Nullsoft's Waste: Encrypted, Distributed, Mesh Net 674
Myriad writes "Nullsoft, makers of the venerable Winamp MP3 player, released today a secure, distributed mesh-like networking protocal and platform called Waste. This v1.0 beta release uses RSA (key based) and Blowfish encryption for security, and features Instant Messanging and group chat, along with file browsing, searching, and transfer. Waste has been released under the GPL, with source and binaries available here."
JabberIM does this (Score:1, Interesting)
We already have JabberIM [jabber.org] which does this and at the same time provides tunnels to other IM networks.
Five minutes later (Score:5, Interesting)
Download and mirror this (Score:2, Interesting)
License? (Score:0, Interesting)
Worse, there is an "rsa" subdirectory, and the files in there all say they are copyright RSA Data Security, and all rights are reserved. Worse, the MD5 source files contain a license that is incompatible with the GPL.
I'd stay away from waste until they straighten this stuff out.
Re:I have to ask.. (Score:3, Interesting)
Is Groove doomed? (Score:4, Interesting)
Discuss.
Re:Download and mirror this (Score:5, Interesting)
+4 RTFA [nullsoft.com]! more like it.
And I blockquote:
So this isn't really a thing like gnutella. It's an enterprise product. As other posters have noted, it could conceivably be used to share (AOL-TW) copyrighted works, but that doesn't seem to be anywhere near it's main purpose. Heck, AOL is probably releasing the core technology as OSS to get the community to shake it down for bugs, in anticipation of releasing a commercial product built on top of the protocol. Kinda like how Apple has worked on open source technologies like zeroconf, and released commercial products like rendezvous built on the technology.4 years later May 28th (Score:5, Interesting)
Go read Pynchon (Score:3, Interesting)
Re:Five minutes later (Score:5, Interesting)
Once you've set it up for a firewall, the f/w effectively vanishes inside the VPN. A friend and I struggled with firewall configs for years tweaking for the game of the day. Enter VPN, and now we have a private TCP network without firewalls. Any game supports that, no reconfiguration required.
The other thing is that it is built into w2k (my gaming platform of choice) and XP (friends platform). This means you can be up and running after reading some quick instructions on setting up the server, your shares (properly!), forward one TCP port (yes, only one) from your firewall to desktop, and that's it forever.
Add an uber-IM like Trillian, and that's all you will ever need.
As for the "What's the point" question... (Score:5, Interesting)
Think of it this way, these guys know probably better than anyone else NOT on the AOL IM team, just how much of IM conversations are monitored, logged, mined for information, media metrics...etc.
Not to mention, they work in that environment, they prolly want to be able to say "god damn, our executive VP is a bitch" and not have some network engineer provide a log documenting that conversation later.
Yeah, i wish it scalled, but wtf, its opensource. Go make it scale. For now, 10-50 is plenty for most groups of online friends.
Personally, I'd loved to see technology like Pastry [microsoft.com] get hacked into it.
-malakai
Linux port ? (Score:5, Interesting)
AOL Time Warner... (Score:4, Interesting)
Here is the full source (Score:3, Interesting)
---
WE AWAIT SILENT TRISTERO'S EMPIRE.
Re:Yes, it's GPL and it says so... (Score:3, Interesting)
Re:Is Groove doomed? (Score:2, Interesting)
It seems to me that secure instant messaging and peer-to-peer file transfer between members of a distributed workgroup serves a real need. I can't imagine that Nullsoft would have developed this unless they saw a need themselves. Other solutions might technically already exist, but they don't appear to be as easy to install. (In that respect I could be wrong about VPN; I haven't looked into it.)
It'll be interesting to see whether Waste follows the path of Groove in the respect of becoming a platform, and providing an API for others to develop new tools.
Revolution of Filesharing? (Score:5, Interesting)
There are two uses I see for this:
There are going to be groups of people dedicated to one theme, for example, Horror Movies, or Horror Movies with mutant bees, sharing all their Horror Movies, you will need a certain ammount of Horror Movie Uploads for Downloads and noone will ever be to know you had Queen Bee 1-3.
If you replace Horror with new release you get lots of small miniDonkeys, many interconnected and unstoppable.
I'm convinced this is a revolution in filesharing because it solves the two biggest Problems filesharing has, crappy downloads and getting sued.
The downloads will be of really good quality beacause you will be sharing with friends of people you know from chatting and if the put crap in their upload directory they won't be one of your cirle of friends much longer.
Getting sued is obvious, noone will be able to tell what you are doing (the might be able to guess that all those people on cable are not running a vpn yet) as just your circle of friends know. There is still the possibility that one of your friends is a traitor but i would call that a rare chance.
