🥇Secure Scuttlebutt — a p2p social network that works offline

Scuttlebutt — a slang term commonly used among American sailors, referring to rumors and gossip. Node.js developer Dominic Tarr, living on a sailboat off the coast of New Zealand, used this word for the name of a p2p network designed for sharing news and personal messages. Secure Scuttlebutt (SSB) allows information sharing using only intermittent access to the Internet or even when completely offline.

SSB has been operational for several years. The social network's features can be tested using two desktop applications (Patchwork and Patchfoo) and an Android application (Manyverse). For the tech-savvy, there is ssb-git. Are you curious about how an offline-first p2p network works without ads or registration? Please read on.

To operate Secure Scuttlebutt, only two computers connected in a local network are needed. SSB-based applications send broadcast UDP messages and can automatically discover each other. Finding nodes on the Internet is a bit more complex, and we will return to this topic in a few paragraphs.

A user account is essentially a linked list of all their entries (log). Each subsequent entry contains the hash of the previous one and is signed with the user's private key. The public key serves as the user's identifier. Deleting and editing entries is impossible for both the author and anyone else. The owner can add entries to the end of the log, while others can only read it.

Applications on the same local network can see each other and automatically request updates from neighbors for the logs they are interested in. It doesn't matter from which node you download the update, as the authenticity of each entry can be verified using the public key. During synchronization, no personal information is exchanged other than the public keys of the logs you're interested in. As you switch between different WiFi/LAN networks (at home, in a café, at work), copies of the logs stored locally will be automatically transmitted to the devices of other nearby users. This is similar to how the 'grapevine' works.: Vasya told Masha, Masha told Petya, and Petya told Valentina. The significant difference from the "gossip network" is that when copying journals, the information within them is not distorted.

"Being friends with someone" here takes on a specific physical meaning: my friends keep a copy of my journal. The more friends I have, the more accessible my journal is to others. In the description of the breach, about various commercial SIEM systems, the Patchwork app synchronizes journals that are within 3 degrees of separation (friends of friends of friends) from you. In most cases, this allows for reading long discussions with many participants while offline.

A user's journal can contain different types of entries: public messages similar to posts on VKontakte, personal messages encrypted with the recipient's public key, comments on other users' entries, and likes. This is an open list. Images and other large files are not placed directly into the journal. Instead, a hash of the file is recorded, allowing the file to be requested separately from the journal itself. The visibility of comments for the original message's author is not guaranteed: if there isn't a sufficiently short path of mutual friends between you, you are unlikely to see those comments. Thus, even if certain entities attempt to seize your post, if they are not your friends or friends of friends of friends, you will not notice anything.

Secure Scuttlebutt is not the first p2p network and not even the first p2p social network. The desire to communicate without intermediaries and break free from the influence of large companies has existed for a long time, and there are several obvious reasons for it. Users are frustrated by large players imposing the rules: few want to see ads on their screens or be banned and wait several days for support to respond. The uncontrolled collection of personal data and its transfer to third parties, which ultimately leads to this data sometimes being sold on the dark web, repeatedly highlights the need to build alternative ways of interaction, where users would have greater control over their data and bear responsibility for its dissemination and safety.

Well-known decentralized social networks like Diaspora or Mastodon, and the protocol Matrix are not peer-to-peer, as there is always a client and server side. Instead of a shared database like Facebook, you can choose your 'home' server where your data will be hosted, which is already a significant step forward. However, the administrator of your 'home' server still has many powers: they can share your data without your knowledge, delete, or block your account. Additionally, they may lose interest in maintaining the server and not inform you about it.

Secure Scuttlebutt also has intermediary nodes that facilitate synchronization (they are called 'pubs'). However, using pubs is optional, and they are interchangeable. If your familiar node is unavailable, you can use others without losing anything, as a complete copy of all your data is always with you. The intermediary node does not store irreplaceable data. A pub will add you as a friend upon your request and will update its copy of your log upon connection. When your followers connect with it, they can download your new posts even if you have already disconnected. For a pub to become friends with you, you must receive an invite from the pub's administrator. This is usually possible to do yourself through the web interface (list of pubs). If you get banned by all the pub administrators, your log will be distributed as described earlier, i.e., only among those you meet in person. Transferring updates via USB stick is also possible.

Although the network has been working for quite some time, there are few people in it. According to André Staltz, the developer of the Android app Manyverse, in June 2018, his local database had about 7 thousand keys. For comparison, there are more than 600 thousand in Diaspora, and about 1 million in Mastodon.

A beginner's guide is available here. The main steps are: install the app, create a profile, get an invite from the pub's website, and copy that invite into the app. You can connect to several pubs at once. You'll need to be patient: the network works much slower than Facebook. The local cache (the .ssb folder) will quickly grow to several gigabytes. Interesting posts can be conveniently searched by hashtags. You can start reading, for example, from Dominik Tarra (@EMovhfIrFk4NihAKnRNhrfRaqIhBv1Wj8pTxJNgvCCY=.ed25519).