider basically follows all the links it can find and sorts them according to some meta-data every page has (title, description...)

Also, dynamic webpages aren't allowed (danger of some calling home etc...)

*just now reads new message just posted in reply to mine*

Or at least thats' how it worked the last time i used Freenet! :P will have to check back to see what they're working on

Re:Erm

[r00zky]

errata:
about dynamic pages: between "some" and "calling" a SCRIPT tag is missing...

Re:Erm

[NoMoreNicksLeft]

My own network is IPv4 based, with a fully functioning www. A search engine could easily be implemented (for all 6 websites, haha), just as on the real internet. Having access to those websites doesn't mean you have any decent way of identifying the publisher.

Re:Erm

[thinkninja]

Hi, like the grandparent poster, I tried freenet but discarded it as unusable without a permanent connection. Is it still pretty much unusable as a transient node?

Re:Erm

[Nf1nk]

treid it again last week and yes still pretty much unusable 9 out of ten sites don't come up at all and it bogged down my 2.4 Ghz p4. Still woefully unimpressive. oh yeah and it pegged my outgoing bandwidth the whole time it ran.

Re:Erm

[ultranova]

Does /anyone/ semi-normal (i.e., not a techno-geek, or a rights-geek) use Freenet,

Couldn't really say, since few people who use anonymous filesharing/messaging use their real names in said anonymous network.

has anything significant ever been published on it?

Quickly scanning The Freedom Engine, I found Fahrenheit 9/11, IIP Revival (which tries to bring back the Invisible IRC), mirror of XBOX Linux, TrekLit (a collection of Star Trek novels in MS Reader .LIT format), various blogs, Freecraft (an open-sourced Warcraft clone which was cease-and-desisted off the Net), Bondage Fairies (fairy porn, kinky too !), a MAME ROM library, a few library freesites, a few movie freesites and, of course, lots of porn.

I really don't know if this is significant, but it proves that there is content in Freenet.

Freenet seems to me to be one of those ivory tower projects that has little relation to the real world.

The development process could be better; currently people are throwing in new features before old ones have been debugged, and as a result the logs are full of NullPointerExecptions and other weird errors. And a bug which caused the node to always route to the worst possible choice went unnoticed for a long time during the switch to NGR...

Apart from that, I really don't see any indication of an ivory tower, especially when it's becoming increasingly clear that the freedoms we are enjoying now are not going to last. And the freedom of communication anonymously is the basis of all other freedoms; without it, you cannot know if your government is honoring the other freedoms, and thus it has no reason to do so.

Please explain your statement ?

No search engine, and very little chance of ever having one.

Three (3) different indexes linked from the start page. And if you use Frost it has an internal search engine for files inserted with Frost.

[/un resists making a dig about people who have been spoiled with Google so they don't know how to find things by surfing anymore]

[/rm101 resists making a dig about their choice to implement in Java]

Considering the amount of NullPointerExecptions the logs contain, I'd say that this was a wise decision. A C program would render the network useless. Of course this might also give an incentive to actually fix those errors before implementing more features...

Just be sure to give the command "LD_ASSUME_KERNEL=2.4.1" followed by "export LD_ASSUME_KERNEL" before running Freenet in Linux 2.6, because otherwise it will try to use pthreads, which will cause Sun JVM to hang.

Re:Erm

[BCoates]

No search engine, and very little chance of ever having one.

Spider the network, generate lookup tables appropriate for search, insert them into the network, and have a client-side script that takes the user's query and responds with the list of results. No changes to the network necessary.

This currently is held back by the unavailability of client side scripting (which is not fundamental, it's just unimplemented) and the current network not having sufficent performance for such a tool to be faster than just going to an index and browsing.

Re:Erm

[Jhan]

Does /anyone/ semi-normal (i.e., not a techno-geek, or a rights-geek) use Freenet, and if they do, has anything significant ever been published on it?

Oh yes! Child porn. Vast amounts of child porn. One could go so far as to say that Freenet is one of the main, if not THE main mechanism for distributing pedophile pornography.

FN was designed for distributing files with maximum anonymity, no matter the performance penalty (speed is horrible). So, it is used only by people who know that their neck would be in the noose if they were caught sharing the file.

Re:Erm

[Anonymous Coward]

In a webpage search engine you send a description of the content you're searching for to a server, this server now knows what you were searching for.

