[GNU/consensus] PS: Social Network 3.0 - Preparing a 30C3 workshop

[Klaus Schleisiek]

PS: These remarks I have to add:

1) The workshop at the 30C3 and its preparatory meeting in August are meant for
people, who already have come to the conclusion that a socialnet_3.0 will be
based on end-to-end encryption and self determined data storage. Should you have
a different opinion then these events are not meant for you. These two points
are essentials and not open for discussion especially at the preparatory meeting.

2) We at WHS would like to limit the cost for the meeting to € 4000.-.
Therefore, if you intend to participate in the August meeting, please send me
your estimated travel cost. If more people would like to attend than can be
funded, we will apply a first-come-first-serve policy according to the doodle
voting list (http://www.doodle.com/tf8vctpe3h2fv4d9).

3) If you need a hotel room: Once it is clear how many rooms are needed we will
take care of a group deal with a hotel in Berlin.

:)

Klaus Schleisiek

Wau-Holland-Stiftung W
Postfach 65 04 43 H O L L A N D
22364 Hamburg/Germany S T I F T U N G
http://www.wauland.de

Am 29.04.2013 11:20, schrieb Klaus Schleisiek:
> Dear friends for unexploitable social networks,
>
> eventually Wau Holland Foundation has decided to sponsor a preparatory meeting
> for a socialnet_3.0 workshop on 30C3.
>
> We decided that OHM would be too distracting for this type of work and instead,
> we invite you to participate in a preparatory meeting in Berlin in August. To
> choose the most appropriate weekend, please make your entry at
> http://www.doodle.com/tf8vctpe3h2fv4d9 if you are interested to participate.
>
> "Invite" means that the foundation will reimburse travel and accomodation costs
> up to € 400,-.
>
> The purpose for this meeting will be to prepare a workshop at 30C3:
>
> We should try to get an overview of current activities for a democratic social
> network, propose an agenda for the 30C3 workshop and make a list of whom we
> would like to participate.
>
> The aim of the 30C3 workshop itself will be to build a consensus of how
> socialnet_3.0 is going to look like and to coordinate activities such that this
> goal can be reached within the next 10 years.
>
> :)
>
> Klaus Schleisiek
>
> Wau-Holland-Stiftung W
> Postfach 65 04 43 H O L L A N D
> 22364 Hamburg/Germany S T I F T U N G
> http://www.wauland.de
>

[Melvin Carvalho]

On 30 April 2013 12:29, Klaus Schleisiek <***@ccc.de> wrote:

> PS: These remarks I have to add:
>
> 1) The workshop at the 30C3 and its preparatory meeting in August are
> meant for
> people, who already have come to the conclusion that a socialnet_3.0 will
> be
> based on end-to-end encryption and self determined data storage. Should
> you have
> a different opinion then these events are not meant for you. These two
> points
> are essentials and not open for discussion especially at the preparatory
> meeting.
>

Could you elaborate on what properties "self determined data storage"
should have?


>
> 2) We at WHS would like to limit the cost for the meeting to € 4000.-.
> Therefore, if you intend to participate in the August meeting, please send
> me
> your estimated travel cost. If more people would like to attend than can be
> funded, we will apply a first-come-first-serve policy according to the
> doodle
> voting list (http://www.doodle.com/tf8vctpe3h2fv4d9).
>
> 3) If you need a hotel room: Once it is clear how many rooms are needed we
> will
> take care of a group deal with a hotel in Berlin.
>
> :)
>
> Klaus Schleisiek
>
> Wau-Holland-Stiftung W
> Postfach 65 04 43 H O L L A N D
> 22364 Hamburg/Germany S T I F T U N G
> http://www.wauland.de
>
> Am 29.04.2013 11:20, schrieb Klaus Schleisiek:
> > Dear friends for unexploitable social networks,
> >
> > eventually Wau Holland Foundation has decided to sponsor a preparatory
> meeting
> > for a socialnet_3.0 workshop on 30C3.
> >
> > We decided that OHM would be too distracting for this type of work and
> instead,
> > we invite you to participate in a preparatory meeting in Berlin in
> August. To
> > choose the most appropriate weekend, please make your entry at
> > http://www.doodle.com/tf8vctpe3h2fv4d9 if you are interested to
> participate.
> >
> > "Invite" means that the foundation will reimburse travel and
> accomodation costs
> > up to € 400,-.
> >
> > The purpose for this meeting will be to prepare a workshop at 30C3:
> >
> > We should try to get an overview of current activities for a democratic
> social
> > network, propose an agenda for the 30C3 workshop and make a list of whom
> we
> > would like to participate.
> >
> > The aim of the 30C3 workshop itself will be to build a consensus of how
> > socialnet_3.0 is going to look like and to coordinate activities such
> that this
> > goal can be reached within the next 10 years.
> >
> > :)
> >
> > Klaus Schleisiek
> >
> > Wau-Holland-Stiftung W
> > Postfach 65 04 43 H O L L A N D
> > 22364 Hamburg/Germany S T I F T U N G
> > http://www.wauland.de
> >
>
>
> _______________________________________________
> SocialSwarm-DISCUSSION mailing list
> SocialSwarm-***@ml.foebud.org
> https://mail.foebud.org/cgi-bin/mailman/listinfo/socialswarm-discussion
>
> Website : http://socialswarm.net/
> Wiki : https://wiki.socialswarm.net
> Liquid Feedback: https://socialswarm.tracciabi.li
>
> All mailing lists for SocialSwarm:
>
> SocialSwarm-ANNOUNCE (Announcements only; no discussion)
> SocialSwarm-DISCUSSION (discussion list)
> SocialSwarm-TECH (discussion list for technik and coders)
>
> https://mail.foebud.org/cgi-bin/mailman/listinfo/socialswarm-announce
> https://mail.foebud.org/cgi-bin/mailman/listinfo/socialswarm-tech
> https://mail.foebud.org/cgi-bin/mailman/listinfo/socialswarm-discussion
>
>
> FoeBuD e.V. | Marktstrasse 18 | 33602 Bielefeld | Germany |
> ***@foebud.org
>

[Klaus Schleisiek]

Am 30.04.2013 12:32, schrieb Melvin Carvalho:
>
> Could you elaborate on what properties "self determined data storage" should have?

You determine yourself, where your data is going to be stored and in what form
(encrypted or not). Which will probably mean in the future: You have to pay for
it pretty much the same way as you pay for your internet access today. See:
unhosted.org.

--
~bit

[Melvin Carvalho]

On 30 April 2013 15:21, Klaus Schleisiek <***@ccc.de> wrote:

> Am 30.04.2013 12:32, schrieb Melvin Carvalho:
> >
> > Could you elaborate on what properties "self determined data storage"
> should have?
>
> You determine yourself, where your data is going to be stored and in what
> form
> (encrypted or not). Which will probably mean in the future: You have to
> pay for
> it pretty much the same way as you pay for your internet access today. See:
> unhosted.org.
>

Ah I see! Yes I've been aware of this project for some time, tho it's many
about client side web apps.

I'd encourage to also look at Tim's work, on which unhosted is partly
influenced:

http://www.w3.org/DesignIssues/CloudStorage.html

What I think you need is:

1. CRUD operations on your data
2. Ability to store in the format you choose (either an existing standard
or encrypted)
3. Ability to use the identity you choose
4.1 Ability to store your data in a data store you choose (data as a
commodity)
4.2 Ability to store data in multiple locations, I may store social data on
my friend's server, but financial data in my secure vault

Now you will be promised all 5 of these by every data store out there from
Microsoft to Dropbox to FLOSS

People will implement parts of this, but still be wary of lockin through
the back door e.g.

With (1) you often have ability to change but not add.

With (2) you are often forced into a format, often restrictive, encryption
is rare, but you can encrypt on the client to an extent

With (3) this is the main danger. You are normally cajoled into the
Trusted Third Party system, sometimes covertly by making you use email.

With (4.1) often it's choose from our list of approved providers, some are
included some excluded

With (4.2) It's rare to see this, most force you into one location for
everything

The project I know of that is closest to passing all 5 tests so far is on
of Tim's students side projects at MIT http://data.fm/

We need to get serious about data, so I'm very glad you posted this! :)



>
> --
> ~bit
>

[Nana Karlstetter]

Hi Klaus,

Did you already set the date for the workshop in August?

Best wishes
n.

> Gesendet: Dienstag, 30. April 2013 um 12:29 Uhr
> Von: "Klaus Schleisiek" <***@ccc.de>
> An: socialswarm-***@ml.foebud.org
> Cc: ***@gnu.org, "Vorstand Wauland" <***@wauland.de>
> Betreff: [SocialSwarm-D] PS: Social Network 3.0 - Preparing a 30C3 workshop
>
> PS: These remarks I have to add:
>
> 1) The workshop at the 30C3 and its preparatory meeting in August are meant for
> people, who already have come to the conclusion that a socialnet_3.0 will be
> based on end-to-end encryption and self determined data storage. Should you have
> a different opinion then these events are not meant for you. These two points
> are essentials and not open for discussion especially at the preparatory meeting.
>
> 2) We at WHS would like to limit the cost for the meeting to € 4000.-.
> Therefore, if you intend to participate in the August meeting, please send me
> your estimated travel cost. If more people would like to attend than can be
> funded, we will apply a first-come-first-serve policy according to the doodle
> voting list (http://www.doodle.com/tf8vctpe3h2fv4d9).
>
> 3) If you need a hotel room: Once it is clear how many rooms are needed we will
> take care of a group deal with a hotel in Berlin.
>
> :)
>
> Klaus Schleisiek
>
> Wau-Holland-Stiftung W
> Postfach 65 04 43 H O L L A N D
> 22364 Hamburg/Germany S T I F T U N G
> http://www.wauland.de
>
> Am 29.04.2013 11:20, schrieb Klaus Schleisiek:
> > Dear friends for unexploitable social networks,
> >
> > eventually Wau Holland Foundation has decided to sponsor a preparatory meeting
> > for a socialnet_3.0 workshop on 30C3.
> >
> > We decided that OHM would be too distracting for this type of work and instead,
> > we invite you to participate in a preparatory meeting in Berlin in August. To
> > choose the most appropriate weekend, please make your entry at
> > http://www.doodle.com/tf8vctpe3h2fv4d9 if you are interested to participate.
> >
> > "Invite" means that the foundation will reimburse travel and accomodation costs
> > up to € 400,-.
> >
> > The purpose for this meeting will be to prepare a workshop at 30C3:
> >
> > We should try to get an overview of current activities for a democratic social
> > network, propose an agenda for the 30C3 workshop and make a list of whom we
> > would like to participate.
> >
> > The aim of the 30C3 workshop itself will be to build a consensus of how
> > socialnet_3.0 is going to look like and to coordinate activities such that this
> > goal can be reached within the next 10 years.
> >
> > :)
> >
> > Klaus Schleisiek
> >
> > Wau-Holland-Stiftung W
> > Postfach 65 04 43 H O L L A N D
> > 22364 Hamburg/Germany S T I F T U N G
> > http://www.wauland.de
> >
>
>
> _______________________________________________
> SocialSwarm-DISCUSSION mailing list
> SocialSwarm-***@ml.foebud.org
> https://mail.foebud.org/cgi-bin/mailman/listinfo/socialswarm-discussion
>
> Website : http://socialswarm.net/
> Wiki : https://wiki.socialswarm.net
> Liquid Feedback: https://socialswarm.tracciabi.li
>
> All mailing lists for SocialSwarm:
>
> SocialSwarm-ANNOUNCE (Announcements only; no discussion)
> SocialSwarm-DISCUSSION (discussion list)
> SocialSwarm-TECH (discussion list for technik and coders)
>
> https://mail.foebud.org/cgi-bin/mailman/listinfo/socialswarm-announce
> https://mail.foebud.org/cgi-bin/mailman/listinfo/socialswarm-tech
> https://mail.foebud.org/cgi-bin/mailman/listinfo/socialswarm-discussion
>
>
> FoeBuD e.V. | Marktstrasse 18 | 33602 Bielefeld | Germany | ***@foebud.org
>

[Klaus Schleisiek]

Dear friends for unexploitable social networks,

the date for the meeting preparing a workshop on socialnet_3.0 at 30C3 has been
set: It will be on the weekend 24/25-August-2013. We will start on Saturday in
the afternoon until Sunday afternoon, so most people will be able to come on
Saturday and get back home on Sunday.

Therefore, I am now collecting your registrations. Please include your estimated
travel costs as well if you have not done so already. Also I need to know
whether you need accomodation in Berlin in which case we will take care of it.

The support for this initiative is encouraging. I hope to see you there!

Klaus Schleisiek

Wau-Holland-Stiftung W
Postfach 65 04 43 H O L L A N D
22364 Hamburg/Germany S T I F T U N G
http://www.wauland.de

[carlo von lynX]

Introducing our Multicast Publish/Subscribe API.
... taken from http://secushare.org/pubsub *** HTML version has links, in particular to https://gnunet.org/design-social-messaging-system
////

The Subscribe & Publish paradigm, recently nicknamed "pubsub," has been essential to Internet technology whenever something was intended for multiple recipients. It is an ancient usage pattern in any computer network, but currently all scalable solutions depend on a cloud infrastructure and are usually owned by a Faceboogle company.

Secure Share intends to provide a scalable publish and subscribe solution for the free and GNU Internet. This is probably what most of all sets it apart from any other privacy-enhancing project.

=== Pubsub used to do a better job before the web came

Pubsub exists on the Internet at least since mailing lists where invented in the early 80's. It's also in the signaling protocols around 1992's IP Multicast and in the /join command of 1987's IRC. Or just think of subscribing newsgroups in UseNET's NNTP.

The latter was arguably one of the best implementations of the pubsub concept to date, because it didn't just model the subscription process - it also provided for a standard to efficiently distribute the content to all the intended recipients. Nodes of the UseNET news system were organized in a multicast tree network with the intention of *minimizing required bandwidth,* which happened to be particularly precious prior to the arrival of web commerce.

Many lessons learned before the web were forgotten in the times after. Blogs and podcasts have been creating content, but you had to poll their RSS feeds to know there's something new. Discussion groups have devolved from newsgroups back to mailing lists.

Scalability is such a boring topic, it is usually left for last - and then it is too late, when millions of people want to use your product but you can't fix it to make it scale. I'm glad that you're still reading.

=== Scalability is proprietary.. or absent.. or you have to roll it yourself

Frequently, in modern designs, scalability isn't even part of the equation. Google's PubSubHubbub provides a simple HTTP-based signaling method, completely leaving out the distribution aspect – knowing that, should it become popular, only a cloud architecture such as Google's would be capable of actually providing a functioning and scalable implementation of the protocol. Thus, in the current pubsub universe, the Google PubSubHubbub server is the most popular one. Surprise.

Similar case with XMPP where the scalability issues are part of the protocol design and XEP-0060 just adds a publish/subscribe signaling procedure on top. Guess which node is the center of the XMPP universe? Google's. All attempts to introduce Multicast into XMPP were rejected by the XSF, ironically because of privacy issues. The term was even subjected to mean something else.

Other protocols that implement the pubsub paradigm, but leave the implementation of a distribution strategy to the respective software vendor, or even the final user, seem to be AMQP, MQTT and ICE. 0MQ has a binding for IP Multicast's PGM of which we already know that it either isn't available or it doesn't scale - so it is only interesting for deployment in the cloud.

PSYC has been providing a pubsub interface to chat rooms, friendships and other subscription channels, garnished with a decentralized multicast strategy, since the late 90's. It has been hosting large audience chat events for media enterprises.

===== Introducing secushare's Multicast and PubSub API

In the Secure Share project we have chosen to adapt and optimize PSYC's approach to the GNUnet architecture, for better independence from the Internet as it has come to be. The new API reflects a revamp of the protocol and an upcoming new implementation of the pubsub paradigm, which still is a great way to model most social interactions on the Internet.

The design is described in Gabor's master thesis, "Design of a Social Messaging System Using Stateful Multicast." Current development is going on in the SVN repository of GNUnet.

This time we are handing out a publish/subscribe API that actually *works out of the user's own computer,* not depending on servers, not exposing interests to other people than to the intended ones, and protecting the flow of information in transit. Designed to function also in cases of extreme popularity such as a pop star's Facebook or Twitter account.

At the same time as the implementation of this fundamental piece of the GNU Internet is taking place, we will soon present the equivalent of the ActivityStreams protocol, enabling developers to create user interfaces and further applications on top of an infrastructure that provides similar social functionality as the social services we are familiar with, but in a distributed and encrypted fashion.

This could be the foundation of a new free and libre Internet. Wish us luck. Or, even better.. participate, contribute.

[Nick Jennings]

Hi Carlo, nice to see this work being done, specifically a distributed
pubsub implementation. Do you have a repo where this is being developed?
Also is this just the beginning or is there something working already?

One question regarding ActivityStreams below:


On Tue, Sep 10, 2013 at 6:41 PM, carlo von lynX <
***@time.to.swarm.psyced.org> wrote:

>
> At the same time as the implementation of this fundamental piece of the
> GNU Internet is taking place, we will soon present the equivalent of the
> ActivityStreams protocol, enabling developers to create user interfaces and
> further applications on top of an infrastructure that provides similar
> social functionality as the social services we are familiar with, but in a
> distributed and encrypted fashion.
>
>
I'm unclear why it makes sense to re-invent the ActivityStreams protocol?
There is nothing in it's nature that defines infrastructure, so being
distributed and/or encrypted is something that can build on-top of the
existing protocol, also something I'm working closely with in Sockethub.

I don't understand where the value is in re-inventing this protocol?

Cheers
Nick

[Melvin Carvalho]

On 10 September 2013 19:45, Nick Jennings <***@silverbucket.net> wrote:

> Hi Carlo, nice to see this work being done, specifically a distributed
> pubsub implementation. Do you have a repo where this is being developed?
> Also is this just the beginning or is there something working already?
>
> One question regarding ActivityStreams below:
>
>
>
> On Tue, Sep 10, 2013 at 6:41 PM, carlo von lynX <
> ***@time.to.swarm.psyced.org> wrote:
>
>>
>> At the same time as the implementation of this fundamental piece of the
>> GNU Internet is taking place, we will soon present the equivalent of the
>> ActivityStreams protocol, enabling developers to create user interfaces and
>> further applications on top of an infrastructure that provides similar
>> social functionality as the social services we are familiar with, but in a
>> distributed and encrypted fashion.
>>
>>
> I'm unclear why it makes sense to re-invent the ActivityStreams protocol?
> There is nothing in it's nature that defines infrastructure, so being
> distributed and/or encrypted is something that can build on-top of the
> existing protocol, also something I'm working closely with in Sockethub.
>
> I don't understand where the value is in re-inventing this protocol?
>

Activity streams is itself a web 2.0 reinvention of existing tech and not a
very scalable interoperable or extensible one

At least 1.0 isnt. 2.0 looks more promising ...


