{"id":37106,"date":"2019-10-31T22:15:46","date_gmt":"2019-10-31T19:15:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vsyo-chto-vy-hoteli-znat-o-detsentralizovannom-internet-provajdere-medium-no-boyalis-sprosit\/"},"modified":"2019-10-31T22:15:46","modified_gmt":"2019-10-31T19:15:46","slug":"vsyo-chto-vy-hoteli-znat-o-detsentralizovannom-internet-provajdere-medium-no-boyalis-sprosit","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vsyo-chto-vy-hoteli-znat-o-detsentralizovannom-internet-provajdere-medium-no-boyalis-sprosit","title":{"rendered":"V\u0161e, co jste cht\u011bli v\u011bd\u011bt o decentralizovan\u00e9m internetov\u00e9m poskytovateli \u201eMedium\u201c, ale b\u00e1li jste se zeptat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dobr\u00fd den, komunit\u011b!<\/p>\n

Jmenuji se Janislav Basiuk<\/b>. Jsem koordin\u00e1torem ob\u010dansk\u00e9 organizace \u201eMedium\u201c.<\/p>\n

V tomto \u010dl\u00e1nku se pokus\u00edm shrom\u00e1\u017edit nejkomplexn\u011bj\u0161\u00ed informace o tom, co p\u0159edstavuje tento funguj\u00edc\u00ed decentralizovan\u00fd internetov\u00fd poskytovatel na \u00fazem\u00ed Rusk\u00e9 federace. decentralizovan\u00fd internetov\u00fd poskytovatel<\/a><\/noindex>.<\/p>\n

Pov\u00edm v\u00e1m:<\/p>\n

\u00a0\u00a0\u00a0\u00a0\"V\u0161e,\u00a0\u00a0\u00a0Co je \u201eMedium\u201c?
\n\u00a0\u00a0\u00a0\u00a0\"V\u0161e,\u00a0\u00a0\u00a0Co je Yggdrasil a pro\u010d \u201eMedium\u201c pou\u017e\u00edv\u00e1 jako hlavn\u00ed transport?
\n\u00a0\u00a0\u00a0\u00a0\"V\u0161e,\u00a0\u00a0\u00a0Jak spr\u00e1vn\u011b nastavit prost\u0159ed\u00ed pro vyu\u017e\u00edv\u00e1n\u00ed zdroj\u016f s\u00edt\u011b \u201eMedium\u201c?<\/p>\n

\"V\u0161e,
\n<\/a><\/noindex><\/p>\n

Co je \u201eMedium\u201c?<\/h2>\n

\nMedium<\/b> (angl. Medium<\/i> \u2014 \u201eprost\u0159edn\u00edk\u201c, p\u016fvodn\u00ed slogan \u2014 Neptejte se na svoji soukrom\u00ed. Vezm\u011bte si ho zp\u011bt<\/i>; tak\u00e9 v angli\u010dtin\u011b slovo medium<\/i> znamen\u00e1 \u201emezi\u201c) \u2014 rusk\u00fd decentralizovan\u00fd internetov\u00fd poskytovatel, kter\u00fd poskytuje slu\u017eby p\u0159ipojen\u00ed k s\u00edti Yggdrasil<\/a><\/noindex> bez n\u00e1roku na finan\u010dn\u00ed odm\u011bnu.<\/p>\n

Kdy, kde a pro\u010d byl \u201eMedium\u201c vytvo\u0159en?<\/h2>\n

\nP\u016fvodn\u011b byl projekt zam\u00fd\u0161len jako Mesh-s\u00ed\u0165<\/a><\/noindex> v v Kolomensk\u00e9 oblasti<\/a><\/noindex>.<\/p>\n

\u201eMedium\u201c byl zalo\u017een v dubnu 2019 v r\u00e1mci vytv\u00e1\u0159en\u00ed nez\u00e1visl\u00e9ho telekomunika\u010dn\u00edho prost\u0159ed\u00ed poskytov\u00e1n\u00edm koncov\u00fdm u\u017eivatel\u016fm p\u0159\u00edstup k zdroj\u016fm s\u00edt\u011b Yggdrasil pomoc\u00ed technologie bezdr\u00e1tov\u00e9ho p\u0159enosu Wi-Fi.<\/p>\n

Kde mohu naj\u00edt \u00fapln\u00fd seznam v\u0161ech bod\u016f s\u00edt\u011b?<\/b>M\u016f\u017eete ho naj\u00edt v repozit\u00e1\u0159i na GitHubu<\/a><\/noindex>.<\/p>\n