You obviosuly haven't throught this through -- Freenet and any other anonymous P2P protocol (including GNUnet) already guard against this type of information leakage by routing requests and searches through a number of nodes on the network. For a given server it is impossible to know whether a given node which makes a request is actually making the request itself or if it's being done on behalf of someone else.

Btw, GNUnet does allow search (it's not a search engine per se, but it does the job) and that's fully anonymous.

Re:Erm

[topynate]

This is true (the extent is unbelievable, actually) but it's important that it doesn't break apart the Freenet project before the software is stable and fast enough to be valuable for better reasons.

And 'semi-normal' is not an adjective I would apply to child porn distributers.

Re:Erm

[topynate]

Most people rather resent the lack of hard news during the summer months, you know...

Re:Erm

[Mind Booster Noori]

In fact, GNUnet is the first and only (AFAIK) p2p program that guarantees a level 3 anonymity, which, per se, makes it the most attractive p2p project (for me, of course, those who doesn't care with anonymity and encription and prefer speed won't choose an anonymous P2P protocol...).

Re:Erm

[OverlordQ]

Obvoiusly you have no clue as to how Freent works. Out of the box, it's just like a baby, it has no clue where anything is, nor what anything is. You have to leave it connected for a while for it to learn this things like routes, etc. I left mine running overnight, and I could get all but the most obscure sites to load.

Re:Erm

[paganizer]

sort of.
if you are talking dial-up, then it's going to take a while for your node to learn the neighborhood; you would probably want to turn it on and run FROST for about an hour; you still are going to have problems getting to some freesites. You will also want to go into your default.ini file and change transient=false to true.

BTW, when people are saying FREENET is not searchable, they are mainly wrong; the Internet isn't searchable, or at least most search engines don't search it the way it would be searchable, by hitting every IP address. It's searchable because search engines go to known sites, index those, and follow the links it just found to other sites, rinse, wash, repeat. You have the same thing going on in freenet, with tools like spider.

If you are expecting freenet to act like emule or gnutella, don't. it's not. If you mainly want to trade files, run frost, it's sort of like using USENET.

Freenet is actually still working pretty well, BTW.
The developers have a nasty tendency to come out with a working build, wait about 2-4 weeks, then come out with a non-working build. the last 6 stable releases have all worked about as well as any have in the past, and we are WAY overdue for the must upgrade non-working build.
Frost is even working pretty good; it has unnecessary libraries (why, exactly, do you need to format the messages in XML? what was wrong with TXT?), and is about 2mb more bloated than the may 9th, 2003 build which worked better, but it DOES work.

Re:Erm

[Reality Master 101]

Congratulations for the concise summary of the fatal flaw of Libertarian philosophy. :)

It's all reactionary. It never occurs to the Libertarian that by creating a market for child porn (i.e., the free trading of it), you create demand for more.

Reminds me of a debate with a Libertarian I had one time who said that shooting guns at people should be completely legal. What's illegal is actually hitting them. ::rolls eyes::

Re:Erm

[Reality Master 101]

(ignoring all the stuff that obviously wasn't what I meant)

Of course, if I shoot at you with a real gun, then even if I miss I am guilty of *attempted* hitting-you-with-a-bullet, which would be a crime even in a libertarian society.

That's what YOU say, not what the other Libertarian said. In a pure Libertarian society, shooting a gun one inch from someone's head should not be illegal, because they are not harmed in any way. His point was that you just make the punishment for hitting someone so draconian that no one wants to take the risk.

Or how about another one that many Libertarians believe: private fire departments. Why should I have to pay for YOUR fire protection? Well, duh, because fires SPREAD. It makes sense to stop fires before they spread, even if someone doesn't pay for it.

The typical Libertarian response is, "Well, then the other homeowners have the right to sue the person who didn't have fire department protection." Which is absurd, of course. A whole section of a city is supposed to get compensation from one individual?

You may think these examples are outside the Libertarian mainstream, but they are underscore the flaws in Libertarian thinking. A lot of the more subtle Libertarian thinking suffer from the same flaws.

Heck, a lot of Libertarians think that private invdividuals should be able to have nuclear weapons. Yes, I've seen people advocate that. Maybe you don't. But then you're not a "pure" Libertarian.

Re:Erm

[amphibian]

There is no technical reason why we shouldn't have a search engine. It would have to involve spidering, that's all. And in terms of general purpose file-sharing, Frost IS searchable.

Re:Erm

[amphibian]

The NPEs are probably caused by you using Java 1.4.2-r04. :). But anyway, how can I fix them if you don't report them to support@freenetproject.org? Please mail me privately and we'll sort it out.

