{"action":"created","issue":{"url":"https://api.github.com/repos/AppImage/AppImageKit/issues/175","repository_url":"https://api.github.com/repos/AppImage/AppImageKit","labels_url":"https://api.github.com/repos/AppImage/AppImageKit/issues/175/labels{/name}","comments_url":"https://api.github.com/repos/AppImage/AppImageKit/issues/175/comments","events_url":"https://api.github.com/repos/AppImage/AppImageKit/issues/175/events","html_url":"https://github.com/AppImage/AppImageKit/issues/175","id":162552427,"number":175,"title":"Investigate peer-to-peer AppImage distribution","user":{"login":"probonopd","id":2480569,"avatar_url":"https://avatars3.githubusercontent.com/u/2480569?v=4","gravatar_id":"","url":"https://api.github.com/users/probonopd","html_url":"https://github.com/probonopd","followers_url":"https://api.github.com/users/probonopd/followers","following_url":"https://api.github.com/users/probonopd/following{/other_user}","gists_url":"https://api.github.com/users/probonopd/gists{/gist_id}","starred_url":"https://api.github.com/users/probonopd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/probonopd/subscriptions","organizations_url":"https://api.github.com/users/probonopd/orgs","repos_url":"https://api.github.com/users/probonopd/repos","events_url":"https://api.github.com/users/probonopd/events{/privacy}","received_events_url":"https://api.github.com/users/probonopd/received_events","type":"User","site_admin":false},"labels":[{"id":293006406,"url":"https://api.github.com/repos/AppImage/AppImageKit/labels/idea","name":"idea","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":19,"created_at":"2016-06-27T21:28:19Z","updated_at":"2017-11-03T22:30:28Z","closed_at":null,"author_association":"OWNER","body":"AppImage is all about easy and secure software distribution for Linux right from the original upstream application author directly to the end user, without any intermediaries such as Linux distributions. It also supports block-based delta binary updartes using [AppImageUpdate](https://github.com/AppImage/AppImageUpdate), allowing for AppImages that can \"update themselved\" by using information embedded into them (like Sparkle Framework for macOS). Consistent with this vision, we would like to enable __peer-to-peer based software distribution__, so that we would not need central hosting (such as GitHub Releases, etc.) while ideally maintaining some notion of a \"web of trust\" in which it is clear who is the original author of the software, and that the AppImage is distributed in the way the original author wants it to be distributed.\r\n\r\nIn this ticket, let's collect and discuss various peer-to-peer approaches, that could ideally be woven into the [AppImageUpdate](https://github.com/AppImage/AppImageUpdate) system as well.\r\n\r\n\"__IPFS__ is the Distributed Web. A peer-to-peer hypermedia protocol to make the web faster, safer, and more open.\" https://ipfs.io\r\n\r\nShould we use it to distribute AppImages?\r\n"},"comment":{"url":"https://api.github.com/repos/AppImage/AppImageKit/issues/comments/341842969","html_url":"https://github.com/AppImage/AppImageKit/issues/175#issuecomment-341842969","issue_url":"https://api.github.com/repos/AppImage/AppImageKit/issues/175","id":341842969,"user":{"login":"pfrazee","id":1270099,"avatar_url":"https://avatars2.githubusercontent.com/u/1270099?v=4","gravatar_id":"","url":"https://api.github.com/users/pfrazee","html_url":"https://github.com/pfrazee","followers_url":"https://api.github.com/users/pfrazee/followers","following_url":"https://api.github.com/users/pfrazee/following{/other_user}","gists_url":"https://api.github.com/users/pfrazee/gists{/gist_id}","starred_url":"https://api.github.com/users/pfrazee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pfrazee/subscriptions","organizations_url":"https://api.github.com/users/pfrazee/orgs","repos_url":"https://api.github.com/users/pfrazee/repos","events_url":"https://api.github.com/users/pfrazee/events{/privacy}","received_events_url":"https://api.github.com/users/pfrazee/received_events","type":"User","site_admin":false},"created_at":"2017-11-03T22:30:27Z","updated_at":"2017-11-03T22:30:27Z","author_association":"NONE","body":"I wrote an article a while back, when I was working on SSB, that tried to summarize a lot of reading I did on trust and reputation analysis. It's overly dense, but the research I linked to was good http://ssbc.github.io/docs/articles/using-trust-in-open-networks.html\r\n\r\nReacting to some of your points @probonopd \r\n\r\nHTTPS & DNS do have the problem you mention -- you can phish using \"close enough\" domain names. It happens pretty frequently.\r\n\r\nGraph & reputation analysis - The issue of \"SEO gaming\" is true. The Advogadro project (see my article) had decent success. It depends on the usecase; if false positives/negatives are dangerous, then you can use graph analysis more as a suggestion.\r\n\r\nStars & user signals - If you filter the stars/signals by \"people you follow\" or \"people in your network\" or some similar tool, you improve the value of that signal, but lose potentially good source that you're just not connected. This is why you might want a single node to try to globally crawl and rank everybody -- they can potentially tell you which stars to trust and which ones not. How?\r\n Basically, what you're doing is having the crawler try to define the \"best people in my network,\" and then use that set to filter signals such as stars (and therefore cut out the spam). Again, check out advogadro or pagerank (in my article). Graph analysis is a way to expand your network of trust without having to manually evaluate each new connection.\r\n\r\n"}}
{"actor":{"display_login":"pfrazee"}}