Forgot your password?
typodupeerror
Encryption Security

Nullsoft's Waste: Encrypted, Distributed, Mesh Net 674

Posted by CmdrTaco
from the p2p-gets-more-and-more dept.
Myriad writes "Nullsoft, makers of the venerable Winamp MP3 player, released today a secure, distributed mesh-like networking protocal and platform called Waste. This v1.0 beta release uses RSA (key based) and Blowfish encryption for security, and features Instant Messanging and group chat, along with file browsing, searching, and transfer. Waste has been released under the GPL, with source and binaries available here."
This discussion has been archived. No new comments can be posted.

Nullsoft's Waste: Encrypted, Distributed, Mesh Net

Comments Filter:
  • Gnutella (Score:2, Insightful)

    by Nermal6693 (622898)
    Didn't they make Gnutella too?
    • Re:Gnutella (Score:4, Funny)

      by localghost (659616) <dleblanc@gmail.com> on Thursday May 29, 2003 @03:55AM (#6065746)
      No, Ferrero [ferrero.de] makes Nutella [nutella.de].
      • Re:Gnutella (Score:2, Informative)

        by Anonymous Coward
        As a matter of fact, Gnutella has nothing to do with Nutella, except for the similar name.

        As you already pointed out in your links, Nutella is a chocalate spread. It is a FOOD item.

        Gnutella is a SOFTWARE item. It is used for P2P (point-to-point) networking. Usually, Gnutella is used to distribute music, although it can be used to distribute any files.

        I hope this comment has been helpful in clearing the matter.
    • Re:Gnutella - YES (Score:3, Informative)

      by Anonymous Coward
      Yes, Nullsoft originally created Gnutella then parent company AOL forced them to stop development, but the cat was out of the back and code was leaked/reverse engineered.
    • Re:Gnutella (Score:5, Informative)

      by MacJedi (173) on Thursday May 29, 2003 @04:02AM (#6065763) Homepage
      Yes, they did. However, AOL didn't like it and got it shut down within the day. Then someone (Justin Frankel?) leaked the source and the rest is history.

      /joeyo

    • Re:Gnutella (Score:5, Informative)

      by Magila (138485) on Thursday May 29, 2003 @04:05AM (#6065774) Homepage
      Indeed, here [slashdot.org] is the original slashdot story. Of course AOL quickly ended development at nullsoft, it lived on after the protocol had been reverse engineered and others picked up where nullsoft left off.
    • by CrazyJim0 (324487) on Thursday May 29, 2003 @06:04AM (#6066085)
      I think hundreds or thousands of coders thought of this shit, especially when Napster got shutdown.

      I personally came across it when removing a section of my P2P anti hacking designed for Diablo 1 to be secure even without a central server.

      Interestingly enough, I was going to call my Gnutella: Dumpster

      Which is cool they're naming their software: Waste

      Lets see how it turns out
      • by elwinc (663074) on Thursday May 29, 2003 @11:15AM (#6067797)
        I believe the name "Waste" is a references to Thomas Pynchon's novel "The Crying of Lot 49." In the novel, W.A.S.T.E is either a hoax or a secret system for communication, and (might) stand for "We Await Silent Tristero's Empire." Here's a little quote:

        "Last night, she might have wondered what undergrounds apart from the couple she knew of communicated by WASTE system. By sunrise she could legitimately ask what undergrounds didn't....[H]ere were God knew how many citizens, deliberately choosing not to communicate by U.S. Mail. It was not an act of treason, nor possibly even of defiance. But it was a calculated withdrawal, from the life of the Republic, from its machinery. Whatever else was being denied them out of hate, indifference to the power of their vote, loopholes, simple ignorance, this withdrawal was their own, unpublicized, private. Since they could not have withdrawn into a vacuum (could they?), there had to exist the separate, silent, unsuspected world."
  • Hmmm.... (Score:4, Insightful)

    by leviramsey (248057) on Thursday May 29, 2003 @03:36AM (#6065670) Journal

    AOL Time Warner (IIRC, owners of the second biggest recording company, not to mention one of the major recording studios) owns Nullsoft, which releases a program that the RIAA and MPAA will undoubtedly call a tool whose sole purpose is to illicitly distribute copyrighted works....

