From fcappello@hotmail.com Mon Oct 1 08:43:04 2001 From: fcappello@hotmail.com (Franck Cappello) Date: Mon, 1 Oct 2001 03:43:04 -0400 Subject: International Workshop on Global and Peer-to-Peer Computing Dear Colleagues, Please find bellow the call for paper of the "International Workshop on Global and Peer-to-Peer Computing" which will take place along with the CCGRID 2002 conference in Berlin, Germany, 21-24 May 2002. We take this opportunity to invite you to submit scientific papers to this workshop. Please forgive us if you receive several copies of this message. Feel free to forward this message to your colleagues. Best Regards. International Workshop on "Global and Peer-to-Peer Computing On Large Scale Distributed Systems" (http: http://www.lri.fr/~fci/GP2PC.htm) organized at the IEEE International Symposium on Cluster Computing and the Grid 2002 CCGRID 2002 In cooperation with the IEEE Task Force on Cluster Computing (TFCC) SCOPE The wide spread of the World Wide Web along with the availability of increasingly powerful off-the-shelf hardware give rise to a new infrastructure for distributed computing. Besides traditional grid computing systems, it is now possible to run computations on a large number workstations, personal computers and servers using a large scale and loosely coupled system. This type of distributed computing, also referred to as Global Computing, is currently used for a large variety of physic, mathematics and biology applications mostly following the Master/slave paradigm. Peer-to-Peer interaction models give the opportunity to enlarge the number of user and applications of Global Computing by allowing any resource to send job or/and data requests, provide data or/and computation services and participate to maintain the infrastructure itself. Because of their size and the high volatility of their resources, Global Computing and Global Peer-to-Peer Computing platforms provide the opportunity for researchers to revisit distributed computing major fields: protocols, infrastructures, security, certification, fault tolerance, scheduling, performance, etc. Authors are invited to submit original, unpublished work describing current research in the area of Global and Peer-to-Peer Computing including design and analysis of computational infrastructures as well as applications in science, technology, and commerce. TOPICS Topics of interest include, but are not limited to: * Global Computing and Peer-to-Peer computing platforms, * Autonomous, self organizing and/or mobile distributed systems, * Middleware, programming models, environments and toolkits, * Protocols for resource management/discovery/reservation/scheduling, * Economic considerations of resource usage (protocols, accounting), * Storage in Global Computing Infrastructures (strategies, protocols) * Performance monitoring, benchmarking, evaluation and modeling of Global Computing and Peer-to-Peer systems and/or components thereof, * Security, management and monitoring of resources, * Result certification (detection/tolerance of wrong/corrupted results), * Parallel computing on large scale distributed systems, * Compute or I/O driven applications (scientific, engineering, business), * Global and Peer-to-Peer computing applications (programmed from scratch, ported from sequential, or parallel version, adaptations to fit a global computing environment) PAPER SUBMISSION Authors are encouraged to: Submit a full paper (max: 6 pages in length, formatted to the IEEE format) Submit a research statement (max: 2 pages in length, formatted to the IEEE format) Use a minimum of 10pt font, and printable on A4 paper. IEEE guidelines can be found here. Please email your papers to fci@lri.fr or lalis@ics.forth.gr which is the preferred method for submission. Full papers (category (a)) will be reviewed by the program committee for relevance, clarity and the novelty of results. If accepted, full papers will be published in the conference proceedings by IEEE Computer Society. Authors may purchase two additional pages. Short papers (category (b)) will be published in a separate section. This is to encourage work that is not yet advanced enough for a full paper. We also encourage authors to present novel ideas, critique of existing work, and application examples, which demonstrate how Global and Peer-to-Peer Computing technology could be effectively deployed. We also welcome practical work which applies Global and Peer-to-Peer Computing technology in novel and interesting ways. IMPROTANTES DATES Papers due: November 24, 2001 Notification to authors: December 21, 2001 Final version of papers due: February 15, 2002 PROGRAM COMMITTEE (still expanding) Mark Baker, DCS , University of Portsmouth, UK Taisuke Boku, CCP, University of Tsukuba, Japan Franck Cappello, CNRS, Paris-South University, France Henri Casanova, SDSC, California, USA Christian Huitema, Microsoft, USA Spyros Lalis, FORTH, Greece Serge Petiton, LILF, Lille University, France Avi Rubin, AT&T Labs - Research, USA Mitsuhisa Sato, CCP, University of Tsukuba, Japan SESSION CHAIRS For more information please contact: Franck Cappello, Spyros Lalis, CNRS, Institute of Computer Science Universite Paris-Sud, Foundation for Research and Technology Hellas France, Greece, fci@lri.lri.fr lalis@ics.forth.gr From antr@microsoft.com Sat Oct 6 13:23:48 2001 From: antr@microsoft.com (Antony Rowstron) Date: Sat, 6 Oct 2001 08:23:48 -0400 Subject: CFP: The 1st International Workshop on Peer-to-Peer Systems (IPTPS'02) CALL FOR PARTICIPATION: IPTPS'02 The 1st International Workshop on Peer-to-Peer Systems (IPTPS'02) 7-8 March, 2002 MIT Faculty Club, Cambridge, MA, USA. http://www.cs.rice.edu/Conferences/IPTPS02/ Peer-to-peer has emerged as a promising new paradigm for distributed