A few words on privacy

Just stumbled upon an article discussing skype's alleged security and how it was built into skype from day one (as opposed to being an afterthought), and felt like throwing my 2 cents on this.

For some bizarre reason, it is commonly thought that a skype p2p link offers anything and everything that can translate to "ultimate privacy" and some more, but this is... anything but. Here's the drill:

1. privacy has two major components, the first of which is protecting your communication from potential eavesdroppers. On this front, skype praises itself with unbeatable encryption, which is technically true, but what skype omits to say is that a good encryption only servers to protect a link that already exists; in other words, if you talk to someone and wish to know that your communication is shielded from eavesdropping, then skype might be the real thing. However, what skype does not, and cannot, guarantee, is that you are indeed talking to the person you think you are: specifically, when you set up your communication link with your peer, the link setup stage is vulnerable to what is called a "man in the middle attack" which essentially means that someone has just placed a listening device between you and your peer, and everything that you'll be talking with your peer will in effect go through said man-in-the-middle eavesdropper. In the security world, this is called "the authentication problem" (i.e. making sure that what you're so carefully whispering to your peer indeed goes to your peer and not to someone else), and this is the hardest part (and philosophically unsolvable in the absence of a trusted third-party authority which knows you both) of the secure communications problem.
• note: without entering into too many technical details, it may be technically true that skype itself cannot eavesdrop on your communication by having one of its engineers flip some switches at their headquarters, but what skype does not explicitly say is that what it can do if it so wishes (or is legally forced) is to provide third parties with a technical equipment (i.e. a piece of skype-certified software) that can eavesdrop on any communication whatsoever if some conditions are met (e.g. if this eavesdropping software is placed on your ISP's routers then there is absolutely no problem whatsoever to wiretap your communications)
2. the second big issue related to communication privacy is whether or not a third-party can know who you're talking to, even if it won't be able to actually listen into your conversation. On this front, skype not only does not offer any protection, but its algorithms actually don't even make any effort whatsoever in this direction (e.g. along the line of Tor and the likes); in other words, there are absolutely no provisions in skype to even attempt to address the issue of protecting the identities of the two ends of a skype link.

To rise, none of the two fundamental attributes that could together label a communication link as "private" are present in skype, and while the "skype is encrypted" mantra is technically true, this mantra is blown out of proportions in terms of communication privacy.

P2P OS is different. I will not say much about the cornerstones (or implementation details) of P2P OS' security framework at this stage, but i will just say that it addresses both of the privacy issues described above, and it will [attempt to] provide the highest level of communication privacy that is philosophically achievable within the technical limitations of a given digital communications equipment.


Later edit
As i said in the post above, i don't want to get [too] technical here, but in light of some new developments i'll just mention that the cornerstone of skype's security model (and just about any security model out there for that matter) are the security certificates, and if a bunch of geeks can do things like this just imagine what a more potent attacker can do. And don't take my word on this, just look at what they say.
Needless to say (since i'm hereby flaming this model), P2P OS will not use this model.

Some business ideas

As i stated in the first post of this blog, one of the main objectives of P2P OS is to have it released as an open source product, and, furthermore, the underpinning P2P protocol should also be released as an open specification. While keeping within the constraints of these self-imposed bounds, this post gathers some business ideas that i thought of, and which could add a business case perspective to the P2P OS project.

• note: by its very nature this page is a perpetual work in progress as it has to reflect the up-to-date technological and business environment, and i'll keep adding/editing/removing ideas as they come and go; feel free to jump right in with any suggestions/criticism/etc that you may have

For starters, several important things that need to be mentioned at this point:

• first, "open source" does not mean free, neither as in "free beer" nor as in "free speech". Although a common perception is that open source software must necessarily be free software all the way (i.e. both as in "free beer" and as in "free speech"), the truth of the matter is that "open source" literally only means that the source code of the application is open for inspection to anyone who'd like to peek into the code. In other words, releasing a piece of software as open source simply means that anyone is allowed to inspect the inner working of said software, with the main benefit being to allow the potential users to check for themselves the claims that the software makes for itself.
• second, keeping in mind that P2P OS is, at its core, an application server (specifically, it provides P2P connectivity services to third-party applications), an important technical detail for the business perspective is that the P2P OS API is based on sockets communications, with P2P OS always running as a background service in parallel with any P2P OS-based application (i.e. as a separate process or thread).
• third, it is important to keep in mind that P2P OS is intended as the foundation for an application ecosystem which creates its own self-supporting network(s), such that P2P OS-based applications (e.g. collaboration platforms, social networks, etc) will barely require any centralized infrastructure, may that me technical, financial, or of some other form, for their operation.
• last but not least, there's a new kid on the block starting to flex its muscles, namely the WebRTC project. WebRTC was little more than a mere statement of intent two years ago when the P2P OS project has been started, but it has made some significant progress during the past two years and it currently looks like a serious potential competitor to P2P OS should it evolve into a truly free and open generic P2P technology (which is not the case in its current incarnation).