Re:Erm

[amphibian]

Really? Last time I looked, 12 out of 440 sites on TFE were by the title obviously child porn or probably child porn. That's less than 5%. And I'm skeptical that Freenet has the capacity to support the terabytes you are casually implying here.

Re:Erm

[amphibian]

It is? Please justify the above statement. I really would be interested to know if most of the world's child porn flows through Freenet. It certainly doesn't go through the main indexes. And the main indexes DONT censor what they link to. 12 of 440 is 12 too many, but it's far too low for the post to be credible - unless there are only 12 sources of child porn in the world.

Re:Erm

[topynate]

I have no way of telling the proportion, but there are links (as you said) to child porn on the indexes, and for all I know there could be gigabytes of content on those sites.

I was really thinking back to when IIP was working, and was plainly being used as a distribution mechanism in concert with Freenet. Any sites publicised that way would be unlikely to be spidered. But you've called me out, I can't prove it's the main channel of distribution - just make the point that it's a highly visible one (it shocked me, certainly), directly as a consequence of the lack of need for any discretion on an anonymous network.

I looked into this roughly at the end of 2003. I don't know the current score.

Re:Erm

[amphibian]

As is Google, at least if you turn the filters off... or so I am told. I *do* know there are some sites on Freenet that by their titles appear to be such filth. But there's a difference between "a few assholes insert child porn" and "Freenet is one of the main, if not THE main mechanism for distributing pedophile pornography".

Re:Erm

[topynate]

Fair enough; I admit that you can't make that inference. I'm concerned about 'appearances' though - 12 out of 440 isn't insignificant (would you expect that proportion of your own acquaintances to be paeodophiles?), but 20 out of 10000 is approaching the level at which you can't really be shocked anymore. If Freenet attracts harsh comment before it can support that kind of size, things will get icky, and I don't want that, because a huge, scalable Freenet will make the Internet a better place to inhabit.

Re:Erm

[amphibian]

Well, actually... I've talked to at least two, one of them over Freenet and one IRL. I'm not an especially sociable person either. But yes, good point.

Some say faster?!

[sulli]

My 11 year old VW Jetta is faster than Freenet. In 5 pm Bay Bridge traffic.

Yeah, entropy ain't what it used to be.

[cool_st_elizabeth]

Now it's official.

Not sure where else I'll be able to use this...

[Exatron]

"How ironic! Not only is there precipitation on the day of your nuptials, but the passage for which you'd previously paid was in fact complimentary! MUHAHAHA!" -Alanis Megatron

mmm really?

[eldacan]

GNUnet is written in C. One buffer overflow exploit could compromise the whole network.

Not quite true IMHO: it's obviously not sufficient to compromise one client/server to compromise the whole network. If it was, it would be a piece of cake to take the existing source code and use it to build this "compromised" client/server.

If you want to compromise the whole network with one buffer overflow exploit, I guess you will have to find an exploit that works with all versions of GNUnet, and you will have to run it against all (ok, most) clients/servers on the network (most of the traffic seen by one computer on the network doesn't make sense for it, it just relays the packets to other computers).

And there is also a Java implementation under development.

Anonymity and Entropy

[trifakir]

Yep, anonymity is a favourite topic of conversation of me and my colleagues. Frankly, I do not understand the concerns of the "Entropy" project leader. Here is why:

1. Theoretically, it is impossible to have anonymous communication on the Internet.
2. In practice it is a balance of resources. The trick is that it is much cheaper to publish contents anonymously, than to trace the origin of an information. Therefore projects like Hacktivismo - Six/Four, Crowds, Freedom-Net, Tarzan, Onion-Routing, etc. make sense.

Furthermore, it is often the content which speaks more about the authorship, than the chain of technical events that leads to the publishing of the information. In Slashdot, for example, I have chosen not to show my e-mail, etc., but by reading my comments even a 10-years old kid can make a deduction about my real identity. Does it make sense for me to use IP-tunneling then?

Finally, I do not understand the author. He just seems pissed. Maybe he will reconsider his opinion and revive the project. Is he sick from the lies (?) about the crypto-protocols used in the software which is written? IMHO the theory proves quite stable and if there is a room for attacks it is more in the implementations than in the protocols themselves. How many broken cryptosystems do you recollect (I know, I know "the knapsack", but it got broken on the conference on which it was presented).

