yes, looks like a really nice place to live

It can't be real. It is only photoshoping, sure!

Is gpg/pgp keys with encryption and keyservers sort of a means of "distributed identity/authentication"?

In a sense - it will allow me to decrypt a photo in my mailbox. It won't allow me to view a photo on your website.

Great. Since y'all have decentralised access control and communications built into your content management systems and all your different websites connect together and provide internet scale access control without a lot of password dialogues and you seem to be quite happy with them - I'll just bugger off and go back to doing things that provide a paycheck.

I'm just trying to get my head around some of this stuff.

What Red does, is it not similar to an exchange with gpg? Like, if David sends me an encrypted mail, and I have his key, I can read it.

This is how Red works, sort of, Yes?
He posts something, and because we are connected, I have the "key" to see his content.
Only, I understand it's done a little differently.
But essentially, I send my post to whomever is in the contacts for my channel. And if it's a private channel, only those folks can see that stuff. But they can see it on their site, AND, if they're logged in, they can see it on my site. AND, they can log in at my site, just the same as on theirs, which is something no other platform does, I don't think.
I mean, you can log into all kinds of crap with your FB, twitter, or google ID, or some openID, stuff, but, in reality,
you're taking those concepts, an openID AND gpg, and taking them to the next evolutionary stage, in a sense.

Am I comprehending what's going on here?
Or am I so far off yet, I sound like a third grader trying to explain nuclear physics?

@Commander Zot How does it work that other sites know who I am?

I think there are two cases:
- If I am browsing on my own Red instance and click onto a link to a friend's Red instance, I think I can imagine how it works - my identifier is appended somehow to the link as a GET parameter, right?
- If I access the friend's channel directly (e.g. by typing the URL in the address bar, without having accessed the site before), how does it work then? Is there a way my browser knows my identifier and provides it to the friend's site automatically, or do I need to type it in manually?

I guess when the friend's site has the identifier, there comes a verification step. How does this work?

I am a bit worried that any site can find out who I am without my accordance. My browser should not tell my identifier to sites I have not declared any relationship with.
And even if it doesn't, sites could guess my identifer. That's improbable, but as long as there are few Red users, this is a danger. Also, it would play a role for famous people - imagine an illegal site that waits until a certain politician visits it, and then publishes that he did. This would be possible if the verification takes place without asking the identity owner if he wants to be verfied.
So I would even get one step further - if I'm not connected to a site, it must not get my identifier automatically, AND I have to be asked before my Red instance verifies my identity.

Perhaps, when connecting to a channel, there should also be a permission field "don't ask me when this channel wants to verify my identity".
Or did you think of all this already and there is?

What Red does, is it not similar to an exchange with gpg?

In the same sense that email is sort of like carrier pigeons, yeah.

the responsible handshakes between the server are covered in ZOT protocol.

It's the decentralized access control that's revolutionary here. OpenID provides a way beyond accessing sites by typing various passwords, but access control on any site with zot is what doesn't exist anywhere outside of Red today. I'm thinking of zot as a the core building block of a distributed, secure file system-like overlay that you can place on your communication stack (thus, the whole emphasis on how Red is pretty generic in its design - thus, the repeated points made by Mike and others that Red is not a social network). Social networking is a built-in subset of it, but what it is, is a generic communication platform, with Unix-like access control built in, in a decentralized fashion (on an internet, but also intranet - if you like - scale).

So it is may be simplified:
OpenID: federated authentication
ZOT: federated authentication + access control
RED: federated authentication + access control + CMS + social network functionality

...ish.

But calling the communications layer "social network functionality" is like calling magic auth "members area".

Social network functionality is a tiny subset of the communications layer.

Distributed authetication + access control + CMS + communications layer + hadoop for mortals.

Was just trying to find an easy description of it for mere mortals. Because if even core users have difficulties in getting it, as this discussion shows, how would other people who never heard of it react to it?

