Charme
Consumer and social
decentralized social network
SHOW HN2016
167points
61comments
#188of 2,264 in 2016
Top 9%of 2016 by points
How HN took it
CuriousMostly questions and neutral comments
2 positive, 15 neutral or asking, 2 mixed, 11 critical, out of 30 comments about the project. Thread score -0.26.
Privacy: 0 for, 7 againstIdea: 1 for, 2 againstExecution: 0 for, 2 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Good idea that deserves a solution
From 2 comments
Nice. Keep working on it. We need a solution. What's your stack?
erikbigelow on HNI want this to work so much. So many people have tried this, and I have signed up for, or self-hosted, every single one of these things, and even convinced my friends to join a…
beatpanda on HN
Maker was open to feedback and honest about being a preview
From 2 comments
Yes, as written on top this is a technology preview, so it is not safe yet. Furthermore the production version will use the web crypto api. The client software must be shipped…
mschultheiss on HN1. The web crypto api was indeed made to secure communications, such as stated by the W3C on http://www.w3.org/TR/WebCryptoAPI/ (...) "Uses for this API range from user or…
mschultheiss on HN
Objections
Browser JavaScript crypto is not secure
From 3 comments
The cryptography in this system does not appear to be safe. Apart from the fact that it's browser Javascript, which can only be as secure as the server's verified TLS key anyways…
tptacek on HNUnfortunately, the Web Crypto API doesn't automatically get you safe cryptography either. It was added by the W3C to allow video vendors to implement content DRM in pure…
tptacek on HN> Apart from the fact that it's browser Javascript Huge red flag.
nyan4 on HN
Custom RSA/AES design is unsafe; needs expert audit
From 2 comments
The cryptography in this system does not appear to be safe. Apart from the fact that it's browser Javascript, which can only be as secure as the server's verified TLS key anyways…
tptacek on HN> 1. The web crypto api was indeed made to secure communications, such as stated by the W3C on http://www.w3.org/TR/WebCryptoAPI/ (...) "Uses for this API range from user or…
sarciszewski on HN
No forward secrecy
From 1 comment
Even if he makes all those decisions correctly the system won't support forward secrecy.
Canada on HN
Needs a user base; past decentralized networks never took off
From 2 comments
I want this to work so much. So many people have tried this, and I have signed up for, or self-hosted, every single one of these things, and even convinced my friends to join a…
beatpanda on HNYes. There's Diaspora and Frendica already, with maybe a few hundred users. To launch something like this, you need to figure out some way to get a user base, a user base that…
Animats on HN
Passwords cannot be recovered; users lose keys
From 1 comment
One main problem is that you have to make passwords recoverable. In real world message like "warring! we can't restore your key!" just doesn't work at all. People ignore it and…
ex3ndr on HN
Requests
Get a cryptography expert audit and design the protocol
From 2 comments
The cryptography in this system does not appear to be safe. Apart from the fact that it's browser Javascript, which can only be as secure as the server's verified TLS key anyways…
tptacek on HN> 1. The web crypto api was indeed made to secure communications, such as stated by the W3C on http://www.w3.org/TR/WebCryptoAPI/ (...) "Uses for this API range from user or…
sarciszewski on HN
Use libsodium or the Web Crypto API correctly
From 2 comments
> 1. The web crypto api was indeed made to secure communications, such as stated by the W3C on http://www.w3.org/TR/WebCryptoAPI/ (...) "Uses for this API range from user or…
sarciszewski on HNWebCrypto is a potluck of popular cryptography standards, chosen by committee. What you want instead is a library that carefully selects primitives with an emphasis on: ``` 1.…
sarciszewski on HN
Build a desktop client instead of browser crypto
From 2 comments
Sure, but consider this: Do you know what stops all passive attackers and most active attackers? TLS. Do you know what WebCrypto adds that TLS doesn't? Nothing. That's why this…
sarciszewski on HNAs someone who has been working on something similar (see old proof of concept here: https://ciety.com - sorry for the expired ssl certificate), I applaud your efforts. I have…
dutchbrit on HN
Questions
How is it different from Diaspora?
From 1 comment
how is it different from diaspora?
sedatk on HN
How does discovery work?
From 2 comments
How do you handle discovery is it location based or in person like a darknet?
zitterbewegung on HNDiscovery is crucial. A social network can be thought of as a kind of search engine: you're trying to find people, posts and resources that are relevant to your interests. On the…
benwerd on HN
Why not peer-to-peer without a server?
From 1 comment
Is there a reason why this still relies on a server? I would have thought that the better option would it to be completely P2P, without any servers whatsoever.
synchronise on HN
How would bots run without self-hosting?
From 1 comment
How do you run the bots if you don't self-host them?
Quiark on HN
Alternatives named
Diaspora
From 2 comments
how is it different from diaspora?
sedatk on HNI support the idea behind this, but I love the community on Diaspora, and more importantly it is also decentralized and open-source.
rndmind on HN
Friendica
From 1 comment
Yes. There's Diaspora and Frendica already, with maybe a few hundred users. To launch something like this, you need to figure out some way to get a user base, a user base that…
Animats on HN
Movim (XMPP)
From 1 comment
It's a nice effort, but it's covered in warnings that say "don't use this" - therefore, not yet interesting. I'm going to leave this here: https://movim.eu/ Movim is a social…
tethra on HN
IRC with private channels
From 1 comment
This is a serious question, because it's the situation I'm in: Why would somebody who is techy enough to use a decentralized social network, not just use IRC? I have a group of…
Swizec on HN