{"id":37685,"date":"2019-10-31T22:19:05","date_gmt":"2019-10-31T19:19:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/chto-nam-stoit-mesh-postroit-kak-detsentralizovannyj-internet-provajder-medium-delaet-novyj-internet-na-baze-yggdrasil\/"},"modified":"2019-10-31T22:19:05","modified_gmt":"2019-10-31T19:19:05","slug":"chto-nam-stoit-mesh-postroit-kak-detsentralizovannyj-internet-provajder-medium-delaet-novyj-internet-na-baze-yggdrasil","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/chto-nam-stoit-mesh-postroit-kak-detsentralizovannyj-internet-provajder-medium-delaet-novyj-internet-na-baze-yggdrasil","title":{"rendered":"What does it cost us to build a Mesh: how the decentralized internet provider 'Medium' is creating a new Internet based on Yggdrasil","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hello!<\/p>\n

It probably won't be a surprise to you that \"Sovereign Runet\"<\/a><\/noindex> is just around the corner \u2014 the law comes into effect on November 1<\/b> of this year.<\/p>\n

Unfortunately, how it will work (or whether it will work at all) is not entirely clear; there are currently no specific instructions available for telecom operators. There are also no methods, penalties, plans, distribution of responsibilities, or designated individuals \u2014 it is merely a declaration.<\/p>\n

A similar situation was observed regarding the implementation of the \"Yarovaya law\" \u2014 the equipment for the law was not developed in time, and the leading telecom operators in the country had to repeatedly approach potential manufacturers of specialized equipment with relevant inquiries. However, even they did not receive answers either about the available equipment or examples.<\/p>\n

But the main thing is not how soon the law comes into effect and what changes await us. The key issue is that thanks to the introduction of this draft law, a community of enthusiasts has begun to deploy an independent telecommunications environment in our country.<\/p>\n

Today I will talk about what we have already managed to achieve, what we plan to do in the near future, and what difficulties and challenges we have encountered along the development path of the project.<\/p>\n

\"What
\n<\/a><\/noindex><\/p>\n

What is the law about?<\/h2>\n

\nBefore diving into the technical aspects of our project, I need to clarify what the \"On the Sovereign Runet\" law entails.<\/p>\n

In short: authorities want to \"secure\" the Russian segment of the Internet in case potential enemies attempt to disconnect it. But as the saying goes, \"the road to hell is paved with good intentions\" \u2014 it\u2019s not entirely clear who we are being protected from and how these \"enemies\" can actually disrupt the functioning of the Russian segment of the Internet.<\/p>\n

For this attack scenario to take place, all countries in the world must conspire, cut all cross-border cables, disable domestic satellites, and create constant radio interference.<\/p>\n

It doesn't seem very plausible.<\/p>\n

\"What
\n<\/p>\n

M. P.:<\/h2>\n

\nMedium<\/b> (English, Medium<\/i> \u2014 \"intermediary\", the original slogan \u2014 Don't ask for your privacy. Take it back<\/i>; in English, the word medium<\/i> means \"intermediate\") \u2014 a Russian decentralized internet provider offering network access services Yggdrasil<\/a><\/noindex> on a non-profit basis.<\/p>\n

When, where, and why was \"Medium\" created?<\/h2>\n

\nInitially, the project was conceived as a Mesh network<\/a><\/noindex> downward API support (simultaneously with this in in the Kolomna urban district<\/a><\/noindex>.<\/p>\n

Medium was established in April 2019 as part of creating an independent telecommunications environment by providing end users with access to the Yggdrasil network resources through the use of wireless data transmission technology, Wi-Fi.<\/p>\n

Where can I find the complete list of all network points?<\/b>You can find it at GitHub repository<\/a><\/noindex>.<\/p>\n

\"What
\n<\/p>\n

What is Yggdrasil and why does Medium use it as the primary transport?<\/h2>\n

\nYggdrasil<\/a><\/noindex> \u2014 it is a self-organizing a Mesh network<\/a><\/noindex>, capable of connecting routers both in overlay mode (on top of the Internet) and directly to each other via wired or wireless connections.<\/p>\n

Yggdrasil is a continuation of the project CjDNS<\/a><\/noindex>. The main difference between Yggdrasil and CjDNS is the use of the STP<\/a><\/noindex> (spanning tree protocol).<\/p>\n

\"What
\n
\nBy default, all routers in the network use end-to-end encryption<\/a><\/noindex> for data transmission between other participants.<\/p>\n

The choice of the Yggdrasil network as the main transport was driven by the need to increase connection speed (until August 2019, Medium used I2P<\/a><\/noindex>).<\/p>\n

Transitioning to Yggdrasil also provided project participants with the opportunity to start deploying a Mesh network with a Full-Mesh topology. This organization of the network is the most effective antidote against censorship.<\/p>\n

\"What
\n<\/p>\n

Debriefing: what pitfalls have we already encountered<\/h2>\n

\n\"Experience is the son of difficult mistakes.\" During the development of Medium, we managed to resolve many issues that arose along our path.<\/p>\n

Mistake #1: the public key infrastructure<\/h3>\n

\nOne of the main problems at the time of network design was the potential for a MITM attack<\/a><\/noindex>. The traffic between the operator's router and the client's device was not encrypted in any way because the decryption of the main traffic took place directly on the operator's router.<\/p>\n

The issue was that anyone could be behind the router \u2014 and we really did not want this \"someone\" to be able to eavesdrop on everything that clients received.<\/p>\n

Our first mistake was the implementation of the public key infrastructure<\/a><\/noindex> (PKI).<\/p>\n

Thanks to the use of the 7th layer of the OSI model. <\/a><\/noindex> We eliminated MITM attacks but acquired a new problem \u2014 the need to install root certificate authority certificates. And certificate authorities pose yet another issue. The key word here is \"trust.\"<\/p>\n

Again, we need to trust someone! What if the certification center turns out to be compromised? As Murphy's law suggests, sooner or later, a certificate authority will indeed be compromised. And that is a bitter truth.<\/p>\n

We pondered the resolution of this issue for a long time and ultimately concluded that there is no need to use PKI \u2014 it's enough to use native Yggdrasil encryption.<\/a><\/noindex>.<\/p>\n

After making the necessary adjustments, the topology of the \"Medium\" network took on the following form:<\/p>\n

\"What<\/p>\n

Error #2: Centralized DNS<\/h3>\n

\nWe needed a domain name system from the very beginning because cumbersome IPv6 addresses not only looked unappealing \u2014 they were inconvenient to use in hyperlinks, and the lack of a semantic component was a significant inconvenience.<\/p>\n

We created several root DNS servers that held a copy of the list AAAA records<\/a><\/noindex>, located in GitHub repository<\/a><\/noindex>.<\/p>\n

\"What
\nHowever, the trust issue remained \u2014 a DNS server operator could replace an IPv6 address in the blink of an eye. With a certain skill, it could even go almost unnoticed by others.<\/p>\n

Since we do not use HTTPS and, in particular, the technology HSTS<\/a><\/noindex>, an address replacement in DNS could carry out an IPv6 address substitution attack on the end server without any issues.<\/p>\n

The solution was swift: we decided to use the technology EmerDNS<\/a><\/noindex> \u2014 decentralized DNS.<\/p>\n

In a sense, EmerDNS is akin to a hosts file, containing entries for all known sites. But unlike hosts:<\/p>\n