Still, even with this project retreating, the subject remains interesting.

Re:Anonymity and Entropy

[Teancum]

I feel for the project leader. He is simply saying that he doesn't want to carry the torch any more. Period. It doesn't really matter what the reason is, although I can also understand what he is saying regarding crypto stuff having a bunch of really weird issues that should never be in the realm of Computer Science.

Part of that is because we are talking about national governments trying to control information flow (notably the U.S. government), and litterally thousands of patents that control who can do what and when with the algorithms. Of all areas of CS, this is perhaps the most litigated subject and has the most restrictions of free speech when discussing this topic. It really is a mine field of trying to know what you can get, and trying to get people who are in the know to spill the beans about what is occuring as well. If patents don't get you, then government security agencies will.

As far as lies are concerned, there is deliberate mis-information going on as well with this branch of computer science. Those are the lies he is talking about. Normally with trying to get computer equipment working, it is so difficult to figure out what is working and what isn't, that you simply presume that the written documentation has mistakes like the wrong pin number or an error code that is one or two numbers off. If documentation is deliberately obfusated to even include mathmatical formulas that are close, but don't really work, or sample code that has intentional holes, you are going to be really lost. Much of this is intentional, on the part of national governments. Some is also due to competitors who are trying to throw potential rivals off from each other. There are "honest" people involved as well, and the trick is trying to know who is your friend and who doesn't really care.

Re:Anonymity and Entropy

[HeghmoH]

Theoretically, it is impossible to have anonymous communication on the Internet.

Can you elaborate some more? I skimmed the linked paper, although I didn't read it thoroughly, and it appears to claim exactly the opposite. Did I completely misunderstand?

Re:Anonymity and Entropy

[trifakir]

Unfortunately, this scheme requires idealized network which does not exist, although many believe that approximation on top of existing techniques can be implemented without compromising much the security of the protocol.

The practical problem with the work of Chaum is that it requires a reliable broadcast network, which is unachievable.

Besides the above difficulty, this is the best work I've read discussing anonymity.

Re:Anonymity and Entropy

[zogger]

I didn't look at your first link, about the impossible to be anonymous, but just at first thought on the subject in general, a combination of freenet type structure combined with a wireless meshed network would get someone pretty darn close, wouldn't it?

Re:Anonymity and Entropy

[trifakir]

Right, practical anonymity should be quite achievable on the technical side, although let the experts here say their word (I just read from time to time on the subject). Now think about the anonymity in broader context.

So, you are the dissident (for short Bob) and you want to talk anonymously. The first problem is that if you are doing that periodically it should be possible to correlate (something) in your statements. I don't know what can be correlated, for example wording or referral to specific events/goals. Just to remind you - humans are much better in finding patterns than computers (for now and IMO). Second, what you are saying already reduces the amount of anonimity, but that I think I've already mentioned.

BTW, I find anonymity, one of the most difficult cryptography branches and I'm amazed how easily some people talk about it.

Also, I believe that the Big Brother invests in science, so should do his opponents.

Re:Anonymity and Entropy

[NoMoreNicksLeft]

You bring up a good point, that is often ignored. Your authorship style can do alot to destroy perfect anonymity, from both the low level (stalkers) and high (CIA/NSA tinfoil hat stuff).

There are resources available on my network that are at least trying to train people how not to give themselves away. Simple example, someone invites you, and right away you jump on IRC as trifakir. Someone showing up there as "trifakir" isn't necessarily you, of course. But if I wanted to track someone down that had that nick, I'd search everywhere on the internet and commercially available databases. In the end, any handles/nicknames/usernames you use on an anonymous network have to be totally original for yourself... you can't get away with re-using that hotmail username you had 5 years ago. And as simple as this all seems, there are problems. It's not easy to turn off that impulse to do such things... and no one can help you, either. 100% your own responsibility (not totally true, the guy that invites you knows at least enough to ID you, and can give advice, get you pointed at the website that goes over this in detail... but that's about it).

There are other problems along these lines too. Certain applications are "leaky". Mirc, in particular. Right from the beginning, we knew it would be a problem, and I was helping folks set it up at the command line level to point at a new INI file. But it is pure shit. Even doing that, it is pulling sensitive details from the registry or the original ini files. We haven't found any quite as bad as this one, but is far from unique. Word documents are suspect, in that we can't be 100% certain that published documents don't have some hidden metadata that identifies the author. PDFs created with Adobe are likely as problematic.