\"V\u0161e,
\n<\/p>\n

Co je Yggdrasil a pro\u010d \u201eMedium\u201c pou\u017e\u00edv\u00e1 jako hlavn\u00ed transport?<\/h2>\n

\nYggdrasil<\/a><\/noindex> \u2014 je to samoorganizuj\u00edc\u00ed se Mesh-s\u00ed\u0165<\/a><\/noindex>, kter\u00e1 m\u00e1 mo\u017enost p\u0159ipojen\u00ed router\u016f jak v re\u017eimu overlay (nad s\u00edt\u00ed Internet), tak p\u0159\u00edmo mezi sebou prost\u0159ednictv\u00edm kabelov\u00e9ho nebo bezdr\u00e1tov\u00e9ho spojen\u00ed.<\/p>\n

Yggdrasil je pokra\u010dov\u00e1n\u00edm projektu CjDNS<\/a><\/noindex>. Hlavn\u00edm rozd\u00edlem mezi Yggdrasil a CjDNS je pou\u017eit\u00ed protokolu STP<\/a><\/noindex> (spanning tree protocol).<\/p>\n

\"V\u0161e,
\n
\nVe v\u00fdchoz\u00edm nastaven\u00ed v\u0161echny routery s\u00edt\u011b pou\u017e\u00edvaj\u00ed end-to-end \u0161ifrov\u00e1n\u00ed<\/a><\/noindex> pro p\u0159enos dat mezi ostatn\u00edmi \u00fa\u010dastn\u00edky.<\/p>\n

Volba s\u00edt\u011b Yggdrasil jako z\u00e1kladn\u00edho transportu byla zp\u016fsobena pot\u0159ebou zv\u00fd\u0161it rychlost p\u0159ipojen\u00ed (do srpna 2019 \u201eMedium\u201c pou\u017e\u00edval I2P<\/a><\/noindex>).<\/p>\n

P\u0159echod na Yggdrasil tak\u00e9 poskytl \u00fa\u010dastn\u00edk\u016fm projektu mo\u017enost zah\u00e1jit nasazen\u00ed Mesh-s\u00edt\u011b s topologi\u00ed Full-Mesh. Takov\u00e1 organizace s\u00edt\u011b je nej\u00fa\u010dinn\u011bj\u0161\u00edm antidotem proti cenzu\u0159e.<\/p>\n

\"V\u0161e,
\n<\/p>\n

Yggdrasil ve v\u00fdchoz\u00edm nastaven\u00ed pou\u017e\u00edv\u00e1 end-to-end \u0161ifrov\u00e1n\u00ed. Pro\u010d slu\u017eby s\u00edt\u011b \u201eMedium\u201c pou\u017e\u00edvaj\u00ed HTTPS?<\/h2>\n

\nNen\u00ed nutn\u00e9 pou\u017e\u00edvat protokol HTTPS pro p\u0159ipojen\u00ed k webov\u00fdm slu\u017eb\u00e1m v s\u00edti Yggdrasil, pokud se k nim p\u0159ipojujete p\u0159es m\u00edstn\u011b funguj\u00edc\u00ed router s\u00edt\u011b Yggdrasil.<\/p>\n

Opravdu: doprava Yggdrasil na \u00farovni protokolu<\/a><\/noindex> umo\u017e\u0148uje bezpe\u010dn\u011b pou\u017e\u00edvat zdroje uvnit\u0159 s\u00edt\u011b Yggdrasil \u2014 mo\u017enost proveden\u00ed MITM \u00fatoku<\/a><\/noindex> je zcela vylou\u010dena.<\/p>\n

Situace se radik\u00e1ln\u011b m\u011bn\u00ed, pokud p\u0159istupujete k vnit\u0159n\u00edm zdroj\u016fm Yggdrasil nikoli p\u0159\u00edmo, ale prost\u0159ednictv\u00edm mezi\u010dl\u00e1nku \u2014 p\u0159\u00edstupov\u00e9ho bodu s\u00edt\u011b \u201eMedium\u201c, kter\u00fd spravuje jej\u00ed oper\u00e1tor.<\/p>\n

Kdo v takov\u00e9m p\u0159\u00edpad\u011b m\u016f\u017ee kompromitovat data, kter\u00e1 p\u0159en\u00e1\u0161\u00edte:<\/p>\n