>
> Cheers
> Nick
>
>
> --
> _______________________________________________
> SocialSwarm-DEV mailing list
> SocialSwarm-***@ml.foebud.org
> https://mail.foebud.org/cgi-bin/mailman/listinfo/socialswarm-dev
>
>

[Melvin Carvalho]

On 10 September 2013 19:45, Nick Jennings <***@silverbucket.net> wrote:

> Hi Carlo, nice to see this work being done, specifically a distributed
> pubsub implementation. Do you have a repo where this is being developed?
> Also is this just the beginning or is there something working already?
>
> One question regarding ActivityStreams below:
>
>
>
> On Tue, Sep 10, 2013 at 6:41 PM, carlo von lynX <
> ***@time.to.swarm.psyced.org> wrote:
>
>>
>> At the same time as the implementation of this fundamental piece of the
>> GNU Internet is taking place, we will soon present the equivalent of the
>> ActivityStreams protocol, enabling developers to create user interfaces and
>> further applications on top of an infrastructure that provides similar
>> social functionality as the social services we are familiar with, but in a
>> distributed and encrypted fashion.
>>
>>
> I'm unclear why it makes sense to re-invent the ActivityStreams protocol?
> There is nothing in it's nature that defines infrastructure, so being
> distributed and/or encrypted is something that can build on-top of the
> existing protocol, also something I'm working closely with in Sockethub.
>

Activity streams is not a protocol

It's a data serialization.

The current version relies on a proprietary central registry of verbs which
does not (currently) support any form of encryption as far as I know


>
> I don't understand where the value is in re-inventing this protocol?
>
> Cheers
> Nick
>
>
> --
> _______________________________________________
> SocialSwarm-DEV mailing list
> SocialSwarm-***@ml.foebud.org
> https://mail.foebud.org/cgi-bin/mailman/listinfo/socialswarm-dev
>
>

[Nick Jennings]

On Wed, Sep 18, 2013 at 2:11 PM, Melvin Carvalho
<***@gmail.com>wrote:

>
> On 10 September 2013 19:45, Nick Jennings <***@silverbucket.net> wrote:
>
>> Hi Carlo, nice to see this work being done, specifically a distributed
>> pubsub implementation. Do you have a repo where this is being developed?
>> Also is this just the beginning or is there something working already?
>>
>> One question regarding ActivityStreams below:
>>
>> On Tue, Sep 10, 2013 at 6:41 PM, carlo von lynX <
>> ***@time.to.swarm.psyced.org> wrote:
>>
>>>
>>> At the same time as the implementation of this fundamental piece of the
>>> GNU Internet is taking place, we will soon present the equivalent of the
>>> ActivityStreams protocol, enabling developers to create user interfaces and
>>> further applications on top of an infrastructure that provides similar
>>> social functionality as the social services we are familiar with, but in a
>>> distributed and encrypted fashion.
>>>
>>>
>> I'm unclear why it makes sense to re-invent the ActivityStreams protocol?
>> There is nothing in it's nature that defines infrastructure, so being
>> distributed and/or encrypted is something that can build on-top of the
>> existing protocol, also something I'm working closely with in Sockethub.
>>
>
> Activity streams is not a protocol
>
>
That depends on who you ask, from the Wikipedia page:

" The Activity
Streams<http://en.wikipedia.org/wiki/Activity_Streams_%28format%29>project,
for example, is an effort to develop an activity stream
protocol <http://en.wikipedia.org/wiki/Protocol_%28computing%29> to
syndicate activities across social
Web<http://en.wikipedia.org/wiki/Social_Web>applications.
[2] <http://en.wikipedia.org/wiki/Activity_stream#cite_note-2> "

While I agree there's more to a protocol than just the data format, there's
definitely work being done to make the content of the AS objects indicate
either intent or result, which lays the groundwork for a protocol.


It's a data serialization.
>
>
While basically true, I'm not sure that's a descriptive enough word, as
JSON itself is a data serialization method.

I was using the same words Carlo used to reference it, and I don't have a
strong opinion either way, but I don't think using the term serialization
makes it any clearer.


The current version relies on a proprietary central registry of verbs which
> does not (currently) support any form of encryption as far as I know
>

If AS is a protocol, then I don't understand why a definition of verbs
should be considered proprietary or centralized - in the same way that any
other protocol, be it HTTP, SMTP or FINGER, has a set of defined commands.

If AS is a data serialization mechanism, I don't understand how it can
written it to "support for any form of encryption". Are the two related?
Does JSON itself have built in support for encryption that AS lacks? Could
you give me some examples of data serialization which supports encryption?

Maybe I misunderstand what is meant by the original statement by Carlo, but
that's why I asked in the first place.

Cheers
Nick

[Melvin Carvalho]

On 18 September 2013 15:47, Nick Jennings <***@silverbucket.net> wrote:

>
>
>
> On Wed, Sep 18, 2013 at 2:11 PM, Melvin Carvalho <***@gmail.com
> > wrote:
>
>>
>> On 10 September 2013 19:45, Nick Jennings <***@silverbucket.net> wrote:
>>
>>> Hi Carlo, nice to see this work being done, specifically a distributed
>>> pubsub implementation. Do you have a repo where this is being developed?
>>> Also is this just the beginning or is there something working already?
>>>
>>> One question regarding ActivityStreams below:
>>>
>>> On Tue, Sep 10, 2013 at 6:41 PM, carlo von lynX <
>>> ***@time.to.swarm.psyced.org> wrote:
>>>
>>>>
>>>> At the same time as the implementation of this fundamental piece of the
>>>> GNU Internet is taking place, we will soon present the equivalent of the
>>>> ActivityStreams protocol, enabling developers to create user interfaces and
>>>> further applications on top of an infrastructure that provides similar
>>>> social functionality as the social services we are familiar with, but in a
>>>> distributed and encrypted fashion.
>>>>
>>>>
>>> I'm unclear why it makes sense to re-invent the ActivityStreams
>>> protocol? There is nothing in it's nature that defines infrastructure, so
>>> being distributed and/or encrypted is something that can build on-top of
>>> the existing protocol, also something I'm working closely with in Sockethub.
>>>
>>
>> Activity streams is not a protocol
>>
>>
> That depends on who you ask, from the Wikipedia page:
>
> " The Activity Streams<http://en.wikipedia.org/wiki/Activity_Streams_%28format%29>project, for example, is an effort to develop an activity stream
> protocol <http://en.wikipedia.org/wiki/Protocol_%28computing%29> to
> syndicate activities across social Web<http://en.wikipedia.org/wiki/Social_Web>applications.
> [2] <http://en.wikipedia.org/wiki/Activity_stream#cite_note-2> "
>
> While I agree there's more to a protocol than just the data format,
> there's definitely work being done to make the content of the AS objects
> indicate either intent or result, which lays the groundwork for a protocol.
>
>
> It's a data serialization.
>>
>>
> While basically true, I'm not sure that's a descriptive enough word, as
> JSON itself is a data serialization method.
>
> I was using the same words Carlo used to reference it, and I don't have a
> strong opinion either way, but I don't think using the term serialization
> makes it any clearer.
>
>
> The current version relies on a proprietary central registry of verbs
>> which does not (currently) support any form of encryption as far as I know
>>
>
> If AS is a protocol, then I don't understand why a definition of verbs
> should be considered proprietary or centralized - in the same way that any
> other protocol, be it HTTP, SMTP or FINGER, has a set of defined commands.
>
> If AS is a data serialization mechanism, I don't understand how it can
> written it to "support for any form of encryption". Are the two related?
> Does JSON itself have built in support for encryption that AS lacks? Could
> you give me some examples of data serialization which supports encryption?
>
> Maybe I misunderstand what is meant by the original statement by Carlo,
> but that's why I asked in the first place.
>

"Depending on who you speak to" is hedging your bets a bit!

I was speaking to you, what's your take? Is activity streams a protocol or
not?

Here's the article you linked to:
http://en.wikipedia.org/wiki/Protocol_%28computing%29 (Communications
Protocol)

>
>
> Cheers
> Nick
>
>
>

[Nick Jennings]

On Wed, Sep 18, 2013 at 5:59 PM, Melvin Carvalho
<***@gmail.com>wrote:

>
> On 18 September 2013 15:47, Nick Jennings <***@silverbucket.net> wrote:
>
>>
>>
>>
>> On Wed, Sep 18, 2013 at 2:11 PM, Melvin Carvalho <
>> ***@gmail.com> wrote:
>>
>>>
>>> On 10 September 2013 19:45, Nick Jennings <***@silverbucket.net> wrote:
>>>
>>>> Hi Carlo, nice to see this work being done, specifically a distributed
>>>> pubsub implementation. Do you have a repo where this is being developed?
>>>> Also is this just the beginning or is there something working already?
>>>>
>>>> One question regarding ActivityStreams below:
>>>>
>>>> On Tue, Sep 10, 2013 at 6:41 PM, carlo von lynX <
>>>> ***@time.to.swarm.psyced.org> wrote:
>>>>
>>>>>
>>>>> At the same time as the implementation of this fundamental piece of
>>>>> the GNU Internet is taking place, we will soon present the equivalent of
>>>>> the ActivityStreams protocol, enabling developers to create user interfaces
>>>>> and further applications on top of an infrastructure that provides similar
>>>>> social functionality as the social services we are familiar with, but in a
>>>>> distributed and encrypted fashion.
>>>>>
>>>>>
>>>> I'm unclear why it makes sense to re-invent the ActivityStreams
>>>> protocol? There is nothing in it's nature that defines infrastructure, so
>>>> being distributed and/or encrypted is something that can build on-top of
>>>> the existing protocol, also something I'm working closely with in Sockethub.
>>>>
>>>
>>> Activity streams is not a protocol
>>>
>>>
>> That depends on who you ask, from the Wikipedia page:
>>
>> " The Activity Streams<http://en.wikipedia.org/wiki/Activity_Streams_%28format%29>project, for example, is an effort to develop an activity stream
>> protocol <http://en.wikipedia.org/wiki/Protocol_%28computing%29> to
>> syndicate activities across social Web<http://en.wikipedia.org/wiki/Social_Web>applications.
>> [2] <http://en.wikipedia.org/wiki/Activity_stream#cite_note-2> "
>>
>> While I agree there's more to a protocol than just the data format,
>> there's definitely work being done to make the content of the AS objects
>> indicate either intent or result, which lays the groundwork for a protocol.
>>
>>
>> It's a data serialization.
>>>
>>>
>> While basically true, I'm not sure that's a descriptive enough word, as
>> JSON itself is a data serialization method.
>>
>> I was using the same words Carlo used to reference it, and I don't have a
>> strong opinion either way, but I don't think using the term serialization
>> makes it any clearer.
>>
>>
>> The current version relies on a proprietary central registry of verbs
>>> which does not (currently) support any form of encryption as far as I know
>>>
>>
>> If AS is a protocol, then I don't understand why a definition of verbs
>> should be considered proprietary or centralized - in the same way that any
>> other protocol, be it HTTP, SMTP or FINGER, has a set of defined commands.
>>
>> If AS is a data serialization mechanism, I don't understand how it can
>> written it to "support for any form of encryption". Are the two related?
>> Does JSON itself have built in support for encryption that AS lacks? Could
>> you give me some examples of data serialization which supports encryption?
>>
>> Maybe I misunderstand what is meant by the original statement by Carlo,
>> but that's why I asked in the first place.
>>
>
> "Depending on who you speak to" is hedging your bets a bit!
>
> I was speaking to you, what's your take? Is activity streams a protocol
> or not?
>
>
I'm more interested in my original question, not whether AS is a protocol
or not. Like I said, I don't have a strong opinion either way.

[Melvin Carvalho]

On 18 September 2013 18:06, Nick Jennings <***@silverbucket.net> wrote:

>
>
>
> On Wed, Sep 18, 2013 at 5:59 PM, Melvin Carvalho <***@gmail.com
> > wrote:
>
>>
>> On 18 September 2013 15:47, Nick Jennings <***@silverbucket.net> wrote:
>>
>>>
>>>
>>>
>>> On Wed, Sep 18, 2013 at 2:11 PM, Melvin Carvalho <
>>> ***@gmail.com> wrote:
>>>
>>>>
>>>> On 10 September 2013 19:45, Nick Jennings <***@silverbucket.net>wrote:
>>>>
>>>>> Hi Carlo, nice to see this work being done, specifically a distributed
>>>>> pubsub implementation. Do you have a repo where this is being developed?
>>>>> Also is this just the beginning or is there something working already?
>>>>>
>>>>> One question regarding ActivityStreams below:
>>>>>
>>>>> On Tue, Sep 10, 2013 at 6:41 PM, carlo von lynX <
>>>>> ***@time.to.swarm.psyced.org> wrote:
>>>>>
>>>>>>
>>>>>> At the same time as the implementation of this fundamental piece of
>>>>>> the GNU Internet is taking place, we will soon present the equivalent of
>>>>>> the ActivityStreams protocol, enabling developers to create user interfaces
>>>>>> and further applications on top of an infrastructure that provides similar
>>>>>> social functionality as the social services we are familiar with, but in a
>>>>>> distributed and encrypted fashion.
>>>>>>
>>>>>>
>>>>> I'm unclear why it makes sense to re-invent the ActivityStreams
>>>>> protocol? There is nothing in it's nature that defines infrastructure, so
>>>>> being distributed and/or encrypted is something that can build on-top of
>>>>> the existing protocol, also something I'm working closely with in Sockethub.
>>>>>
>>>>
>>>> Activity streams is not a protocol
>>>>
>>>>
>>> That depends on who you ask, from the Wikipedia page:
>>>
>>> " The Activity Streams<http://en.wikipedia.org/wiki/Activity_Streams_%28format%29>project, for example, is an effort to develop an activity stream
>>> protocol <http://en.wikipedia.org/wiki/Protocol_%28computing%29> to
>>> syndicate activities across social Web<http://en.wikipedia.org/wiki/Social_Web>applications.
>>> [2] <http://en.wikipedia.org/wiki/Activity_stream#cite_note-2> "
>>>
>>> While I agree there's more to a protocol than just the data format,
>>> there's definitely work being done to make the content of the AS objects
>>> indicate either intent or result, which lays the groundwork for a protocol.
>>>
>>>
>>> It's a data serialization.
>>>>
>>>>
>>> While basically true, I'm not sure that's a descriptive enough word, as
>>> JSON itself is a data serialization method.
>>>
>>> I was using the same words Carlo used to reference it, and I don't have
>>> a strong opinion either way, but I don't think using the term serialization
>>> makes it any clearer.
>>>
>>>
>>> The current version relies on a proprietary central registry of verbs
>>>> which does not (currently) support any form of encryption as far as I know
>>>>
>>>
>>> If AS is a protocol, then I don't understand why a definition of verbs
>>> should be considered proprietary or centralized - in the same way that any
>>> other protocol, be it HTTP, SMTP or FINGER, has a set of defined commands.
>>>
>>> If AS is a data serialization mechanism, I don't understand how it can
>>> written it to "support for any form of encryption". Are the two related?
>>> Does JSON itself have built in support for encryption that AS lacks? Could
>>> you give me some examples of data serialization which supports encryption?
>>>
>>> Maybe I misunderstand what is meant by the original statement by Carlo,
>>> but that's why I asked in the first place.
>>>
>>
>> "Depending on who you speak to" is hedging your bets a bit!
>>
>> I was speaking to you, what's your take? Is activity streams a protocol
>> or not?
>>
>>
> I'm more interested in my original question, not whether AS is a protocol
> or not. Like I said, I don't have a strong opinion either way.
>
>
OK, then why did you argue the case?

HTTP is the protocol, Activity Streams is the serialization. A
(communications) protocol is way more complex than a serialization. And if
this is what you want to do with sockethub / activity stream, I think
you're going to run into major issues.

My comment was that the Activity Streams specification does not mention
encryption anywhere.

You are the person that said: "being distributed and/or encrypted is
something that can build on-top of the existing protocol" ... "something
I'm working closely with in Sockethub"

I have doubts about this comment ... how do you intend to build encryption
on-top of Activity Streams?

[Nick Jennings]

On Wed, Sep 18, 2013 at 6:23 PM, Melvin Carvalho
<***@gmail.com>wrote:

>
>
>
> On 18 September 2013 18:06, Nick Jennings <***@silverbucket.net> wrote:
>
>>
>>
>>
>> On Wed, Sep 18, 2013 at 5:59 PM, Melvin Carvalho <
>> ***@gmail.com> wrote:
>>
>>>
>>> On 18 September 2013 15:47, Nick Jennings <***@silverbucket.net> wrote:
>>>
>>>>
>>>>
>>>>
>>>> On Wed, Sep 18, 2013 at 2:11 PM, Melvin Carvalho <
>>>> ***@gmail.com> wrote:
>>>>
>>>>>
>>>>> On 10 September 2013 19:45, Nick Jennings <***@silverbucket.net>wrote:
>>>>>
>>>>>> Hi Carlo, nice to see this work being done, specifically a
>>>>>> distributed pubsub implementation. Do you have a repo where this is being
>>>>>> developed? Also is this just the beginning or is there something working
>>>>>> already?
>>>>>>
>>>>>> One question regarding ActivityStreams below:
>>>>>>
>>>>>> On Tue, Sep 10, 2013 at 6:41 PM, carlo von lynX <
>>>>>> ***@time.to.swarm.psyced.org> wrote:
>>>>>>
>>>>>>>
>>>>>>> At the same time as the implementation of this fundamental piece of
>>>>>>> the GNU Internet is taking place, we will soon present the equivalent of
>>>>>>> the ActivityStreams protocol, enabling developers to create user interfaces
>>>>>>> and further applications on top of an infrastructure that provides similar
>>>>>>> social functionality as the social services we are familiar with, but in a
>>>>>>> distributed and encrypted fashion.
>>>>>>>
>>>>>>>
>>>>>> I'm unclear why it makes sense to re-invent the ActivityStreams
>>>>>> protocol? There is nothing in it's nature that defines infrastructure, so
>>>>>> being distributed and/or encrypted is something that can build on-top of
>>>>>> the existing protocol, also something I'm working closely with in Sockethub.
>>>>>>
>>>>>
>>>>> Activity streams is not a protocol
>>>>>
>>>>>
>>>> That depends on who you ask, from the Wikipedia page:
>>>>
>>>> " The Activity Streams<http://en.wikipedia.org/wiki/Activity_Streams_%28format%29>project, for example, is an effort to develop an activity stream
>>>> protocol <http://en.wikipedia.org/wiki/Protocol_%28computing%29> to
>>>> syndicate activities across social Web<http://en.wikipedia.org/wiki/Social_Web>applications.
>>>> [2] <http://en.wikipedia.org/wiki/Activity_stream#cite_note-2> "
>>>>
>>>> While I agree there's more to a protocol than just the data format,
>>>> there's definitely work being done to make the content of the AS objects
>>>> indicate either intent or result, which lays the groundwork for a protocol.
>>>>
>>>>
>>>> It's a data serialization.
>>>>>
>>>>>
>>>> While basically true, I'm not sure that's a descriptive enough word, as
>>>> JSON itself is a data serialization method.
>>>>
>>>> I was using the same words Carlo used to reference it, and I don't have
>>>> a strong opinion either way, but I don't think using the term serialization
>>>> makes it any clearer.
>>>>
>>>>
>>>> The current version relies on a proprietary central registry of verbs
>>>>> which does not (currently) support any form of encryption as far as I know
>>>>>
>>>>
>>>> If AS is a protocol, then I don't understand why a definition of verbs
>>>> should be considered proprietary or centralized - in the same way that any
>>>> other protocol, be it HTTP, SMTP or FINGER, has a set of defined commands.
>>>>
>>>> If AS is a data serialization mechanism, I don't understand how it can
>>>> written it to "support for any form of encryption". Are the two related?
>>>> Does JSON itself have built in support for encryption that AS lacks? Could
>>>> you give me some examples of data serialization which supports encryption?
>>>>
>>>> Maybe I misunderstand what is meant by the original statement by Carlo,
>>>> but that's why I asked in the first place.
>>>>
>>>
>>> "Depending on who you speak to" is hedging your bets a bit!
>>>
>>> I was speaking to you, what's your take? Is activity streams a protocol
>>> or not?
>>>
>>>
>> I'm more interested in my original question, not whether AS is a protocol
>> or not. Like I said, I don't have a strong opinion either way.
>>
>>
> OK, then why did you argue the case?
>
>
I'm not arguing any case, I just pointed out that many people, including
the OP and Wikipedia refer to AS as a protocol. I really don't care what
people call it. Maybe you could ask Carlo why he chose those words.