And this is the easy stuff. We've yet to come up with guidelines that will protect you from the most insistent long-term attacks. If a well funded agency were to compile psychological data on you, is itso far-fetched that a demographic profile could lead them to you? Male, 30-40, native born english speaker with definite american language traits, has let a few comments slip about his favorite sports team (in the area?)... it all adds up.

And as serious as all this is, with me communicating with less than 50 users ever, I've still had questions about how safe VOIP and webcam apps are! I mean, I doubt we have spooks listening yet, but who can say?

Many books could be written on this subject without ever exhausting it.

Re:Anonymity and Entropy

[trifakir]

True. My initial statement, without additional context is shaky. Freenet, however, is implemented on top of an existing network - TCP/IP/Ethernet - you name it. And anonimity on top of this particular implementation is not theoretically achievable. There are authors discussing separately that, but I have to dig for their stuff...

BTW, it is much more difficult to show that something does not exist, than the opposite.

Logically, there are faults in what I am claiming, but this discussion is quite informal and I'm trying to summarize what I've heard/read/believe regarding the topic.

Re:Anonymity and Entropy

[zogger]

to beat the patterning, you could have a computer randomize your sentence structure, by you using already overtly published works and your access to them to create "new" works that are your own, but don't look like it.. You could just cut and paste sentences from other works and put them together to make a new work. And if enough people did that, the pattern of the computer assisted copy/paste writing would be so widespread as to be near impossible to track down.

And it depends on what you want to do. If all you want to do is to spread information, you use what work arounds exist. If you (this Bob guy) are a direct action type,along with the words type, you work in a cell of one, no exceptions ever, for any reason. That's just normal assymetrical guerilla warfare theory. Despotic authorities can crack cells of two or more to "many", they do it all the time, but they have an almost impossible task to crack lone individuals. It's possible for them, of course, but much much harder. And if the cell of one is content with only one direct action,or even one critical publication of words, then retires, it becomes so much harder for them to crack as to approach the "impossible" state.

two good essays on this subject you can find on the net:

Leaderless Resistance

The Window War

Best info-mational novel(non sci fi, it's an action/historical genre, very readable) bar none on the subject

Unintended Consequences

Re:Anonymity and Entropy

[Beryllium Sphere(tm)]

From the paper:
>4. Conclusion

This solution to the dining cryptographers problem demonstrates that unconditional secrecy channels can be used to construct an unconditional sender-untraceability channel. It also shows that a public-key distribution system can be used to construct a computationally secure sender-untraceability channel. The approach appears able to satisfy a wide range of practical concerns.

Are you arguing that Internet communication channels can't offer unconditional secrecy?

Re:Anonymity and Entropy

[Mind Booster Noori]

Yep, anonymity is a favourite topic of conversation of me and my colleagues.

Join the club :-)

Frankly, I do not understand the concerns of the "Entropy" project leader.

I do. See, when he doesn't believe even in the cryptographic methods used, something is really wrong. I really support his decision to "abandon the sip", even if I think it is a great loss to this kind of projects that someone with his experience and skills doesn't intend to join his mind to any other project in the field.

Theoretically, it is impossible to have anonymous communication on the Internet.

That paper is quite a good reading, but many research has been made in the field since 1988, and that's not quite true... Take this papers as a reference, and then take a look into GNUnet project itself. This comment may be taken into consideration regaurding your second point too.

Finally, I do not understand the author. He just seems pissed.

I'm afraid the "pissed" tone on his message was directed to some developers out there... If you don't understand it it's not certainly directed to you ;-)

Still, even with this project retreating, the subject remains interesting.

Agreed. Fortunately there are other projects on the field, like GNUnet.

Re:Anonymity and Entropy

[Mind Booster Noori]

Easier than that is to do what some projects do: encrypt the messages and create a flow of alike-messages.

Re:Anonymity and Entropy

[zogger]

how do any random new recipients know which of the endless stream of look alike messages is the real one, even if they have somehow gotten the private key? Just de crypt and read all of them? I can see this working with a pre arranged subkey system where the designated good messages were known in advance or followed a pattern, perhaps with a one time pad arrangement, but to anyone new, it seems about as bad as not being able to decrypt it. Or is the idea the messages are all the same, just coming from so many places it's a waste of time for the enemy to concentrate on any one place?

Re:Anonymity and Entropy

[Mind Booster Noori]

Check for instance GNUnet to know how they achieve it.