    \n
  1. Oper\u00e1tor p\u0159\u00edstupov\u00e9ho bodu<\/b>. Je z\u0159ejm\u00e9, \u017ee funguj\u00edc\u00ed oper\u00e1tor p\u0159\u00edstupov\u00e9ho bodu s\u00edt\u011b \u201eMedium\u201c m\u016f\u017ee odposlouch\u00e1vat ne\u0161ifrovanou komunikaci, kter\u00e1 proch\u00e1z\u00ed jeho za\u0159\u00edzen\u00edm.<\/li>\n
  2. \u00dato\u010dn\u00edk<\/b> (\u010dlov\u011bk uprost\u0159ed<\/a><\/noindex>). \u201eMedium\u201c m\u00e1 probl\u00e9m podobn\u00fd probl\u00e9mu s\u00edt\u011b Tor<\/a><\/noindex>, pouze v p\u0159\u00edpad\u011b vstupn\u00edch a mezilehl\u00fdch uzl\u016f.<\/li>\n<\/ol>\n

    \nTakto to vypad\u00e1<\/b>\"V\u0161e,
    \n
    \n\u0158e\u0161en\u00ed<\/b>: pro p\u0159\u00edstup k webov\u00fdm slu\u017eb\u00e1m uvnit\u0159 s\u00edt\u011b Yggdrasil pou\u017e\u00edvejte protokol HTTPS (7. \u00farove\u0148     modelu OSI<\/a><\/noindex>). Probl\u00e9m je v tom, \u017ee pro slu\u017eby s\u00edt\u011b Yggdrasil nelze b\u011b\u017en\u00fdmi prost\u0159edky vydat autentick\u00fd bezpe\u010dnostn\u00ed certifik\u00e1t, jako jsou Let’s Encrypt<\/a><\/noindex>.<\/p>\n

    Proto jsme zalo\u017eili vlastn\u00ed certifika\u010dn\u00ed autoritu \u2014 \u201eMedium Root CA\u201c<\/a><\/noindex>. Drtiv\u00e1 v\u011bt\u0161ina slu\u017eeb s\u00edt\u011b \u201eMedium\u201c je podeps\u00e1na ko\u0159enov\u00fdm bezpe\u010dnostn\u00edm certifik\u00e1tem t\u00e9to certifika\u010dn\u00ed autority.<\/p>\n

    \"V\u0161e,
    \n
    \nMo\u017enost kompromitace ko\u0159enov\u00e9ho certifik\u00e1tu certifika\u010dn\u00ed autority byla samoz\u0159ejm\u011b zohledn\u011bna \u2014 ale tento certifik\u00e1t je v\u00edce pot\u0159ebn\u00fd pro potvrzen\u00ed integrity p\u0159i p\u0159enosu dat a vylou\u010den\u00ed prov\u00e1d\u011bn\u00ed MITM \u00fatok\u016f.<\/p>\n

    Slu\u017eby s\u00edt\u011b \u201eMedium\u201c od r\u016fzn\u00fdch oper\u00e1tor\u016f maj\u00ed r\u016fzn\u00e9 bezpe\u010dnostn\u00ed certifik\u00e1ty, kter\u00e9 jsou n\u011bjak\u00fdm zp\u016fsobem podeps\u00e1ny ko\u0159enov\u00fdm certifika\u010dn\u00edm \u00fa\u0159adem. Av\u0161ak oper\u00e1to\u0159i ko\u0159enov\u00e9ho certifika\u010dn\u00edho autority nemaj\u00ed mo\u017enost odposlouch\u00e1vat \u0161ifrovan\u00fd provoz slu\u017eeb, kter\u00fdm vydali bezpe\u010dnostn\u00ed certifik\u00e1ty (viz \u201eCo je CSR?\u201c<\/a><\/noindex>).<\/p>\n

    Ti, kte\u0159\u00ed zvl\u00e1\u0161\u0165 dbaj\u00ed na svou bezpe\u010dnost, mohou jako dodate\u010dnou ochranu pou\u017e\u00edt prost\u0159edky jako PGP<\/a><\/noindex> a takov\u00e9<\/a><\/noindex>.<\/p>\n

    V sou\u010dasn\u00e9 dob\u011b m\u00e1 infrastruktura otev\u0159en\u00fdch kl\u00ed\u010d\u016f s\u00edt\u011b \u201eMedium\u201c mo\u017enost ov\u011b\u0159en\u00ed stavu certifik\u00e1tu prost\u0159ednictv\u00edm protokolu OCSP<\/a><\/noindex> nebo pomoc\u00ed CRL<\/a><\/noindex>.<\/p>\n

