What does HackerNews think of i2pd?
🛡 I2P: End-to-End encrypted and anonymous Internet
For anyone wondering what we're talking about:
https://geti2p.net (Official Java implementation)
https://github.com/PurpleI2P/i2pd (C++ implementation)
The unfortunate thing is that, as far as I'm aware, I2P doesn't have a "Tor Browser" of sorts, and most people would want to use I2P as a clearnet proxy; the audience for I2P may always be significantly less than that of Tor even if it was revealed that Tor was totally flawed.
I think that I2P could benefit from selling itself less as a means of anonymity and more as decentralized, censorship-resistant web hosting. The clearnet should then have inproxies to expose I2P sites rather than the other way around, as is the typical use case for Tor. That way you can spin up an I2P instance anywhere, instantly have a web server on a unique address, and have it be available on any number of clearnet inproxy nodes as well as to anyone connected directly to the network.
Having played a lot with I2P recently, I find it more "fun" than using Tor. It lacks in content, but its focus on hidden services (eepsites) and the relatively small number of users is reminiscent of he web back when I first started using it in the 90s. I like that it has a sort of DNS system that is only as centralized as you want it, and that it has a built in way of assigning your own domain aliases. Even if you (the reader) aren't interested in anonymous decentralized networking for any practical reason, I'd say it's worth testing out I2P just to get a kick out of how novel it is.
What we should be doing is encouraging people to use I2P and making it as accessible to the public as Tor (and even more so).
Why I2P over Tor?
- All nodes have the same role, so there's no distinction between nodes in terms of whether they are an entrance relay or any other user.
- It's not designed to be a clearnet proxy, thus there are no "exit" nodes although hidden sites (aka eepsites) can of course be made to forward requests to the clearnet.
- I2P has a sort of DNS system built-in that Tor lacks.
- A totally separate or private P2P network is much easier to form with I2P than Tor.
- Hidden sites are faster on I2P than on Tor.
- I2P didn't come out of DARPA.
- Torrents that are totally internal to the network and don't rely on clearnet trackers or DHT.
Above all, if you have this concept of an "exit" node then it's feasible to observe exit nodes and correlate traffic to a clearnet destination with individual users. Depending on the regime a person is subject to, their use of Tor can potentially backfire on them because the flawed network design.
The concept behind Snowflake seems really cool, and maybe it works out for a lot of people in the short term. It is, however, potentially adding vulnerability to the network by virtue of adding another layer of complexity. Any time you add complexity to a system, you are creating potential for something to go wrong. With Snowflake you are, again, asking for people to identify themselves as Tor bridges (effectively) and neither the Snowflake bridge or the client are benefiting from a darknet connection when talking to each other because they're using WebRTC. WebRTC can of course be used to leak IP addresses.
However, I cannot seem to find the source for the Snowflake browser extension anywhere. This is concerning in and of itself. Does anyone know where it's located? The page for it on addons.mozilla.org does not link to a repo, and the Gitlab repo for Snowflake doesn't appear to include any code for packaging a browser extension. I would not install a browser extension that doesn't have an available source no matter who it's coming from.
If we want censorship-free communication that's as anonymous as can be, then give up on a formalized way of accessing the clearnet and prefer internal networking rather than running glorified VPN proxies.
Tor sucks all the oxygen out of the room while having not adequately addressed the serious flaws in its design.
Although I know there are reasons why people would be interested in running at Tor bridge and using Tor right in this moment, in the long term, we'd be of better help to the world if we worked on bettering and promoting a network project that is overall better for the censored user in the long term. People should be as aware of I2P as Tor and it should be extremely easy to use it. We should also make sure there's plenty of good content available on the I2P network (yes, I am gradually working on this).
I2P implementations:
- https://github.com/i2p/i2p.i2p (the official Java based implementation)
- https://github.com/PurpleI2P/i2pd (a C++ implementation that is also used to make I2P available on Android)
;) My contributions are relatively minor and I2P (as well as other crypto systems) is something I really believe in.
> Do you have any thoughts on HORNET? Could I2P benefit from a more stateless routing mechanism as opposed to tunnels in the far future?
It's been a while since I read the HORNET paper, but as I remember it, HORNET relied heavily on ISP level cooperation which is just not realistic. However, the idea of reducing state is a very good one. Going forward I hope to see more cryptographic systems that aspire to reduce overall state.
> I'm working on Go implementation here: https://github.com/hkparker/go-i2p. Haven't made to irc2p to introduce myself yet but I will. Are there any devs who might be interested in contributing?
Currently there are 3 implementations of I2P apart from yours. The original java one, i2pd[1] and kovri[2]. We all cooperate and discuss specifications to maintain interoperability. However the alternative implementations are not maintained under the I2P project as the developers of them desire to be separate. I was previously unaware of your Go implementation, but you should definitely head over to #i2p-dev and say hi. You can find me under the nick hottuna there.
> Privacy of developers seems a priority. Without any detail of course, can you comment on how necessary this has been. Is it irresponsible of me to work on an implementation in the clear?
About privacy, people have taken various stances. Some a truly anonymous, some are semi anonymous, and some like me are not anonymous. Maintaining privacy for a while might be a good idea. You can always get less anonymous, but going the other way is harder.
[1] https://purplei2p.github.io/ [2] https://github.com/PurpleI2P/i2pd