Re:Anonymity and Entropy

[zogger]

funny, the site won't load directly, but googles cache is fine. At first glance it almost looks like a distributed karma system. I'll check it out more, it looks complex, hard to comment on it with just a glance.

Freenet doesn't even HAVE an UI

[Kjella]

...and quite frankly, for what it does, it is a hog. Yes, I realize it is mostly proof-of-concept but it is mostly a software router (ok, with encryption, software VPN router) with s LRU cache.

Of course, there's no point in nagging unless you actually have something better to suggest... which I don't. So if the choice is a slow Java project, or a C++ project which doesn't exist - I'll take the Java project...

Kjella

Check out my own project.

[NoMoreNicksLeft]

Pros: IPv4/IPv6 based network, static IP addresses, free domain names, all traditional TCP apps work, easier to understand.

Cons: Still small, restrictions on who you can invite, win95/98 not supported very well, some dullards have trouble understanding how anonymity works (if it uses TCP/IP your address can be tracked!).

In particular, I need to find people that favor linux/unix (even OSX would be fine), would be willing to invite others, and plan on residing in any country other than the USA for the next few years. Bandwidth usage is negligible, and I'm willing to prove it.

I'd also be willing to mentor those interested in setting up their own similar network, the more the merrier.

Re:Check out my own project.

[trifakir]

Does the icon on your site relates to the content in it or that's just what you had? A friendly advice - try to read a little bit/browse before you spend your evening in writing... There are many projects implementing ideas similar to yours and even more theory...

In short, what you've written sucks.

Re:Check out my own project.

[NoMoreNicksLeft]

Haha. I didn't write that last night. My own network went live back in August. I understand some of alot of the other theories, but I don't favor any of them.

Besides, you can be playing Quake3 or IRCing on my own network an hour after talking to me. Even if those were possible on freenet, could you be up and running that quickly?

So, is it my (lack of) writing style you dislike, or the theory?

BTW, the icon is mostly for comcast's sake. The internet feels so impersonal, not being able to show them a friendly gesture, I did the next best thing.

Re:Check out my own project.

[trifakir]

Besides, you can be playing Quake3 or IRCing on my own network an hour after talking to me. Even if those were possible on freenet, could you be up and running that quickly?

That's interesting. I take a mental note to look into your project once more, although I don't have much time for fun these days. Maybe you deserve a small credit for an efficient implementation of tunneling.

It is not the writing style what I disliked. I'm simply old-fashioned and I like projects which are based on (scientific) papers, which have been published and lying around for several years and other papers citing them and so on. Then we have some idea what can we expect and only after that we run our XEmacs...

Re:Check out my own project.

[NoMoreNicksLeft]

High school dropout. If you could point me towards a book or website that would help me lay it out as a proper scientific styled paper, I would eventually rewrite it as such.

As for tunneling, I'm not even writing new software. Would rather let the experts do that, freeswan (openswan now?) and OpenVPN are just fine (I tend not to trust the others as much).

I do have some new ideas for transport and routing protocols though. But they aren't necessary at this point, and the network is fully viable, as is. Plus, I truly like to think that a non-mathhead can wrap his brain around how anonymity works on this thing...

Re:Check out my own project.

[NoMoreNicksLeft]

Strictly speaking, my project isn't software at all. Or, if it is, it's the TCP/IP stack that computers have had for 20 years, and one of several VPN software stacks that have been available in some cases for more than 5 years. You even, in many cases, have your choice of which VPN software to use.

Many people have done this, or attempted it, I'll grant you. But my version is far simpler, requires no new software, and it truly gives you an IP network. It's passably fast. As in, pings (yes, ICMP works! try that on freenet!) of 400ms or less at the moment, for most of the hosts I can think of pinging. IRC servers, websites, email, any network app you feel like using. Not some web browser proxy, where you have to know secret hashes beforehand to download the file.

I think that all that alone makes my own project a contender. But let me say it again... my own project needs no custom software. If your computer has ipsec installed or (for the non-masochists) you don't mind downloading 1.5megs of OpenVPN, that is all you need. The architecture is such that even cryptographic flaws in those software packages aren't as serious as they might be for other networks.

Re:Check out my own project.

[jhunsake]

I read your site, and your project is fundamentally flawed. There is no way to know the real relationships between people in different governments. Many countries that are openly hostile to each other frequently cooperate on a lower level. In fact, many leaders that appear to be hostile to each other are in many cases privately friends. Basing your network on these assumptions is a big mistake. The solution has to be technical, and not based on any political or economic understandings.