computing. The 1st International Workshop on Peer-to-Peer Systems (IPTPS'02) aims to provide a forum for researchers active in peer-to-peer computing to discuss the state-of-the-art and to identify key research challenges in peer-to-peer computing. The goal of the workshop is to examine peer-to-peer technologies, applications and systems, and also to identify key research issues and challenges that lie ahead. In the context of this workshop, peer-to-peer systems are characterized as being decentralized, self-organizing distributed systems, in which all or most communication is symmetric. Topics of interest include, but are not limited to: * novel peer-to-peer applications and systems * peer-to-peer infrastructure * security in peer-to-peer systems * anonymity and anti-censorship * performance of peer-to-peer systems * workload characterization for peer-to-peer systems The program of the workshop will be a combination of invited review talks, presentations of position papers, and discussions. To ensure a productive workshop environment, attendance will be limited to about 35 participants who are active in the field. Each potential participant should submit a position paper of 5 pages or less that exposes a new problem, advocates a specific solution, or reports on actual experience. Participants will be invited based on the originality, technical merit and topical relevance of their submissions, as well as the likelihood that the ideas expressed in their submissions will lead to insightful technical discussions at the workshop. Please do not submit abbreviated versions of journal or conference papers. Online copies of the position papers will be made available prior to the workshop. We are investigating the possibility of producing a printed proceedings, including a summary of the interactions at the workshop, which would be mailed to participants after the workshop. Steering committee: Peter Druschel, Rice University, USA Frans Kaashoek, MIT, USA Antony Rowstron, Microsoft Research, UK Scott Shenker, ACIRI, Berkeley, USA Ion Stoica, UC Berkeley, USA Organizing chairs: Frans Kaashoek, MIT, USA Antony Rowstron, Microsoft Research, UK Program Committee: Ross Anderson, Cambridge University, UK Roger Dingledine, Reputation Technologies, Inc., USA Peter Druschel, Rice University, USA (co-chair) Steve Gribble, University of Washington, USA David Karger, MIT, USA John Kubiatowicz, UC Berkeley, USA Robert Morris, MIT, USA Antony Rowstron, Microsoft Research, UK (co-chair) Avi Rubin, AT&T Labs - Research, USA Scott Shenker, ACIRI, Berkeley, USA Ion Stoica, UC Berkeley, USA Guidelines for Submission: To submit, authors should follow the instructions at http://www.cs.rice.edu/Conferences/IPTPS02/submit/. Papers must be submitted by 18:00 GMT, Monday, 3 December 2001. The length of the paper must not exceed 5 pages (11pt font, 1 inch margins). All submissions will be acknowledged by email within 24 hours of receipt. Important Dates: * 3 December 2001 : Submission of position papers * 4 February 2002 : Notification of Acceptance/Rejection * 1 March 2002 : Final copies of accepted papers * 7-8 March 2002 : IPTPS'02 From josh@mercuryfs.net Sun Oct 14 00:03:17 2001 From: josh@mercuryfs.net (Josh) Date: Sat, 13 Oct 2001 16:03:17 -0700 Subject: X.509 CA third party validation service Message-ID: <000101c1543b$3f34e7c0$35512304@koi> One of the changes I'm making to the file system design/sketch is the design of it's central network. I've thought of a method to utilize X.509 as the primary means of authentication where the central network does little more than record who the certificate authority is for your own network. Thus if you receive my files from somebody else, you can contact the central network to verify who I use as my certificate authority. Then you can contact that CA and verify the authenticity of the files. I believe this method could work well for the location independence feature. This makes the design more politically and financially feasible. Since my goal is a maximum of $10 per year, I think this is a much more realistic means of security. My question is this: does anyone know if there is already such a service, or if anybody has already thought of this? - josh From josh@mercuryfs.net Sat Oct 20 21:33:53 2001 From: josh@mercuryfs.net (Josh) Date: Sat, 20 Oct 2001 13:33:53 -0700 Subject: your freenet posts In-Reply-To: <20011020004957.67672.qmail@web21002.mail.yahoo.com> Message-ID: <000601c159a6$8934b2e0$35512304@koi> Martin, if you read my posts then you saw me state that I will be forwarding any more messages I receive regarding freenet back to their chat list. However, I've finally stopped receiving emails (or should I say lectures about the definition of open source) from them. So instead I'm copying this message to another group which has been just as prejudicial, liberal, and useless as the freenet crowd because it may help them to understand what happened. Especially since I just posted a brief and professional message to the list the other day and received another useless insult of a reply, and of course it was a private email. To answer your question, the reason I approached them was a business proposition. I was excited to find out about their project, but didn't do enough research on them because I've got so much stuff on my to do list. Once I learned that Ian had received funding and was forming a company, I assumed he was a businessman who'd be interested in hearing a business proposition. That was mistake #1. When I asked him to return my phone call, he replied "I prefer email". That should have caused me to realize the type of person I'm approaching. That was mistake #2. He was interested in reviewing my design, but didn't have the courtesy to reply to my email