🥇What it takes to build a Mesh: how the decentralized internet provider “Medium” is creating a new Internet based on Yggdrasil

Hello!

It probably won't be a surprise to you that "Sovereign Runet" is just around the corner — the law comes into effect on November 1 of this year.

Unfortunately, how it will work (or whether it will work at all) is not entirely clear; there are currently no specific instructions available for telecom operators. There are also no methods, penalties, plans, distribution of responsibilities, or designated individuals — it is merely a declaration.

A similar situation was observed regarding the implementation of the "Yarovaya law" — the equipment for the law was not developed in time, and the leading telecom operators in the country had to repeatedly approach potential manufacturers of specialized equipment with relevant inquiries. However, even they did not receive answers either about the available equipment or examples.

But the main thing is not how soon the law comes into effect and what changes await us. The key issue is that thanks to the introduction of this draft law, a community of enthusiasts has begun to deploy an independent telecommunications environment in our country.

Today I will talk about what we have already managed to achieve, what we plan to do in the near future, and what difficulties and challenges we have encountered along the development path of the project.

What is the law about?

Before diving into the technical aspects of our project, I need to clarify what the "On the Sovereign Runet" law entails.

In short: authorities want to "secure" the Russian segment of the Internet in case potential enemies attempt to disconnect it. But as the saying goes, "the road to hell is paved with good intentions" — it’s not entirely clear who we are being protected from and how these "enemies" can actually disrupt the functioning of the Russian segment of the Internet.

For this attack scenario to take place, all countries in the world must conspire, cut all cross-border cables, disable domestic satellites, and create constant radio interference.

It doesn't seem very plausible.

M. P.:

Medium (English, Medium — "intermediary", the original slogan — Don’t ask for your privacy. Take it back; in English, the word medium means "intermediate") — a Russian decentralized internet provider offering network access services Yggdrasil on a non-profit basis.

When, where, and why was "Medium" created?

Initially, the project was conceived as a Mesh network downward API support (simultaneously with this in in the Kolomna urban district.

Medium was established in April 2019 as part of creating an independent telecommunications environment by providing end users with access to the Yggdrasil network resources through the use of wireless data transmission technology, Wi-Fi.

Where can I find the complete list of all network points?You can find it at GitHub repository.

What is Yggdrasil and why does Medium use it as the primary transport?

Yggdrasil — it is a self-organizing a Mesh network, capable of connecting routers both in overlay mode (on top of the Internet) and directly to each other via wired or wireless connections.

Yggdrasil is a continuation of the project CjDNS. The main difference between Yggdrasil and CjDNS is the use of the STP (spanning tree protocol).

By default, all routers in the network use end-to-end encryption for data transmission between other participants.

The choice of the Yggdrasil network as the main transport was driven by the need to increase connection speed (until August 2019, Medium used I2P).

Transitioning to Yggdrasil also provided project participants with the opportunity to start deploying a Mesh network with a Full-Mesh topology. This organization of the network is the most effective antidote against censorship.

Debriefing: what pitfalls have we already encountered

"Experience is the son of difficult mistakes." During the development of Medium, we managed to resolve many issues that arose along our path.

Mistake #1: the public key infrastructure

One of the main problems at the time of network design was the potential for a MITM attack. The traffic between the operator's router and the client's device was not encrypted in any way because the decryption of the main traffic took place directly on the operator's router.

The issue was that anyone could be behind the router — and we really did not want this "someone" to be able to eavesdrop on everything that clients received.

Our first mistake was the implementation of the public key infrastructure (PKI).

Thanks to the use of the 7th layer of the OSI model. We eliminated MITM attacks but acquired a new problem — the need to install root certificate authority certificates. And certificate authorities pose yet another issue. The key word here is "trust."

Again, we need to trust someone! What if the certification center turns out to be compromised? As Murphy's law suggests, sooner or later, a certificate authority will indeed be compromised. And that is a bitter truth.

We pondered the resolution of this issue for a long time and ultimately concluded that there is no need to use PKI — it's enough to use native Yggdrasil encryption..

After making the necessary adjustments, the topology of the "Medium" network took on the following form:

Error #2: Centralized DNS

We needed a domain name system from the very beginning because cumbersome IPv6 addresses not only looked unappealing — they were inconvenient to use in hyperlinks, and the lack of a semantic component was a significant inconvenience.

We created several root DNS servers that held a copy of the list AAAA records, located in GitHub repository.

However, the trust issue remained — a DNS server operator could replace an IPv6 address in the blink of an eye. With a certain skill, it could even go almost unnoticed by others.

Since we do not use HTTPS and, in particular, the technology HSTS, an address replacement in DNS could carry out an IPv6 address substitution attack on the end server without any issues.

The solution was swift: we decided to use the technology EmerDNS — decentralized DNS.

In a sense, EmerDNS is akin to a hosts file, containing entries for all known sites. But unlike hosts:

Each line in EmerDNS can be modified only by its owner, and no one else.
The impossibility of "God's (super-admin) interference" is ensured by the consensus of the miners.
This file is the same for everyone, as guaranteed by the blockchain replication mechanism.
A fast search engine is attached to the file.

Source: "EmerDNS — an alternative to DNSSEC"

Error #3: Centralized everything

Originally, the word "Internet" implied nothing other than interconnected networks or a network of networks..

Over time, the Internet has ceased to be associated with something academic and has become a more commonplace concept, as its influence has widely spread into the lives of ordinary people.

Initially, the Internet was decentralized. It is now difficult to call it decentralized, even though the concept has persisted to this day — only the largest traffic exchange nodes are controlled by large companies. And large companies, in turn, are controlled by the state.

But let's return to our problem — the trend towards centralization is set by operators of individual services like social networks, email servers, messengers, and so on.

"Medium" in this regard has not been much different from the larger Internet until now — most services were centralized and controlled by individual operators.

Now, however, we have decided to pursue complete decentralization — so that vital services can continue to operate regardless of whether a failure occurs at the operator's central server.

As a messaging system, we use Matrix. As social networks — Mastodon and Hubzilla. For video hosting — PeerTube.

Of course, most services are still centralized and continue to be controlled by individual operators, but the main thing is that there is movement towards complete decentralization, and it is felt by all members of the community.

A free Internet in Russia starts with you

You can contribute to the establishment of a free Internet in Russia today. We’ve compiled a comprehensive list of ways you can help the network:

       Tell your friends and colleagues about the "Medium" network
       Share the link to this article on social networks or your personal blog
       Participate in the discussion of technical issues regarding the "Medium" network on GitHub
       Create your own web service on the network Yggdrasil
       Lift your access point to the "Medium" network