Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I'm a fan of Freenet, but it has some core (and extremely longstanding!) usability issues that Tor has proven are unforced errors.

The restrictions on JavaScript is the biggest one. The complete inability to run server-side code in a trusted context makes JS more necessary on Freenet than the HTTP web; it's absense makes developing a useful Freenet site extremely difficult. It causes interesting Freenet projects to be deployed as local applications (which necessitates auto-update to be practical). This represents an absolute trust of unknown service providers and is vastly worse than running untrusted JavaScript. It also makes maintaining parallel Freenet and HTTP sites impractical in practice (when only reader-side anonymity is needed), something Tor got right the first time.

Secondly, Freenet's JavaScript exclusion relies entirely on filtering code that's specific to Freenet and thus not anywhere near as battle-hardened as browser JS engines. You don't need a Chrome zero-day to circumvent Freenet's reader anonymity, you just need to find an edge case in its filtering code against the moving target of a self-updating browser.

Freenet's core feature of anonymous distributed hosting (as opposed to just Tor's distributed proxying and Bittorrent's bandwidth sharing) is still a relevant technological frontier that's long overdue to see the light of day, but that's not going to happen until it stops tilting at windmills on some of the crazier technical decisions.

Edit: While I'm complaining, I'm unclear on the real-world threat model that the friend-to-friend Darknet is supposed to protect against. Proving out that globally routable friend networks a la "The Crying of Lot 49" actually function is neat scientific accomplishment but it does nothing but help the Global Passive Attacker and probably makes things easier for more mundane threats too.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: