i2p.www/i2p2www/blog/2004/09/14/status.html

<pre>-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi y'all, its that time of the week again

* Index:

1) 0.4.0.1
2) Threat model updates
3) Website updates
4) Roadmap
5) Client apps
6) ???

* 1) 0.4.0.1

Since last Wednesday's 0.4.0.1 release, things have been going
pretty well on the net - more than 2/3rd of the network has
upgraded, and we'e been maintaining between 60 and 80 routers on
the network.  IRC connection times vary, but lately 4-12 hour
connections have been normal.  There have been some reports of
funkiness starting up on OS/X though, but I believe some
progress is being made on that front too.

* 2) Threat model updates

As mentioned in reply [1] to Toni's post [2], there has been a
pretty substantial rewrite of the threat model [3].  The main
difference is that rather than the old way of addressing the
threats in an ad-hoc manner, I tried to follow some of the
taxonomies offered within the literature [4].  The biggest
problem for me was finding ways to fit the actual techniques
people can use into the patterns offered - often a single
attack fit within several different categories.  As such, I'm
not really too pleased with how the information in that page
is conveyed, but its better than it was before.

[1] <a  rel="nofollow" href="http://dev.i2p.net/pipermail/i2p/2004-September/000442.html">http://dev.i2p.net/pipermail/i2p/2004-September/000442.html</a>
[2] <a  rel="nofollow" href="http://dev.i2p.net/pipermail/i2p/2004-September/000441.html">http://dev.i2p.net/pipermail/i2p/2004-September/000441.html</a>
[3] <a  rel="nofollow" href="http://www.i2p.net/how_threatmodel">http://www.i2p.net/how_threatmodel</a>
[4] <a  rel="nofollow" href="http://freehaven.net/anonbib/topic.html">http://freehaven.net/anonbib/topic.html</a>

* 3) Website updates

Thanks to Curiosity's help, we've begun on some updates to the
website - the most visible of which you can see on the homepage
itself.  This should help people out who stumble upon I2P and
want to know right off the bat wtf this I2P thing is, rather
than having to hunt and peck through the various pages.  In any
case, progress, ever onwards :)

* 4) Roadmap

Speaking of progress, I've finally thrown together a revamped
roadmap [5] based upon what I feel we need to implement and upon
what must be accomplished to provide for the user's needs.  The
major changes to the old roadmap are:

 * Drop AMOC altogether, replaced with UDP (however, we'll support
   TCP for those who can't use UDP *cough*mihi*cough*)
 * Kept all of the restricted route operation to the 2.0 release,
   rather than bring in partial restricted routes earlier.  I
   believe we'll be able to meet the needs of many users without
   restricted routes, though of course with them many more users
   will be able to join us.  Walk before run, as they say.
 * Pulled the streaming lib in to the 0.4.3 release, as we don't
   want to go 1.0 with the ~4KBps per stream limit.  The bounty on
   this is still of course valid, but if no one claims it before
   0.4.2 is done, I'll start working on it.
 * TCP revamp moved to 0.4.1 to address some of our uglier issues
   (high CPU usage when connecting to people, the whole mess with
   &quot;target changed identities&quot;, adding autodetection of IP address)

The other items scheduled for various 0.4.* releases have already
been implemented.  However, there is one other thing dropped from
the roadmap...

[5] <a  rel="nofollow" href="http://www.i2p.net/roadmap">http://www.i2p.net/roadmap</a>

* 5) Client apps

We need client applications.  Applications that are engaging,
secure, scalable, and anonymous.  I2P by itself doesn't do much,
it merely lets two endpoints talk to each other anonymously.
While I2PTunnel does offer one hell of a swiss army knife, tools
like that are only really engaging to the geeks among us.  We need
more than that - we need something that lets people do what they
actually want to do, and that helps them do it better.  We need a
reason for people to use I2P beyond simply because its safer.

So far I've been touting MyI2P to meet that need - a distributed
blogging system offering a LiveJournal-esque interface.  I
recently [6] discussed some of the functionality within MyI2P on
the list.  However, I've pulled it out of the roadmap as its just
too much work for me to do and still give the base I2P network the
attention it needs (we're already packed extremely tight [7]).

