From: Kragen Sitaker (kragen@pobox.com)
Date: Mon Apr 17 2000 - 07:47:06 PDT
[Ccing Ian Clarke mostly so he can correct me if I said something stupid.]
Ramjee writes:
> [Kragen wrote;]
> > I am reading Ian Clarke's report on Freenet now; I will post a followup
> > with what I learn. It may turn out that I will need to post corrections.
>
> Additionally:
>
> - how computationally expensive is it to add new information - is it in any
> way feasible to 'remove' information (is it really a member
> of the Eternity class of systems). Since unaccessed info can disappear,
> I suspect it may not be.
Adding new information is relatively computationally cheap.
The theory is that only very-rarely-accessed information can disappear.
Now that I have read the thesis, it appears that an attacker could
raise the threshold for information removal --- causing all of the N
least-frequently-accessed tidbits of info to vanish --- by publishing a
large number of pieces of information and making requests for them from
every Freenet node or a significant fraction of them.
Doing this singlehandedly requires having access to a large number of
computers, since presumably most Freenet nodes will not be accessible
or even known outside of their local neighborhood.
There's another problem Clarke addressed in his Slashdot interview ---
key collisions. His proposed solution is to have people "vote" for or
against pieces of information they receive; pieces of information that
get voted against will have the routes to them forgotten. The idea is
that people will vote for the "right" page and against the "wrong"
page.
Like auto-response intrusion-detection systems, I tend to think this
defense mechanism may lead to autoimmune diseases.
There is another problem; it is quite likely that legitimate key
collisions will arise, and neither will be voted against very often.
But users will be frustrated when they try to get to one and instead
get to the other. It's likely that each will form a basin of
attraction comprising some part of the Freenet nodes.
I tend to think that the information migration plan --- where a piece
of information created in Turkey that is of more interest to people in
Silicon Valley makes its home in Silicon Valley and disappears from
Turkey --- won't really work. Here's why:
Suppose there are two nodes, A and B. A has a piece of information (or
set of pieces of information) X that people around the world request
from time to time, but not often enough that many requests for X can be
satisfied from caches. So most Freenet nodes know that, to get X, ask
A --- or ask someone in A's direction.
Suppose B's users begin requesting X a great deal; B gets X from A and
caches it. Now, people who would route through B to get to A will have
their requests satisfied from B's cache. But other people nearer to B
than to A will not know B has it cached; their requests will end up
being routed to A anyway. So A will end up satisfying roughly the same
number of requests for X as it did before all of B's users got excited
about X. So X won't expire from A's cache.
In the bad and dangerous case where most of the people in B's vicinity
would route through B to get to A anyway --- e.g. if A and B are single
points of failure for intercontinental communication --- it will work
as planned.
> - anonymous posting is possible, but can we verify the integrity of each
> message (what we are seeing is what was actually posted?).
Well, posted by whom? Obviously if a message is there, somebody posted
it, even if what they posted is a modified version of another message
stored under the same key. If you don't care whose version you're
reading, one version may be just as good as another.
If you're interested in verifying that a particular message was posted
by nym N, you can look at its GPG signature and verify that it matches
N's public key.
> - `Covering' mechanisms like PGP signatures bust the `anonymous'
> nature of the service since these signatures can be tracked via
> their vettors.
PGP/GPG keys and signatures don't need vettors, although they can use
them if their holder wants people to believe that they are a particular
real-life person or organization. PGP/GPG keys for anonymous
pseudonyms will, more or less by definition, have no vettors.
-- <kragen@pobox.com> Kragen Sitaker <http://www.pobox.com/~kragen/> The Internet stock bubble didn't burst on 1999-11-08. Hurrah! <URL:http://www.pobox.com/~kragen/bubble.html> The power didn't go out on 2000-01-01 either. :)
This archive was generated by hypermail 2b29 : Mon Apr 17 2000 - 07:48:59 PDT