Now a few words about what i have in mind w/r to how P2P OS can be introduced on the market in a three-stage licensing approach:

1. in the first stage, start by releasing P2P OS as a multi-platform executable only (i.e. closed source), while also making a promise that it will be released as open source after a certain period of time (about 1 year); this first stage will essentially allow P2P OS to penetrate the market, mainly with the help of early adopters
2. in a second stage, release P2P OS as open source such that the code can be freely inspected, but do not release it as free software yet; instead, specify in the license itself that the code will [automatically] transition to free software status at a well-defined date (specified in the license); this stage should span several years, and it will be used to accomplish two main objectives:
• provide the opportunity to increase market awareness and, based on the availability of the code as open source, establish P2P OS as a trusted brand
• evaluate new business ideas/opportunities, and possibly initiate projects around them
3. finally, release P2P OS as free software under GPL or a similar license. The choice of an "infecting" viral license (like GPL, but not LGLP) is critical for allowing the development and marketing of commercial variants of the product, in parallel with the free software variant

Finally, some business ideas that crossed my mind until now:

Dual-license
This business model is based on releasing the software under dual license, GPL and a commercial license: specifically, a commercial license option can be added (in parallel with the free-software license described in the three-stage licensing model), such that application developers can purchase and embed P2P OS in their own closed source application for a fee (a one time fee, or royalty, etc).
The main idea here is that while closed-source P2P OS-based applications can be released (i.e. under a proprietary license) even in conjunction with a GPLed version of P2P OS, said close-source applications will require the presence of P2P OS as a separate service that must be run alongside the application (think of P2P OS as an independent "system tray" application that must be started for the application to run), i.e. the applications that will use the GPLed version cannot be self-contained (this restriction results from the viral nature of GPL which disallows embedding GPLed software into a close-source app). In contrast, the applications that will use the commercial license version of P2P OS will be allowed to embed [a binary library version of] P2P OS inside the applications themselves, thus enabling the creation of commercial stand-alone products.

App directory
Okay, this idea might be a bit far-fetched, but i'll write it down none-the-less: based on the fact that P2P OS is an Operating System, i.e. it is a software module that serves third-party applications, maybe a business can be made around an application directory, similar to the application store model of iOS or Android, except that the app directory will only list applications for a fee, without attempting to own/control a complete e-commerce solution (i.e. the app directory would act as a one-stop-shopping advertisement platform, directly and prominently linked from P2P OS' main website). Additionally, a number of derived businesses can also be imagined around the app directory, e.g. subcontracting application reviewers (which will themselves be subject to user rankings), etc.

Application development
The two business model ideas described above (application store and dual-licensing) are both based on using P2P OS itself for generating a revenue stream, but a business model can also be built by expanding into in-house development, and marketing, of closed-source P2P OS-based end-user applications that can be released under different licensing terms for different platforms. For example, a full-fledged P2P Communicator solution can be developed in-house and released for free (like in "free beer", but closed source) for Win/Mac/Linux, while mobile platforms variants can be sold for a fee (Android and BlackBerry 10 are prime candidates here). Should such in-house applications manage to attain high quality standards and address real market needs, they will be able to rip the benefits resulting from P2P OS' reputation as an established and trusted brand.