    A cliche regarding:

    • a left hand
    • a right hand
    • and a lack of knowledge

    ...comes to mind.

    • Re:Hmmm.... (Score:5, Informative)

      by glob (23034) on Thursday May 29, 2003 @03:57AM (#6065753) Homepage Journal
      "undoubtedly call a tool whose sole purpose is to illicitly distribute copyrighted works"

      uhh, waste is for small workgroups only ..

      WASTE is a software product and protocol that enables secure distributed communication for small (on the order of 10-50 nodes) trusted groups of users.
      it's not about p2p file sharing, rather it's a colaborative tool.

      sure, you could use to to share illegal stuff, but it's really no different in that respect to email, icq, whatever.

    • Re:Hmmm.... (Score:5, Insightful)

      by Daniel Phillips (238627) on Thursday May 29, 2003 @08:23AM (#6066516)
      AOL Time Warner (IIRC, owners of the second biggest recording company, not to mention one of the major recording studios) owns Nullsoft, which releases a program that the RIAA and MPAA will undoubtedly call a tool whose sole purpose is to illicitly distribute copyrighted works....

      That was a joke right? And the moderators who marked it "interesting" and "insightful" really meant to mark it "funny", they just hit the wrong button, right?

      In fact what we have here is a first cut at a secure distributed network presence system, something that would allow you to run an icq-like network between people you trust without being spied on by a central server. There are many reasons why one would want this: maybe *you* just want to trade copyrighted files, but *I* want to communicate securely and efficiently with my associates.

      As for why AOL lets Nullsoft do things like this, I suppose the choice is either to let them work on what they want to or lose the talent. What Nullsoft is doing is the best thing for the net, and so is the best thing for AOL in the end.
      • The Right Hand Knows (Score:5, Informative)

        by fm6 (162816) on Thursday May 29, 2003 @11:35AM (#6067964) Homepage Journal
        In fact what we have here is a first cut at a secure distributed network presence system, something that would allow you to run an icq-like network between people you trust without being spied on by a central server. There are many reasons why one would want this: maybe *you* just want to trade copyrighted files, but *I* want to communicate securely and efficiently with my associates.
        Besides which, this software isn't particularly useful for illicit file sharing. For that you need a way to get into contact with strangers who happen to have a copy of the file you want to download. The encryption features would actually seem to work against that.

        Also, this is technology that might be very useful to AOL. AIM's big drawback is that it's not very secure, and really shouldn't be used for sensitive corporate communication. (Though the engineers at my last employer used it anyway.) AOL could persuade people that are already using AIM for free to upgrade to WASTE in order to secure their communications. Not to mention the other features.

        We Await Silent Trystero's Empire!

        • by L7_ (645377)
          Yes, it seems to be more of a client where you already have a trusted group of users either from real life (Say, a whole dorm hall or a bunch of co-workers) or from a presence online (Say, a whole gaming guild or software collaborators or even a little message board community) to open some of your system files to. It is a trusted way to get recommended files, be they legal or illegal.

          You don't need to be in contact with strangers if all your friends have GBs upon GBs of "shared source".
          • by jafuser (112236)
            Your post just made me realize how useful it actually is.

            I run a small network in my apartment with my roommates, and we all have various versions of windows, and some computers are "homed" on a different domain, especially if a friend brings his work laptop over during a lan party.

            In these kind of environments, windows file sharing seems to be much more hassle than it's worth. On Win2k, it seems like it's a 10 step process just to share a folder. Even after that, it can take one or two minutes just to
    • Re:Hmmm.... (Score:4, Interesting)

      by abulafia (7826) on Thursday May 29, 2003 @09:06AM (#6066741)
      which releases a program that the RIAA and MPAA will undoubtedly call a tool whose sole purpose is to illicitly distribute copyrighted works....

      There is no reason to call it that. It is a communication tool that tries not to leak information. I would encourage RIAA members to use it themselves, to better secure internal conversations against unintentional leakage. I'm sure "they" send files to each other via email from time to time. Isn't this better? What's not to like?

