Why Freenet is Complicated (or not)

JohnBE writes "'This article is primarily a friendly rebuttal to Steven Hazel's CodeCon 2002 talk entitled "libfreenet: a case study in horrors incomprehensible to the mind of man, and other secure protocol design mistakes". Hazel presents the Freenet protocol as an overly complicated, self designed crypto layer. In fact, though somewhat complicated, literally every step in the protocol was carefully thought out to resist certain attacks and to increase certain properties desirable for Freenet operators and the network as a whole.' Interesting in light of Peek-a-booty, this article covers many of the issues involved with creating a anonymous P2P system."

A little honesty is refreshing sometimes

(from the article) ...
Some perceived minor irritations may arise due to the implementation of Freenet in Java. Java is not like C, so some porting issues are bound to arise. Porting is hard sometimes.

Re:A little honesty is refreshing sometimes

In paragraph specifically mentions that the security model is overly complicated. For comparison...

Microsoft's argument for a long time was that Java's security model was overly complicated. ASP, by contrast, had a simplified security model. Either an ASP executes scripts locally, or it doesn't. Thus ASP does have a simple security model.

Now... which security model will be suitable for your projects? Which security model is potentially better for the client browsers?

I am extremely familiar with freenet and I can tell you that the current security model is very *robust* yet I feel that it is very streamlined. By contrast, napster's security model was simple. So Mr. MP3 Pirate, which security model would you prefer? Do you want to continue to enjoy music or would you rather get nasty letters from the MPAA/RIAA and get your cablemodem shut off.

Oh the joys of cross-posting

http://www.kuro5hin.org/story/2002/2/17/203032/375 [kuro5hin.org]

I could have sworn I read this verbatim before

http://www.kuro5hin.org/?op=displaystory;sid=2002/ 2/17/203032/375

It would have been nice for the person who submitted the article to at least include the link to the article that paragraph came from...

Until...

...we can find the latest Britney Spears album, complete with high-res cover scans and 320kbps MP3s, I highly doubt Freenet will catch on. It's already surpassed by Morpheus and Gnutella in terms of users. The thing preventing Freenet from gaining wide acceptance is, for sure, the fact that mysterious files which you have no knowledge of their content, are automatically downloaded to your shared directory. This of course helps other people, including people you don't want to help.

An Overview of Freenet

Here's a quick overview of Freenet, if you need to get up to speed. [nus.edu.sg]

War was beginning

All your freenet are belong to us

Kuro5hin artical as well.

This was also posted [kuro5hin.org] to another scoop site, kuro5hin :)

For those of you who care, Ian Clark also commented on the story himself(1 [kuro5hin.org] 2 [kuro5hin.org] 3 [kuro5hin.org] 4 [kuro5hin.org] 5 [kuro5hin.org])

Freenet is not complicated

When you compare it to stuff like gnutella, mojonation and others, freenet is about average.

Freenet's not hard to write programs for at all, Freenet itself is whats complicated.

Currently I know C, VB, and I'm learning Java.

Freenet is not that complicated. Its just not documented as well as it could be.

Re:Freenet is not complicated

I can't really comment on mojonation as last time i checked they didn't have any real documenation on how it actually worked, but Gnutella is way simpler then Freenet.

I wrote a gnutella client in one night, when gnutella first hit the net people had already figured out the protocol and we're writing clients for it within days. There are only about 5 different commands in Gnutella, i have no idea how many freenet is. But i have attempted to understand more then just a high level concept and found the details to be confusing as all hell.

anyway,

-Jon

Freenet...

Possible the only network with a higher Porn : Non-Porn ratio than the Internet itself :P

Digital Cable

Do these things work with digital cable? Most of the coolest stuff on HBO, Showtime, MTV2 is really only available with digital cable. Would these things work with that?

Anonymous P2P systems

If you wish to read about well-designed anonymous P2P systems, look at Crowds (similar design to Pick-a-Booty, years earlier).
Anonymity has many more uses: censorship resistant systems often use anonymity. See, for example Free Haven or the following article on a new design
http://www.cl.cam.ac.uk/~aas23/Anon_p2p2.ps

Please tell me why...

I'm not sure why I would want to install freenet on my system. From what I understand, basically I'm expected to download and install this software and give a certain amount of my own bandwidth and disk space over to the network. I have no way of knowing what's stored on my hard disk and being downloaded from me. I've peered through a key list for freenet and it seems most of the data is porn. You might accuse me of being alarmist but i'm fairly confident a good amount of that will be illegal porn (underage, etc) otherwise it would be on the web somewhere.

So now I've paid money to buy bandwidth and disk space to set up a porn server, and I'm not even getting ad revenues.

As for protecting speach, couldn't a government just make the freenet software itself illegal if it wanted to?

I can't see it really catching on - apart from a few paranoid "lone gunmen" types and comic book store guy, who's it going to appeal to?

Just a question.

James

With regards of duel posting.

Here [freenetproject.org] is the original post, on the Freenet homepage about the Infoanarchy piece, as to whether it was posted on Kuro5hin or InfoAnarchy, read either, it doesn't matter. At the above link is an MP3 file of the original cited speech [dnalounge.com] (at Codecon [codecon.org]).