once I asked him to sign a non-disclosure (I had not yet filed for the patent). I should have just moved on, but instead announced the design on the freenet list a month or so later when I had filed for the patent. That was mistake #3, because he clearly had no intention of hearing me out. He was too busy inviting his group to tear into me. Quite an unprofessional response. I found Ian to be a politically correct snob who thinks people seeking patents are bad people. His group views open source as a religion, and like most religions they argue about the 10% difference between their philosophy and other philosophies, while ignoring the 90% we have in common. I remember seeing a post that goes something like "the day is upon us, the BSD license is being pitted against the GNU license, lets all rally together, blah blah blah" No wonder Microsoft dominates; these fools are all too busy arguing among themselves. I'm against most forms of censorship, key escrow, and other common things. I do not support the elimination of copyrights or the rejection of patents. My end goals are similar to freenet's, but the philosophy and methods of achieving those goals are different. To use an analogy, think of me as a republican who's opposed to the death penalty because of the recent DNA evidence that shows that 10% of death row inmates are innocent. I have no problem with the death penalty, but I do have a problem with a flawed system run by ass backwards bureaucrats. Now think of Ian as the liberal who's opposed to the death penalty for moral reasons. Now consider me approaching him as saying "lets work together on a common goal", and him saying "get lost you conservative puke". That's how I view what happened. But I've also run into other groups (such as the second CC address of this email) that are just as worthless as the freenet crowd, and they aren't even political projects like freenet. It's amazing how only 2 of their replies were useful, and one was a response to a question about freenet. The main reason they pissed me off is that they remind me of people who always create personnel problems. I come from a project management background, and am so sick of dealing with close minded idealists that are politically correct yet worthless. I'm so sick of people who waste time on idealism and argue about petty details. To answer your question of why I went about it in that way: I was really pissed off, and didn't think before I typed. My emails for the last 8 years have been to people I've already met face to face, or to tech support people. So I'm not used to the online crowd or meeting people thru emails. I should have spent more than 10 minutes typing the license, which contained statements that were easily misinterpreted. It was definitely not ready for the public, and these guys treat licenses as holy scripture. Plus I could should found a better license to modify than GNU, because it's the most liberal of open source licenses. Basically, the patent app came in the mail and I immediately went online with what I had because I was excited, even though it wasn't ready. When they decided to discuss everything BUT the design, I was a bit shocked. What you didn't see in their email archives was the amount of private messages that was completely insulting and useless. I allowed myself to get angry because of those messages, so my responses were not professional. I was also stressed out and really pissed off because I thought the FBI had contacted me, and I really couldn't understand why; it's just a design and an incomplete one at that. I now know it was some ex-coworkers screwing with my head. I've notified the FBI with some proof they impersonated them, which is a serious crime, but there were no finger prints on the letter they sent me other than my own, so they aren't going to do anything about it. I spent a good amount of money putting a law firm on retainer to deal with this, and that retainer fee is non refundable since it was a hoax. I've illegally obtained emails that prove it was them, but they can't be used as evidence in court. Add that all together and you've got the explanation of what happened. Altogether, it was a big mistake and I've learned from it. Good luck with your report, and keep in mind that my project isn't exactly peer to peer (or client/server), so I'd keep it out of your report. Assuming your report is for school, here are a few tips: Be sure to check out www.oreilly.com, and click on the P2P section, it's a good starting point. Also note that P2P has been around for a long time, it's not a new buzzword. For example, my first introduction to it was Artisoft's Lantastic in the 1980's, but it probably goes back to distributed mini computers of the 1970's (an assumption). I'm not pro at P2P. - josh -----Original Message----- From: martin chao [mailto:martin12345678992649@yahoo.com] Sent: Friday, October 19, 2001 5:50 PM To: josh@mercuryfs.net Subject: your freenet posts Hello, I was reading the freenet e-mail archives and I ran across your posts. I must say, their responses really illustrates the tunnel vision mentality of these people. I'm curious, why did you choose to engage this group? And why did you go about it in that way? (your design comes across much more professionally than those email posts). The reason I ask is for a report I'm writing about peer to peer technologies. Thank you __________________________________________________ Do You Yahoo!? Make a great connection at Yahoo! Personals. http://personals.yahoo.com From george-oldenburg@pobox.com Sat Oct 20 21:47:49 2001 From: george-oldenburg@pobox.com (george-oldenburg@pobox.com) Date: Sat, 20 Oct 2001 13:47:49 -0700 Subject: your freenet posts In-Reply-To: Message-ID: <000701c159a8$7b8fbd40$35512304@koi> > I