Re:Check out my own project.

[NoMoreNicksLeft]

But we aren't talking about leaders, for the most part, but agencies and departments that often work without direct oversight by said leader. Besides, for any given host on metanet, said leader would almost always exploit more than one or two such cooperative foreign nations.

Not knowing where you are from, it's hard to say if you are dumb and just don't understand the scale of gigantic byzantine bureaucracies or if you are somehow insulated from them. I would be willing to risk my safety to such more so than I would to the inability of a large government to crack crypto. Have you ever considered that a government like China or the USA could very well have working quantum computer prototypes at this point? If not yet, then when?

If metanet ever gets even half the size I would like to see it become, the typical host will be 7-20 hops away from you, all across a different international border. More so, at each of those points, the possible path to you will branch out to as many as 30 or 40 false paths, 11 of which will branch out even further. Until each and every one of the routers along the path has been compromised in a blatant way, you're safe. How many weeks of warning do you need to delete all your incriminating files and wipe the hard drive?

Re:Check out my own project.

[jhunsake]

Not knowing where you are from, it's hard to say if you are dumb and just don't understand the scale of gigantic byzantine bureaucracies or if you are somehow insulated from them.

I come from a family where everyone works in government. I think you are lacking a clue of what goes on "behind the scenes". There is A LOT of cooperation between law enforcement, no matter what terms the any two countries appear to be on. I was giving the leaders case as just an example. Look, people know each other the world over. Especially when they work in the same area. It's these people that many times defy whatever the current propaganda says is going on and decide to work together. The point is that *you* will never know who is working together. Security is something far too important to leave to assumptions. Your idea is novel, I'll give you that, but it is flawed.

Work is underway...

[Anonymous Coward]

if you have an idea for a search-engine in a (still) anonymous network you're free to submit it.

It is being worked upon. Not search engine, but a means to efficiently find content (that *wants* to be found, that has been posted publicly, mind you) within the context of the network itself. And no, I'm not talking about Frost/FMB which chokes on just a couple messages a day, but something ready to scale to become as large as the Internet itself. Speaking of which, something Freenet isn't able to do.

There are great things ahead. Within a year, much will have changed. It is not ready to go public yet, but it is taking shape. It will be the Napster of anonymous networks. Easy enough for everyone, and I mean everyone, to use. Sorry about the melodrama, but it has already been resolved in theory and simple simulations. You will know it, when it is complete.

Re:Work is underway...

[Mind Booster Noori]

It is being worked upon.

Too late for you, GNUnet does it already.

You don't know what you are talking about

[Anonymous Coward]

Freenet seems to me to be one of those ivory tower projects that has little relation to the real world.

Thats a pretty bold statement for someone who has clearly never tried it. Freedom of speech may not bear much relation to your reality, but you will probably get a different view from someone from some other countries I can think of.

Its a research project, and they are solving hard problems. Yes its not as easy to use as it could be, but either was Linux for a long time, and in many ways Freenet is much more complicated.

One word: Cascade

[Kjella]

1. Find exploit
2. Create program exploiting said exploit, and to do the same to all nodes it connects to.
3. There is no step 3. You've compromised the entire network.

Kjella

Re:One word: Cascade

[NoMoreNicksLeft]

That's why I've endeavored to create a network where all the clients can't be known. In fact, from any single jurisdiction, it shouldn't be possible to discover the addresses of more than a dozen or two clients.

Re:One word: Cascade

[Mind Booster Noori]

GNUnet already does that, plus it guarantees level 3 anonimity and all connections are encrypted.

On another field, an exploit like the one described wouldn't work because if you manage to exploit GNUnet you could exploit one node, but couldn't make it reproduceable to the other nodes.

Maybe the the gandparent and grand-...-parent should read more about GNUnet before making such claims.

Tried it, looked suspicious

[vadim_t]

Okay, first impression was:

"Wow, great project!". It was like Freenet, only faster, lower latency, some stuff was cooler. It looked really promising. It was much easier to install in a chroot jail than Freenet.

However. From what I saw, I wouldn't trust it for any serious purpose. It looked like the author was only interested in using it for testing his own crypto algorithms, and as anybody who read on this stuff should know, rolling your own crypto is a really bad idea unless you're really, really good, and then make sure it gets well tested for a few years.

It had a nice possibility of restricting the node to chosen allowed crypto algorithms, but none of the available ones was in widespread use. I mean, AES, DES and Blowfish weren't in the list last time I checked. That makes me rather suspicious.

I voiced my concerns once in the Entropy forum, and the author replied saying this is basically a research project and not intended for serious use (IIRC).

If somebody does decide to continue with it, I certainly hope that one of the first things that will be done is to put some tested crypto in it instead of a bunch of homebrew methods. Nothing personal against the author, but I believe that if it was easier to trust it, it could become more popular.

Oh no ...

[Entropy]

Ack!

What are they doing to me???!

Listing Engines Exist Today

[nurb432]

If you care to look there are several established 'listing engines' that are running.

A true 'search engine' might even be detrimental to the privacy goals of Freenet.

But yes, it is currently a bit esoteric for the average Joe, but that will change in time. Its already MUCH friendlier then in the beginning... ( and the speed troubles seem to improve with each release.. )

And don't bash the java thing without realizing that one goal was for it to run everywhere, and to be browser friendly.. Java ( in theory ) was at the time the best answer to that issue.

CVS Repository itself..

[sudog]

Is there any way to copy out the full contents of the CVS repository itself into another archive? The full development (and not just the latest version of it) is valuable to programmers who wish to learn more about the development process itself that went into Entropy.

Privacy enthusiasts?

[One_6453]

Is it a sign of the times or the miseducation among us o rour own stupidity that someone has come up with such a term? I mean one who values ones privacy is termed an enthusiast thus denoting that one is almost but not quite on the fringe of society when it comes to privacy issues. More like a gun enthusiast

Azureus current version is okay

[SmallFurryCreature]

The previous ones on linux suffered and suffered badly from "too many open file" bugs. It was even blamed on java by some but since I haven't updated java only azureus and with the latest version it is now gone I think that the problem was definitly azureus.

So before I agreed that java was a piece of crap whose only saving grace was that it could be portable (plenty of java apps are not). Now that azureus works very stable (constant run since the last update) I must admit that java can work. HOWEVER

I also run freenet and the memory and CPU usuage is still insanely high. Of course this could simply be a freenet problem but it doesn't help java's image.

To me java is an intresting tool that can solve certain problems. It is not perfect and one of its imperfections is that it is a resource hog. Makes you wonder what is different between the java on linux/windows and the java on mobile phones.

Anyway to get back on topic, too bad but the time is not yet right for these kind of projects. If you actually use freenet and look around there is very little worthwhile on it. Just yesterday someone posted Slackware 10 on it. Yeah we need anonymous network to distribute linux. NOT. Maybe if SCO wins but today it just shows that people are just desperate to look for uses.

Current uses are file sharing (can be done far more easily through other means especially if the files are legal), child porn and similar (not exactly something most people consider a worthy cause) and weirdos. About the only "real" use are DeCSS and the Scientology papers (can easily be hosted by those living in free nations).

The problem of course is that while freenet may not be needed now if it is ever needed in the future it will be too late to write it.

By the time the dictator is in power it is too late to protest.

Step 3: PROFIT!

[Bob_Robertson]

Step 1: Find exploit

Step 2: Compromise everyone

Step 3: PROFIT!

Mute: The Searchable Alternative

[KrisHolland]

There is one alternative called Mute, which solves one key problem with Freenet or Entropy which is that it is searchable.

This discussions is about Entropy?

[pyrrhonist]

The author of Entropy has ceased development, because he heard somewhere, that apparently someone, not exactly sure who, had solved the problem.

Jeez, dood, this article was about Entropy... ;)

Overview of anonymous filesharing networks

[Metaframe]

If you are looking for alternatives or an overview of the most important anonymous filesharing networks you should check out http://board.planetpeer.de Although it is living on a .de domain there are also english forums available.

Irony

[Lord_Dweomer]

" The creator alluded to the possibility that the project could continue if a new owner could be found."

Ah the irony....

Entropy Project Closes Up Shop...

[rwbaskette]

...well that was random!

Hashes aren't unique!

[welsh git]

I remember visiting the Entropy web page about a year ago, quite interested, until I read a bit from the author 'proving' that SHA1 hashes are *always* unique, at which point I thought the project must be vapourware..

Maybe...

[jellybear]

the parent post was being ironic.

I2P

[redcliffe]

I2P is a far better system. You can run any normal TCP or UDP apps over it, it's just like an anonymous replacement for IP. http://www.i2p.net

IRC and HTTP work great over it.