The problem with Freenet...

... doesn't lie in its protocol or security, but in its inconvenience to users. Information simply disappears off of the network, making it almost impossible for regular use. While it was not designed for sharing music and porn, thats what most people think p2p networks are for these days. As a result, the oppressed people that the project was designed for can't use the system. The initial concept that one cannot store information on their system was good, but is being abused by too many people. There simply are not enough permanent connections with enough disk space to support the current incarnation of Freenet.

The second problem is the inability to find information. Even if it does exist, very few people know how to find it. Until the key indices are completed and a uniform naming system is accepted, information will just sit there, and be as good as lost.

I apologize for this being somewhat offtopic and please correct me if either of these problems have been solved. I'd really love to see Freenet take off, but it seems that it may be dead on arrival being too difficult to use for end users.

Freenet overall...

I really like Freenet overall and thought a while about putting my new HP up as a freesite. I didn't do it for minor reasons. Anyway I think it is a great project and put all my (big)file releases up as a public KSK, simply beacuse it's a good, clean and simple way to share files.
The main problem is that it will never gain popularity. Freenet has mainly two target audiences: The file-sharing community (WareZ Groups etc.) and the people, who like the Idea of browsing anonymously.
Until now Freenet has no popularity in both areas. The egoistic WareZ Groups don't even think about using Freenet, eventhough they really should contribute more to OpenSource projects, because they are the ones using them really heavily (think of LAME, MPEG2Decoders, etc.), and stick with old/insecure/closed Technologies like FTP, IRC and EDonkey.
Maybe all this would get better if we all start advertising freenet a bit more wherever we hang around (Boards, IRC, Weblogs) and promote it as a fast, secure, anonymous, stable, easy way to share files.

GnuPG???

Why not? GPG [gnupg.org] works pretty well already and is distributed under GPL, so why re-invent the wheel?

I still can't beleive that encryption, digital signatures and random key generators can be both fast and secure in Java...

- Benad

Freenet Trademark

Has anyone dealt with the problem that Freenet is trademarked by some univesity that was responsable for the original community network software that runs places like the National Captial Freenet (ncf.ca), and similar sites?

ttyl
Farrell

Re:Freenet is not perfect!

I must say I agree in every respect. I've written a few apps in the past working on the fproxy level and I was stunned by the (lack of) quality of the documentation. Things like not labelling that numbers are hexadecimal (watch out for that one) or just plain mis-information. I have however found the Freenet team to be quite responisive to direct questions. But in the end it was too much of a pain and I gave up. The program worked OK enough though (for its purposes).

I agree

I also think if freenet were written in C, it would have far more developer support.

Documentation is lacking and that doesnt help, what also doesnt help is using java, Freenet barely works on Linux and MacOSX.

C would have been the language of choice simply because more people know C than java, porting would have been faster.

As far as the freenet project going down, someone needs to port freenet to C right now, if its ported to C people will develop for it.

While I konw C, i dont know java. Alot of people would like a freenet DLL for windows from which they could do somethinng like write a vb app front end for the freenet backend. This would make freenet more popular for windows.

I dont know, I disagree about the freenet developers not knowing how to code, they code way better than me, they dont seem to document anything, they dont have a status page, they rarely use the mailing lists and talk too much on frost, communication skills would help.

I think freenet has come far, I think with alittle more support, perhaps some kinda sponser or from donations, or if they make it easier for people to contribute code, freenet will be a success.

Right now freenet is just too underground and esoteric for normal programmers to deal with.

Re:At least quote who you stole it off

This was posted two hours before on Infoanarchy. I don't understand why people don't understand single quote marks.

Re:Java sucks and I'll prove it.

I have millions+ customers being server on a handful of java programs. The only problem I have is jvm for Solaris seems to leak memory, so we load balance and restart the java processes once a day. We did it once a month, but decided to make it nightly to be safe with the high volume of traffic. (And sys-admins are lazy!)

Most times its not the language that's the problem, its the environment, either os bugs, or some other software incompatibility.

Java seems to be fast enought for realtime mission critial apps, so stop the fud.
-
Courage is resistance to fear, mastery of fear - not absence of fear. - Mark Twain (1835 - 1910)

Re:Why Freenet is complicated

Yeah, crypto is easy. Knowing what a "CHK" is without looking it up is easy. Figuring out how to stop Man-in-the-middle attacks is easy. Solving the initial node announcment problem is easy. It's just that gosh darn Java that is getting in the way.

Incedently, there are many people working on a GCJ-compiled Freenet, which would allow you to run a Java node as a native program. Why don't you go help them out instead of whining on Slashdot?

Re:Freenet is not perfect!

I agree with you in respective of the "fuck you" attitude of the developers, that is their perogative, but I think it is counter productive to one of their goals which is widespread acceptance.

I really beleive that good documentation coupled with good code is the reason that some projects prosper and others fail. Maybe they have the balance right, the system is ludicrously easy for Windows users now. [freenetproject.org] On the plus side:

They have a Wiki system on their homepage which allows you to add to the documentation easily (had this been available 6 months ago I would have)

The code is nearing a stable level (Datastore bug gone)

Usefull non-Pr0n applications are been developed such as Frost [sf.net].

Re:Freenet is not perfect!

...the sheer complexity of what is achieved by the current Freenet codebase would make most software engineers give up before they had started. Connection pooling, real-time unwrapping, progressive hash checking, splitting, and rewrapping of encrypted streams, incorporation of a servlet architecture, threadpooling, unit tests, the list goes on, this is a massively sophisticated piece of software, the code is well commented, and as soon as the inter-node protocols are finalized, they will be documented (in fact, Adam Langley is working on this as we speak). Yes, the code and protocol are complicated, but no more-so than they need to be.

Just to insert my $0.02 on this statement. While I think that Freenet is spiffy, and the work is great, judging programmers skill by what they produce is not always the best method. Please note I am not talking about the Freenet developers here.

I strongly believe in the million monkeys principle. I have seen code that was written by a team of people that expanded over 150K lines to do some amazing things. But the code was shit. You could tell the programmers did not have a grasp on not only how to write what they wrote, but even on common agreed-upon design and implementation principles.

The result: a rewrite bringing it to 57K lines and utilizing a tremendously lesser amount of memory.

The code when we got it was really phenominal. It did a lot, but had a lot of problems under the hood.

Judge a persons ability by the quality of code, not the features they produce.

Re:Freenet is not perfect!

> Those of you who've seen the
> freenet code will most likely agree with me, that
> many of the freenet developers couldn't code their
> way out of a wet paper bag.

I remember looking at Scott Miller's code on Gamora and feeling like, "Wow, this is the most elegent OOP code I've seen in the wild". Most code really sucks, especially if it's written in an OOP language and gets to be more than a few thousand lines.

Very few people could make the concept work in those days when Design Patterns was still new. Scott was one of those people and it looks like he's still an active developer. So, while I agree with the other statements in your comment I must disagree with the snipe about the coders not being any good.

Re:Java sucks and I'll prove it.

Why do I feel the need to defend java on slashdot? Here I go again:

Java is slower than C, yet less powerful than C++.

Yeah, that's a testable statement. Most of java's use is network-bound programming, where pure speed isn't an issue, but it's excellent networking library is a benefit. No one is coding an OS in java.Add to this the fact that java 1.4 is on part (except for GUIs) with C++, and you have no speed issue.

Java is portible but so is C#, C, C++.
Java is binary portable which is a huge advantage. I can take compiled code from one architecture, and run it on another. Do that in C or C++. Hell, you can't even run a complete C# program in solaris now, so much for the common run time.

Java currently doesnt seem to be a match for C#

Is that why C# is an almost exact syntatic copy of java? Is that why the architectures and security models are almost the same? Which language has more users now? Which actually has deployed code running in production?

Java is ok, but i have yet to see a successful project written in java.

Have you heard of Tomcat? That's a moderately successful java project. Also, many real businesses use java on the web layers. I guess those don't count as 'successful projects', but they should count for something. The fact that there are relatively few java projects has more to do with the open source community being stand-offish regarding java, and not with language faults.Just posted on slashdot a couple of weeks ago: Root Node Live, which is a java project (brought to you by konspire) helps people trade jam-band music.

Re:Java sucks and I'll prove it.

What about ArgoUML [tigris.org]? It's written in Java and I'd say it's successful....

Re:Freenet is not perfect!

So YOU'RE the phish!

Re:Freenet is not perfect!

In-case you are thinking how unreasonable it is for us to create a reference implementation before we document the protocol, note that the only reason everyone uses the BSD reference implementation of the TCP stack is that the TCP specification isn't worth the paper it is written on!

Every major operating system (Solaris, Linux, Windows, BSD) has an independant implementation of TCP. None of them share significant code, each was designed with different goals. Every one of these implementations is validated against the standard, which spans multiple RFCs. The entire Internet is held from congestion collapse by cooperation amongst these implementations.

What are you talking about?

ALERT /. EDITORS: Stolen comments

Just thought that people should know that this comment and its parents were copied from here [kuro5hin.org] on Kuro5hin, and at the very least, this reply does not belong to the person who posted it here (since I wrote it myself).

While the comment obviously deserves the score, I really don't think that those who posted them deserve the karma for posting other people's work unattributed. Perhaps if one of Slashdot's editors reads this, they can take appropriate action.

Re:Just tried it out

The longer you use it the faster it gets. [unfourtunately] You will have to open the port that handles FCP request (default 8888 IIRC) on your firewall (don't run the Freenet.jar as root, nor your JVM), after 1-2hours live requests are pretty fast (within 20 seconds) even on this crappy 56k modem that I'm using.

Re:not the freenet but..

All of the above are fixed, bar the inability to work behind a firewall, but I guess that's an act of God/R00T.

Re:Why Freenet is complicated

As a previous node operator and development mailing list lurker, I can tell you that shitty VMs account for half of Freenet's problems. When you write in C, you don't have to put up with a VM.