P2P Imageboard

Sup /Ω/ I've been working on getting a p2p imageboard functioning for a while and I decided to start fresh more recently with a new project. It's still not fully featured per se, but I feel like releasing it in it's current form since it's still functional and I want to see if it works in the wild. Hopefully you'll be able to see the existing boards and start posting. https://gitgud.io/threshold862543/gladden To install: >install node and yarn (or npm instead of yarn) >run "yarn build" to get the dependencies >run "yarn start" to start the server And you can add whatever boards you like. This basically works like a torrent. Moderation is local, so you can delete files and posts that you don't like, but it won't be deleted for others necessarily (unless everyone else blocks them and there are no more seeders). "Subscribing" to others as moderators so you can trust them to delete for you is also possible I just haven't hooked it all up yet.

>one person posts cp >we all get arrested excellent idea, op

>>76006 reasonable concern but not really how it works. What can happen is getting raided and hardware sized if there is any illegal content posted which is why you generally want any server to be outside your apartment because even if you dont get jailed - getting all your electronics taken away is just as bad. In general you only get really in trouble if someone posts illegal content and you dont delete it. There are also timeframes within which you need to respond and delete but there are also cutoffs that exclude the small/private people. Like email gets regulated heavy if you have more than 50 users on your private email server. tldr: legit concern but not that draconic. Gotta read what applies to you.

>>76006 >>76009 Post with me I want to see how robust the system is so far.

Sounds like a bad idea how you have it planned to be set up. If just one person does not delete something effectively nothing gets deleted unless you delete it yourself but it isnt really deleted. If someone posts something and wants to change their mind they can not redact their information. It would be better if you were talking decentralized storage but a user is always able to redact their own posts from all places it is stored except for obviously screenshots. P2P would also over easily expose IP addresses unless at least they were encrypted so users dont get doxxed.

>>76015 >isn't really deleted You can delete anything you don't like or agree with. This way rule users can censor themselves without censoring others, and anyone can delete illegal content. If there are no seeders left for a bit of content, then it is essentially "fully" deleted. >IP IP addresses are not associated with posts, instead log entries in the database are signed by a keypair, and you can randomize this keypair every time you post. You can also connect via TOR, a VPN, or something else (eg. a proxy posting service). to not expose your IP to anyone else in the swarm while you are connected. But peers simply broadcast posts to each other, they don't say which IP address made which post, and the posts being shared by a given peer do not necessarily come from that peer. Think of it like a torrent in that way.

This is kind of off-topic, but I don't really understand how libp2p works. How does one peer discover the addresses of the other peers? The documentation mentions DHTs, which seem to be more or less a distributed master lists, but how does a node gets a initial snapshot of the hash tables? Does it use a list of predefined hubs (like a resolv.conf but different)?

>>76031 >Does it use a list of predefined hubs (like a resolv.conf but different)? Yeah in this case you dial one or more known peers. There is a publish-subscribe "pubsub" system, where you can subscribe to certain topics. In the case of this project, these topics correspond to boards. Those known peers don't have to be subscribed to the topics you're interested in, but they will help you then find other connected peers that are subscribed to those topics so that you can connect with them. Then, peer addresses are saved locally so the next time you initiate your client you will know who to dial. Peer addresses are so-called "mutliAddrs", something like: >"/ip4/127.0.0.1/tcp/8500/p2p/12D3KooWCxiir8F2va27usfWYKQcSZUbjCqorCgUhUN229ZKybJf" The first part is the routing protocol, and the second part is the client ID (based on a cryptographic keypair associated with the client). The one I pasted is localhost but yeah.

>>76021 I am not sure you understood what I meant so let me rephrase. It is a privacy/security hazard if someone can not just delete their own post simply because it was captured by others to seed. What if someone accidentally uploads a wrong image? Just deleting their own side will not do anything if there is someone there capturing every post for storage including government agencies. It ideally should be the anon that posts can delete their posts from all over like they can on any image board.

