6 ms·
Trsst: a distributed secure blog platform for the open web
- walid 13y agoReminds me of App.net but with many price points and a Bitcoin twist. I hope they succeed because we need all kinds of new ideas experimented with.
- mpowers 13y agoOur thing is that we: (1) extend RSS to support self-signed/self-encrypted entries, (2) specify rest apis for http servers to exchange RSS entries (kind of like NNTP). We'll make a reference implementation, but we want and need many providers to experiment with price points and service options. More importantly, anyone can roll-their-own provider on their server.
- zeckalpha 13y agoTheir screenshots are of twitter.
- jcoder 13y agoWJW: https://s3.amazonaws.com/ksr/assets/000/499/002/9bbefc6069c00cab895ac177a63b8778_large.png?1365373759 https://s3.amazonaws.com/ksr/assets/000/499/002/9bbefc6069c0... A hand-drawn sketch of the planned UI would look less vaporwarey.
- mpowers 13y agoWell, it's a kickstarter, so it's by definition trying to get backing for a vaporware product. But fair point.
- mpowers 13y agoOur use cases are of Twitter too, so it makes a certain sense. We haven't designed the UX yet, but it's meant to convey the idea. That said, the architecture supports not only Twitter but FB-style friending and private group shares; we want to encourage different clients in different form factors, with the advantage being that they'd all interop. No more siloes.
- skore 13y agoYeah, sorry, all of that is irrelevant. You use somebody elses UI on your kickstarter. That is a terrible, terrible idea. It's an idea terrible enough that it will make people doubt your competence. For me, personally, "building strong crypto" and "lifting the twitter UI because too lazy to whip up some visualization of a simple roadmap" don't go together.
- mpowers 13y agoAgree, I yield. It's gone now.
- krcz 13y agoWhat programming language do you plan to use for the reference implementation?
- mpowers 13y agoJS on the client, and that's the important bit where all the crypto happens. Likely Java on the server, basically a drop-in servlet for any Tomcat, but still TBD.
- e12e 13y agoI hope you at least consider a java client as well, so there will be one implementation that is actually usable - as javascript and crypto doesn't mix (unless something is happening wrt api-support in the various engines/browsers? But then I guess you'd say html5, not "javascript"). Should be much quicker to develop a common library for use by the server and a (webstart) client - than to do two separate implementations? Also some of the code (and most of the interfaces) could probably be used on Android as well. If you are doing javascript wouldn't nodejs on the server make sense?
- mpowers 13y agoIf normal people are going to use it, it has to run in a browser, hence JS. There are working open source crypto libs in JS today, and kind of the nice thing about them is that they're not compiled, so (if unobfuscated) you can literally just inspect the source. That said, we plan to generate keys like bitcoin does, so there if you have a bitcoin library in your language of choice, that part is done. The server code will probably be less useful because there are so many choices, everyone's got their own preferences, and the server is pretty dumb compared to the client. Our leaning is to go with apache tomcat mainly because it's apache and it's widely deployed and, not least, it's what we use.
- tptacek 13y agoNo, you can't. It's a pervasive and harmful meme that JS crypto code is easy to inspect. But it's not: * If 100 different users are served the code, it's easy to pick 1 unsophisticated user out and serve them something different. * Even if your users are sophisticated, they effectively have to install the code every time they use it, so any inspection they did yesterday will help them not-at-all today * Browser Javascript code is influenced from all sorts of places across the DOM, meaning that you need element- by- element, attribute- by- attribute inspection of the entire page context (and this is before we get into things like caching) to have any clue what a piece of JS code might be doing * The browser itself offers you no mechanism to hash and verify the whole runtime, so there's no way to lock in a specific inspected cryptosystem; even if you have the SHA2 hashes for your crypto .js, you won't have it for every point in the DOM that can override methods in that code Leaning on browser javascript for cryptography is a bad idea that, I think, shows a fundamental disrespect for the security needs of actual real people who will be fooled into relying on it. I strongly advise you to go in some different direction.
- w1ntermute 13y agoHorrible name - please change it. People are going to have no idea how to pronounce that. Just because you were able to get a 5 character .com domain name doesn't mean you should use it for your new venture.
- byoung2 13y agoI guessed "tryst", but with a pun on RSS
- mpowers 13y agoIt's ending up either trust or tryst. Kind of like GIF vs. JIF. That said, we'd have probably half the mainstream press coverage without that name.
- wahsd 13y agoummm ... trust? I didn't find it that difficult. What does Facebook tell us about its service? Reminds me of a perpetrator log, which, I guess it has kind of revealed itself as with revelations that facebook is essentially a mass surveillance dossier system. But I get your point, it will need some marketing to get people to understand what it is all about. But it's not like we knew what Twitter was at first. Did we?
- w1ntermute 13y ago> But I get your point No, you don't. It's not a matter of understanding the meaning, it's a matter of pronunciation.
- talles 13y agoThe name is awful. What it stands for anyway?
- wahsd 13y agoTrust? Doesn't seem all that diffcult, especially with some marketing. Are you trying to say that Facebook and Twitter are better names?
- talles 13y agoI'm not trying to say anything besides the name is not really good IMO. But since you bring up, Facebook and Twitter are way better names. IMHO it is not a good name because: * Not obvious at first glance that means 'trust' * How do you pronounce that? just say 'trust', spell it or try to say it in some bizarre way with a mute 't'? * Doesn't look pretty For me the only good thing about the name is that is unique.
- fatbat 13y agoPlay on the word trust + rss? tRSSt?
- dholowiski 13y agoLooks like you posted this back on 8/18 as well. I guess you can get around the rules by adding/removing a # from the URL.
- mpowers 13y agoI didn't post this. But feel free to make unsubstantiated ad hominem attacks, because: the internet. :)
- ctz 13y ago'decentralized' yet needs $15000 PA for server hosting?
- walid 13y agoAs decentralized as WordPress. The project is open source.
- aray 13y agoSo why not start out as an open source project, then kickstart the hosting/etc after its been built and tested? Many open source software projects (some huge ones today) came out of the woodwork with no funding and little community support.
- mpowers 13y agoAgree, wordpress is an apt comparable. Some of the KS tiers are that we're providing hosting for early backers, so we need to provide hosting for early backers. The intent is to extend an existing standard, RSS, with an http protocol to support it. We need to one of many providers for the system to work as intended.
- pokstad 13y agoCreate a CouchApp. Problem solved.
- davignon 13y agoYou say backers would be opted-out "ads or sponsored posts if we ever have to resort to that". How would you implement ads in a decentralised, open standard?