{"id":37106,"date":"2019-10-31T22:15:46","date_gmt":"2019-10-31T19:15:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vsyo-chto-vy-hoteli-znat-o-detsentralizovannom-internet-provajdere-medium-no-boyalis-sprosit\/"},"modified":"2019-10-31T22:15:46","modified_gmt":"2019-10-31T19:15:46","slug":"vsyo-chto-vy-hoteli-znat-o-detsentralizovannom-internet-provajdere-medium-no-boyalis-sprosit","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/vsyo-chto-vy-hoteli-znat-o-detsentralizovannom-internet-provajdere-medium-no-boyalis-sprosit","title":{"rendered":"Everything you wanted to know about the decentralized Internet provider \"Medium\" but were afraid to ask","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Good day, Community!<\/p>\n

My name is Yanis Slav Basyuk<\/b>. I am the coordinator of the community organization \"Medium.\"<\/p>\n

In this article, I have tried to gather the most comprehensive information about what this decentralized internet provider operating in the territory of the Russian Federation is. decentralized internet provider<\/a><\/noindex>.<\/p>\n

I will discuss:<\/p>\n

\u00a0\u00a0\u00a0\u00a0\"Everything\u00a0\u00a0\u00a0What \"Medium\" represents
\n\u00a0\u00a0\u00a0\u00a0\"Everything\u00a0\u00a0\u00a0What Yggdrasil is and why \"Medium\" uses it as the main transport
\n\u00a0\u00a0\u00a0\u00a0\"Everything\u00a0\u00a0\u00a0How to properly set up the environment to use the resources of the \"Medium\" network<\/p>\n

\"Everything
\n<\/a><\/noindex><\/p>\n

M. P.:<\/h2>\n

\nMedium<\/b> (English, Medium<\/i> \u2014 \"intermediary\", the original slogan \u2014 Don't ask for your privacy. Take it back<\/i>; in English, the word medium<\/i> means \"intermediate\") \u2014 a Russian decentralized internet provider offering network access services Yggdrasil<\/a><\/noindex> on a non-profit basis.<\/p>\n

When, where, and why was \"Medium\" created?<\/h2>\n

\nInitially, the project was conceived as a Mesh network<\/a><\/noindex> downward API support (simultaneously with this in in the Kolomna urban district<\/a><\/noindex>.<\/p>\n

Medium was established in April 2019 as part of creating an independent telecommunications environment by providing end users with access to the Yggdrasil network resources through the use of wireless data transmission technology, Wi-Fi.<\/p>\n

Where can I find the complete list of all network points?<\/b>You can find it at GitHub repository<\/a><\/noindex>.<\/p>\n

\"Everything
\n<\/p>\n

What is Yggdrasil and why does Medium use it as the primary transport?<\/h2>\n

\nYggdrasil<\/a><\/noindex> \u2014 it is a self-organizing a Mesh network<\/a><\/noindex>, capable of connecting routers both in overlay mode (on top of the Internet) and directly to each other via wired or wireless connections.<\/p>\n

Yggdrasil is a continuation of the project CjDNS<\/a><\/noindex>. The main difference between Yggdrasil and CjDNS is the use of the STP<\/a><\/noindex> (spanning tree protocol).<\/p>\n

\"Everything
\n
\nBy default, all routers in the network use end-to-end encryption<\/a><\/noindex> for data transmission between other participants.<\/p>\n

The choice of the Yggdrasil network as the main transport was driven by the need to increase connection speed (until August 2019, Medium used I2P<\/a><\/noindex>).<\/p>\n

Switching to Yggdrasil also provided project participants with the opportunity to start deploying a Full-Mesh topology mesh network. This network organization is the most effective antidote against censorship.<\/p>\n

\"Everything
\n<\/p>\n

Yggdrasil by default uses end-to-end encryption. Why do the services of the \"Medium\" network use HTTPS?<\/h2>\n

\nThere is no need to use the HTTPS protocol to connect to web services in the Yggdrasil network if you are connecting to them through a locally running Yggdrasil network router.<\/p>\n

Indeed: the Yggdrasil transport at the level protocol<\/a><\/noindex> allows the secure use of resources within the Yggdrasil network \u2014 the possibility of conducting MITM attack<\/a><\/noindex> is completely excluded.<\/p>\n

The situation fundamentally changes if you access Yggdrasil's internal resources not directly, but through an intermediary node \u2014 a point of access to the \"Medium\" network administered by its operator.<\/p>\n

Who can compromise the data you transmit in such a case:<\/p>\n

    \n
  1. Access point operator<\/b>. It is clear that an active operator of the \"Medium\" network access point can eavesdrop on unencrypted traffic passing through their equipment.<\/li>\n
  2. Malicious actor<\/b> (man-in-the-middle<\/a><\/noindex>). \"Medium\" has a problem similar to the Tor network's issue<\/a><\/noindex>, but concerning entry and intermediary nodes.<\/li>\n<\/ol>\n

    \nThis is how it looks<\/b>\"Everything
    \n
    \nSolution<\/b>: to access web services within the Yggdrasil network, use the HTTPS protocol (layer 7     of the OSI model<\/a><\/noindex>). The problem is that for Yggdrasil network services, it is impossible to issue a valid security certificate by ordinary means, such as Let's Encrypt<\/a><\/noindex>.<\/p>\n

