Re:Scuttlebutt, a Decentralized Alternative to Facebook
by bigiain on Thursday April 19, 2018 @08:03PM
(#16881194)
> I trust Facebook's security team to audit and patch much more than I trust any random friend.
Sure, but I wouldn't choose "a random friend" to run my FB replacement service, I'd choose a trusted friend. And more importantly, no matter how good Facebooks security team are at patching and auditing servers - THEY ARE THE ADVERSARY IN THIS CONTEXT!
Re:Scuttlebutt, a Decentralized Alternative to Facebook
by gregknicholson on Friday April 20, 2018 @02:00AM
(#16882460)
> Sure, but I wouldn't choose "a random friend" to run my FB replacement service, I'd choose a trusted friend.
How does this relate to scuttlebutt? There's no scuttlebutt “service”; it's a tool and a protocol, like a pen and the English language.
> no matter how good Facebooks security team are at patching and auditing servers - THEY ARE THE ADVERSARY IN THIS CONTEXT!
I think this is the salient point: if you send data to your friend, they necessarily have that data and can leak it; but there's no need for a stranger with unknown motives (Facebook) to also have that data.
No, not at all! TOR is fully encrypted, but there are somewhat regular vulnerability reports about various parts of the stack. Including criticial vulnerabilities that can and have been exploited by nation states, for example.
> This is no worse than Facebook though
This is not at all clear to me. The attack surface for Scuttlebutt is much larger, and I trust Facebook's security team to audit and patch much more than I trust any random friend.