found Ian to be a politically correct snob That's an understatement. > I was also stressed out and really pissed off because I thought the FBI had contacted me, and I really couldn't understand why; it's just a design and an incomplete one at that. I now know it was some ex-coworkers screwing with my head. You should consider a civil suit, but it may cost you as much as you intend to recoup. You may want to avoid the courts completely, it will take years. Your X.509 CA validation idea needs more detail. I am not aware of any existing service like that. Recording who the CA isn't enough, you need the signature of the certificate, its serial #, etc. Plus you need to address how your service will avoid being spoofed itself. Considering the past responses you've received, I'd recommend you move over to the cipherpunks list. They will be far more useful for your project than these people. George O. -----Original Message----- From: Josh [mailto:josh@mercuryfs.net] Sent: Saturday, October 20, 2001 1:34 PM To: Global-Scale Distributed Storage Systems Cc: Bluesky global storage list (E-mail) Subject: RE: your freenet posts Martin, if you read my posts then you saw me state that I will be forwarding any more messages I receive regarding freenet back to their chat list. However, I've finally stopped receiving emails (or should I say lectures about the definition of open source) from them. So instead I'm copying this message to another group which has been just as prejudicial, liberal, and useless as the freenet crowd because it may help them to understand what happened. Especially since I just posted a brief and professional message to the list the other day and received another useless insult of a reply, and of course it was a private email. To answer your question, the reason I approached them was a business proposition. I was excited to find out about their project, but didn't do enough research on them because I've got so much stuff on my to do list. Once I learned that Ian had received funding and was forming a company, I assumed he was a businessman who'd be interested in hearing a business proposition. That was mistake #1. When I asked him to return my phone call, he replied "I prefer email". That should have caused me to realize the type of person I'm approaching. That was mistake #2. He was interested in reviewing my design, but didn't have the courtesy to reply to my email once I asked him to sign a non-disclosure (I had not yet filed for the patent). I should have just moved on, but instead announced the design on the freenet list a month or so later when I had filed for the patent. That was mistake #3, because he clearly had no intention of hearing me out. He was too busy inviting his group to tear into me. Quite an unprofessional response. I found Ian to be a politically correct snob who thinks people seeking patents are bad people. His group views open source as a religion, and like most religions they argue about the 10% difference between their philosophy and other philosophies, while ignoring the 90% we have in common. I remember seeing a post that goes something like "the day is upon us, the BSD license is being pitted against the GNU license, lets all rally together, blah blah blah" No wonder Microsoft dominates; these fools are all too busy arguing among themselves. I'm against most forms of censorship, key escrow, and other common things. I do not support the elimination of copyrights or the rejection of patents. My end goals are similar to freenet's, but the philosophy and methods of achieving those goals are different. To use an analogy, think of me as a republican who's opposed to the death penalty because of the recent DNA evidence that shows that 10% of death row inmates are innocent. I have no problem with the death penalty, but I do have a problem with a flawed system run by ass backwards bureaucrats. Now think of Ian as the liberal who's opposed to the death penalty for moral reasons. Now consider me approaching him as saying "lets work together on a common goal", and him saying "get lost you conservative puke". That's how I view what happened. But I've also run into other groups (such as the second CC address of this email) that are just as worthless as the freenet crowd, and they aren't even political projects like freenet. It's amazing how only 2 of their replies were useful, and one was a response to a question about freenet. The main reason they pissed me off is that they remind me of people who always create personnel problems. I come from a project management background, and am so sick of dealing with close minded idealists that are politically correct yet worthless. I'm so sick of people who waste time on idealism and argue about petty details. To answer your question of why I went about it in that way: I was really pissed off, and didn't think before I typed. My emails for the last 8 years have been to people I've already met face to face, or to tech support people. So I'm not used to the online crowd or meeting people thru emails. I should have spent more than 10 minutes typing the license, which contained statements that were easily misinterpreted. It was definitely not ready for the public, and these guys treat licenses as holy scripture. Plus I could should found a better license to modify than GNU, because it's the most liberal of open source licenses. Basically, the patent app came in the mail and I immediately went online with what I had because I was excited, even though it wasn't ready. When they decided to discuss everything BUT the design, I was a bit shocked. What you didn't see in their email archives was the amount of private messages that was completely insulting and useless. I allowed myself to get angry because of those messages, so