>>76043 what you want is impossible. You cant force others to delete what you posted. At best you could implement a deletion request but nobody is forced to comply with that. Also if you do that much you still aren't safe: Third party bots lurking to archive will snapshot what you wish deleted. Oh and for completeness sake: the things you think you deleted stay on their servers, they merely remove visibility and continue to farm your messages. FB had news even logging what you type but dont post.

>>76043 Yeah what >>76044 said. If we think about machines as extensions of the self, what right does someone have to try to delete something stored in my mind/storage? They can try but I can refuse to comply. That's kind of one point of this project, to give freedom to communities to post what they want and not have outside parties delete their data at will, as that tends to destroy imageboard culture. Not to say there won't be consequences (if you are seeding illegal content), but it's like having a gun. You can do good or bad with it, the important thing is that you get to decide rather than some janny.

>>76044 >>76045 Maybe on how it is set up it isn't possible but this is how various web 3.0 setups work . You post content, you retain control over it but if you allow it other people can host it even if you stop hosting it.

>>76051 >you post content >you retain control over it Doesn't seem productive or interesting, to me content should be disconnected from the individual user identity and free to evolve and stand on its own.

Finally got post quoting working. There's no post numbers so it uses post hash instead. Also neatened up some of the UI.

Added some gateway configuration settings so you can turn off certain features if you want to expose your pageserver to the wider internet: Here's a public gateway where you can browse some boards but with posting disabled: https://gladden.peerchan.net/landing/index.html

Split the files storage into a per-board file pool system to make managing and keeping track of files easier going forward.

>>76009 >What can happen is getting raided and hardware sized if there is any illegal content posted which is why you generally want any server to be outside your apartment because even if you dont get jailed - getting all your electronics taken away is just as bad. That's dumb. This is a Peer-To-Peer network, right? Yet us idiots shouldn't have our servers near where we live? Obviously we are all just going to rent our servers from Big Cloud. Might even make it faster if all our servers are in one server network.

>>76009 if any of this were true, it would be legal to download cp, watch it and then delete it (after advertising to entire internet that you did exactly that as is the case with bittorrent).

>>76597 this is why legal literalism is a blight on the world. Of course the reality is always that the actual rules depend on your country and the bottom line is that if they fuarrrk you they fuarrrk you and maybe if they can prove something like having CP on your computer (maybe that they put there if they're feeling frisky) they fuarrrk you harder. And most of the time they leave you be.

>>76600 >legal literalism is a blight on the world Except the Emperor isn't wearing any clothes.

>>76604 NTA but >Except the Emperor isn't wearing any clothes. This is a crucial component of liberalism.

>>76604 >>76605 Neither is the child that your computer is actively sharing just because anonymous P2P network pulled it in, noone cares if it's an "accident" or something. The reason that vast majority of internet isn't P2P nor anonymous is because even on lainchan.org I have plausible deniability. Someone can upload cp in this very thread, and yet my computer won't start sharing it across the globe, also it's stuck in my browser cache only unless I manually download it, and if lainchan.org is ever hit with a subpoena, they will be asking for information about who uploaded it, not who ever looked at the thread. In P2P network they will be looking at everyone who ever shared those files, everyone is a distributor on BitTorrent, even leechers who stop seeding once their download completes.

>>76606 >Neither is the child that your computer is actively sharing Sorry, I wouldn't know.

>>76606 well ok but elephant in the room is FREENET which im pretty sure has been used for CP. its just setup so its pretty dang hard to prove whether or not individual person has CP in their encrypted block that they sharehost, and if they do its probably not in a complete and useable form anyway. maybe should setup something like this idk. >>76604 what so we have a problem with nudism now huh ?

