Tried it yesterday, no installation and (almost) no configuration required, works fine, nice GUI.
Features: file sharing, chat, group sharing (similar to private Freenet groups). Reminds me of eMule (loved that app) a bit, so if you loved eMule you’ll love this app.
But it’s not open source, for those who care about that (for this particular app, I don’t care, since it’s just downloads/uploads).
For file downloads (I tried some sample files) it works great, I was getting >1MB/s on large files (my maximum from the WiFi client I was using).
Tried it yesterday, no installation and (almost) no configuration required, works fine, nice GUI.
Seems like this falls victim to many of the same problems as the old p2p networks like Gnutella and others? Maybe I missed something
I don’t know what specifically you noticed, so I can’t say if I think you missed something.
What problems does it have?
I have trouble drumming up interest in an app that doesn’t have a revenue stream. Something is always intolerable about such apps: the customer support is ****, the features are worth what you paid for, i.e. ****, the usability is ****, or whatever else. Take your pick.
I’ll check it out if it manages to get a network effect going.
The author is a high caliber guy, not some kid, and he’s got some funding from McAfee too, so it’s like a small version of Kim Doctom’s app.
We’ll see what they come up with in terms of revenue/sustainability, but eMule kept going on forever (10+ years after the last release - I was happily using it until 2 years ago and I stopped only because of new corporate policy). I wouldn’t be surprised if there are still people using eMule today. Just from the main site they scored 500 million downloads. Anyone who fails the way eMule did can be proud
If everything else fails they can always fall back on the same business model as Bittorrent (ads + premium features). It’s a crappy model but it works for apps that are better than the free alternatives.
Awesome write-up. Thank you!
Thank you. I resigned from Rockstar Games ~2 months ago to focus full-time on demonsaw. I worked for Rockstar almost 5 years, and during that time I shipped GTAV on 5 different platforms (PS3, 360, PC, XB1, PS4). GTAV made a lot of money and Rockstar Games was very generous with respect to financially compensating its employees (bonuses, etc). Instead of spending that money, I decided to use it to fund my work on demonsaw. I have enough in reserve to spend the next few years focusing on demonsaw, in hopes of safeguarding our privacy & maybe even saving the Internet for future generations.
Keep up the good work! The Demonsaw project is awesome!
ATTACKS THAT DO NOT WORK ON ANY VERSION OF DEMONSAW:
Any type of passive traffic analysis (correlation, timing, etc) does NOT work.
I dont think you understand how these attacks work, they trace patterns across the network, they call them netflows. Any global adversary can see them, this is why Tor does not protect against this, but we bank on the 5 eyes not having a tap between every relay. Still though if they can see a netflow leaving your computer and then reaching a server then all of Tor in between accomplished nothing.
Packets will be sized randomly.
This is one of the vulnerabilites Tor originally had, they began padding all packets to 512bytes to eliminate this. The reason Tor is currently vulnerable ito a global adversary is due to its low latency the flow of packets create a unique signature that can be traced, adding jitter does little to help this and mixing with other packets in a way that doesnt create massive lag is an unsolved problem.
Currently there are no networks that protect against a global passive adversary except for bitmessage which takes the approach of every node sending all messages to all other nodes at once an then check if any of them are for yours. This is the only way to protect against such a thing, for everyone to send all packets to everyone else at once, this creates a high latency high bandwidth design that is severely limited.
Im sure your network will protect against most corporate and law enforcement efforts but do not say it is NSA-proof, this is simply not true.
Feelz is the SAFE network covered by “currently” or not?
There were discussions about that in the past on this forum.
@eijah I listened to a recent podcast and was encouraged by your attitude and expertise. Will the app provide an API or REST interface? Best of luck and merry X’mas!
This is one of the features on the table for version 4.0 (no ETA right now, but likely about 1 year out at this time). We need to make sure that adding an API doesn’t create additional attack vectors and/or make the app confusing to use by non-technical individuals.
Any response to this @Eijah ?
It isn’t worrysome if one uses decentralized IP allocation table - meshnet.
Thanks for that.
@Eijah ? feelz made some valid points. Can you fill us in?
Thanks for the feedback. To begin with, demonsaw is different from traditional network security applications. Demonsaw gives total control of security to the user, allowing them to configure security at whatever level they want based on their unique security needs (key & primes bit sizes, # layers of crypto, etc). The primary goals of demonsaw are secrecy, privacy & control. The secondary goals of demonsaw is anonymity through a unique combination of configuration elements, opt-in/out features, and network architecture. In terms of anonymity, demonsaw takes a unique approach to solving this problem. Users can choose any or all of the following configurations to suit their needs.
- No P2P. Clients never directly communicate. This removes the source of most ISP notices that people receive, while also providing a surface-layer protection.