my responses were not professional. I was also stressed out and really pissed off because I thought the FBI had contacted me, and I really couldn't understand why; it's just a design and an incomplete one at that. I now know it was some ex-coworkers screwing with my head. I've notified the FBI with some proof they impersonated them, which is a serious crime, but there were no finger prints on the letter they sent me other than my own, so they aren't going to do anything about it. I spent a good amount of money putting a law firm on retainer to deal with this, and that retainer fee is non refundable since it was a hoax. I've illegally obtained emails that prove it was them, but they can't be used as evidence in court. Add that all together and you've got the explanation of what happened. Altogether, it was a big mistake and I've learned from it. Good luck with your report, and keep in mind that my project isn't exactly peer to peer (or client/server), so I'd keep it out of your report. Assuming your report is for school, here are a few tips: Be sure to check out www.oreilly.com, and click on the P2P section, it's a good starting point. Also note that P2P has been around for a long time, it's not a new buzzword. For example, my first introduction to it was Artisoft's Lantastic in the 1980's, but it probably goes back to distributed mini computers of the 1970's (an assumption). I'm not pro at P2P. - josh -----Original Message----- From: martin chao [mailto:martin12345678992649@yahoo.com] Sent: Friday, October 19, 2001 5:50 PM To: josh@mercuryfs.net Subject: your freenet posts Hello, I was reading the freenet e-mail archives and I ran across your posts. I must say, their responses really illustrates the tunnel vision mentality of these people. I'm curious, why did you choose to engage this group? And why did you go about it in that way? (your design comes across much more professionally than those email posts). The reason I ask is for a report I'm writing about peer to peer technologies. Thank you __________________________________________________ Do You Yahoo!? Make a great connection at Yahoo! Personals. http://personals.yahoo.com --- You are currently subscribed to bluesky as: josh@mercuryfs.net For list information visit http://www.transarc.ibm.com/~ota/bluesky/ From josh@mercuryfs.net Sat Oct 20 22:04:21 2001 From: josh@mercuryfs.net (Josh) Date: Sat, 20 Oct 2001 14:04:21 -0700 Subject: thanks In-Reply-To: Message-ID: <000301c159aa$cadf9fd0$35512304@koi> My apologies. Your points are well taken and I appreciate the reply. This has also been sent this to the list, I doubt you will mind. Don't worry folks, this is my last post on the blue sky list. It's been fun. -----Original Message----- From: george-oldenburg@pobox.com Sent: Saturday, October 20, 2001 1:59 PM To: Josh Subject: thanks I don't appreciate you forwarding my mail to the list, but I don't really care either. I'm on your side if you haven't figured it out. From ian@hawk.freenetproject.org Sat Oct 20 22:25:23 2001 From: ian@hawk.freenetproject.org (Ian Clarke) Date: Sat, 20 Oct 2001 14:25:23 -0700 Subject: thanks In-Reply-To: References: Message-ID: <20011020142523.A22487@freenetproject.org> --CE+1k2dSO48ffgeK Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Oct 20, 2001 at 02:04:21PM -0700, Josh wrote: > Don't worry folks, this is my last post on the blue sky list.=20 Great. Say hi to the FBI from me. Ian. --CE+1k2dSO48ffgeK Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE70evDQtgxRWSmsqwRAhWFAJ4sBF3VkZdkke/rcaewrqiwE7RjFwCfc4yr 1RCIWgwIrkWAsWA8uEkzkYs= =G06w -----END PGP SIGNATURE----- --CE+1k2dSO48ffgeK-- From justin@chapweske.com Thu Oct 25 15:33:22 2001 From: justin@chapweske.com (Justin Chapweske) Date: Thu, 25 Oct 2001 09:33:22 -0500 Subject: The Content-Addressable Web Message-ID: <3BD822B2.1050706@chapweske.com> This is a multi-part message in MIME format. --------------050307020603080107010005 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit I've just finished the first draft of "HTTP Extensions for a Content-Addressable Web". I believe that these simple extensions are a huge step forward in providing interopability between P2P systems. I would like for people to start brain-storming around this document. Pick it apart and make it stronger. The documents are located at http://onionneworks.com/caw/caw.ps and http://onionnetworks.com/caw/caw.txt I've also attached the text version to this e-mail. Thanks, -- Justin Chapweske, Onion Networks http://onionnetworks.com/ --------------050307020603080107010005 Content-Type: text/plain; name="caw.txt" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="caw.txt" HTTP Extensions for a Content-Addressable Web Justin Chapweske, Onion Networks (justin@onionnetworks.com) October 7, 2001 Abstract The goal of the Content-Addressable Web (CAW) is to create a URN-based Web that can be optimized for content distribution. The use of URNs allows advanced caching techniques to be employed, and sets the foundation for creating ad hoc Content Distribution Networks (CDNs). This document specifies HTTP extensions that bridge the current Location-Based Web with the Content-Addressable Web. Table of Contents 1 Introduction 2 Self-Verifying URNs 3 HTTP Extensions 3.1 X-Content-URN 3.2 X-Target-URN 3.3 X-URN-N2* 3.3.1 X-URN-N2R 3.3.2 X-URN-N2L and X-URN-N2Ls 4 An Example Application 5 Open Issues 6 Acknowledgments 1 Introduction The rise in popularity of Content Distribution Networks (CDNs), such as Akamai, have shown that significant improvements can be made in throughput, latency, and scalability when content is distributed throughout the network and delivered from the edge. The fact that companies such as Tucows, FilePlanet, and various Linux distributions force