HTTP is the protocol, Activity Streams is the serialization. A
> (communications) protocol is way more complex than a serialization.
>

I'm fully aware of the differences between serialization and protocols.



> And if this is what you want to do with sockethub / activity stream, I
> think you're going to run into major issues.
>
> My comment was that the Activity Streams specification does not mention
> encryption anywhere.
>
> You are the person that said: "being distributed and/or encrypted is
> something that can build on-top of the existing protocol" ... "something
> I'm working closely with in Sockethub"
>
> I have doubts about this comment ... how do you intend to build encryption
> on-top of Activity Streams?
>

You have doubts that I'm working closely with implementing encryption
wherever I can? I'm sorry to hear that, but I asked my original question to
perhaps gain some insight into what shortcomings AS has in regards to being
implemented in a distributed, encrypted infrastructure.

As in, what characteristics about a protocol or serialization method lend
itself to encryption or make it more difficult, and why does it really
matter what a payload is within an encrypted channel.

I think it should be considered with care when deciding to re-implement
something that already exists, like AS, to serve the same purpose. So I was
curious as to what the thought process was, and asked the question in the
hopes I might learn something new.

I don't really want to continue to get caught up in semantics with you
about wording of protocol vs. serialization, as it's completely unrelated
to my question.

Cheers
Nick

[Melvin Carvalho]

On 19 September 2013 21:51, Nick Jennings <***@silverbucket.net> wrote:

>
>
>
> On Wed, Sep 18, 2013 at 6:23 PM, Melvin Carvalho <***@gmail.com
> > wrote:
>
>>
>>
>>
>> On 18 September 2013 18:06, Nick Jennings <***@silverbucket.net> wrote:
>>
>>>
>>>
>>>
>>> On Wed, Sep 18, 2013 at 5:59 PM, Melvin Carvalho <
>>> ***@gmail.com> wrote:
>>>
>>>>
>>>> On 18 September 2013 15:47, Nick Jennings <***@silverbucket.net>wrote:
>>>>
>>>>>
>>>>>
>>>>>
>>>>> On Wed, Sep 18, 2013 at 2:11 PM, Melvin Carvalho <
>>>>> ***@gmail.com> wrote:
>>>>>
>>>>>>
>>>>>> On 10 September 2013 19:45, Nick Jennings <***@silverbucket.net>wrote:
>>>>>>
>>>>>>> Hi Carlo, nice to see this work being done, specifically a
>>>>>>> distributed pubsub implementation. Do you have a repo where this is being
>>>>>>> developed? Also is this just the beginning or is there something working
>>>>>>> already?
>>>>>>>
>>>>>>> One question regarding ActivityStreams below:
>>>>>>>
>>>>>>> On Tue, Sep 10, 2013 at 6:41 PM, carlo von lynX <
>>>>>>> ***@time.to.swarm.psyced.org> wrote:
>>>>>>>
>>>>>>>>
>>>>>>>> At the same time as the implementation of this fundamental piece of
>>>>>>>> the GNU Internet is taking place, we will soon present the equivalent of
>>>>>>>> the ActivityStreams protocol, enabling developers to create user interfaces
>>>>>>>> and further applications on top of an infrastructure that provides similar
>>>>>>>> social functionality as the social services we are familiar with, but in a
>>>>>>>> distributed and encrypted fashion.
>>>>>>>>
>>>>>>>>
>>>>>>> I'm unclear why it makes sense to re-invent the ActivityStreams
>>>>>>> protocol? There is nothing in it's nature that defines infrastructure, so
>>>>>>> being distributed and/or encrypted is something that can build on-top of
>>>>>>> the existing protocol, also something I'm working closely with in Sockethub.
>>>>>>>
>>>>>>
>>>>>> Activity streams is not a protocol
>>>>>>
>>>>>>
>>>>> That depends on who you ask, from the Wikipedia page:
>>>>>
>>>>> " The Activity Streams<http://en.wikipedia.org/wiki/Activity_Streams_%28format%29>project, for example, is an effort to develop an activity stream
>>>>> protocol <http://en.wikipedia.org/wiki/Protocol_%28computing%29> to
>>>>> syndicate activities across social Web<http://en.wikipedia.org/wiki/Social_Web>applications.
>>>>> [2] <http://en.wikipedia.org/wiki/Activity_stream#cite_note-2> "
>>>>>
>>>>> While I agree there's more to a protocol than just the data format,
>>>>> there's definitely work being done to make the content of the AS objects
>>>>> indicate either intent or result, which lays the groundwork for a protocol.
>>>>>
>>>>>
>>>>> It's a data serialization.
>>>>>>
>>>>>>
>>>>> While basically true, I'm not sure that's a descriptive enough word,
>>>>> as JSON itself is a data serialization method.
>>>>>
>>>>> I was using the same words Carlo used to reference it, and I don't
>>>>> have a strong opinion either way, but I don't think using the term
>>>>> serialization makes it any clearer.
>>>>>
>>>>>
>>>>> The current version relies on a proprietary central registry of verbs
>>>>>> which does not (currently) support any form of encryption as far as I know
>>>>>>
>>>>>
>>>>> If AS is a protocol, then I don't understand why a definition of verbs
>>>>> should be considered proprietary or centralized - in the same way that any
>>>>> other protocol, be it HTTP, SMTP or FINGER, has a set of defined commands.
>>>>>
>>>>> If AS is a data serialization mechanism, I don't understand how it can
>>>>> written it to "support for any form of encryption". Are the two related?
>>>>> Does JSON itself have built in support for encryption that AS lacks? Could
>>>>> you give me some examples of data serialization which supports encryption?
>>>>>
>>>>> Maybe I misunderstand what is meant by the original statement by
>>>>> Carlo, but that's why I asked in the first place.
>>>>>
>>>>
>>>> "Depending on who you speak to" is hedging your bets a bit!
>>>>
>>>> I was speaking to you, what's your take? Is activity streams a
>>>> protocol or not?
>>>>
>>>>
>>> I'm more interested in my original question, not whether AS is a
>>> protocol or not. Like I said, I don't have a strong opinion either way.
>>>
>>>
>> OK, then why did you argue the case?
>>
>>
> I'm not arguing any case, I just pointed out that many people, including
> the OP and Wikipedia refer to AS as a protocol. I really don't care what
> people call it. Maybe you could ask Carlo why he chose those words.
>
>
> HTTP is the protocol, Activity Streams is the serialization. A
>> (communications) protocol is way more complex than a serialization.
>>
>
> I'm fully aware of the differences between serialization and protocols.
>
>
>
>> And if this is what you want to do with sockethub / activity stream, I
>> think you're going to run into major issues.
>>
>> My comment was that the Activity Streams specification does not mention
>> encryption anywhere.
>>
>> You are the person that said: "being distributed and/or encrypted is
>> something that can build on-top of the existing protocol" ... "something
>> I'm working closely with in Sockethub"
>>
>> I have doubts about this comment ... how do you intend to build
>> encryption on-top of Activity Streams?
>>
>
> You have doubts that I'm working closely with implementing encryption
> wherever I can? I'm sorry to hear that, but I asked my original question to
> perhaps gain some insight into what shortcomings AS has in regards to being
> implemented in a distributed, encrypted infrastructure.
>

i asked how you are working to build encryption on top, in line with our
claim


>
> As in, what characteristics about a protocol or serialization method lend
> itself to encryption or make it more difficult, and why does it really
> matter what a payload is within an encrypted channel.
>
> I think it should be considered with care when deciding to re-implement
> something that already exists, like AS, to serve the same purpose. So I was
> curious as to what the thought process was, and asked the question in the
> hopes I might learn something new.
>
> I don't really want to continue to get caught up in semantics with you
> about wording of protocol vs. serialization, as it's completely unrelated
> to my question.
>

activity streams itself is a reinvention ... you are saying pick one
reinvention over another and at the same time not to reinvent ... it's a
contradiction


>
> Cheers
> Nick
>

[Nick Jennings]

On Thu, Sep 19, 2013 at 10:48 PM, Melvin Carvalho
<***@gmail.com>wrote:

> On 19 September 2013 21:51, Nick Jennings <***@silverbucket.net> wrote:
>
>> On Wed, Sep 18, 2013 at 6:23 PM, Melvin Carvalho <
>> ***@gmail.com> wrote:
>>
>>> On 18 September 2013 18:06, Nick Jennings <***@silverbucket.net> wrote:
>>>
>>>> On Wed, Sep 18, 2013 at 5:59 PM, Melvin Carvalho <
>>>> ***@gmail.com> wrote:
>>>>
>>>>> On 18 September 2013 15:47, Nick Jennings <***@silverbucket.net>wrote:
>>>>>
>>>>>> On Wed, Sep 18, 2013 at 2:11 PM, Melvin Carvalho <
>>>>>> ***@gmail.com> wrote:
>>>>>>
>>>>>>> On 10 September 2013 19:45, Nick Jennings <***@silverbucket.net>wrote:
>>>>>>>
>>>>>>>> Hi Carlo, nice to see this work being done, specifically a
>>>>>>>> distributed pubsub implementation. Do you have a repo where this is being
>>>>>>>> developed? Also is this just the beginning or is there something working
>>>>>>>> already?
>>>>>>>>
>>>>>>>> One question regarding ActivityStreams below:
>>>>>>>>
>>>>>>>> On Tue, Sep 10, 2013 at 6:41 PM, carlo von lynX <
>>>>>>>> ***@time.to.swarm.psyced.org> wrote:
>>>>>>>>
>>>>>>>>>
>>>>>>>>> At the same time as the implementation of this fundamental piece
>>>>>>>>> of the GNU Internet is taking place, we will soon present the equivalent of
>>>>>>>>> the ActivityStreams protocol, enabling developers to create user interfaces
>>>>>>>>> and further applications on top of an infrastructure that provides similar
>>>>>>>>> social functionality as the social services we are familiar with, but in a
>>>>>>>>> distributed and encrypted fashion.
>>>>>>>>>
>>>>>>>>>
>>>>>>>> I'm unclear why it makes sense to re-invent the ActivityStreams
>>>>>>>> protocol? There is nothing in it's nature that defines infrastructure, so
>>>>>>>> being distributed and/or encrypted is something that can build on-top of
>>>>>>>> the existing protocol, also something I'm working closely with in Sockethub.
>>>>>>>>
>>>>>>>
>>>>>>> Activity streams is not a protocol
>>>>>>>
>>>>>>>
>>>>>> That depends on who you ask, from the Wikipedia page:
>>>>>>
>>>>>> " The Activity Streams<http://en.wikipedia.org/wiki/Activity_Streams_%28format%29>project, for example, is an effort to develop an activity stream
>>>>>> protocol <http://en.wikipedia.org/wiki/Protocol_%28computing%29> to
>>>>>> syndicate activities across social Web<http://en.wikipedia.org/wiki/Social_Web>applications.
>>>>>> [2] <http://en.wikipedia.org/wiki/Activity_stream#cite_note-2> "
>>>>>>
>>>>>> While I agree there's more to a protocol than just the data format,
>>>>>> there's definitely work being done to make the content of the AS objects
>>>>>> indicate either intent or result, which lays the groundwork for a protocol.
>>>>>>
>>>>>>
>>>>>> It's a data serialization.
>>>>>>>
>>>>>>>
>>>>>> While basically true, I'm not sure that's a descriptive enough word,
>>>>>> as JSON itself is a data serialization method.
>>>>>>
>>>>>> I was using the same words Carlo used to reference it, and I don't
>>>>>> have a strong opinion either way, but I don't think using the term
>>>>>> serialization makes it any clearer.
>>>>>>
>>>>>>
>>>>>> The current version relies on a proprietary central registry of verbs
>>>>>>> which does not (currently) support any form of encryption as far as I know
>>>>>>>
>>>>>>
>>>>>> If AS is a protocol, then I don't understand why a definition of
>>>>>> verbs should be considered proprietary or centralized - in the same way
>>>>>> that any other protocol, be it HTTP, SMTP or FINGER, has a set of defined
>>>>>> commands.
>>>>>>
>>>>>> If AS is a data serialization mechanism, I don't understand how it
>>>>>> can written it to "support for any form of encryption". Are the two
>>>>>> related? Does JSON itself have built in support for encryption that AS
>>>>>> lacks? Could you give me some examples of data serialization which supports
>>>>>> encryption?
>>>>>>
>>>>>> Maybe I misunderstand what is meant by the original statement by
>>>>>> Carlo, but that's why I asked in the first place.
>>>>>>
>>>>>
>>>>> "Depending on who you speak to" is hedging your bets a bit!
>>>>>
>>>>> I was speaking to you, what's your take? Is activity streams a
>>>>> protocol or not?
>>>>>
>>>>>
>>>> I'm more interested in my original question, not whether AS is a
>>>> protocol or not. Like I said, I don't have a strong opinion either way.
>>>>
>>>>
>>> OK, then why did you argue the case?
>>>
>>>
>> I'm not arguing any case, I just pointed out that many people, including
>> the OP and Wikipedia refer to AS as a protocol. I really don't care what
>> people call it. Maybe you could ask Carlo why he chose those words.
>>
>>
>> HTTP is the protocol, Activity Streams is the serialization. A
>>> (communications) protocol is way more complex than a serialization.
>>>
>>
>> I'm fully aware of the differences between serialization and protocols.
>>
>>
>>
>>> And if this is what you want to do with sockethub / activity stream, I
>>> think you're going to run into major issues.
>>>
>>> My comment was that the Activity Streams specification does not mention
>>> encryption anywhere.
>>>
>>> You are the person that said: "being distributed and/or encrypted is
>>> something that can build on-top of the existing protocol" ... "something
>>> I'm working closely with in Sockethub"
>>>
>>> I have doubts about this comment ... how do you intend to build
>>> encryption on-top of Activity Streams?
>>>
>>
>> You have doubts that I'm working closely with implementing encryption
>> wherever I can? I'm sorry to hear that, but I asked my original question to
>> perhaps gain some insight into what shortcomings AS has in regards to being
>> implemented in a distributed, encrypted infrastructure.
>>
>
> i asked how you are working to build encryption on top, in line with our
> claim
>

I'm not working to build encryption on-top of AS, but I am working with
encrypting data and that data happens to be Activity Streams-like objects.
In fact all data that comes into Sockethub is immediately encrypted. (and
yes, I know that's not good enough, which is why GNUnet is aiming to be
what it's aiming to be)

I'm not a security expert and make no claims to any encryption
sophistication to the levels that GNUnet is aiming. In fact I chimed in
this thread not to argue semantics with you, believe it or not, but in the
hopes I might learn something new about shortcomings of AS from Carlos
perspective. Instead it seems I've caught a troll. :)



>> As in, what characteristics about a protocol or serialization method lend
>> itself to encryption or make it more difficult, and why does it really
>> matter what a payload is within an encrypted channel.
>>
>> I think it should be considered with care when deciding to re-implement
>> something that already exists, like AS, to serve the same purpose. So I was
>> curious as to what the thought process was, and asked the question in the
>> hopes I might learn something new.
>>
>> I don't really want to continue to get caught up in semantics with you
>> about wording of protocol vs. serialization, as it's completely unrelated
>> to my question.
>>
>
> activity streams itself is a reinvention ... you are saying pick one
> reinvention over another and at the same time not to reinvent ... it's a
> contradiction
>

I'm not saying anything of the kind, please don't put words in my mouth,
and please don't assume I'm evangelizing AS. The point I made you would,
and have, agreed with - or made yourself - on several occasions. I don't
care if it's AS or HTTP or FINGER or JSON, I think it should be thought
through and hopefully discussed as to the reasoning for re-creating
something. As I was not part of that conversation I asked that I might
learn something, but now I'm repeating myself.
http://xkcd.com/927/

I answered your question (re: encryption) above, because you asked, though
based on your comments so far, I question whether you asked for any reason
other than to find more avenues to attack... Sorry to say but I find this
thread completely pointless and not conducive to a constructive
conversation.

Let's end it shall we?

Cheers
Nick

[carlo von lynX]

This summer somebody broke the Internet, or at least we finally found
out about it. #youbroketheinternet now has a map of several dozen free
software projects, organized by architectural layer, that are somehow
in the mix for fixing the Internet, from getting hardware right, through
enabling the necessary scalability for the social swarm, up to dealing
with the usability of it all.

Let us know if you find your favorite projects placed properly on
http://youbroketheinternet.org/map - in any case all green and yellow
projects mentioned on the map are invited to SPEAK at our 30C3 sessions
in Hamburg after Christmas. Just click on "create project" and add it
to the YBTI assembly:

https://events.ccc.de/congress/2013/wiki/Assembly:Youbroketheinternet

I hope you will consider this also the GNU Consensus and Social Swarm
assembly that this project was born in. Please also add yourself as an
individual member, if you're likely to be at the congress.

[Andreas Kuckartz]

carlo von lynX:
> Let us know if you find your favorite projects placed properly on
> http://youbroketheinternet.org/map - in any case all green and yellow
> projects mentioned on the map are invited to SPEAK at our 30C3
> sessions in Hamburg after Christmas. Just click on "create project"
> and add it to the YBTI assembly:
>
> https://events.ccc.de/congress/2013/wiki/Assembly:Youbroketheinternet

I have added "FederatedSocialWeb" as a project, which stands for the
"W3C Federated Social Web Community Group".