Re:Hmmm.... (Score:1, Interesting)
Re:Download and mirror this (Score:5, Interesting)
Re:They already fixed Winamp, whiner (Score:4, Interesting)
I know many people do feel the way I do, talk to most people who have tried 3.0 or even go to their website and see people bitching about it. Winamp is the most used player in windows, second only to WMP, though I wouldn't be surprised if more used. To stop trying to make a decent product and ignore the problems will cause them to loose their marketshare and thus make them worthless, not a very good business model if you want to be around to do other things like protocols.
Also I don't think many people care about this protocol, sure the paranoid types might, but this is very much something most people could care less about.
Also I in no way have said they are obligated to do anything. I was just pointing out how they have gone from something good to complete crap. I don't belive companies own anyone anything unless there was some deal which requires them to.
I doubt it was done in spare time, if it was employees doing something it was during work time, and if there are things that need to be done to your product you don't have "free time" . Free time is when there is nothing you should be doing.
Nullsoft is a company. Time is money for them. Users are money for them. Being a company that gives product away for free, the balance of keaping them is huge. If no one goes to your sight and clicks on ads and so forth they are done.
One last thing, they haven't fixed jake shit. winamp 3 is broken, go to their sight, winamp 3 is what they are advertising. Making updates to an older product is not fixing. To be fixed means they got all the issues sorta out with 3.0 .
Re:Yes, it's GPL and it says so... (Score:3, Interesting)
Now if you can just explain away the RSA code that has the license that is incompatible with the GPL, everything will be fine.
Re:License? GPL (Score:3, Interesting)
I goofed, and grepped for "gpl". "gnu" would have been a better grep term.
However, there's still the rsa directory, which contains stuff not compatible with GPL. (Which puzzles me...since waste is GPL'ed, why didn't they use gmp for the math, or whatever gpg uses?)
Everyone invented Gnutella (Score:5, Interesting)
I personally came across it when removing a section of my P2P anti hacking designed for Diablo 1 to be secure even without a central server.
Interestingly enough, I was going to call my Gnutella: Dumpster
Which is cool they're naming their software: Waste
Lets see how it turns out
Re:Linux port ? (Score:5, Interesting)
I haven't used C in 3 years and I managed to get it to compile with a bit of hacking. As for stability, your guess is as good as mine...
diff -r waste/Makefile.posix waste_port/Makefile.posix
4c4
< RSAOBJS = md5c.o nn.o prime.o r_random.o rsa.o
---
> RSAOBJS = rsa/md5c.o rsa/nn.o rsa/prime.o rsa/r_random.o rsa/rsa.o
7,8c7,8
< CXXFLAGS = -O2 $(DEBUGFLAG) -pipe -march=pentiumpro
< CFLAGS = -O2 $(DEBUGFLAG) -pipe -march=pentiumpro
---
> CXXFLAGS = -O2 $(DEBUGFLAG) -pipe
> CFLAGS = -O2 $(DEBUGFLAG) -pipe
diff -r waste/connection.cpp waste_port/connection.cpp
771c771
< if (::getsockname(m_socket,(struct sockaddr *)&sin,(socklen_t *)&len)) return 0;
---
> if (::getsockname(m_socket,(struct sockaddr *)&sin,(unsigned socklen_t *)&len)) return 0;
diff -r waste/listen.cpp waste_port/listen.cpp
85c85
< int s = accept(m_socket, (struct sockaddr *) &saddr, (socklen_t *)&length);
---
> int s = accept(m_socket, (struct sockaddr *) &saddr, (unsigned socklen_t *)&length);
diff -r waste/srvmain.cpp waste_port/srvmain.cpp
31c31
< #include "md5.h"
---
> #include "rsa/md5.h"
diff -r waste/xfers.cpp waste_port/xfers.cpp
812c812,814
< if (!RemoveDirectory(s)) break;
---
>
>
>
It's a really useful tool for business too (Score:5, Interesting)
WASTE is something that is indeed very useful for small company or teams (especially dispersed teams) in larger organizations. In many places one or another IM system is being used to communicate with team members. Over ICQ or AOL contracts and employment conditions are discussed, remarks about contractors and clients are passed etc. That is a huge security leak if you look at it from a certain prospective, especially for some profiles of companies like small consulting firms with employees regularly using clients networks. WASTE is a simple to use and free method of closing that leak.
I know at least two small companies that should adopt WASTE immediately and I would advise them to do so. One is a PR company with 2-10 people offices around Europe, where ICQ is frequently used as a discussion medium. Other is a small consulting company. Someone eavesdropping on their ICQ chats could seriously damage both of them.
Looks great but... (Score:3, Interesting)
How can I point it at a node that will allow me to try it out? I ask this because what if someone is on the internet and needs to connect to me network. How do I point them to my network?
Re:They already fixed Winamp, whiner (Score:1, Interesting)
Re:They already fixed Winamp, whiner (Score:3, Interesting)
Key exchange (Score:5, Interesting)
"Initial connection to the mesh requires manual key exchange. PITA, but moderatley secure."