their users to manually select mirrors points to a hole in existing web caching infrastructure. Standard web caching can provide significant benefits in certain situations, but suffers from a number of short comings: * It is ill-advised to retrieve content from an untrusted cache, because it can modify/corrupt the content at will. This severely limits the utility of cooperative caching systems. * URL-based naming causes the same object on different mirrors to look like different objects. This decreases the efficiency of caching and mirroring combinations. * There are few ways to discover optimal replicas of a given piece of content. There is no way for a browser to download a mirror list and automatically select an optimal mirror. To add to the burden, the Transient Web is steadily growing in size and importance. The Transient Web is embodied by peer-to-peer systems such as Gnutella, and is characterized by unreliable nodes and a high rate of nodes joining and leaving the network. URL-based addressing would be unacceptable for the Transient Web because there would be a high failure rate of retrieving objects. The solution to these problems it to create a Content-Addressable Web (CAW) that is URN-based rather than URL-based. A few proposals have been made to enable the practical use of URNs, such as RFC 2169 and and RFC 2915, but little has been done with them due to lack of application demand. Recently, however, the growing importance of peer-to-peer systems and the desire to create ad hoc CDNs has created demand for the Content-Addressable Web. One of the more interesting applications of the Content-Addressable Web is the creation of ad hoc Content Distribution Networks. In such networks receivers can achieve tremendous throughput by downloading content from multiple hosts in parallel. Receivers can also crawl through the network searching for optimal replicas, and can even retrieve content from completely untrusted hosts but be assured that they are receiving the content in tact. All of this is made possible by URNs. 2 Self-Verifying URNs While any kind of URN can be used within the Content-Addressable Web, there is a specific type of URN called a "Self-Verifying URN" that is particularly useful. These URNs have the property that the URN itself can be used to verify that the content has been received intact. It is RECOMMENDED that applications use cryptographically strong self-verifying URNs because hosts in ad hoc CDNs and the Transient Web are assumed to be untrusted. For instance, one could hash the content using the SHA-1 algorithm, and encode it using Base32 to produce the following URN: urn:sha1:RMUVHIRSGUU3VU7FJWRAKW3YWG2S2RFB * It is RECOMMENDED that implementations support SHA-1 URNs at minimum. * Receivers MUST verify self-verifying URNs if any part of the content is retrieved from a potentially untrusted source. A future version of this document will also specify a URN format for performing streaming and random-access verification using Merkle Hash Trees. 3 HTTP Extensions In order to provide a transparent bridge between the URL-based Web and the Content-Addressable Web, a few HTTP extensions must be introduced. The nature of these extensions is that they need not be widely deployed in order to be useful. They are specifically designed to allow for proxying for hosts that are not CAW-aware. The following HTTP extensions are based off of the conventions defined in RFC 2169. It is RECOMMENDED that implementers of this specification also implement RFC 2169. The HTTP headers defined in this specification are all response headers. No additional request headers are specified by this document. It is RECOMMENDED that implementers of this specification use an HTTP/1.1 implementation compliant with RFC 2616. This specification uses the "X-" header prefix convention to denote that these are not W3C/IETF standard headers. If and when this specification becomes a standard the prefix will either be simply removed or replaced with an appropriate header extension mechanism. 3.1 X-Content-URN The X-Content-URN entity-header field provides a URN that uniquely identifies the entity-body. The URN is based on the content of the entity-body and any content-coding that has been applied, but not including any transfer-encoding applied to the message-body. For example: X-Content-URN: urn:sha1:RMUVHIRSGUU3VU7FJWRAKW3YWG2S2RFB 3.2 X-Target-URN The X-Target-URN entity-header field provides a URN that uniquely identifies the desired entity-body in the case of a redirect. For HTTP 3xx responses, the URN SHOULD indicate the server's preferred URN for automatic redirection to the resource. The X-Content-URN header is inappropriate in this case, because HTTP 3xx responses often still include message-body that explains that a redirect is taking place. This header primarily exists to allow the creation of URN-aware proxies that provide URN information w/o modifying the original web server. This allows URN-aware user-agents to take advantage of the headers, while simply redirecting user-agents that don't understand the Content-Addressable Web. For Example: X-Target-URN: urn:sha1:RMUVHIRSGUU3VU7FJWRAKW3YWG2S2RFB 3.3 X-URN-N2* These headers specify locations of various resolution services for the URNs specified in the X-Content-URN and X-Target-URN headers. These headers provide various ways of locating other replicas of the content. They can be used to provide additional sources for a multiple-source download. Or one can build an application that crawls across the resolution services searching for an optimal replica. These headers are based off of conventions defined in RFC 2169 and include N2L, N2Ls, N2R, N2Rs, N2C, N2Cs, and N2Ns. These headers provide URIs at which the associated resolution services can be performed for the URNs specified in the X-Content-URN and X-Target-URN headers. It is not necessary for these URIs to conform to the "/uri-res/?" convention specified in RFC 2169. It is believed that N2R, N2L, and N2Ls will be the most useful services for the Content-Addressable Web, so we will cover examples of those explicitly. The rest of the N2* headers should be implemented using the conventions used for N2R, N2L, and N2Ls. Implementations can feel free to use any additional URN resolution mechanisms, such as RFC 2915 DNS-based URN resolution. It is RECOMMENDED that receivers assume that the URN resolver services are potentially untrusted and should verify all content retrieved using a resolver's services. 