This runs on android if you set it up through termux. If you have a good wifi connection posting and replicating data from other peers seems to work fine: >install termux through fdroid >apt upgrade >if things can't be found, try termux-change-repo and select a different one and when upgrading enter y on every prompt to get the remote version >if things aren't found in apt, try pkg instead >apt install git >apt install nodejs >install openssl-static if necessary for nodejs >git clone the repo >(you can download with wget or something if git doesn't work) >cd into the repo folder >npm install (not yarn) >npm start >termux-wake-lock to prevent it from shutting down when the app goes out of focus >if it shuts down randomly, disable killing of child process in android developer settings >you can daemonize the process with pm2 etc

>>76630 >This runs on android But I will not run it. So does it run, then?

>>76606 > everyone is a distributor on BitTorrent, Only for things that you choose specifically to download. You would have had to specifically choose to download CP to be seeding it or even receiving it. FreeNet can also be configured in this way.

>>76000 Disgusting picture. Most hives have one big leader, it's extremely centralized and accepts no variation. Monoculture. Communist soykaf. >>76006 The same issue. Mitigating solutions: 1. Moderators see a waterfall of thumbnails of all posted pictures. They're grouped by the posts that contain them. 2. Any post that contains at least one picture must be validated. Can be toggled with a soft posting option where the text is allowed but pictures are under a spoiler-like tag that is "pending", for awaiting moderation. Hard delay option possible (x minutes or hours). 3. AI may help detect child pornography. They should be easily forked and should rely on shared recognition algorithms. Obviously a database of known pictures could not be kept around, at least not in visible form. But what if encrypted and only "visible" by the AI? BIG LEGAL QUESTION MARK HERE. 4. Links to cp content must be checked against a known and transparent database that can be edited by anyone, but with caveat that it takes 48 hours for a URL to be validated. Until that, it's merely added as proposal. Unallowed links are simply scrubbed. 5. URLs can be salted or voluntarily damaged by malicious posters so this won't cut the necessity for a manual checking. 6. Posts should be easy to flag, with a quick option for "illegal content". There should be a measure to block the spamming of such warnings though. Moderators are warned as usual and can quickly delete the content. 7. Possibility to do a sweeping purge of all new content based on a specific time and date. Anything after this gets deleted. This should be an extreme solution but applicable if moderators consider that until a given time, the content on their board was safe. 8. Mandatory encryption and hashed IPs.

It's an interesting idea but it needs a fvckton of combined mental energy to do it right. What you're essentially trying to do is make a p2p CDN for your forum... it's something like a democracy and anarchy to be honest. Traditionally, forums are hosted by a single person. When you go to their forum, you're entering their 'house' and so you abide by their rules. The problem here is 1. mod abuse and 2. vulnerability to get shut down because the forum is a single vector of attack. The reason why they were never able to stop torrenting is because it's impossible to kill a torrent swarm and because there have been too many indexing sites and torrent creators/maintainers. So yes, it has been proven that p2p can solve problem #2. But what about problem #1: moderation? When you're using a p2p service, you become part of the network. With torrents it's pretty easy and straightforward: you seed what you like and are comfortable with. But what happens when you seed things that you're not aware of? Or things you simply don't agree with? So the question is: is everyone in the network seeding the same things? Or do users individually decide what they seed? If you choose the latter, which is probably the better choice, then how do you build a UI that makes it easy to seed? You could compare it to Reddit's upvote system. In stead of giving someone an up- or downvote, you can simply 'upvote' them by seeding them. However... in the beginning, when there aren't many users yet, this may result in threads which may have trouble loading posts that are not being seeded. But maybe that isn't that big of a deal... Finally I would propose to build this application separate from internet browsers. Browsers are very problematic in so many ways and honestly, there is a case to be made to just move away from them. Why do we need browsers in the first place? Most of what we do on the internet is literally just reading articles, browse for videos or lurk on forums. You don't need a browser to do those things. But we still use them because no one is willing to take the first step and just ditch it. If this p2p forum thing gets somewhere, it would be a good way to get some people to move away from the browser. Same applies to search engines and databases. We don't really need browsers to interface with them. We can build our own interfaces. What we need are protocols and standards we can agree upon. Wanna share your blog post? Write it in markdown, create a torrent for it and index the torrent on a database server that can be accessed through a terminal or just a custom desktop GUI or even an APK. Compare it to RSS readers: there's hundreds of them and you can pretty much choose whichever one you like. In the end the all do the same thing because they agree upon the RSS format. Same needs to happen for blog posts, forums, indexing databases et al. Anyways, just some thoughts. Will keep lurking here