IIRC, key exchange is where most encryption schemes fall down. If this ever takes off I'd guess 99% of users will trade keys over plain ol unencrypted SMTP.
Nice summary though - this really does look interesting.
Re:It's a really useful tool for business too (Score:1, Interesting)
It arguably is worse than plaintext, as it gives people the impression that the conversations are secure when the truth is that they are nothing of the sort
Re:AOL Time Warner... (Score:3, Interesting)
Re:For readers of Pynchon. . . (Score:5, Interesting)
Now I've never read the book, but I'd say in an underground postal system every person in the system has to be trusted. Much like this protocol -- each node in the network needs to be trusted.
You have to build your own little underground network with a few trusted friends. This reminds me a lot of the pirate BBS days
This system allowed for only quality 'warez' files because everyone who was allowed to trade files had to be trusted, and therefore they weren't going to damage their reputation by sending crap like you get on P2P nowadays like incomplete packages or stuff that said it was one thing, but really was another thing. Back when trading pirated software was more like a gentlemen's agreement and not the 'o-D4Y \/\/4R3Z!!!!' crap pimply-faced teenagers with nothing better to do do today.
On the other hand, one has to think, 'Who needs it?' Most of us who were in that community back then have merged in with the Open Source community today and if we trade software at all it's with a CD burner over a cup of coffee.
Just a thought...
Re:Hmmm.... (Score:1, Interesting)
That was the day I started seeing NullSoft ads appear in there... *HMMMM*
Re:Interesting (Score:2, Interesting)
I don't see anything wrong with that -- they're a business, after all.
Re:I have to ask.. (Score:1, Interesting)
posting anonymously for obvious reasons:
The unofficial amusing diversion (when things were slow) for members of the security team of the Fortune 100 organization I worked for was to read people's IM conversations that were logged by our IDS. Whether they're being routed through AOL or Microsoft or Yahoo, they're plaintext transmissions to and from a few very well-known port numbers. Think about that the next time you're telling John/Jane exactly which part of them you'd like them to insert in which part of you, and you bring the whipped cream and they'll supply the ball gag, etc. Do you really want the geek sitting at the firewall desk reading that?
Re:Hmmm.... (Score:2, Interesting)
Re:Hmmm.... (Score:4, Interesting)
There is no reason to call it that. It is a communication tool that tries not to leak information. I would encourage RIAA members to use it themselves, to better secure internal conversations against unintentional leakage. I'm sure "they" send files to each other via email from time to time. Isn't this better? What's not to like?
As a long time cypherpunk, I'm glad this is here. Way back in '94, I wrote out a model of this sort of thing, but with decent routing and key exchange, and then got busy working for money. I'm glad someone is doing this, even if it doesn't work on a larger scale.
Please flame the evil cypherpunk vision below.
Re:name "Waste" -- Pynchon's The Crying of Lot 49 (Score:5, Interesting)
Re:Gnutella (Score:5, Interesting)
the reason why winamp 3 sucks so much, is because it's written by some other guy. justin isn't even in the credits of winamp3
Re:name "Waste" -- Pynchon's The Crying of Lot 49 (Score:3, Interesting)
Nevertheless, it's a great name choice....
Re:The Right Hand Knows (Score:3, Interesting)
I run a small network in my apartment with my roommates, and we all have various versions of windows, and some computers are "homed" on a different domain, especially if a friend brings his work laptop over during a lan party.
In these kind of environments, windows file sharing seems to be much more hassle than it's worth. On Win2k, it seems like it's a 10 step process just to share a folder. Even after that, it can take one or two minutes just to navigate the windows network to get to the other computer (why is this so slow anyway?).
Sometimes I've gotten so frustrated with it that I'll skip all the windows sharing BS and just upload the files to an FTP site hosted somewhere else on the internet, then have my friend, who is only 10 meters away from me and on the same private network as me, ftp it back down.
Sure, I could put my own ftp server on my machine, but that is too much hassle for a one-time use.
With something like this, it looks like it might be a quick and easy way to do file sharing that sounds a lot safer than most of the the simple alternatives...
Re:What no LibTomMath for bignum RSA? (Score:2, Interesting)
Here, tell the WASTE folks instead: http://forums.winamp.com/forumdisplay.php?forumid
Re:Gnutella: Ouch this is gone also (Score:3, Interesting)
Coincidentally, see also this lecture on this history of Gnutella [cf.ac.uk] (warning: PDF), or its handy Google HTML-ized version [216.239.51.100].
Jouster
Has WASTE been removed from nullsoft ? (Score:3, Interesting)
Both the Download Page [nullsoft.com] and the Security Page [nullsoft.com] aren't accessible.
This bring the question of whether WASTE have been removed from nullsoft.com, or not?