      As a long time cypherpunk, I'm glad this is here. Way back in '94, I wrote out a model of this sort of thing, but with decent routing and key exchange, and then got busy working for money. I'm glad someone is doing this, even if it doesn't work on a larger scale.

      Please flame the evil cypherpunk vision below.

  • until when (Score:3, Insightful)

    by Vej (199488) on Thursday May 29, 2003 @03:38AM (#6065675)
    Makes you wonder how long it will be until protocols/network designs are attacked on the same basis as the product derived from them. ie p2p/filesharing.

    Considering nullsoft, might be a risky move.
  • Interesting (Score:5, Insightful)

    by harikiri (211017) on Thursday May 29, 2003 @03:39AM (#6065679)
    I haven't yet spotted any cryptographic "reviews" of this yet, but it certainly looks like an appealing platform to work with.

    Going through the documentation, I found this:

    From here [nullsoft.com]

    Note: It might be worth implementing WASTE using a subset of SSL, to avoid any concern of flaws in this protocol. Feedback is gladly accepted on any potential weaknesses of the negotiation. We have spent a decent amount of time analyzing this, and although we have found a few things that are not ideal (i.e. if you know public keys from a network, you can sniff some traffic and do an offline dictionary attack on the network name/ID), but overall it seems decent. The current implementation probably needs work, too.

    Which suggests to me that it isn't worth rushing out and developing application with *just* yet, until further reviews have occured (and the protocol has matured/evolved).

  • Five minutes later (Score:5, Interesting)

    by Jacer (574383) on Thursday May 29, 2003 @03:41AM (#6065684) Homepage
    I read the article and immediately got excited. I downloaded all of the software and had it all setup and working within a few minutes. As of right now I'm living in an apartment and have no practical use, but on Monday I'm moving into my dorm room to start my summer class (bleh!) Anyway, I think this is so wonderful! I've been thinking about a secure network computing solution for my three computers when I'm at school. I have my server, workstation, and my laptop that I'd like to tie all together. The leading choice was vpn, but after playing around with this, I do think that running on my server and having the three of them connect to it, and maybe a few of my friends computers on campus, we can create a very nice, effective, small, and secure lan. Then again, after five minutes I haven't decided if the whole reinventing of the wheel is worth it. I'll probably try it out, and setup a vpn server too, and see which I like more.
    • by graveyhead (210996) <fletch@@@fletchtronics...net> on Thursday May 29, 2003 @04:24AM (#6065835)
      VPN is better if you're a gamer...

      Once you've set it up for a firewall, the f/w effectively vanishes inside the VPN. A friend and I struggled with firewall configs for years tweaking for the game of the day. Enter VPN, and now we have a private TCP network without firewalls. Any game supports that, no reconfiguration required.

      The other thing is that it is built into w2k (my gaming platform of choice) and XP (friends platform). This means you can be up and running after reading some quick instructions on setting up the server, your shares (properly!), forward one TCP port (yes, only one) from your firewall to desktop, and that's it forever.

      Add an uber-IM like Trillian, and that's all you will ever need.
      • Yeah, I had a VPN setup from work to home before, and it didn't always take kindly to the network address translation. Certian things wouldn't function, and I'm hoping that's fixed here. Also, we have a whole chunk of public addresses on campus. I could easily configure the pool to assign some of them, and not worry about the nat, but then there is always a chance that there will be an address conflict. As a former net admin before coming back to school, I can tell you that I don't take too kindly to ro
  • by scrod (136965)
    while you can. Remember what happened when they first released Gnutella? If I recall, AOL forced them to pull it within hours (though it was already completely reverse-engineered almost immediately afterward).
    • by Farley Mullet (604326) on Thursday May 29, 2003 @04:12AM (#6065796)

      +4 RTFA [nullsoft.com]! more like it.

      And I blockquote:

      WASTE is a software product and protocol that enables secure distributed communication for small (on the order of 10-50 nodes) trusted groups of users.
      So this isn't really a thing like gnutella. It's an enterprise product. As other posters have noted, it could conceivably be used to share (AOL-TW) copyrighted works, but that doesn't seem to be anywhere near it's main purpose. Heck, AOL is probably releasing the core technology as OSS to get the community to shake it down for bugs, in anticipation of releasing a commercial product built on top of the protocol. Kinda like how Apple has worked on open source technologies like zeroconf, and released commercial products like rendezvous built on the technology.
  • by rmlane (589573) on Thursday May 29, 2003 @03:43AM (#6065693)

    Designed for small groups of people (up to 50)

    It allows easy colloboration across firewalls, and only one user inside the firewall is required to allow all users inside access to the mesh.