There are a few other apps that have much promise.  Stasher [8]
would provide a significant infrastructure for distributed data
storage, but I'm not sure how that's progressing.  Even with
Stasher, however, there would need to be an engaging user
interface (though some FCP apps may be able to work with it).

IRC is also a potent system, though has its limitations due to
the server-based architecture.  oOo has done some work to see
about implementing transparent DCC though, so perhaps the IRC
side could be used for public chat and DCC for private file
transfers or serverless chat.

General eepsite functionality is also important, and what we
have now is completely unsatisfactory.  As DrWoo points out [9],
there are significant anonymity risks with the current setup,
and even though oOo has made some patches filtering some
headers, there is much more work to be done before eepsites can
be considered secure.  There are a few different approaches to
addressing this, all of which can work, but all of which
require work.  I do know that duck mentioned he had someone
working on something, though I don't know how thats coming or
whether it could be bundled in with I2P for everyone to use
or not.  Duck?

Another pair of client apps that could help would be either a
swarming file transfer app (ala BitTorrent) or a more
traditional file sharing app (ala DC/Napster/Gnutella/etc).
This is what I suspect a large number of people want, but there
are issues with each of these systems.  However, they're well
known and porting may not be much trouble (perhaps).

Ok, so the above isn't anything new - why did I bring them all
up?  Well, we need to find a way to get an engaging, secure,
scalable, and anonymous client application implemented, and it
isn't going to happen all by itself out of the blue.  I've come
to accept that I'm not going to be able to do it myself, so we
need to be proactive and find a way to get it done.

To do so, I think our bounty system may be able to help, but I
think one of the reasons we haven't seen much activity on that
front (people working on implementing a bounty) is because
they're spread too thin.  To get the results we need, I feel we
need to prioritize what we want and focus our efforts on that
top item, 'sweetening the pot' so as to hopefully encourage
someone to step up and work on the bounty.

My personal opinion is still that a secure and distributed
blogging system like MyI2P would be best.  Rather than simply
shoveling data back and forth anonymously, it offers a way to
build communities, the lifeblood of any development effort.  In
addition, it offers a relatively high signal to noise ratio,
low chance for abuse of the commons, and in general, a light
network load.  It doesn't, however, offer the full richness of
normal websites, but the 1.8 million active LiveJournal users
don't seem to mind.

Beyond that, securing the eepsite architecture would be my
next preference, allowing browsers the safety they need and
letting people serve eepsites 'out of the box'.

File transfer and distributed data storage are also incredibly
powerful, but they don't seem to be as community oriented as
we probably want for the first normal end user app.

I want all of the apps listed to be implemented yesterday, as
well as a thousand other apps I couldn't begin to dream of.  I
also want world peace, and end to hunger, the destruction of
capitalism, freedom from statism, racism, sexism, homophibia,
an end to the outright destruction of the environment and all
that other evil stuff.  However, we are only so many people
and we can only accomplish so much.  As such, we must
prioritize and focus our efforts on achieving what we can
rather than sit around overwhelmed with all we want to do.

Perhaps we can discuss some ideas about what we should do in
the meeting tonight.

[6] <a  rel="nofollow" href="http://dev.i2p.net/pipermail/i2p/2004-September/000435.html">http://dev.i2p.net/pipermail/i2p/2004-September/000435.html</a>
[7] <a  rel="nofollow" href="http://www.i2p.net/images/plan.png">http://www.i2p.net/images/plan.png</a>
[8] <a  rel="nofollow" href="http://www.freenet.org.nz/python/stasher/">http://www.freenet.org.nz/python/stasher/</a>
[9] <a  rel="nofollow" href="http://brittanyworld.i2p/browsing/">http://brittanyworld.i2p/browsing/</a>

* 6) ???

Well, thats all I've got for the moment, and hey, I got the
status notes written up *before* the meeting!  So no excuses,
swing on by at 9pm GMT and barrage us all with your ideas.

=jr

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBQUc1OhpxS9rYd+OGEQLaYQCg0qql8muvuGEh46VICx4t69PuRl8An0Ki
3GEF2jrg/i9csiMO6VdQccxH
=4Tip
-----END PGP SIGNATURE-----


</pre>