[ahdinosaur]

hi gregknicholson, i'll try! =^.^=

Scuttlebutt is a social network platform where each uxer has a personal diary where each page is a signed message that links to the previous page. to receive updates on someone's diary, you follow the person. on each page, content is free-form. the most common message type is 'post', but there's a chat app (similar to Cabal) that uses message type 'scat_message': https://www.scuttlebutt.nz/applications#scat.

Cabal is a chat app, built using the Dat protocol (https://datproject.org/). Dat has a similar architecture, except the diaries (sigchains) are centered on content rather than people. so to receive updates on a diary, you follow the _content_, which in Cabal is a chat group similar to a Slack group.

[e12e]

I looked at the faq, but it's rather non-technical. Is there a security/privacy faq? My initial reading is that it's a lot like Twitter or things shouted out in a pub that films and archives everything that goes on? : no expectation of privacy, no secure private messages, no deniabilty?

Ed: looks like https://github.com/ssbc/scuttlebot/blob/master/README.md has a bit more meat. Still happy to hear any comments. Especially I assume any recipient can prove to a third party that someone said something?

[fenwick67]

The real meat of the protocol is explained here:

https://ssbc.github.io/scuttlebutt-protocol-guide/

> I assume any recipient can prove to a third party that someone said something

All public messages are signed with the author's key, so any third-party can verify it.

Private messages are different, though. You need one of the recipient / sender's keys to decrypt that, and so for a third-party to verify it they would need one of those private keys.

[ChristianBundy]

This was true until about 14 hours ago. :)

https://github.com/ssbc/secure-scuttlebutt/pull/220

You can now generate an unbox key for a private message send it to a non-recipient for them to be able to access the message, which is really cool. No private key sharing necessary!

[e12e]

That is cool. But the point stands that public (to all) and private (to designated recipients) messages are "on the record" and can forever be proven to be made by someone that held your private key at the time?

So if I say: "let's fight racism!" and you later decide to collaborate with a (now) racist government - you could prove (not merely allege) that I should go to the gulag?

[ahdinosaur]

hi e12e,

yes, on-chain messages are designed to be "on the record" (https://viewer.scuttlebot.io/%25G7BjZsZr02TPAoIeD%2Bw3WgiAbi...), where the game theory is of an infinitely-repeated game (https://en.wikipedia.org/wiki/Repeated_game#Infinitely_repea...) where participants have verifiable knowledge of past game activity, which is useful for trust-based coordination.

our plan is to eventually add a side protocol for off-chain ("off the record") messages which re-use the same cryptographic identities, for all your other conversations. :)

[dmos62]

I too find it a bit discouraging that my data would leak away to the whole network eventually. I'd like to have "an island" (I believe this metaphor was used in some docs) to myself and those close to me. Or maybe I haven't yet grasped how SSB works.

[ahdinosaur]

hi dmos62, Scuttlebutt is designed to allow users to create social communities with trust-based boundaries, but there's just a lot of work to do to bring our implementation up to match our intentions. for example here's a recent step in that direction: https://github.com/ssbc/ssb-incoming-guard.

[EGreg]

How does discovery happen in Cabal or in Scuttlebutt?

Does it use any kind of DHT like Kademlia? I know you want to avoid singletons but are there any hubs that are DHTs or what? How does discovery work? And do you support Web Push?