- You can totally control/own the endpoints. By controlling all of the entry & exit nodes on a hidden/private network, you can avoid any traffic analysis associated with publicly facing networks. Even if a demonsaw network is private, but not totally internal, you can modify your network on the fly, causing new paths to be generated which can avoid trace patterns from being easily obtained. Most people who use demonsaw do it in this fashion, via a private and internal network or via a private network that’s partially publicly-facing with ownership of all entry/exit nodes. As you pointed out… TCP/IP packets must be sent through ISP routers, but there is little that can be done to avoid this for publicly-facing networks.
- Network design: message router & data router abstraction. The 3 tier architectural abstraction of client, message & data router provides clear and precise separation of duties (similar to Perfect Forward Secrecy). This abstraction is much more powerful in 3.0 as clients will assume full responsibility to elect which nodes they traverse in the network.
- You can always use traditional Proxy/VPN & Tor. It’s better to be paranoid than be caught. There’s no reason why you can’t tack on more traditional solutions to mask your IP, if you want.
- 2.6: Ghosting (browse, search, transfer, chat, message, etc). Next week we’re launching a new version which allows the clients to opt-out of certain features in the app, to prevent IP doxing as Tonda said. You can opt-out of browse, search, transfer, chat, or private messaging. And you can modify this on a whim as well.
- 3.0: Client/Router Proxies. In 3.0 (DefCon 24 release) you will be able to setup message & data router proxies within the demonsaw application. This means that you can totally connect & interact with an external network via the comfort or another IP address. Proxy routers can be any existing demonsaw routers, and changeable at will. You could hide all of your activity behind a single $5/month Digital Ocean VPS or a random VPS. And you could switch on an hourly basis if you chose to do so.
- 3.0: Client controlled/defined message & data routers. Clients will be able to define a white list of the message & data routers that wish to pass through. By giving 100% control to the clients, you avoid the scenario where you get IP doxed by a data router during a file transfer, etc.
tl;dr version: Unlike Tor, demonsaw doesn’t have to go through public networks - it depends on how you configure your client & how you setup your network. Many people use demonsaw privately, far from the prying eyes of public government surveillance. In version 2.6 & 3.0 you’ll have 100% control in the client to further hide your activity by limiting unknown nodes in the network from consideration.
As a side note, demonsaw 2.0 uses a technique similar to bitmessage to send the same packets to every member of a group. As you mentioned, this is severely limiting in design and won’t scale to 100,000 users plus. White noise, padded packet sizes, or other obfuscation overhead is non-desirable because demonsaw is primarily an information sharing application that focuses on secrecy & privacy, then anonymity. Be it as it may, it still does an amazing job of protecting anonymity when configured in such a manner.
As a quick follow-up I’m abandoning this design in 3.0 due to the limitation in architecture. It worked fine in 1.0 & 2.0 but I need a new approach in 3.0. I haven’t settled on a design yet, but I don’t want to introduce noise or overhead into demonsaw transactions for the purpose of IP obfuscation. There are far more productive ways to achieve such IP masquerading (e.g. architecture) without incurring transaction overhead and thereby limiting the overall network.
By “private-networks” you mean a LAN? There was never an issue of surveillance and censorship with lans unless you are talioring this program for college students.
I dont see what your program solves that Tor or I2p doesnt. Tor already provides anonymity against everything but a global adversary. If you can crack that nut then hats off to you, otherwise it seems as if you are reinventing the wheel.
First, other networks are very hard (slow) or difficult to use. Demonsaw takes 0 minutes to use and runs fast. What other software works as well as DS? None.
Second, which “current” project does not reinvent the wheel when it comes to global adversaries? I asked you before if MaidSafe is reinventing the wheel to get a sense of proportion but you ignored that question.
Third, global adversaries don’t care about regular civilian use. They don’t even care much about illegal use by civilians (at least not now) either. They care about military (and paramilitary) and intelligence targets.
Holy crap! A v2.6 release! Well merry Christmas to you too friend! My first Porsche and now this! Only a multiracial harem (a la McAfee) would make this holiday better!!!
Demonsaw is designed for everyone, not just technically savvy individuals. Why have so many different distros of Linux if 1 could suffice? (https://en.wikipedia.org/wiki/List_of_Linux_distributions) It’s because everybody is different, and sometimes our preferences are different. People want simplicity and ease of use first, security & anonymity second. But they want all of this in an easy-to-use and simple-to-understand package that meets their needs. Demonsaw does this.
Demonsaw provides file sharing, chat, and private message right now. Android in 2 months. In 3.0 we’re adding file sync, streaming, and demoncast (a spotify-like feature). In 4.0 we’re adding VOIP, and API, etc. In 5.0 even more.
I’m committing the next 3-5 years of my life to demonsaw to make this the best information sharing app in the world. I’m not going anywhere.