Some comments regarding youbroketheinternet.org:

1. "We are preparing a EU law proposal to require obfuscated and
end-to-end encrypted communications in all telephony and computer
appliances sold after 2014. The law shall include ways to ensure its
correct implementation and a transition path from the existing
unencrypted systems."

I can guess who "we" is, and I do not support this. It is extremely
likely that such a proposal will not lead to a positive result. If such
a law is accepted it will contain legal requirements to implement
backdoors in end-to-end encrypted communications for so-called "law
enforcement" purposes.

2. "We like the Pirate Party, but we are not a project of the Pirate
movement."

I (and probably some of the projects on the map) do not like the Pirate
Party. I can elaborate on that, but that probably would be off-topic.
But let me just mention that I do not like _any_ party which has a
chairperson defending the German secret services.

3. Some of the light red colors on the map regarding "faulty
technologies that we shall replace" are not appropriate. I don't want to
prevent other people from trying to replace "Web Browsers", for example.
But sometimes it is better to improve existing technologies than to
attempt to replace them.

Cheers,
Andreas

[hellekin]

On 11/14/2013 05:47 AM, Andreas Kuckartz wrote:
>
*** Hi Andreas, you and lynX put me in quoting mode...

> a law is accepted it will contain legal requirements to implement
> backdoors in end-to-end encrypted communications for so-called
> "law enforcement" purposes.
>
*** I guess that is the point of such a law: to make explicit--and
public--the actual (supposed) limits of police usage of surveillance.

That said: "The more laws and order are made prominent, the more
thieves and robbers there will be." -- Lao Tzu

I recommend having a look at the horrible TPP draft leaked by
Wikileaks yesterday for some insight.

> 2. "We like the Pirate Party, but we are not a project of the
> Pirate movement."
>
*** Again, I agree with Andreas, for different reasons, which Simone
Weil, the philosopher, not the politician, expressed perfectly in her
essay "On the Abolition of All Political Parties", which happens to
have been published in English this year [0]:

"every party is totalitarian - potentially, and by aspiration." (for
the reasons leading to such conclusion, I recommend reading the essay!)

[0] http://www.blackincbooks.com/books/abolition-all-political-parties

>
> 3. Some of the light red colors on the map regarding "faulty
> technologies that we shall replace" are not appropriate. I don't
> want to prevent other people from trying to replace "Web Browsers",
> for example. But sometimes it is better to improve existing
> technologies than to attempt to replace them.
>
*** You're contradicting yourself here Andreas, I assume you wanted to
say "I don't want to prevent other people from trying to *improve*
"Web Browsers", for example."

I also think that statement is wrong, lynX. And that will be my last
quote for today, by Buckminster Fuller this time: "You never change
things by fighting the existing reality. To change something, build a
new model that makes the existing model obsolete."

==
hk

[carlo von lynX]

On Thu, Nov 14, 2013 at 12:22:18PM -0300, hellekin wrote:
> *** I guess that is the point of such a law: to make explicit--and
> public--the actual (supposed) limits of police usage of surveillance.

yup

> "every party is totalitarian - potentially, and by aspiration." (for
> the reasons leading to such conclusion, I recommend reading the essay!)

she didn't take the internet in consideration. yes, you can't win
elections without an authoritarian structure, disciplining everyone
that says stupidities in the media - that's something the pirates
haven't accepted yet - but that doesn't mean that you can't be
extremily (electronically) democratic in respect to:

- making political choices
- taking important decisions
- indicating parliamentaries how to vote

so a better democracy is achievable and the PP are the only
ones working on that.

> I also think that statement is wrong, lynX. And that will be my last
> quote for today, by Buckminster Fuller this time: "You never change
> things by fighting the existing reality. To change something, build a
> new model that makes the existing model obsolete."

that's exactly what the pink box is about. denoting the things that we
need to obsoleted in the new model. i'm not trying to abolish the
existence of mozilla.

[carlo von lynX]

On Thu, Nov 14, 2013 at 09:47:42AM +0100, Andreas Kuckartz wrote:
> I have added "FederatedSocialWeb" as a project, which stands for the
> "W3C Federated Social Web Community Group".

hehe.. http://secushare.org/federation

> Some comments regarding youbroketheinternet.org:
>
> 1. "We are preparing a EU law proposal to require obfuscated and
> end-to-end encrypted communications in all telephony and computer
> appliances sold after 2014. The law shall include ways to ensure its
> correct implementation and a transition path from the existing
> unencrypted systems."
>
> I can guess who "we" is, and I do not support this. It is extremely
> likely that such a proposal will not lead to a positive result. If such
> a law is accepted it will contain legal requirements to implement
> backdoors in end-to-end encrypted communications for so-called "law
> enforcement" purposes.

that is off the point. the point to make here is to make people
understand that a legislation that actually implements the
constitution is feasible. it's not about who manages to mess it
up in which way. of course the moment you have it in parliament
it will suffer from harsh attacks on its solidity.. but that
ain't new. and it only gets worse if you didn't even try.

> 2. "We like the Pirate Party, but we are not a project of the Pirate
> movement."
>
> I (and probably some of the projects on the map) do not like the Pirate
> Party. I can elaborate on that, but that probably would be off-topic.
> But let me just mention that I do not like _any_ party which has a
> chairperson defending the German secret services.

the pirates have non-representative chair persons saying stupid things.
where did he say anything like that? the official PP-DE position on
secret services is to abolish them, so you must be at least partially
wrong.

> 3. Some of the light red colors on the map regarding "faulty
> technologies that we shall replace" are not appropriate. I don't want to
> prevent other people from trying to replace "Web Browsers", for example.
> But sometimes it is better to improve existing technologies than to
> attempt to replace them.

web browsers are not suitable for private communications. they should
be used for accessing websites. by making that clear in the design
requirements we work towards our goal, creating an alternative to
abusing the web for things it wasn't designed for.

[Andreas Kuckartz]

carlo von lynX:
> On Thu, Nov 14, 2013 at 09:47:42AM +0100, Andreas Kuckartz wrote:
>> I have added "FederatedSocialWeb" as a project, which stands for the
>> "W3C Federated Social Web Community Group".
>
> hehe.. http://secushare.org/federation

Well, I am tolerant regarding most of the views expressed on that page ;-)

If I had to choose the name of the Community Group again, I probably
would propose another more general one. Other decentralised or
distributed approaches are welcome and represented in the W3C FSW CG.

Changing the name was briefly discussed a few months ago but it is
difficult and now would not make sense because the W3C is currently
preparing a larger more official Interest Group which likely will simply
be named "Social Interest Group". The charter is being discussed.

BTW: As long as this discussion is taking place using a federated
communication system I do not think that federation has become irrelevant.

>> It is extremely
>> likely that such a proposal will not lead to a positive result. If such
>> a law is accepted it will contain legal requirements to implement
>> backdoors in end-to-end encrypted communications for so-called "law
>> enforcement" purposes.
>
> that is off the point. the point to make here is to make people
> understand that a legislation that actually implements the
> constitution is feasible. it's not about who manages to mess it
> up in which way. of course the moment you have it in parliament
> it will suffer from harsh attacks on its solidity.. but that
> ain't new. and it only gets worse if you didn't even try.

That does not convince me to support such a proposal. It is spreading
illusions in the European Parliament not educating people.

> the pirates have non-representative chair persons saying stupid things.

Which by itself says a lot about the party.

> where did he say anything like that?

http://www.freitag.de/autoren/felix-werdermann/die-empoerung-ist-geheuchelt

http://www.piratenpartei.de/2013/07/22/piraten-fordern-reform-der-geheimdienste-und-der-parlamentarischen-kontrolle/

> the official PP-DE position on
> secret services is to abolish them,

Really? Where? Even if such an "official position" exists it obviously
is irrelevant in practice: The secret service supporter Bernd Schlömer
is still chairman of the German Pirate Party.

> web browsers are not suitable for private communications. they should
> be used for accessing websites.

They _are_ used for private communications. And I am not aware of any
reason why they can not be sufficiently improved regarding security and
privacy.

> by making that clear in the design
> requirements we work towards our goal, creating an alternative to
> abusing the web for things it wasn't designed for.

There are several good reasons why the (vast) majority of users does not
want to install software in addition to a web browser to be able to
communicate with others. Alternatives or design requirements which do
not take that into account will not lead to a different situation.

Cheers,
Andreas

[carlo von lynX]

On Fri, Nov 15, 2013 at 08:39:36AM +0100, Andreas Kuckartz wrote:
> BTW: As long as this discussion is taking place using a federated
> communication system I do not think that federation has become irrelevant.

In fact relevant amounts of discussions are not taking place over federated
systems. I am super positive about abolishing these mailing lists and email
in general ASAP.

> > that is off the point. the point to make here is to make people
> > understand that a legislation that actually implements the
> > constitution is feasible. it's not about who manages to mess it
> > up in which way. of course the moment you have it in parliament
> > it will suffer from harsh attacks on its solidity.. but that
> > ain't new. and it only gets worse if you didn't even try.
>
> That does not convince me to support such a proposal. It is spreading
> illusions in the European Parliament not educating people.

i'm bored by the notorious incapacity of people to reach consensus
on just about anything. we will never fix the world if we don't start.

> > the pirates have non-representative chair persons saying stupid things.
>
> Which by itself says a lot about the party.

it's like with any newbie party. the greens were a lot worse in the
early years. and no, it says close to nothing since these folks have
nothing to decide - they just end up being interviewed and taking far
too seriously. so the party isn't the bug.

> > where did he say anything like that?
>
> http://www.freitag.de/autoren/felix-werdermann/die-empoerung-ist-geheuchelt

"Ich persönlich" ....he clearly states that it is his personal opinion.
And your interpretation of what he means by that seems rather excentric.

> http://www.piratenpartei.de/2013/07/22/piraten-fordern-reform-der-geheimdienste-und-der-parlamentarischen-kontrolle/

Same here. He just says IF secret services are to be kept at all
they need to have a decent form of control. And considering how other
journalists criticized the pirates for being too radical and populistic,
now here you are criticizing the chairman for using more diplomatic
wording. No matter which wording they choose, there's always someone
who finds the excuse to disagree.

It's boring to disagree just to incapacitate a whole slice of the
population to be represented in parliament and to bring forward
important policies concerning digital civil rights.

> > the official PP-DE position on
> > secret services is to abolish them,
>
> Really? Where? Even if such an "official position" exists it obviously
> is irrelevant in practice: The secret service supporter Bernd Schlömer
> is still chairman of the German Pirate Party.

Humbug, he is not a supporter. He just isn't radical enough from your point
of view. Funny that you can at the same time be a proponent of W3C and federation.
You are diplomatic on technical issues (where it is not useful for nothing) and
radical on political issues (where it is bad for getting into parliament and
actually getting anything done). Try doing it exactly the opposite way, that
would be better for both.

No, in fact it's not an official position yet, there have ONLY been four surveys
on the topic but no Parteitag decision yet (that's why the permanent electronic
assembly is overdue):

https://lqfb.piratenpartei.de/lf/initiative/show/3889.html
https://lqfb.piratenpartei.de/lf/initiative/show/6442.html
https://lqfb.piratenpartei.de/lf/initiative/show/3411.html
https://lqfb.piratenpartei.de/lf/initiative/show/6477.html

Notice how several of these are older than this summer.

Here's also a person who actually has the opinion that you are attributing
to Mr Schloemer:

https://lqfb.piratenpartei.de/lf/suggestion/show/12580.html

Notice the big fat red bar of disapproval?

But if you go tell the press you just want to abolish all that, they won't
even report your opinion. That's why you HAVE to criticize the government
for its lousy oversight AND MAYBE AS A SIDE NOTE mention that secret
services do not deserve to exist in the first place.

The communication the chairman does is strategy and marketing. The politics
the pirate party actually implements comes from the base of the activists,
so it isn't him actually deciding anything. He just tries to put it in
words that find acceptance.

Why do people think political parties work like corporations or army regiments?
Probably because several of the old parties actually do.

> > web browsers are not suitable for private communications. they should
> > be used for accessing websites.
>
> They _are_ used for private communications. And I am not aware of any
> reason why they can not be sufficiently improved regarding security and
> privacy.

http://secushare.org/end2end - The web browser is designed to do what
the server tells it to. Privacy is about AT LEAST having end to end
encryption, which doesn't work if the UI is coming from the server.
So the web browser only makes sense if you simulate the server on
localhost, which is an architectural choice which is considered on
the http://youbroketheinternet.org/map in the third box. To avoid
risks of privacy loss we should however consider to disable http and
other surveillance technologies.

> > by making that clear in the design
> > requirements we work towards our goal, creating an alternative to
> > abusing the web for things it wasn't designed for.
>
> There are several good reasons why the (vast) majority of users does not
> want to install software in addition to a web browser to be able to
> communicate with others. Alternatives or design requirements which do
> not take that into account will not lead to a different situation.

There is no way to provide for decent privacy for users without installing
new software. Also, why do they trust a phony HTTP download when they install
the web browser? It makes more sense to install a solid cryptographic
foundation, then have it pull in the web browser and whatever else in a
secure manner.

[hellekin]

On 11/15/2013 11:28 AM, carlo von lynX wrote:
> On Fri, Nov 15, 2013 at 08:39:36AM +0100, Andreas Kuckartz wrote:
>> BTW: As long as this discussion is taking place using a
>> federated communication system I do not think that federation has
>> become irrelevant.
>
> In fact relevant amounts of discussions are not taking place over
> federated systems. I am super positive about abolishing these
> mailing lists and email in general ASAP.
>
*** Until I can run GNUnet and share conversation with people from my
Emacs, I don't see that happening. The majority of relevant
discussion I'm having are happening via Tor+PSYC, Tor+IRC, and
GPG+Email. RetroShare still is marginal, as is I2P.

I wish email--that is, the system of: SMTP+POP3/IMAP--would be amended
or disappear, but first we need the GNS, and proper UIs that mimic
plain conversation, because that is what people know and like. When
talking about email, we should be careful distinguishing the
underlying protocols, from the general usage habits.

In the end, for the user, there's no difference between Email,
Facebook, or What's App: it's all about conversations, and they will
use 1) the system that brings them most closely to most of their
contacts, 2) the system that offers the most straightforward
interface, 3) eventually, the system that protect their privacy better.

Obviously, that is a power law, and 3) is already in the long tail.
Your mission, if you're willing to accept it, is to ramp it up to
provide safety to users who only care about efficient, and maybe
effective, if they have a personal reason to doubt they're a fish
inside a net.

>> That does not convince me to support such a proposal. It is
>> spreading illusions in the European Parliament not educating
>> people.
>
> i'm bored by the notorious incapacity of people to reach consensus
> on just about anything. we will never fix the world if we don't
> start.
>
*** Educating people is the long term, and probably a side-effect of
bringing them working applications. Boredom, the consequence of
delaying such endeavor. If someone sees something to be done, it's
good that they try doing it. But they cannot expect anyone else to
jump in, because that notoriously doesn't work. If people were moved
by ethical purpose, Edward Snowden would not be a persecuted hero, he
would be a casual citizen. We've started long ago to struggle and to
try and fix the world. Maybe the world needs no fixing. Maybe each
of us does.

I'd rather keep the discussions about the Pirate Party to the Pirate
Party.

>>
>> They _are_ used for private communications. And I am not aware of
>> any reason why they can not be sufficiently improved regarding
>> security and privacy.
>
> http://secushare.org/end2end - The web browser is designed to do
> what the server tells it to.
>
*** Indeed, there's a discrepancy between the intended design of the
browser, and its actual use. As there is between
Email-before-firewalls, and email today. There are no right
solutions: each solution that we can come up with will have flaws.

Pursuing "the right design" does not disqualify trying to fix a
sinking boat, for while the lifeboat is not ready, nobody leaves the
shipwreck.

> Privacy is about AT LEAST having end to end encryption, which
> doesn't work if the UI is coming from the server.
>
*** Actually the expected design for Lorea 2.0, that Sembrestels is
now exploring, consists in moving all the engine to the client side,
and use the server as a store-and-forward agent. I believe that
approach is gaining ground over a pure end-to-end approach that
requires both ends being online at the same time. Some use a DHT,
others dumb-servers. "Always on" is itself a problematic concept,
both technically and privacy-wise.

> to disable http and other surveillance technologies.
>
*** I fail to see how HTTP qualifies as a surveillance technology.
HTTP is designed to make information sharing easier. I doubt sharing
information can be considered a monopoly of surveillance freaks.

>>
>> There are several good reasons why the (vast) majority of users
>> does not want to install software in addition to a web browser to
>> be able to communicate with others. Alternatives or design
>> requirements which do not take that into account will not lead to
>> a different situation.
>
*** I agree with lynX on that one. There is a matter of perception
here. People do not associate "browsing the web" with "downloading
and installing software", because the software, unless it's cached on
the client, usually is downloaded every time, which makes it
inherently less secure than a proper software installation, and the
reason why the LibreJS project exists in the first place: to warn the
user and demonstrate that there's non-free software running there.

One might argue that the browser works in a reduced scope in
comparison to an actual software install, and thus cannot affect the
system. I would argue that the security model here is not to attack
the system, but to watch the user; the OS is not the target, the user
is, and running non-free and stealth javascript inside a Web browser
is sufficient to perform proper surveillance.

The complexity of protecting the user from that surveillance is nicely
illustrated by the Content-Security Policy: just try implementing it
on your website, and see all your Web 2.0 applications break. You
cannot use Google* or Amazon* or whatever third-party process without
granting them access to a lot more than you actually intend to
use--thus, you trust them. Then, if you're able to stick to the
minimum, you can still work around CSP by choosing to proxy
third-party contents "transparently" to your user, without their
knowledge--thus, they trust you, the website operator, who is only an
intermediate in the social interaction.

==
hk

[carlo von lynX]

On Fri, Nov 15, 2013 at 12:40:02PM -0300, hellekin wrote:
> *** Until I can run GNUnet and share conversation with people from my
> Emacs, I don't see that happening. The majority of relevant
> discussion I'm having are happening via Tor+PSYC, Tor+IRC, and
> GPG+Email. RetroShare still is marginal, as is I2P.

Well, you mentioned Tor twice - and Tor is a cryptographically
routed system, not a federated one. All you need to do is move
on from GPG over mail to GPG over Pond.

> I wish email--that is, the system of: SMTP+POP3/IMAP--would be amended
> or disappear, but first we need the GNS, and proper UIs that mimic
> plain conversation, because that is what people know and like. When
> talking about email, we should be careful distinguishing the
> underlying protocols, from the general usage habits.

Yes, it could be enough to make newer better UIs since that has
worked impressively well for Facebook, and later consider offering
IMAP gatewaying for legacy-affectionate users.

