After a year of development, the release of a decentralized web platform was released , which proposes using Bitcoin's addressing and verification mechanisms in combination with BitTorrent's distributed delivery technologies to create sites that cannot be censored, counterfeited, or blocked. The content of sites is stored in a P2P network on visitors’ machines and is verified using the owner’s digital signature. A system of alternative root DNS servers is used for addressing . The project is written in Python and licensed under GPLv2.
The data posted on the site is verified and linked to the account of the site owner, similar to the linking of Bitcoin wallets, which also makes it possible to control the relevance of information and update content in real time. To hide IP addresses, the anonymous Tor network can be used, support for which is built into ZeroNet. The user participates in the distribution of all sites he accessed. Once downloaded to the local system, the files are cached and made available for distribution from the current machine using methods reminiscent of BitTorrent.
To view ZeroNet sites, just run the zeronet.py script, after which you can open sites in the browser via the URL “http://127.0.0.1:43110/zeronet_address” (for example, “http://127.0.0.1:43110/1HeLLo4uzjaLetFx6NMN3PMwF5qbebTf1D”) . When opening a website, the program finds nearby peers and downloads files associated with the requested page (html, css, images, etc.).
To create your site, just run the command “zeronet.py siteCreate”, after which a site identifier and a private key will be generated to confirm authorship using a digital signature.
For the created site, an empty directory of the form “data/1HeLLo4usjaLetFx6NMH5PMwF3qbebTf1D” will be created. After changing the contents of this directory, the new version must be certified using the command “zeronet.py siteSign site_identifier” and entering the private key. Once the new content has been verified, it needs to be announced with the command “zeronet.py sitePublish site_id” so that the changed version becomes available to peers (the WebSocket API is used to announce changes). Along the chain, peers will check the integrity of the new version using a digital signature, download the new content and transfer it to other peers.
All :
- There is no single point of failure - the site remains accessible if there is at least one peer in the distribution;
- Lack of reference storage for the site - the site cannot be closed by disconnecting hosting, since the data is located on all machines of visitors;
- All previously viewed information is in the cache and is accessible from the current machine in offline mode, without access to the global network.
- Support real-time content update;
- Possibility of addressing through domain registration in the “.bit” zone;
- Work without preliminary setup - just unpack the archive with the software and run one script;
- Ability to clone websites in one click;
- Format-based passwordless authentication : the account is protected by the same cryptographic method as the Bitcoin cryptocurrency;
- Built-in SQL server with P2P data synchronization functions;
- The ability to use Tor for anonymity and full support for using Tor hidden services (.onion) instead of IPv4 addresses;
- TLS encryption support;
- Automatic accessibility via uPnP;
- Possibility of attaching several authors with different digital signatures to the site;
- Availability of a plugin for creating multi-user configurations (openproxy);
- Support for broadcasting news feeds;
- Works in any browsers and operating systems.
Major changes in ZeroNet 0.7
- The code has been reworked to support Python3, ensuring compatibility with Python 3.4-3.8;
- A protected database synchronization mode has been implemented;
- Where possible, the main distribution of third-party libraries has been discontinued in favor of external dependencies;
- The code for verifying digital signatures has been accelerated 5-10 times (the libsecp256k1 library is used;
- Added randomization of already generated certificates to bypass filters;
- Updated P2P code to use ZeroNet protocol;
- Added Offline mode;
- Added UiPluginManager plugin for installing and managing third-party plugins;
- Full support for OpenSSL 1.1 is provided;
- When connecting to peers, dummy SNI and ALPN records are used to make connections more similar to calls to regular sites over HTTPS;
Same day as ZeroNet 0.7.0 release update 0.7.1, which eliminates a dangerous vulnerability that potentially allows code execution on the client side. Due to an error in the code for rendering template variables, an open external site can establish a connection to the client system via WebSocket with unlimited ADMIN/NOSANDBOX rights, which makes it possible to change configuration parameters and execute its code on the user’s computer through manipulations with the open_browser parameter.
The vulnerability appears in branch 0.7, as well as in experimental builds starting from the revision (change made 20 days ago).
Source: opennet.ru