    M\u00e1 \u201eMedium\u201c vlastn\u00ed syst\u00e9m dom\u00e9nov\u00fdch jmen?<\/h2>\n

    \nNa za\u010d\u00e1tku v s\u00edti \u201eMedium\u201c nebyl centralizovan\u00fd server dom\u00e9nov\u00fdch jmen, kter\u00fd by \u00fa\u010dastn\u00edk\u016fm s\u00edt\u011b umo\u017enil p\u0159\u00edstup k nejnav\u0161t\u011bvovan\u011bj\u0161\u00edm zdroj\u016fm jednodu\u0161\u0161\u00edm a zn\u00e1m\u011bj\u0161\u00edm zp\u016fsobem (na rozd\u00edl od pou\u017e\u00edv\u00e1n\u00ed IPv6 adresy konkr\u00e9tn\u00edho serveru).<\/p>\n

    My v \u201eMedium\u201c jsme se rozhodli tuto my\u0161lenku o\u017eivit \u2014 a abych to zkr\u00e1til, povedlo se n\u00e1m to!<\/p>\n

    \"V\u0161e,
    \n
    \nRegistrace dom\u00e9nov\u00fdch jmen prob\u00edh\u00e1 automaticky \u2014 sta\u010d\u00ed pouze uv\u00e9st IPv6 adresu serveru, na kter\u00e9m je slu\u017eba spu\u0161t\u011bna. Robot zkontroluje, zda tato adresa skute\u010dn\u011b pat\u0159\u00ed \u010dlov\u011bku, kter\u00fd se pokou\u0161\u00ed zaregistrovat dom\u00e9nov\u00e9 jm\u00e9no.<\/p>\n

    V p\u0159\u00edpad\u011b \u00fasp\u011bchu bude dom\u00e9nov\u00e9 jm\u00e9no p\u0159id\u00e1no do datab\u00e1ze dom\u00e9nov\u00fdch jmen do 24 hodin. Pokud server p\u0159estane robotovi odpov\u00eddat a nebude dostupn\u00fd v\u00edce ne\u017e 72 hodin, dom\u00e9nov\u00e9 jm\u00e9no bude uvoln\u011bno.<\/p>\n

    Registrace dom\u00e9nov\u00e9ho jm\u00e9na na ::1 nebude mo\u017en\u00e1<\/b>\"V\u0161e,
    \n
    \nKopie \u00fapln\u00e9ho seznamu registrovan\u00fdch dom\u00e9nov\u00fdch jmen se nach\u00e1z\u00ed v     repozit\u00e1\u0159i na GitHubu<\/a><\/noindex>. To umo\u017e\u0148uje zajistit maxim\u00e1ln\u00ed transparentnost ohledn\u011b aktu\u00e1ln\u00edho stavu dom\u00e9nov\u00fdch jmen a vylou\u010dit jejich blokaci vzhledem k mo\u017en\u00e9 ambivalentn\u00ed situaci vypl\u00fdvaj\u00edc\u00ed z lidsk\u00e9ho faktoru. N\u00e1hodou se DNS oper\u00e1torovi n\u011bco nebude l\u00edbit<\/i>.<\/p>\n

    \"V\u0161e,
    \n<\/p>\n

    A co vyd\u00e1v\u00e1n\u00ed SSL certifik\u00e1t\u016f pro webov\u00e9 slu\u017eby?<\/h2>\n

    \nVytvo\u0159en\u00ed serveru dom\u00e9nov\u00fdch jmen bylo tak\u00e9 podm\u00edn\u011bno pot\u0159ebou nasazen\u00ed infrastruktury otev\u0159en\u00fdch kl\u00ed\u010d\u016f \u2014 pro vyd\u00e1n\u00ed certifik\u00e1tu je nezbytn\u00e9 m\u00edt v n\u011bm pole CN (Common Name), co\u017e je dom\u00e9nov\u00e9 jm\u00e9no, pro kter\u00e9 je certifik\u00e1t vyd\u00e1v\u00e1n.<\/p>\n