    Each link is encrypted, but each message is decrypted and re-encrypted at each hop of the mesh, so you have to trust all of the nodes. It's also very hard to drop a node onc it is trusted, as each node shares public keys around to make sure all nodes have all public keys. Initial connection to the mesh requires manual key exchange. PITA, but moderatley secure.

    All network traffic is encrypted, it will flood each mesh link with a minimum amount of bandwidth to foil traffic analysis.

    • Key exchange (Score:5, Interesting)

      by yem (170316) on Thursday May 29, 2003 @06:48AM (#6066182) Homepage

      "Initial connection to the mesh requires manual key exchange. PITA, but moderatley secure."

      IIRC, key exchange is where most encryption schemes fall down. If this ever takes off I'd guess 99% of users will trade keys over plain ol unencrypted SMTP.

      Nice summary though - this really does look interesting.


  • by BitHive (578094) on Thursday May 29, 2003 @03:44AM (#6065695) Homepage
    That's W A S T E, not 'Waste'.
    • by IntlHarvester (11985) on Thursday May 29, 2003 @04:28AM (#6065847) Journal
      Above post was not at all offtopic. Crying of Lot 49 is a good nerd book, so go read it.

      In the book, W.A.S.T.E is an underground postal system that allowed people to exchange messages without the authorities finding out.
      • by Surak (18578) * <surak.mailblocks@com> on Thursday May 29, 2003 @07:30AM (#6066297) Homepage Journal
        And I doubt that's a coincidence either considering that's exactly what the protocol seems to do.

        Now I've never read the book, but I'd say in an underground postal system every person in the system has to be trusted. Much like this protocol -- each node in the network needs to be trusted.

        You have to build your own little underground network with a few trusted friends. This reminds me a lot of the pirate BBS days ... if you wanted access to the 'private' or 'elite' (we didn't use such silliness as 31337 ;) file sections, you had to know the sysop.

        This system allowed for only quality 'warez' files because everyone who was allowed to trade files had to be trusted, and therefore they weren't going to damage their reputation by sending crap like you get on P2P nowadays like incomplete packages or stuff that said it was one thing, but really was another thing. Back when trading pirated software was more like a gentlemen's agreement and not the 'o-D4Y \/\/4R3Z!!!!' crap pimply-faced teenagers with nothing better to do do today.

        On the other hand, one has to think, 'Who needs it?' Most of us who were in that community back then have merged in with the Open Source community today and if we trade software at all it's with a CD burner over a cup of coffee. ;) OTOH, maybe this is just the thing for people like us.

        Just a thought...

  • Waste? (Score:2, Redundant)

    by arvindn (542080)
    Why would anyone call their product waste? I thought it must be an acronym, since they've spelt it in all caps, but they haven't said what it stands for.
    • Go read Pynchon (Score:3, Interesting)

      by billstewart (78916)
      In "The Crying of Lot 49" [powells.com], which is a nice short fast spacy read, there's a plot thread about competing mail services and a conspiracy that conducts its private communications in a way that, if you refer to the name of the product as "waste" rather than "W A S T E", indicates you're clearly not part of their group. There are also email systems called "Trystero" for similar reasons, and it makes looking at post office boxes in Scandinavia quite silly even without sampling the local agricultural products.
  • Is Groove doomed? (Score:4, Interesting)

    by misuba (139520) on Thursday May 29, 2003 @03:49AM (#6065726) Homepage
    Resolved that: Gnutella aside, this technology is really a direct shot at Groove Networks, the company founded by Ray Ozzie of Lotus Notes fame to sell P2P-derived technology to small and large business.

