Hacker News new | ask | show | jobs
by travisluis 2829 days ago
Can anybody explain the important differences between this and Briar/Bramble[1]?

[1] https://dymaxion.org/essays/briarvision.html previously discussed at https://news.ycombinator.com/item?id=18027949

1 comments

How does Scuttlebutt (and Briar) relate to [Cabal]?

[Cabal]: https://cabal-club.github.io/

There seems to be a large overlap between the SSB and Cabal communities.

hi gregknicholson, i'll try! =^.^=

Scuttlebutt is a social network platform where each uxer has a personal diary where each page is a signed message that links to the previous page. to receive updates on someone's diary, you follow the person. on each page, content is free-form. the most common message type is 'post', but there's a chat app (similar to Cabal) that uses message type 'scat_message': https://www.scuttlebutt.nz/applications#scat.

Cabal is a chat app, built using the Dat protocol (https://datproject.org/). Dat has a similar architecture, except the diaries (sigchains) are centered on content rather than people. so to receive updates on a diary, you follow the _content_, which in Cabal is a chat group similar to a Slack group.

I looked at the faq, but it's rather non-technical. Is there a security/privacy faq? My initial reading is that it's a lot like Twitter or things shouted out in a pub that films and archives everything that goes on? : no expectation of privacy, no secure private messages, no deniabilty?

Ed: looks like https://github.com/ssbc/scuttlebot/blob/master/README.md has a bit more meat. Still happy to hear any comments. Especially I assume any recipient can prove to a third party that someone said something?

The real meat of the protocol is explained here:

https://ssbc.github.io/scuttlebutt-protocol-guide/

> I assume any recipient can prove to a third party that someone said something

All public messages are signed with the author's key, so any third-party can verify it.

Private messages are different, though. You need one of the recipient / sender's keys to decrypt that, and so for a third-party to verify it they would need one of those private keys.

This was true until about 14 hours ago. :)

https://github.com/ssbc/secure-scuttlebutt/pull/220

You can now generate an unbox key for a private message send it to a non-recipient for them to be able to access the message, which is really cool. No private key sharing necessary!

That is cool. But the point stands that public (to all) and private (to designated recipients) messages are "on the record" and can forever be proven to be made by someone that held your private key at the time?

So if I say: "let's fight racism!" and you later decide to collaborate with a (now) racist government - you could prove (not merely allege) that I should go to the gulag?

How does discovery happen in Cabal or in Scuttlebutt?

Does it use any kind of DHT like Kademlia? I know you want to avoid singletons but are there any hubs that are DHTs or what? How does discovery work? And do you support Web Push?