After a year of development, the release of the decentralized web platform , which offers the use of Bitcoin's addressing and verification mechanisms combined with BitTorrent distributed delivery technologies to create websites that cannot be censored, forged, or blocked. The content of the sites is stored in a P2P network on visitors' machines and verified against the owner's digital signature. Alternative root DNS server systems are used for addressing. . The project is written in Python and is licensed under GPLv2.
The data hosted on the site is verified and linked to the owner's account, analogous to linking Bitcoin wallets, which also allows controlling the relevance of the information and updating content in real-time. An anonymous network like Tor can be used to conceal IP addresses, support for which is built into ZeroNet. The user participates in the distribution of all the sites they visit. Once downloaded to the local system, the files are cached and become available for distribution from the current machine, using methods similar to BitTorrent.
To view ZeroNet sites, it is enough to run the script zeronet.py, after which sites can be opened in the browser via the URL "http://127.0.0.1:43110/zeronet_address" (for example, "http://127.0.0.1:43110/1HeLLo4uzjaLetFx6NMN3PMwF5qbebTf1D"). When opening a site, the program finds the nearest peers and loads the files associated with the requested page (html, css, images, etc.).
To create your own site, simply run the command "zeronet.py siteCreate", after which a site identifier and a private key for confirming authorship via digital signature will be generated.
For the created site, an empty directory like "data/1HeLLo4usjaLetFx6NMH5PMwF3qbebTf1D" will be formed. After changing the contents of this directory, the new version must be certified using the command "zeronet.py siteSign site_identifier" along with the private key. Once the new content is certified, it needs to be announced with the command "zeronet.py sitePublish site_identifier" so that the modified version becomes available to peers (the API WebSocket is used for announcing changes). Peers will check the integrity of the new version against the digital signature, download the new content, and pass it on to other peers.
Key :
- The absence of a single point of failure means the site remains accessible as long as there is at least one peer in the network;
- The lack of a reference storage for the site means it cannot be shut down by disabling hosting, as data is distributed across all users' machines;
- All previously viewed information is cached and available from the current machine in offline mode, without connecting to the global network.
- Support for real-time content updates;
- Capability for addressing through domain registration in the '.bit' zone;
- Works without prior setup — simply unpack the software archive and run a single script;
- Ability to clone sites with one click;
- Passwordless authorization based on the format : the account is protected by the same cryptographic method as the Bitcoin cryptocurrency;
- Built-in SQL server with P2P data synchronization functionalities;
- Support for using Tor for anonymity and full support for using hidden Tor services (.onion) instead of IPv4 addresses;
- Support for TLS encryption;
- Automatic availability via uPnP;
- Ability to attach multiple authors with different digital signatures to the site;
- Availability of a plugin for creating multi-user configurations (openproxy);
- Support for streaming news feeds;
- Works in any browsers and operating systems.
Main changes in ZeroNet 0.7
- Code redesigned for Python3 support, ensuring compatibility with Python 3.4-3.8;
- Implemented a secure database synchronization mode;
- Where possible, the supply of third-party libraries in the main distribution has been curtailed in favor of external dependencies;
- Code for verifying digital signatures has been accelerated by 5-10 times (using the libsecp256k1 library);
- Randomization of already generated certificates has been added to bypass filters;
- Updated P2P code, which has transitioned to using the ZeroNet protocol;
- An Offline mode has been added;
- UiPluginManager plugin added for installing and managing third-party plugins;
- Full support for OpenSSL 1.1 has been provided;
- When connecting to peers, fake SNI and ALPN records are used to make the connections resemble those to regular HTTPS sites;
On the same day as the release of ZeroNet 0.7.0 Update 0.7.1, which fixes a critical vulnerability that potentially allows for remote code execution on the client side. Due to an error in the template variable rendering code, an external open website can establish a WebSocket connection to the client's system with unrestricted ADMIN/NOSANDBOX privileges, enabling the modification of configuration parameters and executing code on the user's computer through parameter manipulation of open_browser.
The vulnerability is present in the 0.7 branch, as well as in experimental builds starting from revision. (change made 20 days ago).
Source: opennet.ru