    Discuss.
    • by reaper20 (23396) on Thursday May 29, 2003 @04:30AM (#6065854) Homepage
      If

      a) Groove was actually used by anybody and
      b) It wasn't such horrible software

      then I would say yes. Unfortunately Groove is a solution looking for a problem, and how many people get excited when you hear "designed by the guy that designed Notes."
      • Re:Is Groove doomed? (Score:2, Interesting)

        by misuba (139520)
        Well, that begs the question: what problem is Waste designed to solve? Who will use it?

        It seems to me that secure instant messaging and peer-to-peer file transfer between members of a distributed workgroup serves a real need. I can't imagine that Nullsoft would have developed this unless they saw a need themselves. Other solutions might technically already exist, but they don't appear to be as easy to install. (In that respect I could be wrong about VPN; I haven't looked into it.)

        It'll be interesting to s
  • Beep! (Score:2, Funny)

    Thanks for the link!

    On their site I found a program called Beep. It makes noises on keyboard/mouse input :-)

    http://www.nullsoft.com/free/nbeep

    It gets annoying after a while, but it is 'cute' enough to impress my girlfriend. And that matters as much as keeping my RedHat system up2date. LOL
    • Re:Beep! (Score:4, Funny)

      by millwall (622730) on Thursday May 29, 2003 @04:02AM (#6065766)

      "[...] It makes noises on keyboard/mouse input :-) [...] it is 'cute' enough to impress my girlfriend."

      Where do you find a girl that could be impressed that easily? No need for fancy restaurants or expensive gifts, just type on your keyboard and she goes mental.... nice!
  • well... (Score:2, Funny)

    by inkedmn (462994)
    as long as it has those uber-bitchin' skins, i'm in.
  • 1337 (Score:5, Funny)

    by houston_pt (514463) on Thursday May 29, 2003 @04:13AM (#6065801) Journal
    Listen port
    Listening on port 1337


    Somehow I think this is a very well chosen port... ;-)
  • by Isosonys (589846) on Thursday May 29, 2003 @04:18AM (#6065823)
    Did nullsoft do this to thumb its nose at Aol? It was released May 28th 4 years after Aol paid a nice sum to buy Nullsoft.
  • by malakai (136531) * on Thursday May 29, 2003 @04:29AM (#6065853) Journal
    put on your conspiracy hats...

    Think of it this way, these guys know probably better than anyone else NOT on the AOL IM team, just how much of IM conversations are monitored, logged, mined for information, media metrics...etc.

    Not to mention, they work in that environment, they prolly want to be able to say "god damn, our executive VP is a bitch" and not have some network engineer provide a log documenting that conversation later.

    Yeah, i wish it scalled, but wtf, its opensource. Go make it scale. For now, 10-50 is plenty for most groups of online friends.

    Personally, I'd loved to see technology like Pastry [microsoft.com] get hacked into it.

    -malakai
  • Linux port ? (Score:5, Interesting)

    by theefer (467185) * on Thursday May 29, 2003 @04:33AM (#6065861) Homepage
    How many minutes before we can see the first Linux port (it works under W$, FreeBSD and MacOS X) ?
    • Re:Linux port ? (Score:5, Interesting)

      by Kompressor (595513) on Thursday May 29, 2003 @06:12AM (#6066100)
      Closer than you think...

      I haven't used C in 3 years and I managed to get it to compile with a bit of hacking. As for stability, your guess is as good as mine...

      diff -r waste/Makefile.posix waste_port/Makefile.posix
      4c4
      < RSAOBJS = md5c.o nn.o prime.o r_random.o rsa.o
      ---
      > RSAOBJS = rsa/md5c.o rsa/nn.o rsa/prime.o rsa/r_random.o rsa/rsa.o
      7,8c7,8
      < CXXFLAGS = -O2 $(DEBUGFLAG) -pipe -march=pentiumpro
      < CFLAGS = -O2 $(DEBUGFLAG) -pipe -march=pentiumpro
      ---
      > CXXFLAGS = -O2 $(DEBUGFLAG) -pipe
      > CFLAGS = -O2 $(DEBUGFLAG) -pipe
      diff -r waste/connection.cpp waste_port/connection.cpp
      771c771
      < if (::getsockname(m_socket,(struct sockaddr *)&sin,(socklen_t *)&len)) return 0;
      ---
      > if (::getsockname(m_socket,(struct sockaddr *)&sin,(unsigned socklen_t *)&len)) return 0;
      diff -r waste/listen.cpp waste_port/listen.cpp
      85c85
      < int s = accept(m_socket, (struct sockaddr *) &saddr, (socklen_t *)&length);
      ---
      > int s = accept(m_socket, (struct sockaddr *) &saddr, (unsigned socklen_t *)&length);
      diff -r waste/srvmain.cpp waste_port/srvmain.cpp
      31c31
      < #include "md5.h"
      ---
      > #include "rsa/md5.h"
      diff -r waste/xfers.cpp waste_port/xfers.cpp
      812c812,814
      < if (!RemoveDirectory(s)) break;
      ---
      > // The below seems to be from the win32 API. I'll just comment it out and hope it doesn't break anything.
      > // Jordan R. Urie
      > // if (!RemoveDirectory(s)) break;
      • Re:Linux port ? (Score:3, Informative)

