search

rule110-io / surge

Surge is a p2p filesharing app designed to utilize blockchain technologies to enable 100% anonymous file transfers. Surge is end-to-end encrypted, decentralized and open source.
https://getsurge.io
Apache License 2.0
421 stars 48 forks source link

Export hashes to Virustotal? #21

Closed Darthagnon closed 3 years ago

Darthagnon commented 3 years ago

Is your feature request related to a problem? Please describe. You currently have hashes in the GUI (bit difficult to tell if I've selected the whole hash or not, due to ellipsis and popup). However, I can find no way of indicating "trusted" peers, or reliable sources. Opening the program shows a list of seeded files (PDFs, JPEGs, Movies) any of which could be viruses. The magnet link implementation will help, as I'll know what site I got the magnet from. But currently, I can't really use it. Would it be possible to implement a way of exporting hashes directly to Virustotal? or perhaps getting rid of the ellipsis, so that it doesn't look like it's replacing half the hash? or a way of trusting/untrusting peers?

MutsiMutsi commented 3 years ago

Hi @Darthagnon thank you for your interest!

You're correct that the enduser has little means of file integrity validation at this time (the client will verify file integrity however), the fileid/filehash is a SHA256 hash of the file, we should make it so that this hash can easily be read out for the tech savvy users.

With regards to "trusted peers" there isn't really such a thing in a completely decentralised implementation such as we have now, all peer and file discovery is done by the client, there is no central server for reputation, or associations with files.

That said when we have a good centralised system going we have nothing against the idea of having a centralised service that tracks seeders and files, indexes those in a database and provides a sort of centralised endpoint akin to something like the piratebay.

We do plan to add a way to add contacts, share privately with those contacts that could be in a form of direct sharing 1:1 or perhaps private groups, this would then include a way to add addresses as contacts on your local machine so that you can be sure of who you are sharing with.

Darthagnon commented 3 years ago

Thank you so much for the explanation!

From first impressions, it looks promising!

From the documentation, it appears to run on a blockchain - could metadata/reputation be circulated on that as part of transactions or identifier exchanges?

Another thing I'd wondered - is the blockchain a big dependency? or e.g. if all but 2 users were to disappear, would they still be able to connect to each other? (nervous, as I've heard of lots of cryptocurrencies and related blockchain tech coming and going)

MutsiMutsi commented 3 years ago

You're very welcome, and I'm glad you think its promising!

We do use blockchain to have a verifiable and immutable identity to communicate with on the network to ensure anonimity. These identities (nkn addresses) need a decentralised manner to announce themselves as participants on Surge. The solution here is the blockchain. As far as I am aware there simply is no decentralised alternative that can achieve the same result.

That said NKN has been around for a while now, its only been growing, if you compare it to an altruistic network like TOR that is still around, then NKN has a financial incentive for the next 25 years or so, and already far exceeds TOR in both scale and security. So that gives me the confidence that we will have no problem with availability of the network for the forseeable future.

To answer your last part if all but two NKN nodes survive, yes it would still be possible but security and efficient pathing/connectivity of course can no longer be guaranteed.

If there are sufficient nodes running (currently more than 30k globally) and there are only 2 surge clients running that is no problem at all even considering me and my colleagues dropped dead tomorrow and there was no more website, nothing left of our efforts, as long as someone is running the surge client somewhere you can connect and share files with eachother, this is of course the beauty of decentralisation.

MutsiMutsi commented 3 years ago

@Darthagnon the new version allows for copying out the SHA256 hash, which is compatible with VirusTotal.