> In the end, for the user, there's no difference between Email,
> Facebook, or What's App: it's all about conversations, and they will
> use 1) the system that brings them most closely to most of their
> contacts, 2) the system that offers the most straightforward
> interface, 3) eventually, the system that protect their privacy better.
> Obviously, that is a power law, and 3) is already in the long tail.

Point (3) unfortunately still isn't very important to them, so we
really need to do some magic in the field of (1) and (2)

> Your mission, if you're willing to accept it, is to ramp it up to
> provide safety to users who only care about efficient, and maybe
> effective, if they have a personal reason to doubt they're a fish
> inside a net.

Hm. I would simply do something new which is so amazing that everyone
loves to use it. I won't go into details as enemies are reading in. ;)

> I'd rather keep the discussions about the Pirate Party to the Pirate
> Party.

I removed that line from the website.

> Pursuing "the right design" does not disqualify trying to fix a
> sinking boat, for while the lifeboat is not ready, nobody leaves the
> shipwreck.

But that's not the job of this working group. If you want to fix
up a sinking boat join LEAP. I prefer to simply refrain from having
private conversations over the current Internet. I started meeting
people in person again.. if I can't get them into a secure comm tool.

> > Privacy is about AT LEAST having end to end encryption, which
> > doesn't work if the UI is coming from the server.
> >
> *** Actually the expected design for Lorea 2.0, that Sembrestels is
> now exploring, consists in moving all the engine to the client side,
> and use the server as a store-and-forward agent. I believe that
> approach is gaining ground over a pure end-to-end approach that
> requires both ends being online at the same time. Some use a DHT,
> others dumb-servers. "Always on" is itself a problematic concept,
> both technically and privacy-wise.

Dumb servers with custom smart software or with a client-side website
that you have to "install" on your computer? In any case you have an
installation procedure, so you could aswell bring something like
Tor or GNUnet along which also protects transaction data.

> > to disable http and other surveillance technologies.
> >
> *** I fail to see how HTTP qualifies as a surveillance technology.
> HTTP is designed to make information sharing easier. I doubt sharing
> information can be considered a monopoly of surveillance freaks.

Cookies, E-Tags, Cache bits, counter GIFs, URI session IDs,
SSL session IDs, Javascript session IDs etc etc etc.
All because the browser trusts the server and the web is
so superprogrammable. HTTP is the technology for web sites to
phone home, but you are right.. it's not only HTTP. We also
have web sockets and WebRTC and other bad stuff coming our way
to introduce more surveillance in the web.

> The complexity of protecting the user from that surveillance is nicely
> illustrated by the Content-Security Policy: just try implementing it
> on your website, and see all your Web 2.0 applications break. You
> cannot use Google* or Amazon* or whatever third-party process without
> granting them access to a lot more than you actually intend to
> use--thus, you trust them. Then, if you're able to stick to the
> minimum, you can still work around CSP by choosing to proxy
> third-party contents "transparently" to your user, without their
> knowledge--thus, they trust you, the website operator, who is only an
> intermediate in the social interaction.

+1

[Andreas Kuckartz]

carlo von lynX:
>>> where did he say anything like that?
>>
>>
http://www.freitag.de/autoren/felix-werdermann/die-empoerung-ist-geheuchelt
>
> "Ich persönlich" ....he clearly states that it is his personal
> opinion. And your interpretation of what he means by that seems
> rather excentric.

For those who do not know which section in the interview is meant:

"Die Abschaffung der Geheimdienste ist für die Piraten keine Option?

Ich persönlich halte eine Institution, die die Verfassung schützen soll,
für wichtig und hilfreich."

Those requiring a translation will know how to get one.

I refrain from replying to the rest of your mail regarding the Pirate
Party. At this point it might be best to agree that we disagree.

> There is no way to provide for decent privacy for users without
> installing new software.
> Also, why do they trust a phony HTTP download when they install the
> web browser?
> It makes more sense to install a solid cryptographic foundation, then
> have it pull in the web browser and whatever else in a secure manner.

A chicken-and-egg or bootstrapping problem. It obviously is not trivial
to solve. And it includes the operating system.

Cheers,
Andreas

[hellekin]

On 11/15/2013 01:49 PM, Andreas Kuckartz wrote:
>
> A chicken-and-egg or bootstrapping problem. It obviously is not
> trivial to solve. And it includes the operating system.
>
*** I guess you can use plural here: operating systems, since phones
are now (ahaha) known to run another chip-borne, proprietary operating
system that accesses to any peripheral from USB to GPS.

A simple approach to the bootstrapping problem is to ship software as
part of the operating system.

==
hk

[Andreas Kuckartz]

hellekin:
> On 11/15/2013 01:49 PM, Andreas Kuckartz wrote:
>
>> A chicken-and-egg or bootstrapping problem. It obviously is not
>> trivial to solve. And it includes the operating system.
>
> *** I guess you can use plural here: operating systems, since
> phones are now (ahaha) known to run another chip-borne, proprietary
> operating system that accesses to any peripheral from USB to GPS.

Plural, yes. There are at least two operating systems in a modern
mobile phone: The "main" one such as Android or CyanogenMod and the
one on the SIM card. (In a support phone call with my mobile service
provider the support person informed me that they would "restart your
card" in a few minutes. The problem then disappeared.)

> A simple approach to the bootstrapping problem is to ship software
> as part of the operating system.

But how do you know that the shipped operating system was not
compromised? Where is the trust anchor?

I have seen a mail on the Tails mailing list about how to ensure or
verify that the content of a USB memory stick with Tails was not
modified. That is non-trivial when the number of USB sticks is large.

Cheers,
Andreas

[hellekin]

On 11/15/2013 02:37 PM, Andreas Kuckartz wrote:
>
> But how do you know that the shipped operating system was not
> compromised? Where is the trust anchor?
>
*** True. But Ken Thompson addressed that issue in his seminal
article "Reflections on Trusting Trust" [0] and that is a known bug,
definitely out of our scope. Moreover, that problem becomes even
worse if you consider how Javascript in the browser can bypass the
Same-Origin policy and dynamically load third-party code.

So yes, we're trusting something along the path. At minimum, I'm
trusting you're going to read my message. And a lot of other things,
such as: we both have access to electricity, the infrastructure is
working, no bomb will obliterate us before we have finished our
conversation, and the Messiah is not coming right away--otherwise it
would be the Final Judgment, and all resistance would be futile. ;o)

==
hk

[0] https://dl.acm.org/citation.cfm?id=358210

[carlo von lynX]

On Fri, Nov 15, 2013 at 08:39:36AM +0100, Andreas Kuckartz wrote:
> > web browsers are not suitable for private communications. they should
> > be used for accessing websites.
>
> They _are_ used for private communications. And I am not aware of any
> reason why they can not be sufficiently improved regarding security and
> privacy.

So you are advocating for integrating GNUnet or Tor into the distribution
of web browsers? Because that is what this working group is about. Actual
protecting of transaction data, not just pseudo end-to-end encryption in
Javascript.

> There are several good reasons why the (vast) majority of users does not
> want to install software in addition to a web browser to be able to
> communicate with others. Alternatives or design requirements which do
> not take that into account will not lead to a different situation.

That is outside the scope of this working group. People who are not going
to have a Tor or GNUnet node on their computers can't be helped.

So let's consider the possibility that the W3C requires all browser
vendors to upgrade to a "Tor Browser" with built-in end-to-end
messaging separated from the regular web rendering engines.

Let's also presume that the privacy community doesn't fall prey to
that trojan horse called WebRTC which comes equipped with MITM
capabilities and missed the chance to at least mandate pinning.

How many minutes would it take until all major vendors are compelled
to provide backdoors? How many >90% of humanity are using web browsers
from insecure sources?

Don't you see that the architecture of the web is completely hopeless?

The problem with congregations like W3C or the FSW events is that
people who actually know how bad the situation is DON'T GO THERE TO
DISCUSS IT. And if they do, like we did in 2011, WE ARE HARDLY TAKEN
IN CONSIDERATION because there isn't enough competence to even
UNDERSTAND WHAT WE ARE TALKING ABOUT.

These are the people we should trust for technological developments?
SRSLY?

Please shut down the W3C. I know it since I volunteered at the 1995
web conferences. I can't recall it achieving anything good ever since.

[Andreas Kuckartz]

carlo von lynX:
> So you are advocating for integrating GNUnet or Tor into the
> distribution of web browsers?

I do think that this is one approach. And solutions like Tails are
another one.

>> There are several good reasons why the (vast) majority of users does
>> not want to install software in addition to a web browser to be able
>> to communicate with others. Alternatives or design requirements
>> which do not take that into account will not lead to a different
>> situation.
>
> That is outside the scope of this working group.

Dissemination is mentioned as a topic for the 30C3 assembly. And (at
least) in that context it seems to be in scope.

> People who are not going to have a Tor or GNUnet node on their
> computers can't be helped.

That statement is like "Windows users can't be helped". They can never
have an absolutely secure system without migrating to another operating
system. But that does not imply that improving their security is
impossible as long as they do not make that step. It really depends on
the threats one intends to protect against.

> So let's consider the possibility that the W3C requires all browser
> vendors to upgrade to a "Tor Browser" with built-in end-to-end
> messaging separated from the regular web rendering engines.

To avoid misunderstandings. I do not speek for the W3C, but it can not
and will not "require" that. It does not even require web browsers to
use HTML. It is not involved in specifying such protocols. It also is
not specifying http or requiring that browsers use http. Such
specifications are a matter for the IETF. And you might be aware that
some interesting work is taking place within the IETF recently.

> Let's also presume that the privacy community doesn't fall prey to
> that trojan horse called WebRTC which comes equipped with MITM
> capabilities and missed the chance to at least mandate pinning.

Such decisions are not immutable.

> How many minutes would it take until all major vendors are compelled
> to provide backdoors? How many >90% of humanity are using web browsers
> from insecure sources?
>
> Don't you see that the architecture of the web is completely hopeless?

I do not get what you want to tell me.

Cheers,
Andreas

[hellekin]

On 11/15/2013 01:57 PM, Andreas Kuckartz wrote:
>>
>> That is outside the scope of this working group.
>
> Dissemination is mentioned as a topic for the 30C3 assembly. And
> (at least) in that context it seems to be in scope.
>
*** We need to distinguish two vectors in our working group.

One is the hardcore P2P "next generation" that focuses on GNUnet and
peer-to-peer solutions ; and the other is the "transitional" that
focuses on how to go from here to there, including contemplating
alternate paths, such as patching hopeless protocols, or seeking to
reform the existing nightmarish hell of a reality.

Although I'm convinced personally that jumping ships will be the best
move, there are still 1.5-and-growing billion users to convince as
well, without mentioning all the people with whom we all interact with
in our daily lives using insecure protocols and unprotected
communications.

That factual inertia needs to be addressed, and although technologies
such as LEAP do not convince me yet on their practicability, there's
no doubt there's a market for it--people are working on it and do have
the intention to deploy it. So, it's not only a matter of what we
want, we know, or what we think is best, but also to consider and take
into account the complexity of reality. The fact that there are many
projects and much attention given to what we like to anticipatively
call "legacy protocols" (SMTP, HTTP), should prompt us not to fight
reality and instead, skim the milk, and embrace them as vectors for
change.

I urge to stop entirely with this anti-whatever discourse: we have
nothing to justify, nothing to fear, and we can't do much about other
people's decisions, but to bring them better alternatives.

>
> That statement is like "Windows users can't be helped". They can
> never have an absolutely secure system without migrating to another
> operating system. But that does not imply that improving their
> security is impossible as long as they do not make that step. It
> really depends on the threats one intends to protect against.
>
*** I guess you're right in some way, but *that* is definitely out of
the scope of our working group: we're talking about free software,
right? So the only correct step such a user could make would be to
start using free software. And if "they don't have a choice", well,
sorry, but we cannot do everything, talk with the FSF.

That also supports the case of LEAP, or LinkedData, Lorea, etc.: those
projects might not be what we want, and have a lot of flaws from our
point of view, but they're addressing some problem, and there's no
reason not to let them do it--we're free not to use them if that would
harm us. It's not exactly as if we would let Monsanto take over the
water supplies of a continent, destroy biodiversity, and feed cancer
to entire populations. We're still talking about lessons learned
here, with potential synergies involved. Some inventions come from
tricky paths.

If you cannot convince someone to join forces, repeating how bad their
choices are probably won't help convince them. That's especially
important as while you're complaining, they're working. And when they
show their product, users go there, and then you can't tell users:
wait! Wait! That is wrong! On the other hand, showing examples of
things you can do with your solution, that you cannot with another--or
not even considering it: showing what's possible and how to get
started doing it, then yes, you get people working with you. That's
the hard part.

>> that trojan horse called WebRTC which comes equipped with MITM
>> capabilities and missed the chance to at least mandate pinning.
>
> Such decisions are not immutable.
>
*** Indeed, that could be an interested channel for aggressiveness.

>> How many minutes would it take until all major vendors are
>> compelled to provide backdoors?
>
*** That is precisely why Snowden defected: for such illegal things
not to be able to happen. Now, I understand your position, to help
build technology that will prevent such abuse. But you're still
fighting reality if you consider that question seriously. "They broke
the Internet. We're building a GNU one." One where such blackmail
over vendors is not worthy. We're not looking for absolute, we're
looking for enough.

==
hk

[carlo von lynX]

On Fri, Nov 15, 2013 at 03:28:38PM -0300, hellekin wrote:
> *** We need to distinguish two vectors in our working group.
>
> One is the hardcore P2P "next generation" that focuses on GNUnet and
> peer-to-peer solutions ; and the other is the "transitional" that
> focuses on how to go from here to there, including contemplating
> alternate paths, such as patching hopeless protocols, or seeking to
> reform the existing nightmarish hell of a reality.

No, we don't need to make that distinction. At the last meeting
there was a clear majority who only wants to get something solid
off the ground and doesn't care for legacy patchwork.

Since there are dozens of projects oriented on writing yet another
easy UI for PGP, there is no need to disturb this project with it.

> I urge to stop entirely with this anti-whatever discourse: we have
> nothing to justify, nothing to fear, and we can't do much about other
> people's decisions, but to bring them better alternatives.

It's not anti-whatever but anti pro-whatever. Like if someone
comes here to sell open standards, the web browser or XMPP as a
part of the solution to our challenge. If we don't place clear
limits to how much humbug this working group can take it becomes
distracting, confusing and derailing from the plan.

The job is complicated enough, we don't have the time to discuss
the broken pieces, too.

> If you cannot convince someone to join forces, repeating how bad their
> choices are probably won't help convince them.

We can patiently explain why we aren't doing things the way they
think should be done. If that doesn't help, they can come back
four year laters when they learned the lesson. Has happened so
many times before, it's nothing new.

> That's especially
> important as while you're complaining, they're working. And when they
> show their product, users go there, and then you can't tell users:
> wait! Wait! That is wrong! On the other hand, showing examples of
> things you can do with your solution, that you cannot with another--or
> not even considering it: showing what's possible and how to get
> started doing it, then yes, you get people working with you. That's
> the hard part.

Yes, all brilliant. With PSYC we've been doing things XMPP couldn't do -
and still nothing changed. People stick to the "open standard" even if
it doesn't work.

> >> that trojan horse called WebRTC which comes equipped with MITM
> >> capabilities and missed the chance to at least mandate pinning.
> >
> > Such decisions are not immutable.
> >
> *** Indeed, that could be an interested channel for aggressiveness.

The W3C recommends certificate pinning, yet Firefox doesn't do it
and you have to install Certificate Patrol by hand - and there are
even sucky websites that produce false positives all the time.
Under these preconditions you want to convince Google and Mozilla
to pin down DTLS identities? The whole architecture is so super
programmable, the browser wouldn't even know which ones are important
and which ones aren't. Also, if Facebook wants to MITM your WebRTC
video phone call, it simply sends you a new identity for that person.
How would the browser possibly be able to figure out, that its user
is being tricked?

Hopeless.. if Mallory wants to record all those WebRTC sessions, it
will be able to.. and even WebRTC devs will not be able to figure
it out, unless they are working for Facebook or Google.

> *** That is precisely why Snowden defected: for such illegal things
> not to be able to happen. Now, I understand your position, to help

I don't see much progress in people comprehending what needs to be
done to actually cut out the middle man. I still have to discuss
basic mistakes day-in day-out.

> build technology that will prevent such abuse. But you're still
> fighting reality if you consider that question seriously. "They broke
> the Internet. We're building a GNU one." One where such blackmail
> over vendors is not worthy. We're not looking for absolute, we're
> looking for enough.

Blackmail? Just assessing the situation.
A GNU Internet stack is barely enough.
SMTP, the web, WebRTC, XMPP.. is not.

There must be at least one no-BS working group on earth.

[hellekin]

On 11/15/2013 07:29 PM, carlo von lynX wrote:
>
> No, we don't need to make that distinction. At the last meeting
> there was a clear majority who only wants to get something solid
> off the ground and doesn't care for legacy patchwork.
>
*** Then you need to distinguish GNU consensus from the rest of the
working group, because I do care about "the minorities", and although
I have a preference for GNUnet, I don't exclude "legacy patchwork".
The role of this project is not to make judgments over the qualities
of the various approaches. I prefer leaving that to the developers
themselves.

> Since there are dozens of projects oriented on writing yet another
> easy UI for PGP, there is no need to disturb this project with it.
>
*** I understand. So I propose this discussion goes on to the
Socialswarm mailing-list alone, and when we have something to
announce, we can use the GNU consensus. Otherwise, it mixes up the
goals and means.

>
> Blackmail? Just assessing the situation.
>
*** I say it's blackmail for a government (agency) to force a company
into betraying their customers.

> A GNU Internet stack is barely enough. SMTP, the web, WebRTC,
> XMPP.. is not.
>
> There must be at least one no-BS working group on earth.
>
*** Let it be the Social Swarm then. GNU consensus needs to include
the way from here to there. Hopefully when GNUnet is ready, it will
be trivial to mass-switch by the billions to a sane system. But more
likely, a lot of people will keep dancing in the ball room until the
ship wrecks.

So, people, please subscribe to the socialswarm mailing list, if
you're not there already, and let's keep this conversation there,
without any mentions of non-P2P solutions: end of the year is coming fast.

SocialSwarm mailing lists: https://socialswarm.net/en/participate/

==
hk

[carlo von lynX]

On Fri, Nov 15, 2013 at 08:05:44PM -0300, hellekin wrote:
> *** I say it's blackmail for a government (agency) to force a company
> into betraying their customers.

Well, I'm afraid that's what the German and other governments are capable
to actually do in reaction to the NSA so they don't have a disadvantage.
That's why any strategy that depends on a company not to betray its
users (which from a business model unfortunately always makes sense)
is calling for trouble.

> likely, a lot of people will keep dancing in the ball room until the
> ship wrecks.