        by Bob Uhl (30977)
        According to Microsoft [microsoft.com], RemoveDirectory() removes the directory specifed in a C string. The directory must be empty, exactly as with the POSIX rmdir(). The return value is 0 if unsuccessful, non-zero otherwise; this is the opposite of rmdir(). So, it's better to replace that snippet with:

        if (rmdir(s)) break;

      • Re:Linux port ? (Score:3, Informative)

        by grazzy (56382)
        This code actually does work, with this patch you are able to both transfer files, connect, and chat.

        The tricky thing is to set up the server properly.

        The easiest way is like someone else pointed out to make a new profile in waste, (copy your own default.pr* files out of the way first).

        Then, add your public SERVER key to your public-key list in the windows-client. And add your public-windows-client-key to the list of keys of the server.. (default.pr3).

        Dont forget to NOT use a network name ( or make sure
  • AOL Time Warner... (Score:4, Interesting)

    by tolarianacademy (580638) on Thursday May 29, 2003 @04:41AM (#6065886) Homepage
    ...owns Nullsoft, (as already mentioned by leviramsy) but an interesting theory had been presented to me, suggesting that AOL Time Warner has for some time been planning to trump Apple's iTunes store. Maybe they are planning to power such a service with peer networking? I have never beleived this personally because AOL Time Warner would just as soon want to have everyone surfing from the same servers anyhow, and a decentralized system would only tax their bandwidth more. Maybe...maybe they will release such a service that utilizes both p2p transfers in combination with traditional server-to-client transfers, and maybe use it as an advertising platform for AOL, giving AOL users better functionality, or maybe even restricting server-to-client transfers to AOL users once the service becomes popular. Does anyone else think this idea is bogus? I find it hard to beleive, but I can't figure out how else Nullsoft could be /allowed/ to create this new service.
    • by afidel (530433)
      If I remember correctly Justin's contract basically gave him complete freedom from luser management as long as he didn't do anything illegal. Besides he got so much dough from AOL that he could just work on it at home and release it, though it would lack the Nullsoft name that obviously gets it more press. This would be pretty worthless from AOL/TW's perspective, for that they would probably want something like BitTorrent with user authentication.
  • by infonography (566403) on Thursday May 29, 2003 @04:43AM (#6065895) Homepage
    Here is the source [gnutenberg.net] for those who are wondering what it's all about.

    ---

    WE AWAIT SILENT TRISTERO'S EMPIRE.

  • "Waste" is such a user-friendly name. NOT!

    Another example of the marketing skill of technically minded people?
  • by cyberm_acc (676979) on Thursday May 29, 2003 @05:10AM (#6065980)
    I'm suprised no one has mentioned the obvious. This is a terrible blow to the RIAA and the all the people who have been trying to sue filesharers into oblivion.

    There are two uses I see for this:
    There are going to be groups of people dedicated to one theme, for example, Horror Movies, or Horror Movies with mutant bees, sharing all their Horror Movies, you will need a certain ammount of Horror Movie Uploads for Downloads and noone will ever be to know you had Queen Bee 1-3.

    If you replace Horror with new release you get lots of small miniDonkeys, many interconnected and unstoppable.