>>76680 Runs on my machine, therefore, it runs

>>76716 >Disgusting picture. Most hives have one big leader, it's extremely centralized and accepts no variation. Monoculture. Communist soykaf. Each person interprets things differently huh. >>76718 Yeah right now you seed everything on the boards you are "watching" (each board has its content in a separate p2p database). Each peer can delete content they don't like and stop seeding it, as well as subscribe to moderators. However there are some future improvements planned for Peerbit, the underlying database system, that will allow more granular control over the seeding of individual documents (posts, files, etc.). This would facilitate what you're describing with each peer explicitly choosing to seed given posts. >browser I should mention the main meat of the program doesn't actually run in the browser necessarily; basically there is a node express server that serves you pageviews but all the p2p stuff is happening on the backend server. I've been thinking the browser is familar to imageboard users and is already installed on most machines (obviating additional installation steps or dependencies as such), and has a robust HTML rendering engine built in so it's a nice thing to use to browse the content. There are also HTTP apis and stuff for various functions, like adding or removing boards. Maybe I should also include JSON format views like jschan has so that people can get the organized post data more simply via external programs and then process it as they want. But you can curl and stuff and get the html that way already without using a browser, though some functions require POST requests and aren't as CLI friendly in all cases. Agree with what you say about agreeing on protocols rather than interfaces.

>>76776 curl does post requests :) >there are some future improvements planned for Peerbit Perhaps the users could just be seeding live threads. For example, they would just serve all the threads they've watched (cached) recently. These automatically expire, either by time limit or simply a cache size limit. Then, in order to serve a thread permanently, perhaps there should be an "archive" button or something. In stead of caching, the thread is now moved to permanent storage. Every time the user runs the program, the archived and cached threads are being synced to its peers in order to fetch updates. This is also how you could get the notification system working. Are you familiar with Soulseek? It's a similar system. I think the seed/archive method would be a good system to filter content. In the short term, users serve all the threads they recently viewed, but they expire eventually after a couple days or weeks unless they seed/archive it. This way, valuable threads stay alive, whereas irrelevant, useless threads just die. Personally I wouldn't even bother about a delete system. Suppose you're on a mailing list, if you post something, you can't remove it either. Same IRL: if you say something, you can't unsay it. Your only hope is that people don't bother and just 'forget' (they don't seed/archive it). I would implement a block function though: if you're watching a thread and you don't like it (or has illegal material on it), you should be able to remove it from your cache. A question though, sorry if you already answered it, but I wonder if the backend server can see peer IP addresses? Naturally, VPN's are recommended, but I wonder if there would be a way to hide IP addresses. But I'm guessing that even if you did, tech savvy users who alter the source code could potentially find ways to expose IP's, no?

>>76716 >Disgusting picture. Most hives have one big leader, it's extremely centralized and accepts no variation. Monoculture. Communist soykaf. lain, this is a picture of cicada exoskeletons, they don't live in hives...

>>76718 >lurk on forums. Many people use an app to post on their social networks. So here the idea is to have a client that's the interface to the p2p. There can be as many clients as we want. Must be transparent, with no risk of any malicious shadow banning happening. >>76738 Fair.

What do you all think of bitchan ? https://github.com/813492291816/BitChan

>>77302 https://www.bleepingcomputer.com/news/security/bitmessage-zero-day-used-in-attacks-that-steal-bitcoin-wallet-files/