The same way they'll react when you tell them they're using a website running on Apache, written in PHP, using the Zend framework.

You won't tell them. It's invisible to the user. You'll say "Have you seen this website about kittens?", and they'll go "Wow, that's awesome", and they'll sign up so they can comment on the lolcats, and find other interesting thing showing up in their streams - because we send public posts to servers, not people. Then they'll be magically logged in, without even noticing most of the time.

Other sites will have a "Login with Zot" button. They won't understand how it's different to "login with Facebook", they'll just do it, and it will just work. With one click, most of the time. After a couple of weeks, they'll stop saying "What's your email?", or "I like your shoelaces", or "When does the narwhal bacon?", and they'll start saying "Got Zot?"

Ok, @tony baldwin if it's ok with you, I'll be using your "Got Zot??" jpg as one of my avatars on Red (it's too awesome not to use it!).

@Leberwurscht Brot If one desires, one can provide a plugin to control whether or not to authenticate based on personal preference, allow list, block list, whatever. Writing a plugin which only auto authenticates to "connections" or even "close connections" (for instance) would probably take a few (ten?) minutes.

If you visit my website and I know that you are David, I can show you things which I only make available to David. I don't need to encrypt them. This is just as if you were logged into my site via username and password (or OAuth, or whatever). I know who you are.

In this case, you don't need to login to my site. In a manner very similar to OpenID, I just need to prove that you are you. I can do this by checking with your site. GnuPG is more of a basic encryption and signature verification library with key management. Not a cross-site authentication toolkit. It's not a perfect fit. Some areas do overlap. OpenID is also not a perfect fit for what we're doing either - though again some areas overlap, probably a lot more than GnuPG.

The identification token starts as a simple web address (user@host) but is verified as a four component array comprising your globally unique ID, with a signature - and your current URL, with a signature. All signatures must be provable to ensure you are you.

Why can it not be a GnuPG key?

If you wrote it and figured out how to make all this stuff work, maybe it could be. You didn't. Nobody else did either. So I did.

If somebody would like to create an alternate authentication and access control system using GnuPG, go right ahead. I once again need to remind readers that like Friendica, Red is OPEN SOURCE.

Yes, I do find it a bit annoying. I've been describing how this is going to work for almost two years, with particular detail over the last 8-10 months. Now that it's working after a great deal of time and struggle and sacrifice on my part, to come back and suggest/hint that I should dump it all and start over because it doesn't use a particular ID format is a bit of an insult. I didn't think to use X.25 ID's or ASN formats either. Maybe I should have, but I didn't. [Shrug.] It is what it is.

You aren't currently protected against evil site admin unless you encrypt your disk (even then it's not perfect). We'll be doing E2EE soon enough.

But yes, we encrypt communication traffic between sites. And we do this with RSA and AES, the same building blocks GnuPG uses. At a very rough high level, GnuPG is RSA with a key store. We've got a decentralised key store already.

Besides communication and status updates, Red - like Friendica, supports private profiles, photos and files. In the case of Red, even more things like pages. These are not actually transmitted between sites, but are stored on the origination site using decentralised access control to decide who to allow to see what resource.

Because if even core users have difficulties in getting it, as this discussion shows, how would other people who never heard of it react to it?

I've seriously under-estimated this task.

You have these websites, right, and anyone who is on any of them can talk to anyone on any other website.

And if you go to another website, it knows who you are, and lets you into the members area where there's private stuff.


If you don't understand it, ask your grandma how she thinks the internet works, and she won't describe the internet - she'll describe Red.

Well, that clears stuff up for me a little bit, at least insofar as what's similar/different between OpenID, GnuPG and Zot.
Sort of.

Honestly, it all might just as well be Magick to me, however.
I can barely write a bash script, and I'm trying to get my head around stuff written by a genius, visionary, code wizard from like the 23rd century here.

In any case, I'm truly fascinated by what Red does(will do), and, indeed, think it must be the next step in the evolution of networked, digital communications.
I think it's going to take folks a while to catch on, however.
@Commander Zot , you're just way ahead of the rest of us.

Heck, Friendica is beyond the capacity for most clueluess lusers to comprehend, it seems, and is AMAZING stuff! But even the failure on the part of other projects to effectively cooperate on federation shows you how much people "get it".
DRFN, which I don't even comprehend (well, I know what it does, but not HOW it does it, of course), was already way ahead of what anybody else is or was doing.
Red+Zot is going to leave jet trails on a lot of foreheads as it zooms right over people's heads for a while.
I understand what it's meant to do, the decentralized authentication, that makes sense.
I imagine if I had never a) used friendica, b) used an openID, and c) used a gpg key (with which my experience is very rudimentary, and my comprehension nebulous), I wouldn't have an inkling what you are describing.
But how you accomplish what Zot does/will do, I don't think I'll be getting my head around that any time soon.

Oh, but I don't think you should even considering stopping building it.
I don't want you to be discouraged, just because the rest of us are clueless.
They hung Galileo for suggesting the Sun was the center of our solar system.
Geniuses are often misunderstood.
At least today, we don't hang so many of them any more.

Honestly, it all might just as well be Magick to me, however.

Yeah, see, that's kinda the point.

It's supposed to be magic. It doesn't matter how it works as long as it does. It's not like anyone is contributing to it - even the four of us in this thread who have, only one has actually done anything with the magic bits.

I do want to understand better.
I figure the more I understand, the more likely I am to be able to contribute something.
At the same time, I know Mike can't hold my (or anyone else's) hand all day and teach me to build a jet plane when I can barely stick two legos together.

I suppose my contributions will have to stay in the plugins and themes realm.
Plus advocacy, and possibly even some documentation for admins.
Even if I don't understand what's all under the hood, I'm guessing I can drive one.
I deleted the Red I had on this server, but I'm likely to install another one at any time. Probably do it at red.tonybaldwin.me or something.

Even some of that stuff, theming and plugins, can be challenging for me, so maybe thinking I can go beyond that is a pipe dream, anyway.

You don't need to understand thermodynamics to drive a car.

Unless you're going to implement Zot somewhere else, you don't have to understand Zot to use Red. You don't need to understand it to contribute to Red - Mike already did that bit. Unless, for some reason, you're planning on re-writing it, all you need to worry about is what happens after you're authenticated.

You didn't install WordPress, and go to the forum to ask them how to write blogging software, you just did whatever you needed to do on top of it.

Even some of that stuff, theming and plugins, can be challenging for me, so maybe thinking I can go beyond that is a pipe dream, anyway.

I've just committed the PCSS theme. There's some cleaning up, and quite a bit of polishing to do, but I (think I) documented it well enough to make it clear what needs to be done. There are examples for pretty much everything except the iconset.

Most people don't even realise that this is the case, but your browser will very happily tell anybody in the world where you are. Some of it we can figure out due to your IP address. But you can also give permission for your browser to hand out your exact location on demand.

But what your browser will not do, is tell anybody on the internet who you are. It will get in your way and try to prevent anybody from doing this.

You have to jump through a million hoops to get one website to tell another website who you are. There are a couple of ways - which use URL fragments linked to invisible iframes which make it possible, but you're depending on browser implementations not to fix this "known bug in the Cross Site Origin Policy". And you can only reliably pass a very small amount of information - 26 bytes if I recall, though I researched this long ago and that number just stuck in my head and might be wrong.


Now this is all fine and provides a level of privacy, and keeps big advertisers from tracking you all over the web (or that's what it was designed to do, when in fact they can track you everywhere using tracking cookies.) And this is all good for large sites like Facebook that can spread their tracking cookes and that know who you are.

But this makes a decentralised communications web damn near impossible, because there's no way for one site to tell another site who you are. And these are little sites that can't ALL get tracking cookies embedded in every other site. That doesn't scale. There's no way for your browser to share between two sites and tell both of them who you are. So we have a web full of little islands that only know who their own people are - and nobody else.

So what I've done is to make it possible for cooperating websites to tell each other who you are, and a way for those websites to verify it. And a way for you to pass this information from site to site as you surf the web.

This isn't doing anything to violate your privacy because as I mentioned - the big sites already know who you are. These big sites share cookies amongst themselves to sell you stuff. But while they know who you are, your friends don't. Your friends can't. Because your friends can't plant tracking cookies all over the internet disguised as "Google Analytics" or Facebook "Social Graph".

Or at least they didn't and couldn't until I managed to figure out a way to share this information amongst cooperating sites using established protocols - no browser hacks. No hidden tracking cookies. Just internet URLs. And yes, it's magic. That's why I call it 'magic auth'.

And knowing who you are opens up an incredible number of decentralised services which are simply not possible without it. It means that small cooperating sites can actually cooperate and offer services which compete with the big Internet monsters, because they can now join together and do things as a team instead of being isolated islands.

Yes, it's a big deal. It's a HUGE deal. And most people don't even know that it couldn't be done - until now.

... It means that small cooperating sites can actually cooperate and offer services which compete with the big Internet monsters, because they can now join together and do things as a team instead of being isolated islands.

This is what people seem to have a tough time grasping. And yet, the idea is conveyed in 2 simple words -- "la red" ("network" in Spanish)

But how you accomplish what Zot does/will do, I don't think I'll be getting my head around that any time soon.

I'll really try to keep this simple, but this kind of thing isn't simple. It's a mess of redirects and passing around encrypted blobs until everybody is happy that all the encrypted blobs have been decrypted properly.

You come to my site, zothub.com. "Hi. I'm Tony Balwin from free-haven.org".

The hell? I don't care if you're the pope - I'm not letting you through unless you prove it.

I'm going to send you back to free-haven.org and insist that you prove it. You can come back once I know it's you.

So that's what I do. I send you back to free-haven.org. Except I provide a snippet in the URL to tell you where to come back to once we're done proving who you are.

Free-haven.org says "Yup. That's Tony. He's got an authenticated browser cookie here, which would only happen if he knew Tony's email and password - so he's logged in.

So hey, zothub.com - here's Tony's ID - signed with his private key. And here's him telling you that he uses free-haven.org, and that's signed with his private key. And here's a little secret message signed with his private key. Oh and just to prove that you're zothub.com we're going to encrypt the whole bloody mess with zothub.com's public key.

zothub.com takes a look and decrypts the thing; then proves Tony signed it, because we've got a copy of Tony's public key stashed away. We can always get it from free-haven.org if we lost it.

Yeah, Tony signed this. OK, free-haven.org, here's the secret message you sent. You'll know that it's us because only we can decrypt it, and it should match the secret message you sent. Oh, and it's encrypted so only you can read it. If Tony is really logged in there, send him back over here with the secret message which has been passed around encrypted the entire time and has never been transmitted in the clear.

And so it happens and Tony comes back to zothub.com with the secret message and we say "yeah that's Tony all right". Free-haven.org says it's you, and you've proven that you use free-haven.org. Now we'll send you to where ever you were going originally. Have a nice day, Tony.

http://en.wikipedia.org/wiki/Macquarie_Pass

http://www.beddysblog.com/2010/01/macquarie_pass_climb_with_the/

Here's the downhill run and much more realistic - watch him open up after he gets past the white-knucklers, only to get stuck in a queue behind yet another one.

https://www.youtube.com/watch?v=vdG-wBk-aGY

Australia is strange ... They are all driving at the wrong side ... :)

What are "white-knucklers"? The internet gave different explanations.

causing or experiencing fear or anxiety

a white-knuckle ride

Sounds more like death grip in that context.

Somebody who holds on to the handlebars (or steering wheel) with all their might, in case they fall off.

It's a lovely road though, so many are probably sightseeing and/or enjoying the view.

Also found this while looking for videos of the pass - a quick look at what it's like here on the edge. I'll miss it.

https://www.youtube.com/watch?v=CplXCkxWVzU

"white-knucklers" are people who are gripping the steering wheel so tightly that their knuckles turn white.

The drive is absolutely terrifying the first few times. Some places are so narrow you practically scrape mirrors of opposing traffic, and if you're in the top 1-2kms and look off to the side of the road (there are only guardrails in a few spots), it goes straight down at 90 degrees. Turn just a bit too wide to avoid scraping mirrors and you're gone. Unless somebody reports you missing it could take months to be found. Apparently it's a popular place for dumping bodies and stolen cars.

Ah yes, the "Silicon Valley Surprise". I know it well. Lost a family friend there before the median was installed. Luckily these days the median takes the brunt of the damage. In the photo below, at the bottom center is the nexus of the kill zone. At 70mph, the centrifugal forces slam cars into the wall as they start to round the curve.

YouTube: Welcome to Woop Woop (renouf26)

I'm reasonably certain he was one of my occasional late night customers when I made doughnuts on the night shift in high school. There was a guy who lived in Mill Valley who came in once in a while and chatted about zen philosophy at 2-3 AM while the world was asleep.

It wasn't until around the time he died that they started running some of his seminars on late night radio - and I said "Wait, I've heard this before... I know that voice..."

That question, of what happens after we die, has always mystified me. The question that is almost impossible to answer with any level of certainty.

The idea of going away into oblivion, into the "dark room" that you can never emerge from, as Watts said, is indeed horrifying. It makes my stomach turn, just at the thought of it. On the other side of the spectrum, the idea that we somehow persist afterwards seems convenient; but a bit too easy. It seems like its just my "ego" wanting to exist forever, when it may not really be practical.

The idea, however, the "you" are "everything", or that you are the "universe experiencing itself"; means that, in a manner of speaking, you are like a thought in the mind of the universe, one of a countless array of thoughts that it thinks in infinite permutations. I feel much better thinking of it that way. It seems far more balanced and correct.

Still, there is a sadness inside me, that thinks, this individual me should go on existing forever. Who knows? Maybe the Buddhists who speak of reincarnation of the soul were correct. Perhaps our individual soul is reborn, to a point, so as to evolve over many lifetimes, with the eventual option to "return to source."

Perhaps all of you have the rigth theory, but sincerily, after dead there is nothing. It is like the existence of god only believe who have faith.The rest are "majaderias".

but sincerily, after dead there is nothing

And you know this because.... ?

There cannot be nothing unless there can be everything. It is a duality, and they define each other. So "after dead there is nothing" is a really interesting (and I dare say impossible) state. It's like an old car. The engine may stop. It may go to a junkyard, but everything which made up that car still exists. In fact the running car still exists in space/time; and the history of the car also exists in space/time. If you can only perceive one sliver of space/time you might conclude that it is gone, but the universe contains all of space and time, as well as the concept of "nothing"; of which you speak.

@Commander Zot is a good thing have faith it can help you in troubles and give you a way of life.
You forget that I beguin my text given to the others the posibility that they have rigth and I'am mistaking.

I belive in each individual person (you can say conscience) I dont belive in a communitary concience. When you die remains the things that you do in your life material (tangible) and espiritual(in the conscience of others persons) But your body continue the cycle of life (soft form or way of saying that rots). I think that if humans would become extinct only material things for a while, but in no way would have something more.

Which occurs just after a cardiorespiratory arrest is also achieved with certain risky sexual practices.

Relax - I'm not advocating any philosophy over another.

"Faith" is merely what one believes to be true - and it's quite likely that everything any or all of us believe about death is wrong. We can't comprehend reality. We can only observe and discuss it.

What happens after death is also somewhat immaterial to those bound by life; but it is an interesting thing to ponder from the standpoint of physical laws.

Energy and matter presumably cannot be destroyed - they just flow back and forth, according to the belief systems of modern science and to some extent the traditional zen religions. This has interesting implications when one ponders death - as Alan Watts describes.

Again, these might be completely wrong (I have serious issues with a lot of the current faith in astronomy and cosmology, for instance - for ignoring the blatantly obvious role of electricity in the bigger scheme of things). But if even partially correct, it makes for interesting discussion about death. It means you can't really die in an atomic sense.

Then the belief system of "we're merely in a simulation" starts to make a lot more sense because of the absurdity of something dying. It can't happen, so it's likely an artificial constraint or a boundary condition in the simulation.

And so on and so on until we arrive at a belief system which fully describes life and death in terms we can comprehend. Even then, a lot of people won't believe it and will kill other people who believe differently from themselves.

So perhaps we should be talking instead about the fact that my lungs are taking in oxygen from the gases floating around me and expelling carbon monoxide and I'm sharing thoughts with people around the planet by sending encoded vibrations via a device made of metal and sand and a bit of petroleum.

Don't you find that fascinating?

I find it fascinating, because death is perhaps the only thing we all have in common; but know almost nothing about. To me, it is important to explore the ideas and information surrounding the concept of death in great depth. I've often pondered questions such as?

* Are we reborn, if so how?
* Do we simply cease to exist, if so how?
* Do we "return to source" so to speak? i.e., are we simply a passing thought in the mind of a larger entity.
* Do we permanently go to "some other place."

I'm inclined to think that this is a sort of "simulation" and that the physical representation of reality is just an organizational structure, so rebirth or "return to source" does not seem too far fetched to me.

But if we think of ourselves as simply a system, that eventually breaks down, death does make sense.
Many things in nature exist in some form, and then entropy ensues, and they break down, their components eventually becoming components of some other system or seemingly cohesive element, as we, ourselves, are composed of chemical compounds that were once the stuff of stars, then a "lifeless" planet, and which have been components of many "living" organisms before they became part of us (I, for instance, have many components from chickens, pigs and cows in me, since I eat them. As well as a lot of plant matter).
Even as a singe entity, of course, I am constantly in motion, taking in new components and chuffing off the old, so that, today, I am not the same set of components I was 10 years ago. What makes me consistent is that I am the system that uses or incorporates these components for a time.
So, in a sense, life, itself, well, that is that? Perhaps just systems in motion...in which case, the entire universe is alive. But "things" we identify as living beings, the come into existence and fade back into the cosmos, like waves on the ocean, rising to lap the shores for a time, and then blending back into the sea, their molecules to rise again in new waves in future storms. The ocean remains, but a single wave only exists, in itself, for a short time. This is how I think of "living beings".
That which makes me aware of myself (or my Self, if you will) as distinct from the ocean is merely, as I see it, electrical impulses within the system that is my body. I can only assume that once the system breaks down, those impulses will cease to exist, as will any consciousness of "me" as separate and distinct from the ocean from which I rise like a wave.
As far as the eternal or temporary nature of the very base components that are currently me, I have no concrete knowledge. I mean the higgs-bosons, the particles and waves...Will they go on forever? The laws of physic seem to imply so, but then, we haven't been around long enough to really know, have we? We discuss some "Big Bang", and it's a fascinating theory, a very useful way of thinking of the origins and cycles of universes, but it seems, for an instant, outside of time, nothing exists, in the cycle and flux of Big Bangs and expanding universes. Hawking has said this, or, at least, posed the theory that, essentially, as I understand it, there was nothing, not even time, and then a big bang, and then an expanding universe, but this is in flux, and eventually the universe will collapse on itself into nothing, again, and then explode into another expanding universe.
It's all rather fascinating, really.
What I find fascinating is speculating on the nature of life as consciousness, and wondering, how much life is there, even right around us, of which we are unaware? Are inanimate "things" not living, because we see no sign that they are aware of themselves? How can we know?
Is it really just the electrical impulses firing in my brain that make me aware, functioning, living?
Perhaps stars and planets are living things? Perhaps strings or quarks or gluons are?
We think the complexity of our brains make us so smart, so aware, so advanced, but life, and consciousness, perhaps they have other forms the likes of which our limited imaginations can not fathom. Perhaps life is distinct from physical matter, but I can only speculate such things.
As that Gautama guy said, when asked of "life" after "death","I do not know. I am not yet dead."

@tony baldwin this is the first ~f post I'm saving in a folder. Lots to cogitate on.

What I find fascinating is how physics does posit a kind of eternity given the loopiness (in several senses) of space/time.

I too have often wondered if our carbon based definition of life means we are overlooking other life living in parallel with us right here.

What if our entire universe were floating in a teardrop of some immense creature, the expansion caused as the tear drop reaches the size required to fall?

What if there were an entire universe in each of our own teardrops?

Seems this got a few likes even without a description. That big rock is "south head", the one further in the distance is "north head". In between them is the entrance to Sydney Harbour. It's a treacherous bit of coastline. There are signs along the walking trail providing numbers for suicide hotlines, as it seems to be about as popular to do oneself in on the rocks below as it once was to jump from the San Francisco Golden Gate Bridge.

Maxwell Salzberg wrote:

● D* didn't exactly solve our own, personal problems of giving us a space to hang out with our friends like we originally thought...

● Since day one, our goal is to move the needle on giving people ownership of their data. We actually care less about implementations, standards, and code...

Implosion is inevitable.

I still can't understand why this is so hard for people to figure out and/or accept TBH.

Yes, I saw that sentence "We actually care less about implementations, standards, and code..." and thanked my lucky stars that I hadn't been drinking or eating anything at the moment.

check.. it.. out... ha . nice :D

There's some pretty cool stuff in the pipeline, but OMG there's a lot of work to do.

If I didn't deserve that already, I will do by the time I've finished playing with this.

Oh yeah and there was the language detection bit. It's implemented a bit differently in Red than it is in Friendica and I'm hoping to just tie this into "browser-accept-language" so that language filtering will be automatic. But it should also be tied to the free web volume control so you can see if it desired, and of course if we ever get a good free web translator, we should have the option of using that instead of obscuring it.

@Paul Taylor Friendica uses 4096-bit encryption keys. I believe status.net uses 512-bit keys.

The statusnet crypto library (PHP-seclib) runs as interpreted PHP code and doing the requisite crypto math on numbers this large can lead to memory starvation (it can also take up to 3-4 minutes to verify a single message signature depending on your system configuration).

In Friendica we use native openssl libraries which run in machine code and which don't have any such issues with these large keys.

This is the free web response to EdgeRank and filter bubbles.

♫ Hallelujah, Hallelujah, Hallelujah... ♫

The identity abstraction and DNS mobility is far and away the most interesting thing for me. Anything on top of that is icing.

That's a hell of a lot of icing already.

Edit - plus it seems I made the right decision standing by my guns to use a globe icon for the network tab.

@David Benfell

And I mean, a good reason.

Licensing. Status.Net is pretty solidly on the GPL side of the license wars.

http://people.gnome.org/~markmc/openssl-and-the-gpl.html

In all fairness, I believe we need to add the specified clauses to our README or whatever, even though as a built-in PHP library we never (as PHP developers) see these terms or are otherwise reminded of our responsibilities.

I keep forgetting to do this.

You can still fit a rather incredible amount of prime numbers into a 512-bit integer. I wouldn't say it's necessarily more insecure than a longer key since we have to assume that the NSA can crack RSA of any length.

Larger keys allow us to encrypt slightly larger datasets directly with RSA before falling back to AES (non-symmetric) encryption. So the larger keys are a big convenience to us. It's the difference between a ~40 byte RSA encryption limit and a ~390 byte RSA encryption limit.

We've got a valid repository now - but you are warned that the code can change out from under you at any time and without warning. There's a Buckley's chance that you can get it working and keep it working without help. Questions and pleas for help will be quietly ignored.

You broke updates from Mistpark!

It's bloody fast - not sure how much of that is the changes, and how much of that is the nearly empty item table.

The installer works at this point too, but not in a subdirectory for some reason (possibly sloppy nginx rules on my side).

Themes work, which is nice - I expected to need a re-write, but it seems it's just a case of keeping up with new changes rather than starting from scratch.

But yeah, liking it so far.

No problems so far at http://friendica.red.wf

Registration is open for anyone wanting their first look at Red.

There's another sort of public trial here.

I'm less worried about it getting busy if Keith has one too - at least they won't all congregate on one site.

Be warned things will break, your account can be lost at any time, it's a preview only, etc, etc,

Sigh - it's not even a preview. I've barely begun.

All this represents is an effort to develop the project in the open and be able to share patches and bug fixes between projects.

Let me say one more time - things will break. Not may break, will break.

Yeah - I'm doing partly because a Buckley's chance sounded like a dare, but mostly because I want my theme to be ready the same day Friendica Red is. There's no harm in letting other people have a look while it's up there. If it's going to do horrible things, it's going to do horrible things whether other people are using it or not,

Not really.

Nobody is running this in 'production mode'. You don't really get a clearer warning of that than "things will break, your account can be lost at any time".

It's closer to showing somebody else your computer and going "Hey, look what we're working on" than running Sid.

The difference is that Debian unstable is amazingly stable

Curious about it ... something to try when i get home.

The DB wasn't working when either of us installed. An update is fairly likely to break things - it did for me. That'll happen a lot. It's a tech demo, at best.

There's not much to see on the user side of things yet anyway though.

it looks and feels much like Friendica, which is good :)

"DNS mobility" ? .. that could open up some new very interesting possibilities!

Most of the federated web bases communications on webfinger e.g. user@host or profile URLs, but we've seen this fail several times as sites come and go, and the members of those sites have to re-establish friendships.

There's also the potential of manipulation of DNS by rogue agents and governments that is outside our control.

So we're going to give you a unique hash, that together with one other piece of secure information will allow you to prove your identity and post from any Friendica/Zot site. Think of it as an overlay network where we abstract out the DNS component.

The plan is that you will be able to register or login to any Friendica site and provide your old ID and private key and we'll re-connect you to all your friends. That's the plan. There's still a fair chunk of work involved.

Obviously, the more information we can extract before the old DNS location goes silent the better. But our baseline will be to re-establish and provide continuity for your basic identity and friends. Content and configurations will be harder.

That sounds great.
But how would people add me as a contact? Will they need the hash? Or will there still be something easy to remember like user@host?
(I can't imagine myself remembering and giving my hash to someone when i'm drunk at a party ;) )

No we start with your "current" webfinger (user@host). That's the address ("webbie") you give folks.

Once contact is established and connections made, your webbie no longer matters and can change.

Ho ok, thanks for the answer.

You're right - it isn't easy. However if you allow your contacts to be seen, your other friends know who your friends are and this knowledge is stored in multiple places.

I anticiapte a few different levels of recovery from a move.

1. I only have my ID and private key and my contacts are public. Any of my friends can provide my (non hidden) contact list.

2. I have my ID and key and my address book.

3. I'm missing one or more of these pieces.

#3 is the worst, depending on what you're missing. If you have nothing, you'll be starting over. If you have something, we'll see what we can do - given the availability of any information about you that still exists.

We collect friends of friends locally via PortableContacts or "poco" to build the social graph for friend suggestions. I'm looking at extending this further to where it actually becomes a decentralised directory.

If you don't allow your friend info to be publicly available, it won't be stored anywhere but your own contact list.