    I'm convinced this is a revolution in filesharing because it solves the two biggest Problems filesharing has, crappy downloads and getting sued.
    The downloads will be of really good quality beacause you will be sharing with friends of people you know from chatting and if the put crap in their upload directory they won't be one of your cirle of friends much longer.

    Getting sued is obvious, noone will be able to tell what you are doing (the might be able to guess that all those people on cable are not running a vpn yet) as just your circle of friends know. There is still the possibility that one of your friends is a traitor but i would call that a rare chance.
  • Getting it to work. (Score:3, Informative)

    by commonchaos (309500) on Thursday May 29, 2003 @05:12AM (#6065983) Homepage Journal
    Looks like you not only have to trade public keys with your friend, but somebody needs to have WASTE on a public IP with port 1337 open.
  • by Anonymous Coward on Thursday May 29, 2003 @05:50AM (#6066064)
    Is it called wasted ?
  • by Eminence (225397) <akbrandt&gmail,com> on Thursday May 29, 2003 @06:15AM (#6066102) Homepage

    WASTE is something that is indeed very useful for small company or teams (especially dispersed teams) in larger organizations. In many places one or another IM system is being used to communicate with team members. Over ICQ or AOL contracts and employment conditions are discussed, remarks about contractors and clients are passed etc. That is a huge security leak if you look at it from a certain prospective, especially for some profiles of companies like small consulting firms with employees regularly using clients networks. WASTE is a simple to use and free method of closing that leak.

    I know at least two small companies that should adopt WASTE immediately and I would advise them to do so. One is a PR company with 2-10 people offices around Europe, where ICQ is frequently used as a discussion medium. Other is a small consulting company. Someone eavesdropping on their ICQ chats could seriously damage both of them.

  • by tomstdenis (446163) <tomstdenis.gmail@com> on Thursday May 29, 2003 @06:18AM (#6066109) Homepage
    Oh darn. Looks like they used some homebrew crap for their bignum stuff.

    Common LibTomMath is like a billion times faster [not to mention very well tested]....

    Plug plug plug!

    http://math.libtomcrypt.org

    Tom
  • Looks great but... (Score:3, Interesting)

    by randomErr (172078) <ervin,kosch&gmail,com> on Thursday May 29, 2003 @06:29AM (#6066139) Homepage Journal
    The software looks great and installed like a dream but How can I test it?

    How can I point it at a node that will allow me to try it out? I ask this because what if someone is on the internet and needs to connect to me network. How do I point them to my network?
    • by tamagen (181519) on Thursday May 29, 2003 @08:29AM (#6066550) Journal
      You need at least one other client running somewhere.

      You both need to enter each other's public key into your client to get started. This step shows that you "trust" one another.

      Anyone else who wants to join your "network" must also enter one of your existing network members' public key into their client and have that existing member enter the new user's public key into *their* client. This step automatically makes the new person "trusted" by all the other members of the network - the important part is that you don't have to explicitly swap public keys with EVERYONE - just with one member of the network. The client does the rest once you connect to the network - see below.

      Now, to get started and initially connect to someone's machine, enter their hostname or IP address (not their "username") into the "Network" window. This primes your client - it will then discover all it needs to know about the other members of the network, since by default, each client will be broadcasting discovery information (usernames, hostnames, public keys).

      The "Browser" window shows all the users in the network, but currently ONLY if they are sharing one or more files. So, get each person who joins the network to share at least a test file so that they will always appear in everyone's "Browser" window.

      Right-click on any names in the browser window to start interacting with them.

      HTH

  • by JakusMinimus (49854) on Thursday May 29, 2003 @12:13PM (#6068237) Journal
    a link to the cleaned up code i am running: http://www.entheal.com/users/dweomer/waste-source- clean.tgz [entheal.com]