Yes, but they will do so on Facebook, so they're out of our reach anyway.
While concerning e-mail.. well.. bootstrapping PGP is more work and
less effective than bootstrapping Pond for example.

Btw, I updated Best Practice recommendations on http://secushare.org/comparison
from my best understanding and knowledge of the situation. There are Tor-based
or otherwise advanced ways to solve many use cases here today, so there is no
reason to spend time with federation or silo tools...

[Andreas Kuckartz]

hellekin:
> *** I understand. So I propose this discussion goes on to the
> Socialswarm mailing-list alone, and when we have something to
> announce, we can use the GNU consensus. Otherwise, it mixes up
> the goals and means.

The exclusionary approach proposed by carlo von lynX also does not
seem to be aligned with the goals and means of Socialswarm:

"Oh no, not another social media project trying to save humanity?
That’s what we thought. There are plenty of people working on that
already. The only problem is: They are not working together.
That is why we want to build a platform to connect us all:
• users
• coders
• the different projects"

http://socialswarm.net/?lang=en

But my main question are the goals and means of the proposed 30C3
assembly. Maybe it makes sense to create an alternative, more open
proposal?

BTW: The proposal text created by carlo von lynX currently suggests:
"Contact us on ircs://psyced.org:6667/youbroketheinternet
Or join our #youbroketheinternet working group on RetroShare".

Maybe the discussion regarding the youbroketheinternet assembly
proposal should simply take place there? That would also help to ensure
that "legacy"-projects are kept out.

Cheers,
Andreas

[Andreas Kuckartz]

carlo von lynX:
> On Fri, Nov 15, 2013 at 03:28:38PM -0300, hellekin wrote:
>> *** We need to distinguish two vectors in our working group.
>>
>> One is the hardcore P2P "next generation" that focuses on GNUnet and
>> peer-to-peer solutions ; and the other is the "transitional" that
>> focuses on how to go from here to there, including contemplating
>> alternate paths, such as patching hopeless protocols, or seeking to
>> reform the existing nightmarish hell of a reality.
>
> No, we don't need to make that distinction. At the last meeting
> there was a clear majority who only wants to get something solid
> off the ground and doesn't care for legacy patchwork.

Was there a vote on that? What does clear majority mean (60% of the
participants? participants representing 90% of users?) ?

Can you name those projects represented in that meeting which do not
care about improving the situation for users of what you call
"legacy"-software and -standards ?

Cheers,
Andreas

[Melvin Carvalho]

On 17 November 2013 11:29, Andreas Kuckartz <***@ping.de> wrote:

> carlo von lynX:
> > On Fri, Nov 15, 2013 at 03:28:38PM -0300, hellekin wrote:
> >> *** We need to distinguish two vectors in our working group.
> >>
> >> One is the hardcore P2P "next generation" that focuses on GNUnet and
> >> peer-to-peer solutions ; and the other is the "transitional" that
> >> focuses on how to go from here to there, including contemplating
> >> alternate paths, such as patching hopeless protocols, or seeking to
> >> reform the existing nightmarish hell of a reality.
> >
> > No, we don't need to make that distinction. At the last meeting
> > there was a clear majority who only wants to get something solid
> > off the ground and doesn't care for legacy patchwork.
>
> Was there a vote on that? What does clear majority mean (60% of the
> participants? participants representing 90% of users?) ?
>
> Can you name those projects represented in that meeting which do not
> care about improving the situation for users of what you call
> "legacy"-software and -standards ?
>

At the workshop lots of projects were represented, including a good mix of
P2P techs and web.

Carlo gave a presentation where he argued that the federated social web, or
even the web in general, would lead to centralization such as we've seen in
webmail. We didnt spend that much time talking about the web.

I can understand the point of view, but I am unsure that there was
unanimous agreement. There was a session where one goal was to get a large
user base, and another where interaction with existing systems was a goal.

I left slightly early to get my train, but towards the end there was a
contingent that was keen on a DNS replacement, some viewing it as a "nice
to have" others as a "central component" my personal concern is that this
might be taking on too much.


>
> Cheers,
> Andreas
> --
> SocialSwarm mailing lists: https://socialswarm.net/en/participate/
> Websites: https://socialswarm.net/ https://wiki.socialswarm.net/
> Liquid Feedback: https://socialswarm.tracciabi.li/
> Digitalcourage, Bielefeld, Germany ***@digitalcourage.de
>

[Andreas Kuckartz]

carlo von lynX:
> On Fri, Nov 15, 2013 at 03:28:38PM -0300, hellekin wrote:
>> That's especially
>> important as while you're complaining, they're working. And when
>> they
>> show their product, users go there, and then you can't tell users:
>> wait! Wait! That is wrong! On the other hand, showing examples of
>> things you can do with your solution, that you cannot with
>> another--or
>> not even considering it: showing what's possible and how to get
>> started doing it, then yes, you get people working with you. That's
>> the hard part.
>
> Yes, all brilliant. With PSYC we've been doing things XMPP couldn't
> do -
> and still nothing changed. People stick to the "open standard" even if
> it doesn't work.

That seems to imply that changing the open standard might make sense. Or
not?

Cheers,
Andreas

[Guido Witmond]

On 11/15/13 19:28, hellekin wrote:
> On 11/15/2013 01:57 PM, Andreas Kuckartz wrote:
>>>
>>> That is outside the scope of this working group.
>
>> Dissemination is mentioned as a topic for the 30C3 assembly. And
>> (at least) in that context it seems to be in scope.
>
> *** We need to distinguish two vectors in our working group.
>
> One is the hardcore P2P "next generation" that focuses on GNUnet and
> peer-to-peer solutions ; and the other is the "transitional" that
> focuses on how to go from here to there, including contemplating
> alternate paths, such as patching hopeless protocols, or seeking to
> reform the existing nightmarish hell of a reality.

I can't get my 80 year old father to install and use retroshare. He
needs something simpler.

He found out about Tor a few years ago but I had to get him off that, as
he wanted to do electronic banking over it. It would lead to greater
chance of MitM attacks than plain https over direct connections.

Recently he got an Android tablet. Although Google protects him a bit
against malware, the price for that is high (in lost privacy). We need
something to protect people that need it the most.

That second path is what I'm promoting with my eccentric-authentication
protocol. It's basically a way to use client certificates combined with
centralised (shared) methods of detection of some attacks. It might not
be perfect, but I believe it is way better than plaintext passwords over
http.

To get the benefits, all it takes is a browser plug in and a configured
server. Very backwards compatible. And without asking any security
questions to users. No more: "this site uses an invalid
certificate"-stuff. The encryption forms part of the normal work flow.

Check it out at http://eccentric-authentication.org/


Cheers, Guido.

[Guido Witmond]

On 11/16/13 21:29, carlo von lynX wrote:
> On Sat, Nov 16, 2013 at 07:19:47PM +0100, Guido Witmond wrote:



> I do banking over Tor, but I know the certs my bank uses.

You are exceptional that you know your banks' certificate. I asked
people at a security conference and most had to admit they didn't know
nor verify. And that is security people...


> Exactly, you are providing a neat alternative to X.509 but it doesn't
> change anything about the entire rest of the architecture. I think that's
> okay for banking or for Tor hidden services apps, but I don't like it for
> a communications and messaging system as I won't accept that my naked
> teenager pics are on your server's hard disk.

Eccentric is not the holy grail in cryptography. It has its strong
points and weaknesses.

The strong point is that it's easy to implement and get quite a lot of
communication encrypted. A weak point is that it is still vulnerable to
traffic analysis. It needs Tor for that. Another weak point is that if
you lose a private key, you're out of that account forever. Unless you
can prove identity to the site some other way.

It also has a very simplistic repudiation model: delete the private key
of an account securely and never mention that it was you.

Eccentric has either unsigned or signed public messages, or encrypted
private messages. To get your naked teenager pics in clear-view on my
server, you need to publish it. If you send it to a specific person,
whose public key you've learned somehow, it is encrypted and my site
can't decrypt it. All private messaging is end-to-end. Guaranteed. I
don't know if Snapchat can offer that guarantee. :-)

I expect sites make it clear when you are publishing to the world or
sending a private message. Anyway, the user agent should always show
which of the two actions it is doing, signing a public message or
encrypting a private message.

You may still not like it but it is quite an improvement over the
current http-internet. Or Dropbox, or Google drive or ... I hope that
once people get used to this model they can search for other systems
that offer even more privacy. We crypto-designers have to lead them. The
hardest part is not designing, it is selling.


> So the server has the complete social graph. The tools I am recommending
> as best current practice try to protect the social graph.

That is one other weakness but it is not so bad as you imagine. The
server sees all traffic (not contents) between its users. As soon as two
people have verified that there is no mitm, they can send this message:
Hi User2@@guido's-site,
Please connect to <protocol://my-ip:port/url>
Use your certificate to authenticate, I use mine.
Regards: User1@@guido-s-site
User 1 opens the port on his computer and awaits if user2 connects.

Here we bootstrap a new channel based upon an existing channel. The
protocol can be anything, xmpp, zrtp, maybe even psyc. My site acts as
an introducer to people, like a mutual friend that arranges a blind
date, only with cryptography.

As the message is encrypted, my server doesn't learn of this new
channel. All the server learns is that after a few message, the
communication ceased. There is nothing that I can do to prevent this new
channel from opening. And once established, my server that has signed
the certificate is not needed anymore. It can be nuked from orbit.

When User2 has previously established a private channel with User3,
User2 can introduce User3 to User1 over their private channel. Again,
the server cannot learn of this. The new channel between User1 and User3
is invisible to the site. The site learns only about a partial social
graph, not the full graph. The users, of course will learn the whole graph.

That message from User1 to User2 can even be published as wide as
possible by User1. The whole world will learn that 1 is trying to
contact 2 but only they have the matching private keys to validate each
others' public key. It can be used in case my server is gone. Success
depends on User2 learning of the contact request and willingness to
connect. If either uses Tor, the world won't learn if they ever get
connected.

That's the power of pseudonymous authenticated connections.


I hope it sparked your interested.

Regards, Guido.

[carlo von lynX]

It is no longer clear if people in here are Social Swarm, GNU consensus
or something else currently using the name #youbroketheinternet. The
latter just seemed to be the most appropriate name since we can't get
social off the ground without fixing the Internet first.

In the past we worked out http://libreplanet.org/wiki/GNU/consensus/berlin-2013
and reached a consensus on at least these points:

- End-to-end encryption
- Perfect Forward Secrecy
- Social graph and transmission pattern obfuscation
- Self determined data storage

These four requirements make it such that any discussion of "improvements" of
the general situation that does not fulfil them should be seen as out of
scope for this group of people.

Feel free to put some band aids around SMTP, XMPP and other established apps,
but don't discuss it here - especially not as a solution to our list of basic
requirements. Let us work on solutions that fulfil OUR basic requirements for privacy.
This is the only thing that differentiates us from dozens of other similar groups.

And sorry for not having been patient enough to say this every couple
of months, using the best possible wording. As always with mailing lists,
memory fades quickly and people won't read documents before they start contributing.


On Sat, Nov 16, 2013 at 11:01:08PM +0100, Guido Witmond wrote:
> > Exactly, you are providing a neat alternative to X.509 but it doesn't
> > change anything about the entire rest of the architecture. I think that's
> > okay for banking or for Tor hidden services apps, but I don't like it for
> > a communications and messaging system as I won't accept that my naked
> > teenager pics are on your server's hard disk.
>
> The strong point is that it's easy to implement and get quite a lot of
> communication encrypted. A weak point is that it is still vulnerable to
> traffic analysis. It needs Tor for that. Another weak point is that if
> you lose a private key, you're out of that account forever. Unless you
> can prove identity to the site some other way.
>
> It also has a very simplistic repudiation model: delete the private key
> of an account securely and never mention that it was you.
>
> Eccentric has either unsigned or signed public messages, or encrypted
> private messages. To get your naked teenager pics in clear-view on my
> server, you need to publish it. If you send it to a specific person,
> whose public key you've learned somehow, it is encrypted and my site
> can't decrypt it. All private messaging is end-to-end. Guaranteed. I
> don't know if Snapchat can offer that guarantee. :-)
>
> I expect sites make it clear when you are publishing to the world or
> sending a private message. Anyway, the user agent should always show
> which of the two actions it is doing, signing a public message or
> encrypting a private message.
>
> You may still not like it but it is quite an improvement over the
> current http-internet. Or Dropbox, or Google drive or ... I hope that
> once people get used to this model they can search for other systems
> that offer even more privacy. We crypto-designers have to lead them. The
> hardest part is not designing, it is selling.

Currently many aspects are hard.

> > So the server has the complete social graph. The tools I am recommending
> > as best current practice try to protect the social graph.
>
> That is one other weakness but it is not so bad as you imagine. The
> server sees all traffic (not contents) between its users. As soon as two
> people have verified that there is no mitm, they can send this message:
> Hi User2@@guido's-site,
> Please connect to <protocol://my-ip:port/url>
> Use your certificate to authenticate, I use mine.
> Regards: User1@@guido-s-site
> User 1 opens the port on his computer and awaits if user2 connects.

And you can even do that with WebRTC's DTLS.

> Here we bootstrap a new channel based upon an existing channel. The
> protocol can be anything, xmpp, zrtp, maybe even psyc. My site acts as
> an introducer to people, like a mutual friend that arranges a blind
> date, only with cryptography.
>
> As the message is encrypted, my server doesn't learn of this new
> channel. All the server learns is that after a few message, the
> communication ceased. There is nothing that I can do to prevent this new
> channel from opening. And once established, my server that has signed
> the certificate is not needed anymore. It can be nuked from orbit.
>
> When User2 has previously established a private channel with User3,
> User2 can introduce User3 to User1 over their private channel. Again,
> the server cannot learn of this. The new channel between User1 and User3
> is invisible to the site. The site learns only about a partial social
> graph, not the full graph. The users, of course will learn the whole graph.
>
> That message from User1 to User2 can even be published as wide as
> possible by User1. The whole world will learn that 1 is trying to
> contact 2 but only they have the matching private keys to validate each
> others' public key. It can be used in case my server is gone. Success
> depends on User2 learning of the contact request and willingness to
> connect. If either uses Tor, the world won't learn if they ever get
> connected.
>
> That's the power of pseudonymous authenticated connections.

So to put it into the frame of our consensus, it doesn't preclude
installing something like Tor or GNUnet. It could be a tool for
dealing with web apps better - without them having to cooperate in
a the way they have to with unhosted.org. But it's a discussion aside
to figure out if we should politically require apps to work in an
unhosted style rather than eccentric. If we take requirement 4 of our
list for real, then eccentric must not substitute unhosted.

In any case this needs a patch of the browser and, what is the thing
that I criticize about browser extension approaches (and I did some
myself, so I know) is

1. that you only achieve the first two requirements, E2E and PFS, if
you have DHE implemented in such a browser extension AND
2. the user interface for encrypting and decrypting messages is kept
safely out of the regular HTML rendering so the user cannot be
fooled by some website recreating exactly that GUI
3. you still put your communications at risk because of the many potential
security leaks in web browser technology

That's the point when it is so distant from "the web" - if we can't even
trivially and safely use the rendering engine of the browser - that I
don't see a point to still use web technology and bring in all the risks
related to javascript backdoorability etc etc....

We don't need and we should not have javascript in THE tool that we intend
to use for the majority of our social interactions. It's unreasonable
and totally unnecessary since we require a software installation ANYWAY.
If people are installing some Tor/* bundle, let them have a fully viable
communications stack outside the browser.

I think, in future releases of a GNU internet OS, the web browser has
to run in a separated virtual machine from the actual communication apps,
anyway. Then it needs both an 0day for the browser AND the virtual machine
to cause harm. And you can easily make a two-physical-computers set-up as
recommended by Whonix if a VM isn't good enough for you.

These days we can even separate certificate control from the web browser
as we have developed a C version of Certificate Patrol that could be
integrated into the Tor socks proxy - thus it checks the validity of
certificates (beyond just the broken X.509) before the connection with
the sandboxed/isolated browser is even permitted.

Real security is feasible, why lose time on things that won't cut it?

[Andreas Kuckartz]

carlo von lynX:
> It is no longer clear if people in here are Social Swarm, GNU consensus
> or something else currently using the name #youbroketheinternet. The
> latter just seemed to be the most appropriate name since we can't get
> social off the ground without fixing the Internet first.
>
> In the past we worked out http://libreplanet.org/wiki/GNU/consensus/berlin-2013
> and reached a consensus on at least these points:
>
> - End-to-end encryption
> - Perfect Forward Secrecy
> - Social graph and transmission pattern obfuscation
> - Self determined data storage

I unfortunately did not participate in that meeting but I probably would
have agreed with these items as goals. (I had seen the invitation but
considered most of the projects which were originally mentioned as being
mostly irrelevant.)

But it is unlikely that I would have agreed that improvements of subsets
of this set of items are out of scope.

> These four requirements make it such that any discussion of "improvements" of
> the general situation that does not fulfil them should be seen as out of
> scope for this group of people.

I wonder if all the participants agree with _that_ interpretation. I
guess that I would have been surprised by it...

> Feel free to put some band aids around SMTP, XMPP and other established apps,
> but don't discuss it here - especially not as a solution to our list of basic
> requirements. Let us work on solutions that fulfil OUR basic requirements for privacy.
> This is the only thing that differentiates us from dozens of other similar groups.

That meeting decided what is in scope for the GNU/consensus and the
Social Swarm mailing lists? Really?

I am definitely not opposed to making decisions about requirements and
things which are out-of-scope in a discussion or for a working group.
Such decisions sometimes are necessary. But I doubt that these
out-of-scope decisions have really been made.

And I am beginning to wonder if what I see here is representative for
the CCC...

Cheers,
Andreas

[Nick Jennings]

On Sun, Nov 17, 2013 at 3:22 PM, Andreas Kuckartz <***@ping.de>wrote:

> carlo von lynX:
> > It is no longer clear if people in here are Social Swarm, GNU consensus
> > or something else currently using the name #youbroketheinternet. The
> > latter just seemed to be the most appropriate name since we can't get
> > social off the ground without fixing the Internet first.
> >
> > In the past we worked out
> http://libreplanet.org/wiki/GNU/consensus/berlin-2013
> > and reached a consensus on at least these points:
> >
> > - End-to-end encryption
> > - Perfect Forward Secrecy
> > - Social graph and transmission pattern obfuscation
> > - Self determined data storage
>
> I unfortunately did not participate in that meeting but I probably would
> have agreed with these items as goals. (I had seen the invitation but
> considered most of the projects which were originally mentioned as being
> mostly irrelevant.)
>
> But it is unlikely that I would have agreed that improvements of subsets
> of this set of items are out of scope.
>
> > These four requirements make it such that any discussion of
> "improvements" of
> > the general situation that does not fulfil them should be seen as out of
> > scope for this group of people.
>
> I wonder if all the participants agree with _that_ interpretation. I
> guess that I would have been surprised by it...
>
>

I did participate in the meeting in Berlin in August as part of the
unhosted movement, specifically Sockethub and remoteStorage. Although we
did agree on those 4 points listed, there was no consensus on the
conclusion being "throw it all out and start over". Although I think what
Carlo is doing is interesting and has a lot of potential, I think there are
still many things to be done to improve privacy and improve or create new
paradigms for the responsibility of developing for the web, and
expectations of users.

