lobsters score: 1 · tags: distributed
Learned a bit about Bittorrent and pkarr was new to me. The rewriting of
blake3.netandpkarr.netURLs is a clever hack but one that gives me pause. I obviously don’t understand the whole architecture from reading one blog post but the browser extension + localhost daemon combo could mean that a confused deputy vulnerability is lurking somewhere.
score 1 · canonical
You have to trust the local gateway. Assuming the gateway and plugin work as intended, the gateway has two functions, BLAKE3 lookups and pkarr lookups.
For BLAKE3 lookups they are content-addressed, so asking the gateway for some resource isn’t much different than asking any CDN for a resource. In fact arguably it is safer since you are guaranteed to get the content matching the hash.
For pkarr lookups you have to trust the author. But this isn’t fundamentally different to a request to a third party domain via https. If you get some resource from a CDN you have to trust the domain owner not to put malware there.
score 1 · canonical
So we need a tiny extra UDP address index service (udp-addr-index) to provide this mapping.
This feels close enough to STUN or TURN that I wonder if they could be repurposed. Probably not, but…
Conversely, I wonder what a malicious actor could do with spoofed UDP source addresses…
score 1 · canonical
For publishing I require a roundtrip with a token, so you can’t pretend to own an UDP source address you don’t own.
For the content, the record is signed with the iroh endpoint key, so you can’t impersonate an endpoint you don’t own.
score 1 · canonical
The other question is: who keeps that service running? And do they really get that much benefit from using mainline instead of just forking mainline to store EndpointId’s?
score 1 · canonical
In then long term I would love to get this service into mainline itself. It is extremely simple and generically useful, not just for iroh.
The benefit of using mainline is that it is a huge deployed DHT. I have also experimented with writing a new DHT using iroh connections, but I want a solution for this problem now.
score 1 · canonical