    my server's public key
    WASTE_PUBLIC_KEY 20 2048 entheal.com
    ABB44E9339FC6CE16A3C04A9D828AD3F6C78A 308FF66442E35B3F69C2CFC
    7AAF98FFFCE94A95E074C6B8F B8F46105A7575A5AB9CFBF9112E1AE13C02
    B7CFDA578CD7B 114A64E6B18D9F857BD982E741D2A214EE52878580B51DA
    4 081980FA0923244FA59D05FE314347384D23DBD58C736D71D6 D490EFD4D
    E3587D463D351236280BCAD18DD40F12D9F0DAF 6C3C88CAB2243A21B7A8D
    B0C89075685E12052263C6DD9EA 6809967A7D354037EF00F078E5E298DFC
    2E89E43AF161FCF B30B2B41873F0BB34706B4C8EF749B6A3E45135F9F08D
    FAF 6F684E29787ECE5FB0DFEBABF904C11327CE085F735C0D7E08 DE811B3
    04CEC56742090AA7A714497B9CEF1C35000301000 1
    WASTE_PUBLIC_KEY_END
    server name is entheal.com (you may have guessed from the public key ... )
    • If you are using gcc 3.2 as I am on Debian Unstable, you will probably need this patch:

      --- waste/Makefile.posix 2003-05-29 11:58:45.000000000 -0400
      +++ waste/Makefile.posix.new 2003-05-29 14:00:34.000000000 -0400
      @@ -8,7 +8,7 @@

      wastesrv: $(OBJS) $(RSAOBJS)
      - $(CC) $(DEBUGFLAG) -pthread -o wastesrv $(OBJS) $(RSAOBJS)
      + $(CC) $(DEBUGFLAG) -pthread -o wastesrv $(OBJS) $(RSAOBJS) -lstdc++

      clean:
      rm -f $(OBJS) $(RSAOBJS) wastesrv
  • by NerveGas (168686) on Thursday May 29, 2003 @12:33PM (#6068395)

    While on the surface, this might seem like a reinvention of IP tunnelling and VPN's, there are a couple of important features bundled in that set it apart:

    1. It turns each node into a router. While you can establish a VPN with other tool kits, you still have to enable and configure the routing manually.

    2. It's entirely user-land - it's a standalone program that a user can plop on their machine and be on their way.

    The best part about it is that you can get through firewalls. The worst part about it is that you can get through firewalls.

    Most people are pretty polar in their opinions of firewalls, with most of those people seeing them a fascist mechanism to control what they can see. In some (perhaps most) cases, that can be true. However, firewalls are much more than that: They can (and often are) used to protect YOU, the clueless end-user, from the other bad people on the Internet.

    After I clear out counters on firewall rules, it's not uncommon to see 10-20 (sometimes more) incoming attacks within 5 seconds.

    So, this will be great for letting people browse the web from work. On the other hand, it will expose them to propagation of worms and attacks which would have otherwise been caught by the firewall.

    Is this a good program? Overall, I think that it's a good thing that NullSoft created it. We simply need to realize that with all of the benefits it brings, it will also bring a few negatvies with it.

    steve
  • by Str8Dog (240982) * on Thursday May 29, 2003 @12:38PM (#6068435) Homepage Journal
    I threw up a forum for people who would like to list their public nodes here [str8dog.com]
  • by ntk (974) on Thursday May 29, 2003 @05:27PM (#6071068) Homepage
    I guess AOL found out again...
    • Well, all the pages about WASTE are 404 now, WASTE also disappeared from the list of software made by Nullsoft. But - as I said already here - it's already irrelevant, as the GPL-ed source is already mirrored around the world and will be worked on. Soon we will see ports and mutations of WASTE everywhere.

      Looks like the guys at Nullsoft learned from Gnutella...

  • Found a Mirror (Score:5, Informative)

    by Anonymous Coward on Thursday May 29, 2003 @06:16PM (#6071503)
    while perusing the winamp forums, I found a mirror:

    waste installer [blueyonder.co.uk]
    waste source [blueyonder.co.uk]
  • Waste Mirror (Score:3, Informative)

    by Freaek (11909) on Thursday May 29, 2003 @07:46PM (#6072215) Homepage

    Waste is here [sifnt.net]

    Contents of the file are as follows;

    waste - network architecture.htm

    waste - network architecture_files
    waste - security model and implementation.htm
    waste-setup.exe
    waste-source.tar.gz
    waste-source.zip

    This will be up until it's not. Enjoy! :)

    --Pete (peteg [at] sifnt dot net)

Our business in life is not to succeed but to continue to fail in high spirits. -- Robert Louis Stevenson

Working...