    Therefore, we established our own certification authority \u2014 \"Medium Root CA\"<\/a><\/noindex>. The vast majority of the services in the \"Medium\" network are signed with the root security certificate of this certification authority.<\/p>\n

    \"Everything
    \n
    \nThe possibility of compromising the root certificate of the certification authority was certainly taken into account \u2014 but here the certificate is primarily needed to confirm the integrity during data transmission and to prevent the possibility of MITM attacks.<\/p>\n

    The services of the 'Medium' network from various operators have different security certificates, which are signed by the root certificate authority. However, the operators of the root certificate authority do not have the ability to eavesdrop on the encrypted traffic of the services for which they have issued security certificates (see. What is a CSR?<\/a><\/noindex>).<\/p>\n

    Those who care especially about their security can use additional protective measures such as PGP<\/a><\/noindex> and similar ones.<\/a><\/noindex>.<\/p>\n

    Currently, the public key infrastructure of the 'Medium' network has the capability to verify the status of a certificate via the protocol OCSP<\/a><\/noindex> or by using CRL<\/a><\/noindex>.<\/p>\n

    Does 'Medium' have its own domain name system?<\/h2>\n

    \nInitially, the 'Medium' network did not have a centralized domain name server that would allow participants to access the most frequently visited resources in a simpler, more familiar way (as opposed to using the IPv6 address of a specific server).<\/p>\n

    We at 'Medium' decided to breathe life into this idea \u2014 and to jump ahead a bit, we succeeded!<\/p>\n

    \"Everything
    \n
    \nDomain name registration occurs automatically \u2014 you just need to specify the IPv6 address of the server where the service is running. The robot will check whether this address actually belongs to the person attempting to register the domain name.<\/p>\n

    In case of success, the domain name will be added to the domain name database within 24 hours. If the server stops responding to the robot and remains unavailable for more than 72 hours, the domain name will be released.<\/p>\n

    It will not be possible to register a domain name at ::1.<\/b>\"Everything
    \n
    \nA copy of the full list of registered domain names can be found at     GitHub repository<\/a><\/noindex>. This ensures maximum transparency regarding the current state of domain names and eliminates the possibility of their blockage due to potential ambiguous situations arising from human factors. What if the DNS operator doesn't like something?<\/i>.<\/p>\n

    \"Everything
    \n<\/p>\n

    And what about issuing SSL certificates for web services?<\/h2>\n

    \nThe creation of domain name servers was also driven by the need to deploy public key infrastructure \u2014 in order to issue a certificate, it is necessary to include a CN (Common Name) field that represents the domain name for which the certificate is issued.<\/p>\n

    The procedure for issuing certificates signed by the certification authority is carried out automatically \u2014 a robot checks the accuracy and authenticity of the data entered by the user. If successful, the end user is sent an email containing the signed certificate.<\/p>\n

    Here's such a<\/b>\"Everything
    \n
    \n\"Everything
    \n<\/p>\n

    How to properly configure the environment for utilizing resources of the 'Medium' network?<\/h2>\n

    \nThe specifics of setting up the working environment depend on the operating system you are using.<\/p>\n

    Choose wisely (the image is clickable):<\/p>\n

    \"Everything<\/a><\/noindex>\"Everything<\/a><\/noindex><\/p>\n

    A free Internet in Russia starts with you<\/h2>\n

    \nYou can contribute to the establishment of a free Internet in Russia today. We\u2019ve compiled a comprehensive list of ways you can help the network:<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\"Everything\u00a0\u00a0\u00a0Tell your friends and colleagues about the \"Medium\" network
    \n\u00a0\u00a0\u00a0\u00a0\"Everything\u00a0\u00a0\u00a0Share     the link<\/a><\/noindex> to this article on social networks or your personal blog
    \n\u00a0\u00a0\u00a0\u00a0\"Everything\u00a0\u00a0\u00a0Participate in the discussion of technical issues regarding the \"Medium\" network     on GitHub<\/a><\/noindex>
    \n\u00a0\u00a0\u00a0\u00a0\"Everything\u00a0\u00a0\u00a0Create your web service on the Yggdrasil network and add it to     the DNS of the 'Medium' network<\/a><\/noindex>
    \n\u00a0\u00a0\u00a0\u00a0\"Everything\u00a0\u00a0\u00a0Lift your     access point<\/a><\/noindex> to the \"Medium\" network<\/p>\n

    \nAlso read:<\/p>\n

    Honey, we are killing the Internet<\/a><\/noindex>
    \n     Decentralized internet provider 'Medium' \u2014 three months later<\/a><\/noindex>
    \n    \u00abMedium\u00bb \u2014 the first decentralized internet provider in Russia<\/a><\/noindex><\/p>\n

    We are on Telegram: @medium_isp<\/a><\/noindex><\/p>\n

    Only registered users can participate in the survey. Please log in<\/a><\/noindex>, please.<\/p>\n

    Alternative Voting: We value the opinions of those who do not have a full-fledged account on Habr.<\/h2>\n