• "Pro" connectivity services
  as explained in the P2P networking post, the P2P application server's functionality heavily depends on the reliability of an underlying network of relaying-capable nodes, and said network of nodes is inherently not [close enough to] 100% reliable in a pure P2P network (primarily because there is no guarantee that a sufficient number of relay nodes are online at a given time, as required by a given traffic pattern). In this context, a constant revenue stream for an application vendor could come from selling a "pro" connectivity service in conjunction with its applications, which would guarantee the end users a reliable network of fallback servers whenever the p2p-based main network is unable to cope with the network traffic.
  Furthermore, the availability of "pro" connectivity services in conjunction with P2P OS-based applications is valuable not only to the end users of an app (by providing them with reliable connectivity for a decent price), but also to P2P OS's reputation by establishing it not only as an enabler for free best-effort services, but also as a foundation for reliable "pro"-class services

Sponsorships & partnerships
Well, this is more of a wishful thinking than a business idea, but i still think it has some merit: namely, when P2P OS will be released as free software, and should it indeed turn into a unique and valuable piece of software, i don't think it's totally off the wall to imagine receiving some sponsorship offers from the likes of Fedora, Ubuntu, or even Mozilla (and in exchange display their logo as sponsors on the project's home page, on the application store, etc) . Or maybe some partnership programs could be put in place with free-sofware-based companies, like e.g. imagine providing a free-software P2P communications backbone for Firefox OS, Jolla, or even BB10 (and maybe they'd be willing to provide a network of fallback servers - see the paragraph above); now wouldn't that be cool or what?

Selling the software
I'd rather keep this option as a last resort, but it is a fallback option none-the-less if WebRTC (or a similar free-software project) will evolve towards providing a self-sustained P2P network (i.e. doing away with the reliance on dedicated relay servers): in this case, whether P2P OS got to be released as free software or not, maybe a large software company/organization will be interested in acquiring the software's copyrights and owning a WebRTC alternative in-house - and again i'm primarily thinking of free-software outfits like Fedora, Ubuntu, or KDE, but maybe even a "more traditional" company like e.g. Microsoft, Apple, Viber, or Yahoo might be an interested buyer.

P2P OS in a nutshell

The P2P OS project aims at creating an open-source Peer-to-Peer Network Operating System that will enable users to communicate and share with each other without relying on any centralized infrastructure and/or service provider.

A top-level technical overview
From a technical perspective, the core of P2P OS will consist of a P2P Application Server that will implement an open-spec peer-to-peer communication API, thus enabling P2P OS-based applications to seamlessly connect with each other inside a transparently-managed P2P network.

• for example, a P2P Messenger text-only application will be able to simply request to the underlying P2P operating system to connect to [a copy of itself running on] a remote user's computer, and then send and receive messages without dealing with any of the P2P network connection details:
  
  
  
  
  
• additionally, a P2P application running on a user's computer will be able to start other "helper applications" on said computer, and thus it may both extend its own functionality via plug-ins, or it may even become a service provider (i.e. a server) for other, totally distinct, third-party applications
• for example, the above-mentioned text-based chat application can start, and fully control the operation of, a voice/video chat plug-in (which is itself a separate application), thus effectively integrating peer-to-peer voice/video chat functionality in the original (text-only) chat application:

The peer-to-peer application server module will be the first OS component to be developed, while additional kernel and userland components will be added at a later stage, with the end goal of supplying P2P OS with a comprehensive set of system management functions in areas such as the management of distributed resources, task control, creation and management of peer-to-peer overlay networks, system monitoring and diagnosis tools, etc.

P2P OS will be initially developed on the Windows platform with Windows-specific development tools, but should the project reach a stage where it becomes usable it will be ported to Nokia's Qt framework on Windows, Linux, MacOS, and MeeGo. Additionally, P2P OS will also be ported to all the mobile operating systems for which Qt support will be available, with a primary candidate being the Android OS when/if Qt support for Android will become adequate.

A few words on the business potential
Currently there are several peer-to-peer products on the market that share some common design elements with P2P OS (e.g. Yahoo messenger, Skype, Google talk, and various file sharing applications, all use some form of peer-to-peer communication), but all these products are a far cry from P2P OS in terms of both their technological foundation and their objectives: more specifically, all said products except for Skype are not pure peer-to-peer applications in that they rely on some form of centralized resources - i.e. they have the fundamental problem of requiring continuous and substantial financial backing, none of them is intended as a foundation platform for third-party applications, and none of them is open-source software. Given the above, a number of distinctive business models can be thought of which can add a business component to P2P OS, all without compromising its quintessential free public service role (i'll write a mode detailed post on this topic sometime in the coming weeks).

Support this project

If you consider this project interesting/meaningful/valuable in any way, please help spread the word to as many people you can, may they be software developers, potential sponsors and/or angel investors interested in supporting free software, or just about any other people you think might be willing to further spread the word to their own circle(s) of friends and colleagues.