    Proces vyd\u00e1v\u00e1n\u00ed certifik\u00e1t\u016f podepsan\u00fdch certifika\u010dn\u00edm \u00fa\u0159adem prob\u00edh\u00e1 automaticky \u2014 robot kontroluje spr\u00e1vnost a pravost zadan\u00fdch \u00fadaj\u016f u\u017eivatele. V p\u0159\u00edpad\u011b \u00fasp\u011bchu je koncov\u00e9mu u\u017eivateli zasl\u00e1n e-mail obsahuj\u00edc\u00ed podepsan\u00fd certifik\u00e1t.<\/p>\n

    Takov\u00e9to<\/b>\"V\u0161e,
    \n
    \n\"V\u0161e,
    \n<\/p>\n

    Jak spr\u00e1vn\u011b nastavit prost\u0159ed\u00ed pro vyu\u017e\u00edv\u00e1n\u00ed zdroj\u016f s\u00edt\u011b \u201eMedium\u201c?<\/h2>\n

    \nPodm\u00ednky procesu nastaven\u00ed pracovn\u00edho prost\u0159ed\u00ed z\u00e1vis\u00ed na opera\u010dn\u00edm syst\u00e9mu, kter\u00fd pou\u017e\u00edv\u00e1te.<\/p>\n

    Vyberte moud\u0159e (obr\u00e1zek je klikac\u00ed):<\/p>\n

    \"V\u0161e,<\/a><\/noindex>\"V\u0161e,<\/a><\/noindex><\/p>\n

    Svobodn\u00fd internet v Rusku za\u010d\u00edn\u00e1 u v\u00e1s<\/h2>\n

    \nM\u016f\u017eete p\u0159isp\u011bt k rozvoji svobodn\u00e9ho internetu v Rusku ji\u017e dnes. P\u0159ipravili jsme vy\u010derp\u00e1vaj\u00edc\u00ed seznam toho, jak m\u016f\u017eete pomoci t\u00e9to s\u00edti:<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\"V\u0161e,\u00a0\u00a0\u00a0Pov\u011bzte o s\u00edti \u201eMedium\u201c sv\u00fdm p\u0159\u00e1tel\u016fm a koleg\u016fm
    \n\u00a0\u00a0\u00a0\u00a0\"V\u0161e,\u00a0\u00a0\u00a0Pod\u011blte se     odkazem<\/a><\/noindex> na tento \u010dl\u00e1nek na soci\u00e1ln\u00edch s\u00edt\u00edch nebo ve va\u0161em osobn\u00edm blogu
    \n\u00a0\u00a0\u00a0\u00a0\"V\u0161e,\u00a0\u00a0\u00a0Zapojte se do diskuse technick\u00fdch ot\u00e1zek s\u00edt\u011b \u201eMedium\u201c     na GitHubu<\/a><\/noindex>
    \n\u00a0\u00a0\u00a0\u00a0\"V\u0161e,\u00a0\u00a0\u00a0Vytvo\u0159te sv\u016fj webov\u00fd servis v s\u00edti Yggdrasil a p\u0159idejte ho do     DNS s\u00edt\u011b \u201eMedium\u201c<\/a><\/noindex>
    \n\u00a0\u00a0\u00a0\u00a0\"V\u0161e,\u00a0\u00a0\u00a0Zvedn\u011bte sv\u016fj     p\u0159\u00edstupov\u00fd bod<\/a><\/noindex> k s\u00edti \u201eMedium\u201c<\/p>\n

    \nP\u0159e\u010dt\u011bte si tak\u00e9:<\/p>\n

    Drah\u00fd, zab\u00edj\u00edme internet<\/a><\/noindex>
    \n     Decentralizovan\u00fd internetov\u00fd poskytovatel \u201eMedium\u201c \u2013 po t\u0159ech m\u011bs\u00edc\u00edch<\/a><\/noindex>
    \n    \u201eMedium\u201c \u2013 prvn\u00ed decentralizovan\u00fd internetov\u00fd poskytovatel v Rusku<\/a><\/noindex><\/p>\n

    Jsme na Telegramu: @medium_isp<\/a><\/noindex><\/p>\n

    Pouze registrovan\u00ed u\u017eivatel\u00e9 se mohou \u00fa\u010dastnit ankety. P\u0159ihlaste se<\/a><\/noindex>, pros\u00edm.<\/p>\n

    Alternativn\u00ed hlasov\u00e1n\u00ed: zaj\u00edm\u00e1 n\u00e1s n\u00e1zor t\u011bch, kte\u0159\u00ed nemaj\u00ed plnohodnotn\u00fd \u00fa\u010det na Habr<\/h2>\n