3.3.1 X-URN-N2R This header specifies one or more URIs that perform the N2R (URN to Resource) resolution service for the URNs specified by the X-Content-URN or X-Target-URN headers. The N2R URIs directly specify mirrors for the content addressed by the URN and can be useful for multi-source downloads. For example: X-URN-N2R: http://urnresolver.com/uri-res/N2R?urn:sha1: or X-URN-N2R: http://untrustedmirror.com/pub/file.zip The key difference between this header and something like the Location header is that the URIs specified by this header should be assumed to be untrusted. 3.3.2 X-URN-N2L and X-URN-N2Ls This header specifies one or more URIs that perform the N2L (URN to URL) and N2Ls (URN to URLs) resolution services. These headers are used when other hosts provide URLs where the content is mirrored. This is most useful in ad hoc CDNs where mirrors may maintain lists of other mirrors. Browsers can simply crawl across the networks, recursively dereferencing N2L(s). For example: X-URN-N2L: http://urnresolver.com/uri-res/N2L?urn:sha1: and X-URN-N2Ls: http://untrustedmirror.com/pub/file.zip-mirrors.list For the N2Ls service, it is RECOMMENDED that the result conform to the text/uri-list media type specified in RFC 2169. 4 An Example Application The above HTTP extensions are deceptively simple and it may not be readily apparent how powerful they are. We will discuss an example application that will take advantage of a few of the features provided by the extensions. In this example we will will look at how the CAW could help at the imaginary linuxiso.org where ISO CD-ROM images of the various linux distributions are kept. The first step will be to issue a GET request for the content: GET /pub/Redhat-7.1-i386-disc1.iso HTTP/1.1 Host: www.linuxiso.org The abbreviated response: HTTP/1.1 200 OK Content-Type: Application/octet-stream Content-Length: 662072345 X-Content-URN: urn:sha1:RMUVHIRSGUU3VU7FJWRAKW3YWG2S2RFB X-URN-N2R: http://www.linuxmirrors.com/pub/Redhat-7.1i386-disc1.iso X-URN-N2R: http://123.24.24.21:8080/uri-res/N2R?urn:sha1: X-URN-N2Ls: http://123.24.24.21:8080/uri-res/N2Ls?urn:sha1: With this response, a CAW aware browser can immediately begin downloading the content from www.linuxiso.org, linuxmirrors.com, and 123.24.24.21 all in parallel. At the same time the browser can be dereferencing the N2Ls service at 123.24.24.21 to discover more mirrors for the content. The existence of the 123...21 host is meant to represent a member of an ad hoc CDN, perhaps the personal computer of a linux advocate that just downloaded the ISO and wants to share their bandwidth with others. By dereferencing the N2Ls, even more ad hoc nodes could be discovered. 5 Open Issues It is unclear how to deal with the mapping of X-URN-N2* headers in the presence of multiple X-Content-URN or X-Target-URN headers. This must be resolved. 6 Acknowledgments Gordon Mohr (gojomo@bitzi.com) for working on many of the concepts in this document within the Gnutella community. We also wish to thank Tony Kimball (alk@pobox.com) for his continued advocacy of RFC 2169. --------------050307020603080107010005-- From Zooko Thu Oct 25 21:41:51 2001 From: Zooko (Zooko) Date: Thu, 25 Oct 2001 13:41:51 -0700 Subject: [p2p-hackers] Re: [decentralization] The Content-Addressable Web In-Reply-To: Message from "Gordon Mohr" of "Thu, 25 Oct 2001 12:39:33 PDT." <00b001c15d8c$c66077a0$0ea7fea9@golden> References: <200110251500.LAA19254@markbaker.ca> <00b001c15d8c$c66077a0$0ea7fea9@golden> Message-ID: [Everyone please note that this thread is being crossposted to p2p-hackers, decentralization and bluesky. Only subscribers can post directly to p2p-hackers, but messages from non-subscribers get forwarded to me for approval. --Zooko http://zgp.org/mailman/listinfo/p2p-hackers/ ] Lines prepended with "> > > " were written by Justin Chapweske. Lines prepended with "> > " were written by Mark Baker. > > > While any kind of URN can be used within the Content-Addressable > > > Web, there is a specific type of URN called a "Self-Verifying > > > URN" that is particularly useful. These URNs have the > > > property that the URN itself can be used to verify that > > > the content has been received intact. It is RECOMMENDED > > > that applications use cryptographically strong self-verifying > > > URNs because hosts in ad hoc CDNs and the Transient Web > > > are assumed to be untrusted. For instance, one could hash > > > the content using the SHA-1 algorithm, and encode it using > > > Base32 to produce the following URN: > > > > > > urn:sha1:RMUVHIRSGUU3VU7FJWRAKW3YWG2S2RFB > > > > That's an invalid URN, AFAIK. There's no authority. All URIs > > need an authority to vouch for the identity. This is surely the most pernicious myth about naming: that it is impossible to verify the correctness of a mapping yourself and you are doomed to trust in some external authority who will tell you the answer. There are two counterexamples: names that are a deterministic function of the content (which Freenet calls "Content Hash Keys" or "CHKs") and names that include the ID of a public key in the name, so that you can check a digital signature on the content (which Freenet calls "Sub-Space Keys" or "SSKs", and the Self-Certifying File System[1] calls "names"). I think this is an extremely important point. IMO the only part of "p2p" which is really revolutionary is the potential for "cooperation without vulnerability" -- two agents live on opposite sides of an unbridgeable trust boundary who are still able to interoperate and cooperate. I'm going to say it again: The most important concept in the whole field of the "p2p" or "decentralization" or whatever you call it is the concept of "cooperation without vulnerability". The most important component of infrastructure that we lack right now in order to enable cooperation without vulnerability is a name service which uses self-authenticating keys so that no agent is ever vulnerable to deception with regard to what object a name should map to. Regards, Zooko http://zooko.com/ [1] http://fs.net/ From alk@pobox.com Thu Oct 25 21:51:49 2001 From: alk@pobox.com (Tony Kimball) Date: Thu, 25 Oct 2001 15:51:49 -0500 Subject: [decentralization] The Content-Addressable Web References: <3BD7B24C.9030403@chapweske.com> <200110251500.LAA19254@markbaker.ca> Message-ID: <15320.31589.458110.880405@gargle.gargle.HOWL> : : The N2* conventions run completely against the architecture of the Web. : URIs are resource identifiers. URNs are one kind of URI. How many : URIs does a resource need? N2L doesn't provide URIs, it provides URLs. A resource needs at least as many URLs has it has addressible locations. From alk@pobox.com Thu Oct 25 22:17:41 2001 From: alk@pobox.com (Tony Kimball) Date: Thu, 25 Oct 2001 16:17:41 -0500 Subject: [decentralization] The Content-Addressable Web References: <00b001c15d8c$c66077a0$0ea7fea9@golden> <200110252117.RAA22943@markbaker.ca> Message-ID: <15320.33141.378877.269651@gargle.gargle.HOWL> Quoth Mark Baker on Thursday, 25 October: : : But if it's still really important for this system to have the : hash in the URI, how about this; : : http://foobar.org/my_content?sha1hash=32452345ASDASDFASDFS It's also really important for this system not to have a location in the URI. : Do you have an example of a resource that is best named by its : hash? All resources are best named by their hash, for some value of "best". From orasis@acm.cs.umn.edu Thu Oct 25 22:46:02 2001 From: orasis@acm.cs.umn.edu (Justin Chapweske) Date: Thu, 25 Oct 2001 16:46:02 -0500 Subject: [p2p-hackers] Re: [decentralization] The Content-Addressable Web In-Reply-To: ; from zooko@zooko.com on Thu, Oct 25, 2001 at 01:41:51PM -0700 References: <200110251500.LAA19254@markbaker.ca> <00b001c15d8c$c66077a0$0ea7fea9@golden> Message-ID: <20011025164602.A7220@sorry.cs.umn.edu> I think it would be best if follow-up conversation was held on decentralization. On Thu, Oct 25, 2001 at 01:41:51PM -0700, Zooko wrote: > > [Everyone please note that this thread is being crossposted to p2p-hackers, > decentralization and bluesky. Only subscribers can post directly to > p2p-hackers, but messages from non-subscribers get forwarded to me for > approval. --Zooko http://zgp.org/mailman/listinfo/p2p-hackers/ ] > > Lines prepended with "> > > " were written by Justin Chapweske. > Lines prepended with "> > " were written by Mark Baker. > > > > > While any kind of URN can be used within the Content-Addressable > > > > Web, there is a specific type of URN called a "Self-Verifying > > > > URN" that is particularly useful. These URNs have the > > > > property that the URN itself can be used to verify that > > > > the content has been received intact. It is RECOMMENDED > > > > that applications use cryptographically strong self-verifying > > > > URNs because hosts in ad hoc CDNs and the Transient Web > > > > are assumed to be untrusted. For instance, one could hash > > > > the content using the SHA-1 algorithm, and encode it using > > > > Base32 to produce the following URN: > > > > > > > > urn:sha1:RMUVHIRSGUU3VU7FJWRAKW3YWG2S2RFB > > > > > > That's an invalid URN, AFAIK. There's no authority. All URIs > > > need an authority to vouch for the identity. > > This is surely the most pernicious myth about naming: that it is impossible to > verify the correctness of a mapping yourself and you are doomed to trust in > some external authority who will tell you the answer. > > There are two counterexamples: names that are a deterministic function of the > content (which Freenet calls "Content Hash Keys" or "CHKs") and names that > include the ID of a public key in the name, so that you can check a digital > signature on the content (which Freenet calls "Sub-Space Keys" or "SSKs", and > the Self-Certifying File System[1] calls "names"). > > > I think this is an extremely important point. IMO the only part of "p2p" which > is really revolutionary is the potential for "cooperation without > vulnerability" -- two agents live on opposite sides of an unbridgeable trust > boundary who are still able to interoperate and cooperate. > > I'm going to say it again: > > The most important concept in the whole field of the "p2p" or > "decentralization" or whatever you call it is the concept of "cooperation > without vulnerability". > > The most important component of infrastructure that we lack right now in order > to enable cooperation without vulnerability is a name service which uses > self-authenticating keys so that no agent is ever vulnerable to deception with > regard to what object a name should map to. > > Regards, > > Zooko > > http://zooko.com/ > > [1] http://fs.net/ > > > --- > You are currently subscribed to bluesky as: orasis@acm.cs.umn.edu > For list information visit http://www.transarc.ibm.com/~ota/bluesky/ -- Justin Chapweske