I think GNUnet is a huge undertaking and, like Melvin, wonder whether it's
a realistic expectation to redesign everything and implement it with what I
believe is only a couple developers (?). We discussed the possibility that
somewhere down the road a lot of the work we're doing with remoteStorage
and Sockethub might be applied to the app-level infrastructure of GNUnet,
which is an interesting idea and one way to offload a bit of the work of
starting over and re-implementing everything from scratch.




> > Feel free to put some band aids around SMTP, XMPP and other established
> apps,
> > but don't discuss it here - especially not as a solution to our list of
> basic
> > requirements. Let us work on solutions that fulfil OUR basic
> requirements for privacy.
> > This is the only thing that differentiates us from dozens of other
> similar groups.
>
> That meeting decided what is in scope for the GNU/consensus and the
> Social Swarm mailing lists? Really?
>
> I am definitely not opposed to making decisions about requirements and
> things which are out-of-scope in a discussion or for a working group.
> Such decisions sometimes are necessary. But I doubt that these
> out-of-scope decisions have really been made.
>
> And I am beginning to wonder if what I see here is representative for
> the CCC...
>
> Cheers,
> Andreas
> --
> SocialSwarm mailing lists: https://socialswarm.net/en/participate/
> Websites: https://socialswarm.net/ https://wiki.socialswarm.net/
> Liquid Feedback: https://socialswarm.tracciabi.li/
> Digitalcourage, Bielefeld, Germany ***@digitalcourage.de
>

[Melvin Carvalho]

On 20 November 2013 01:57, Simon Hirscher <***@simonhirscher.de> wrote:

> On Sun, Nov 17, 2013 at 5:41 PM, Nick Jennings <***@silverbucket.net>
> wrote:
> > I did participate in the meeting in Berlin in August as part of the
> unhosted
> > movement, specifically Sockethub and remoteStorage. Although we did
> agree on
> > those 4 points listed, there was no consensus on the conclusion being
> "throw
> > it all out and start over".
>
> No, and I don't think Carlo meant starting all over. He simply
> repeated that our goal is to find, assemble or (if necessary) write
> that piece or even stack of software that fulfills those 4
> requirements. And that's what the workshops @30C3 are going to be
> about, right?
>

Im curious as to how it is possible to have "self determined data storage",
yet also preclude use of the web to store that data?


>
> > Although I think what Carlo is doing is
> > interesting and has a lot of potential, I think there are still many
> things
> > to be done to improve privacy and improve or create new paradigms for the
> > responsibility of developing for the web, and expectations of users.
>
> Yes, there definitely are. And there're certainly several approaches
> (like unhosted) that don't contradict those 4 points so we'll
> eventually might talk about how to combine them (as we already started
> to do). But our first and primary goal really need to be those 4
> points. I would have thought that we all agreed on this back in
> Berlin?
> --
> SocialSwarm mailing lists: https://socialswarm.net/en/participate/
> Websites: https://socialswarm.net/ https://wiki.socialswarm.net/
> Liquid Feedback: https://socialswarm.tracciabi.li/
> Digitalcourage, Bielefeld, Germany ***@digitalcourage.de
>

[Melvin Carvalho]

On 20 November 2013 02:58, Simon Hirscher <***@simonhirscher.de> wrote:

> On Wed, Nov 20, 2013 at 2:05 AM, Melvin Carvalho
> <***@gmail.com> wrote:
> >
> > On 20 November 2013 01:57, Simon Hirscher <***@simonhirscher.de>
> wrote:
> >>
> >> No, and I don't think Carlo meant starting all over. He simply
> >> repeated that our goal is to find, assemble or (if necessary) write
> >> that piece or even stack of software that fulfills those 4
> >> requirements. And that's what the workshops @30C3 are going to be
> >> about, right?
> >
> >
> > Im curious as to how it is possible to have "self determined data
> storage",
> > yet also preclude use of the web to store that data?
>
> Is this question directed at me? Because I seem to miss what that
> question has got to do with what I wrote or what we're discussing
> here. Anyway, to give an answer: That is certainly possible by storing
> that data on your very own or your friend's hdd, isn't it?
>

Not particularly directed at you, but it's directed at one of the "4
requirements"

Surely self determined means I get to *choose* where to store my data? Not
just that it's *possible* to store it ...

[Simon Hirscher]

On Wed, Nov 20, 2013 at 2:05 AM, Melvin Carvalho
<***@gmail.com> wrote:
>
> On 20 November 2013 01:57, Simon Hirscher <***@simonhirscher.de> wrote:
>>
>> No, and I don't think Carlo meant starting all over. He simply
>> repeated that our goal is to find, assemble or (if necessary) write
>> that piece or even stack of software that fulfills those 4
>> requirements. And that's what the workshops @30C3 are going to be
>> about, right?
>
>
> Im curious as to how it is possible to have "self determined data storage",
> yet also preclude use of the web to store that data?

Is this question directed at me? Because I seem to miss what that
question has got to do with what I wrote or what we're discussing
here. Anyway, to give an answer: That is certainly possible by storing
that data on your very own or your friend's hdd, isn't it?

[Simon Hirscher]

On Sun, Nov 17, 2013 at 5:41 PM, Nick Jennings <***@silverbucket.net> wrote:
> I did participate in the meeting in Berlin in August as part of the unhosted
> movement, specifically Sockethub and remoteStorage. Although we did agree on
> those 4 points listed, there was no consensus on the conclusion being "throw
> it all out and start over".

No, and I don't think Carlo meant starting all over. He simply
repeated that our goal is to find, assemble or (if necessary) write
that piece or even stack of software that fulfills those 4
requirements. And that's what the workshops @30C3 are going to be
about, right?

> Although I think what Carlo is doing is
> interesting and has a lot of potential, I think there are still many things
> to be done to improve privacy and improve or create new paradigms for the
> responsibility of developing for the web, and expectations of users.

Yes, there definitely are. And there're certainly several approaches
(like unhosted) that don't contradict those 4 points so we'll
eventually might talk about how to combine them (as we already started
to do). But our first and primary goal really need to be those 4
points. I would have thought that we all agreed on this back in
Berlin?

[Melvin Carvalho]

On 20 November 2013 02:18, Simon Hirscher <***@simonhirscher.de> wrote:

> On Sun, Nov 17, 2013 at 3:22 PM, Andreas Kuckartz <***@ping.de>
> wrote:
> >> These four requirements make it such that any discussion of
> "improvements" of
> >> the general situation that does not fulfil them should be seen as out of
> >> scope for this group of people.
> >
> > I wonder if all the participants agree with _that_ interpretation. I
> > guess that I would have been surprised by it...
>
> As stated in my other post to this thread, yes, I agree with that
> interpretation.
>
> > But it is unlikely that I would have agreed that improvements of subsets
> > of this set of items are out of scope.
> > […]
> > That meeting decided what is in scope for the GNU/consensus and the
> > Social Swarm mailing lists? Really?
>
> I can't speak for GNU/consensus because I don't know who is part of it
> but regarding this mailing list I've seen almost every person that's
> been active here in Berlin. So let's wait for their answer regarding
> the interpretation of the meeting's results.
>
> On a different note, and this is just my opinion and might not be the
> consensus from the meeting (although I think we scratched this topic):
> How many different projects do you want the SocialSwarm initiative to
> "focus" on? Everyone's got a day job and is only doing this in his or
> her free time. Also taking into account that we're not exactly
> hundreds of people here to begin with, I say: Let's focus on one thing
> – on getting this right, on fulfilling all 4 points. Why? Because no
> one else is doing this. In contrast, there are already *hundreds* of
> projects out there working on improvements of approaches that only
> fulfill subsets of those 4 items. So these projects are already taken
> care of and certainly don't need an umbrella red tape enhancer
> project.
>

Why do you say no other project is working on this? How can you even know
every project out there?

* E2E + Forward secrecy

TLS and SSH have this property. I have been using WebID + TLS for almost 5
years now.

* Social Graph Transmission

I've been doing this with Linked Data for 5 years, others have done it for
10 years+

*Self Determined Data Storage

Yes this is relatively new, but im unsure I've a solution proposed on this
list, so far. In our read write web community group we've got the first
solutions to this in a very scalable way, that lets users put data
*anywhere* they want, including in multiple locations.



>
> > And I am beginning to wonder if what I see here is representative for
> > the CCC...
>
> What has that got to do with the Chaos Computer Club?
> --
> SocialSwarm mailing lists: https://socialswarm.net/en/participate/
> Websites: https://socialswarm.net/ https://wiki.socialswarm.net/
> Liquid Feedback: https://socialswarm.tracciabi.li/
> Digitalcourage, Bielefeld, Germany ***@digitalcourage.de
>

[Melvin Carvalho]

On 20 November 2013 03:05, Simon Hirscher <***@simonhirscher.de> wrote:

> On Wed, Nov 20, 2013 at 2:31 AM, Melvin Carvalho
> <***@gmail.com> wrote:
> >
> > On 20 November 2013 02:18, Simon Hirscher <***@simonhirscher.de>
> wrote:
> >>
> >> Also taking into account that we're not exactly
> >> hundreds of people here to begin with, I say: Let's focus on one thing
> >> – on getting this right, on fulfilling all 4 points. Why? Because no
> >> one else is doing this. In contrast, there are already *hundreds* of
> >> projects out there working on improvements of approaches that only
> >> fulfill subsets of those 4 items. So these projects are already taken
> >> care of and certainly don't need an umbrella red tape enhancer
> >> project.
> >
> >
> > Why do you say no other project is working on this? How can you even
> know
> > every project out there?
>
> Melvin, I obviously can't know every project out there. Let's do a
> search & replace then:
> >> Because no one *we (or I) know of* is doing this *successfully*.
>
> *sigh*
>

These are modular components, which elements do you think are not being
done successfully?

TLS *as an example* lets you exchange keys, and encrypt messages. Rolled
out to billions of users and devices.

Social graph storage rolled out to 100s of millions using linked data.

(Self Determined) Storage is new, but ever since we have HTTP POST and REST
it's been possible in that protocol. Plus any other protocol that lets you
write can do this too.

Why cant this be done in a modular way with different teams working on
different pieces and then put together. I agree maybe not all pieces are
perfect, but we cant some of us work on fixing the bugs working together?

[carlo von lynX]

On Wed, Nov 20, 2013 at 03:21:16AM +0100, Melvin Carvalho wrote:
> These are modular components, which elements do you think are not being
> done successfully?
>
> TLS *as an example* lets you exchange keys, and encrypt messages. Rolled
> out to billions of users and devices.

But it doesn't protect who is communicating with whom, it doesn't protect
the social graph of the users. Also it fails at actually authenticating
them.

> Social graph storage rolled out to 100s of millions using linked data.

Which is exactly what we NOT want. This data MUST NOT be available but
exactly to the people involved in exactly the way they are supposed to
see it, while for anyone observing network traffic it MUST NOT be
reconstructible who is exchanging data with whom.

> (Self Determined) Storage is new, but ever since we have HTTP POST and REST
> it's been possible in that protocol. Plus any other protocol that lets you
> write can do this too.

And even that is not what we mean. We mean on the end devices of the
users, and that's it. Zero servers having access to any clear data.

> Why cant this be done in a modular way with different teams working on
> different pieces and then put together. I agree maybe not all pieces are
> perfect, but we cant some of us work on fixing the bugs working together?

All the projects that work on something similar are featured on the
map. There may be a few more operating in the dark.

[Hugo Roy]

Hi everyone,

Just wanted to point out that this was certainly not the original
intent behind GNU Consensus (or is it something else that we are
discussing it?)

If we are really going into that direction for the scope of GNU
Consensus, then there’s no point in having “Terms of Service;
Didn’t Read” listed as a supporting organisation (why the heck
would we need terms for then? we would just have software
licenses)

I haven’t participated much recently, but I’m a bit concerned on
how the goal of GNU Consensus has been defined. This was certainly
not what I was looking into participating, for the mere reason
that there’s little I can do in the direction this is taking.

I suppose I’ll also unsubscribe from the list, I don’t really see
what I can contribute.

Best wishes and good luck,

Best,
Hugo


--
Hugo Roy | Free Software Foundation Europe, www.fsfe.org
FSFE Legal Team, Deputy Coordinator, www.fsfe.org/legal
FSFE French Team, Coordinator, www.fsfe.org/fr/

Support Free Software, sign up! https://fsfe.org/support

[Andreas Kuckartz]

Hugo Roy:
> Just wanted to point out that this was certainly not the original
> intent behind GNU Consensus (or is it something else that we are
> discussing it?)

Some of the mails in the last few days probably have been somewhat
off-topic. I still found some of them enlightening.

> I suppose I’ll also unsubscribe from the list, I don’t really see
> what I can contribute.

I feel your pain. But don't unsubscribe because of a few off-topic mails.

Cheers,
Andreas

[hellekin]

On 11/20/2013 08:19 AM, Hugo Roy wrote:
> Hi everyone,
>
> Just wanted to point out that this was certainly not the original
> intent behind GNU Consensus (or is it something else that we are
> discussing it?)
>
*** What do you mean? I guess you missed a couple of my emails where
I said there was a difference between the goal of the workshop at 30c3
and the goals and means of the GNU consensus. Please refer to

http://lists.gnu.org/archive/html/consensus/2013-11/msg00022.html
http://lists.gnu.org/archive/html/consensus/2013-11/msg00032.html

==
hk

[Hugo Roy]

+ 2013-11-20 Wed 16:55, hellekin <***@gnu.org>:

> On 11/20/2013 08:19 AM, Hugo Roy wrote:
> > Hi everyone,
> >
> > Just wanted to point out that this was certainly not the original
> > intent behind GNU Consensus (or is it something else that we are
> > discussing it?)
> >
> *** What do you mean? I guess you missed a couple of my emails where
> I said there was a difference between the goal of the workshop at 30c3
> and the goals and means of the GNU consensus. Please refer to
>
> http://lists.gnu.org/archive/html/consensus/2013-11/msg00022.html
> http://lists.gnu.org/archive/html/consensus/2013-11/msg00032.html

Thanks for clarifying. Sorry for the noise.


--
Hugo Roy | Free Software Foundation Europe, www.fsfe.org
FSFE Legal Team, Deputy Coordinator, www.fsfe.org/legal
FSFE French Team, Coordinator, www.fsfe.org/fr/

Support Free Software, sign up! https://fsfe.org/support

[Simon Hirscher]

On Wed, Nov 20, 2013 at 3:21 AM, Melvin Carvalho
<***@gmail.com> wrote:
>
> TLS *as an example* lets you exchange keys, and encrypt messages. Rolled
> out to billions of users and devices.

What about MITM attacks? What about the fundamentally broken
certificate architecture? The only way I see that both issues
obviously can be solved is to solve the DNS issue right from the start
and use public keys as fundamental identifiers. Now, we're back to
Zooko's Triangle, an issue that GNS probably solves in the most
elegant way.

On Wed, Nov 20, 2013 at 3:21 AM, Melvin Carvalho
<***@gmail.com> wrote:
>
> On 20 November 2013 03:05, Simon Hirscher <***@simonhirscher.de> wrote:
>>
>> On Wed, Nov 20, 2013 at 2:31 AM, Melvin Carvalho
>> <***@gmail.com> wrote:
>> >
>> > Why do you say no other project is working on this? How can you even
>> > know
>> > every project out there?
>>
>> Melvin, I obviously can't know every project out there. Let's do a
>> search & replace then:
>> >> Because no one *we (or I) know of* is doing this *successfully*.
>
> These are modular components, which elements do you think are not being done
> successfully?

I said those 4 problems are not being addressed successfully *at
once*. And that's really the key to understanding why we can't just
solve these issues by mostly building upon existing technologies –
like TLS and web technologies. Because every project [again: I know
of] is just paying attention to one or, at the maximum, two of those
points and on the other hand makes it damn hard or simply impossible
to solve those other two or three issues at the same time. Yes, some
web applications might enable self-determined storage at first glance.
But, meanwhile, by running server-delivered code (which might not even
come from the server you trust – due to compromised TLS certificates)
in your browser you give up on end2end encryption. So, no, it actually
doesn't allow self-determined storage because there might be someone
else listening.

In fact, we could boil down the four requirements to just one:
Self-determined storage. This already implies end2end encryption,
perfect forward secrecy as well as social graph obfuscation because
*I* determine who gets to see my data and my messages and my buddy
lists. Now and in the future.

Hence, to wrap it all up and answer your question in the shortest way
possible: So far, there is absolutely no project that managed to
realize genuinely self-determined storage.

> Why cant this be done in a modular way with different teams working on
> different pieces and then put together. I agree maybe not all pieces are
> perfect, but we cant some of us work on fixing the bugs working together?

See above. Also, I don't even know where to start when talking about
fixing TLS and doing web apps in a secure way. Then again, that might
be due to the fact that their design is fundamentally broken with
respect to our wishlist.

Maybe I'm all wrong – in which case I'd ask you to tell me which
building blocks you would use in our quest to fulfill those 4
requirements. At the same time, I'd ask you to explain to me why do
you think it's even possible to fix all their "bugs" (I prefer the
term "architectural flaws") all at once. In short: Give me a plan I
can believe in.

So far, however, all those solutions you proposed in your previous
email – regarding "E2E + Forward secrecy", "Social Graph Transmission"
and "Self Determined Data Storage" – aren't solutions at all. I think
Carlo really has a point here.

[Melvin Carvalho]

On 21 November 2013 02:08, Simon Hirscher <***@simonhirscher.de> wrote:

> On Wed, Nov 20, 2013 at 3:21 AM, Melvin Carvalho
> <***@gmail.com> wrote:
> >
> > TLS *as an example* lets you exchange keys, and encrypt messages. Rolled
> > out to billions of users and devices.
>
> What about MITM attacks? What about the fundamentally broken
> certificate architecture? The only way I see that both issues
> obviously can be solved is to solve the DNS issue right from the start
> and use public keys as fundamental identifiers. Now, we're back to
> Zooko's Triangle, an issue that GNS probably solves in the most
> elegant way.
>
> On Wed, Nov 20, 2013 at 3:21 AM, Melvin Carvalho
> <***@gmail.com> wrote:
> >
> > On 20 November 2013 03:05, Simon Hirscher <***@simonhirscher.de>
> wrote:
> >>
> >> On Wed, Nov 20, 2013 at 2:31 AM, Melvin Carvalho
> >> <***@gmail.com> wrote:
> >> >
> >> > Why do you say no other project is working on this? How can you even
> >> > know
> >> > every project out there?
> >>
> >> Melvin, I obviously can't know every project out there. Let's do a
> >> search & replace then:
> >> >> Because no one *we (or I) know of* is doing this *successfully*.
> >
> > These are modular components, which elements do you think are not being
> done
> > successfully?
>
> I said those 4 problems are not being addressed successfully *at
> once*. And that's really the key to understanding why we can't just
> solve these issues by mostly building upon existing technologies –
> like TLS and web technologies. Because every project [again: I know
> of] is just paying attention to one or, at the maximum, two of those
> points and on the other hand makes it damn hard or simply impossible
> to solve those other two or three issues at the same time. Yes, some
> web applications might enable self-determined storage at first glance.
> But, meanwhile, by running server-delivered code (which might not even
> come from the server you trust – due to compromised TLS certificates)
> in your browser you give up on end2end encryption. So, no, it actually
> doesn't allow self-determined storage because there might be someone
> else listening.
>
> In fact, we could boil down the four requirements to just one:
> Self-determined storage. This already implies end2end encryption,
> perfect forward secrecy as well as social graph obfuscation because
> *I* determine who gets to see my data and my messages and my buddy
> lists. Now and in the future.
>
> Hence, to wrap it all up and answer your question in the shortest way
> possible: So far, there is absolutely no project that managed to
> realize genuinely self-determined storage.
>
> > Why cant this be done in a modular way with different teams working on
> > different pieces and then put together. I agree maybe not all pieces are
> > perfect, but we cant some of us work on fixing the bugs working together?
>
> See above. Also, I don't even know where to start when talking about
> fixing TLS and doing web apps in a secure way. Then again, that might
> be due to the fact that their design is fundamentally broken with
> respect to our wishlist.
>
> Maybe I'm all wrong – in which case I'd ask you to tell me which
> building blocks you would use in our quest to fulfill those 4
> requirements. At the same time, I'd ask you to explain to me why do
> you think it's even possible to fix all their "bugs" (I prefer the
> term "architectural flaws") all at once. In short: Give me a plan I
> can believe in.
>
> So far, however, all those solutions you proposed in your previous
> email – regarding "E2E + Forward secrecy", "Social Graph Transmission"
> and "Self Determined Data Storage" – aren't solutions at all. I think
> Carlo really has a point here.
>

I agree with most almost everything you say here.

I could spend time going into much more details of the specifics of each
modular component, but I suspect it's not going to be that productive at
this point. I think maybe a demo would work better, which is something I
can work on. It wont be read for this years conf, but maybe next.

[Nick Jennings]

On Thu, Nov 21, 2013 at 2:08 AM, Simon Hirscher <***@simonhirscher.de>wrote:

>
> On Wed, Nov 20, 2013 at 3:21 AM, Melvin Carvalho
> <***@gmail.com> wrote:
> >
> > On 20 November 2013 03:05, Simon Hirscher <***@simonhirscher.de>
> wrote:
> >>
> >> On Wed, Nov 20, 2013 at 2:31 AM, Melvin Carvalho
> >> <***@gmail.com> wrote:
> >> >
> >> > Why do you say no other project is working on this? How can you even
> >> > know
> >> > every project out there?
> >>
> >> Melvin, I obviously can't know every project out there. Let's do a
> >> search & replace then:
> >> >> Because no one *we (or I) know of* is doing this *successfully*.
> >
> > These are modular components, which elements do you think are not being
> done
> > successfully?
>
> I said those 4 problems are not being addressed successfully *at
> once*. And that's really the key to understanding why we can't just
> solve these issues by mostly building upon existing technologies –
> like TLS and web technologies.


I don't think anyone is saying that GNUnet is going about it the wrong way.
I think it's great that they are addressing things from the ground up. I
personally, also think that addressing from the top down provides value to
people in more ways than just the immediate technical results.

To say that you can't, for instance, provide self-determined data storage
because there is a possibility it could be compromised, is like saying you
can't run an HTTP server because it could be hacked. There is value in
making things better, and giving users more autonomy, and working toward
better circumstances.

Don't count your GNU/chickens before they hatch ... :)



> Because every project [again: I know
> of] is just paying attention to one or, at the maximum, two of those
> points and on the other hand makes it damn hard or simply impossible
> to solve those other two or three issues at the same time.


I'm not sure I understand what you mean here. By trying to solve one or two
of the 4, it makes solving the other two harder?


>
> Yes, some
> web applications might enable self-determined storage at first glance.
> But, meanwhile, by running server-delivered code (which might not even
> come from the server you trust – due to compromised TLS certificates)
> in your browser you give up on end2end encryption. So, no, it actually
> doesn't allow self-determined storage because there might be someone
> else listening.
>
> In fact, we could boil down the four requirements to just one:
> Self-determined storage. This already implies end2end encryption,
> perfect forward secrecy as well as social graph obfuscation because
> *I* determine who gets to see my data and my messages and my buddy
> lists. Now and in the future.
>
> Hence, to wrap it all up and answer your question in the shortest way
> possible: So far, there is absolutely no project that managed to
> realize genuinely self-determined storage.
>

There are several projects working toward this goal. remoteStorage.js is
one of them, as with the others people have mentioned.

I don't think it makes sense, from a social perspective, to say we can't
provide real self-determined data storage because TLS has issues. That's
mixing two different issues.

You *can* provide self determined data storage *and at the same time* you
can further illustrate the remaining vulnerabilities.

You *can* provide a better method for point-to-point encryption *and at the
same time* point out the vulnerabilities in the existing DNS system.

Yes, these things wont be perfect. But they *will* be better, and they
*will* be progress, and there will be less remaining problems to address,
which will be highlighted more so, because solving some problems can
improve clarity of remaining problems to a larger audience.

"Hey we made this awesome library that will save your user data to your own
private storage target, you may need to install this browser plugin,
though, to verify that the application you are using hasn't been tampered
with, and that you are connecting to the correct server(s)"




>
> > Why cant this be done in a modular way with different teams working on
> > different pieces and then put together. I agree maybe not all pieces are
> > perfect, but we cant some of us work on fixing the bugs working together?
>
> See above. Also, I don't even know where to start when talking about
> fixing TLS and doing web apps in a secure way. Then again, that might
> be due to the fact that their design is fundamentally broken with
> respect to our wishlist.
>
> Maybe I'm all wrong – in which case I'd ask you to tell me which
> building blocks you would use in our quest to fulfill those 4
> requirements. At the same time, I'd ask you to explain to me why do
> you think it's even possible to fix all their "bugs" (I prefer the
> term "architectural flaws") all at once. In short: Give me a plan I
> can believe in.
>

I think GNUnet is a very good answer to all 4 of those issues, all wrapped
up in one project. That's great, I want GNUnet to succeed very much so, but
still I don't think we should be exclusionary, or count or GNU/chickens...

Is it fair to say that it's possible only parts of the project succeed? Are
there any pieces that can be stand-alone without the other components and
still provide some level of value?




> So far, however, all those solutions you proposed in your previous
> email – regarding "E2E + Forward secrecy", "Social Graph Transmission"
> and "Self Determined Data Storage" – aren't solutions at all. I think
> Carlo really has a point here.
> --
> SocialSwarm mailing lists: https://socialswarm.net/en/participate/
> Websites: https://socialswarm.net/ https://wiki.socialswarm.net/
> Liquid Feedback: https://socialswarm.tracciabi.li/
> Digitalcourage, Bielefeld, Germany ***@digitalcourage.de
>

[Simon Hirscher]

On Thu, Nov 21, 2013 at 4:12 AM, Nick Jennings <***@silverbucket.net> wrote:
>
>> Because every project [again: I know
>> of] is just paying attention to one or, at the maximum, two of those
>> points and on the other hand makes it damn hard or simply impossible
>> to solve those other two or three issues at the same time.
>
> I'm not sure I understand what you mean here. By trying to solve one or two
> of the 4, it makes solving the other two harder?

Not necessarily. What I meant was that projects tend to focus on one
or two of those four points. In order to fulfill them, however, and
also due to restricted resources (time, developers etc.) they neglect
the other two – which, in turn, might indeed mean that they decide to
use technologies that only enable them to solve a strict subset of
those problems. Web technologies are a classic example – because you
can't trust the certificate authorities, you're running 3rd party code
all the time, and don't even get me started on cookies and the like.

> To say that you can't, for instance, provide self-determined data storage
> because there is a possibility it could be compromised, is like saying you
> can't run an HTTP server because it could be hacked. There is value in
> making things better, and giving users more autonomy, and working toward
> better circumstances.
>
> […]
>
> You *can* provide self determined data storage *and at the same time* you
> can further illustrate the remaining vulnerabilities.
>
> You *can* provide a better method for point-to-point encryption *and at the
> same time* point out the vulnerabilities in the existing DNS system.
>
> Yes, these things wont be perfect. But they *will* be better, and they
> *will* be progress, and there will be less remaining problems to address,
> which will be highlighted more so, because solving some problems can improve
> clarity of remaining problems to a larger audience.

Agreed, there is value in making things better. But I'm here for the
solution to *all four* of our problems. Why? Because…

1.) It's within our reach and I hate to settle with anything less than
what's possible.

2.) We are facing the biggest adversary one could possibly imagine:
The NSA. (Also: other intelligence agencies and some huge companies'
CEOs, all of which are having wet dreams about big data). With respect
to their resources, "better" and "some progress" is just not good
enough.

3.) We, the SocialSwarm, set out to create an actual alternative to
Faceboogle – for the masses. That however means that we only have one
single shot to get it right. People won't follow us from one platform
to another, more secure one every year.

On a similar note:
I'm actually a bit surprised that there are people on this list
complaining about those four requirements. If they really wanted to be
a part of the SocialSwarm initiative and help with creating a secure
Faceboogle alternative that's actually ready for mass adoption, I
wonder what they were thinking this was going to take? A bit of HTML
thrown onto some web server? No offense guys (and sorry for the harsh
and probably even unjustified words). If you're not down, that's
absolutely fine. Keep doing what you're doing. Because, as Nick said,
there IS value in making things better!

As for me, I think this is going to be my last post on this topic for
the time being. Everything's been discussed extensively, now, and I
should better invest my time in finally finishing reading tg's paper
on the GNUnet/PSYC/secushare API.

[Nick Jennings]

Thanks for the response Simon - don't get me wrong, I totally agree with
what we're doing here. I'm not questioning the project, goals, or methods.
I do think there is value in incremental chances on the other end of the
spectrum, I think if both succeed the more power to us, and I hope that
there is great success with GNUnet and look forward to being able to help
more hands-on later in the development cycle as the application level is
ready to be addressed.

Cheers
Nick

On Tue, Nov 26, 2013 at 1:07 AM, Simon Hirscher <***@simonhirscher.de>wrote:

> On Thu, Nov 21, 2013 at 4:12 AM, Nick Jennings <***@silverbucket.net>
> wrote:
> >
> >> Because every project [again: I know
> >> of] is just paying attention to one or, at the maximum, two of those
> >> points and on the other hand makes it damn hard or simply impossible
> >> to solve those other two or three issues at the same time.
> >
> > I'm not sure I understand what you mean here. By trying to solve one or
> two
> > of the 4, it makes solving the other two harder?
>
> Not necessarily. What I meant was that projects tend to focus on one
> or two of those four points. In order to fulfill them, however, and
> also due to restricted resources (time, developers etc.) they neglect
> the other two – which, in turn, might indeed mean that they decide to
> use technologies that only enable them to solve a strict subset of
> those problems. Web technologies are a classic example – because you
> can't trust the certificate authorities, you're running 3rd party code
> all the time, and don't even get me started on cookies and the like.
>
> > To say that you can't, for instance, provide self-determined data storage
> > because there is a possibility it could be compromised, is like saying
> you
> > can't run an HTTP server because it could be hacked. There is value in
> > making things better, and giving users more autonomy, and working toward
> > better circumstances.
> >
> > [
]
> >
> > You *can* provide self determined data storage *and at the same time* you
> > can further illustrate the remaining vulnerabilities.
> >
> > You *can* provide a better method for point-to-point encryption *and at
> the
> > same time* point out the vulnerabilities in the existing DNS system.
> >
> > Yes, these things wont be perfect. But they *will* be better, and they
> > *will* be progress, and there will be less remaining problems to address,
> > which will be highlighted more so, because solving some problems can
> improve
> > clarity of remaining problems to a larger audience.
>
> Agreed, there is value in making things better. But I'm here for the
> solution to *all four* of our problems. Why? Because

>
> 1.) It's within our reach and I hate to settle with anything less than
> what's possible.
>
> 2.) We are facing the biggest adversary one could possibly imagine:
> The NSA. (Also: other intelligence agencies and some huge companies'
> CEOs, all of which are having wet dreams about big data). With respect
> to their resources, "better" and "some progress" is just not good
> enough.
>
> 3.) We, the SocialSwarm, set out to create an actual alternative to
> Faceboogle – for the masses. That however means that we only have one
> single shot to get it right. People won't follow us from one platform
> to another, more secure one every year.
>
> On a similar note:
> I'm actually a bit surprised that there are people on this list
> complaining about those four requirements. If they really wanted to be
> a part of the SocialSwarm initiative and help with creating a secure
> Faceboogle alternative that's actually ready for mass adoption, I
> wonder what they were thinking this was going to take? A bit of HTML
> thrown onto some web server? No offense guys (and sorry for the harsh
> and probably even unjustified words). If you're not down, that's
> absolutely fine. Keep doing what you're doing. Because, as Nick said,
> there IS value in making things better!
>
> As for me, I think this is going to be my last post on this topic for
> the time being. Everything's been discussed extensively, now, and I
> should better invest my time in finally finishing reading tg's paper
> on the GNUnet/PSYC/secushare API.
>

[Andreas Kuckartz]

Simon Hirscher:
> 3.) We, the SocialSwarm, set out to create an actual alternative to
> Faceboogle – for the masses. That however means that we only have
> one single shot to get it right. People won't follow us from one
> platform to another, more secure one every year.
> ...
> If they really wanted to be
> a part of the SocialSwarm initiative and help with creating a secure
> Faceboogle alternative that's actually ready for mass adoption, I
> wonder what they were thinking this was going to take?

This suggests that the complexity of this task and the obstacles are
severely underestimated.

This is not a "If you build it, they will come"-type of problem.

An alternative to the existing proprietary platforms at least has to
provide some of the core features of those services which are valued by
users. But even that will not be sufficient by itself.

Developing the software is the easiest part of the solution.

Cheers,
Andreas

[Simon Hirscher]

On Wed, Nov 20, 2013 at 2:31 AM, Melvin Carvalho
<***@gmail.com> wrote:
>
> On 20 November 2013 02:18, Simon Hirscher <***@simonhirscher.de> wrote:
>>
>> Also taking into account that we're not exactly
>> hundreds of people here to begin with, I say: Let's focus on one thing
>> – on getting this right, on fulfilling all 4 points. Why? Because no
>> one else is doing this. In contrast, there are already *hundreds* of
>> projects out there working on improvements of approaches that only
>> fulfill subsets of those 4 items. So these projects are already taken
>> care of and certainly don't need an umbrella red tape enhancer
>> project.
>
>
> Why do you say no other project is working on this? How can you even know
> every project out there?

Melvin, I obviously can't know every project out there. Let's do a
search & replace then:
>> Because no one *we (or I) know of* is doing this *successfully*.

*sigh*

[Simon Hirscher]

On Sun, Nov 17, 2013 at 3:22 PM, Andreas Kuckartz <***@ping.de> wrote:
>> These four requirements make it such that any discussion of "improvements" of
>> the general situation that does not fulfil them should be seen as out of
>> scope for this group of people.
>
> I wonder if all the participants agree with _that_ interpretation. I
> guess that I would have been surprised by it...

As stated in my other post to this thread, yes, I agree with that
interpretation.

> But it is unlikely that I would have agreed that improvements of subsets
> of this set of items are out of scope.
> […]
> That meeting decided what is in scope for the GNU/consensus and the
> Social Swarm mailing lists? Really?

I can't speak for GNU/consensus because I don't know who is part of it
but regarding this mailing list I've seen almost every person that's
been active here in Berlin. So let's wait for their answer regarding
the interpretation of the meeting's results.

On a different note, and this is just my opinion and might not be the
consensus from the meeting (although I think we scratched this topic):
How many different projects do you want the SocialSwarm initiative to
"focus" on? Everyone's got a day job and is only doing this in his or
her free time. Also taking into account that we're not exactly
hundreds of people here to begin with, I say: Let's focus on one thing
– on getting this right, on fulfilling all 4 points. Why? Because no
one else is doing this. In contrast, there are already *hundreds* of
projects out there working on improvements of approaches that only
fulfill subsets of those 4 items. So these projects are already taken
care of and certainly don't need an umbrella red tape enhancer
project.

> And I am beginning to wonder if what I see here is representative for
> the CCC...

What has that got to do with the Chaos Computer Club?

[hellekin]

On 11/17/2013 10:16 AM, carlo von lynX wrote:
> It is no longer clear if people in here are Social Swarm, GNU
> consensus or something else currently using the name
> #youbroketheinternet.
>
*** All right, it seems that my previous message was not so clear.

Here is what I think, and how I think it should happen.

1. SocialSwarm is the part of the project that focuses exclusively on
Peer-to-Peer solutions such as GNUnet, Briar, I2P, Tor, and
others--although I don't think it was it at the beginning: it was only
concerned with privacy, and the P2P approach was deemed the only one
worth exploring to foster privacy. The discussions are happening on
the socialswarm mailing list, and is often cross-posted to the GNU
consensus mailing list.

2. GNU consensus is the part of the project that focuses on easing the
path from the current situation to the situation where the Internet is
decentralized again, and freedom-respecting and privacy-respecting
networks provide social networking capabilities, regardless of the
path to go from here to there--that includes experimental, hopelessly
broken, or genius approaches: the goal is to orient, and educate
developers into making decisions towards more freedom, more
decentralization, and more cooperation on shared issues and across
like-minded projects. The discussions are happening on the GNU
consensus mailing and are often cross-posted on the SocialSwarm
mailing list.

3. SocialSwarm, GNU consensus, and others, form a working group called
#youbroketheinternet with the focus of meeting at the 30c3 in order to
establish strategies for pushing Peer-to-Peer solutions, with the
central proposal being to build on top of the GNUnet framework. That
specific discussion SHOULD NOT happen on the GNU consensus list as it
excludes Web-based (HTTP, WebRTC) and federation-based (SMTP, XMPP)
approaches entirely. That discussion should either happen on the
SocialSwarm list exclusively, or be marked as being specific to the
30c3 meeting, e.g., by prefixing all posts with [YouBrokeTheInternet]
or a shorter [aGNUone].

Did I miss something?

==
hk