From 67f1f8c589cc5a13e703343a8c344de7152b4578 Mon Sep 17 00:00:00 2001 From: hosted-fornet Date: Thu, 18 Jan 2024 11:24:12 -0800 Subject: [PATCH 01/10] change `NDNS` -> `KNS` --- src/identity_system.md | 14 +++++++------- src/intro.md | 4 ++-- src/my_first_app/chapter_1.md | 2 +- src/pki.md | 8 ++++---- 4 files changed, 14 insertions(+), 14 deletions(-) diff --git a/src/identity_system.md b/src/identity_system.md index 5c3fc0bb..8cb55ea7 100644 --- a/src/identity_system.md +++ b/src/identity_system.md @@ -5,23 +5,23 @@ This identity must be self-sovereign, unforgeable, and easy to discover by peers Kinode OS uses a domain system similar to [ENS](https://ens.domains/) to achieve this. It should be noted that, in our system, the concepts of `domain`, `identity`, and `username` are identical and interchangeable. -Like ENS, Kinode domains (managed by our NDNS) are registered by a wallet and owned in the form of an NFT. +Like ENS, Kinode domains (managed by our KNS) are registered by a wallet and owned in the form of an NFT. However, unlike ENS, Kinode domains never expire. Additionally, they contain metadata.osessary to both: - demonstrate the provenance of a given identity. - route messages to the identity on the Kinode network. -NDNS provides both sensible defaults and flexibility. +KNS provides both sensible defaults and flexibility. The cheapest option is also the default: minting a new NFT, a `.os` TLD. -However, unlike ENS, NDNS is not restricted to a single set of NFTs. +However, unlike ENS, KNS is not restricted to a single set of NFTs. Instead, it is designed to easily extend and wrap existing NFTs, enabling users to use identities they are already attached to as their Kinode identity. What does this look like in practice? It's easy enough to check for provenance of a given identity. If you have an Kinode domain, you can prove ownership by signing a message with the wallet that owns the domain. -However, to essentially use your Kinode identity as a domain name for your personal server, NDNS domains have routing information, similar to a DNS record, that points to an IP address. +However, to essentially use your Kinode identity as a domain name for your personal server, KNS domains have routing information, similar to a DNS record, that points to an IP address. -A NDNS domain can either be `direct` or `indirect`. +A KNS domain can either be `direct` or `indirect`. When users first boot a node, they may decide between these two domain types as they create their initial identity. Direct nodes share their literal IP address and port in their metadata, allowing other nodes to message them directly. Again, this is similar to registering a WWW domain name and pointing it at your web server. @@ -34,8 +34,8 @@ When a node wants to send a message to an indirect node, it first finds the node The router is responsible for forwarding the message to the indirect node and similarly forwarding messages from that node back to the network at large. For more information about the architectural specifics of the networking protocol, see [Networking Protocol](./networking_protocol.md). -The main takeaway for the identity system is that *domain provenance* and *domain resolution* are unified by NDNS. +The main takeaway for the identity system is that *domain provenance* and *domain resolution* are unified by KNS. -Like .eth for ENS, the NDNS domain space is fixed inside the `.os` top-level domain. +Like .eth for ENS, the KNS domain space is fixed inside the `.os` top-level domain. However, we reserve the ability to expand domain availability in the future, and governance of the Kinode protocol will include the ability to manage domain names. Eventually, we hope to link various TLDs to existing NFT communities and other identity systems. diff --git a/src/intro.md b/src/intro.md index cbfb98d2..a7626ac1 100644 --- a/src/intro.md +++ b/src/intro.md @@ -28,8 +28,8 @@ Kinode's kernel handles the startup and teardown of processes, as well as messag Processes are programs compiled to Wasm, which export a single `init()` function. They can be started once and complete immediately, or they can run "forever". -Peers in Kinode OS are identified by their onchain username in the "NDNS": Kinode Domain Name System, which is modeled after ENS. -The modular architecture of the NDNS allows for any Ethereum NFT, including ENS names themselves, to generate a unique Kinode identity once it is linked to a NDNS entry. +Peers in Kinode OS are identified by their onchain username in the "KNS": Kinode Name System, which is modeled after ENS. +The modular architecture of the KNS allows for any Ethereum NFT, including ENS names themselves, to generate a unique Kinode identity once it is linked to a KNS entry. Data persistence and blockchain access, as fundamental primitives for p2p apps, are built directly into the kernel. The filesystem is abstracted away from the developer, and data is automatically persisted across an arbitrary number of encrypted remote backups as configured at the user-system-level. diff --git a/src/my_first_app/chapter_1.md b/src/my_first_app/chapter_1.md index 789e861a..55532ef2 100644 --- a/src/my_first_app/chapter_1.md +++ b/src/my_first_app/chapter_1.md @@ -153,7 +153,7 @@ $ cat my_chat_app/pkg/metadata.json } ``` -Here, the `publisher` is some default value, but for a real package, this field should contain the NDNS id of the publishing node. +Here, the `publisher` is some default value, but for a real package, this field should contain the KNS id of the publishing node. The `publisher` can also be set with a `kit new --publisher` flag. ## Building the Package diff --git a/src/pki.md b/src/pki.md index fc594425..fca20152 100644 --- a/src/pki.md +++ b/src/pki.md @@ -1,12 +1,12 @@ # Public Key Infrastructure -The following is a high level overview of Kinode's public key infrastructure, the Kinode Identity System, or NDNS. +The following is a high level overview of Kinode's public key infrastructure, the Kinode Identity System, or KNS. You can find a more general discussion of the Kinode [identity system](./identity_system.md) here. ## Identity Registration -The NDNS Registry and Resolver are coupled in the same contract, the `NDNSRegistryResolver`. -This contract issues nodes on the NDNS network and records the data.osessary for a node to interact with other nodes. +The KNS Registry and Resolver are coupled in the same contract, the `KNSRegistryResolver`. +This contract issues nodes on the KNS network and records the data.osessary for a node to interact with other nodes. At a high level, the PKI depends on two elements: public keys and networking information. @@ -27,7 +27,7 @@ These router nodes communicate between indirect nodes and the network at large. ## Name Registration The `DotNecRegistrar` (AKA `.os`) is responsible for registering all `.os` domain names. -It is also responsible for authorizing alterations to `.os` node records managed by the NDNSRegistryResolver. (Todo: just confused by this) +It is also responsible for authorizing alterations to `.os` node records managed by the KNSRegistryResolver. (Todo: just confused by this) `DotNecRegistrar` implements ERC721 tokenization logic for the names it is charged with, so all `.os` names are NFTs that may be transferred to and from any address. There is currently a minimum length of 9 characters for Kinode IDs. From 6dfa8e152a8957cc47b5282a70c312b3760b3258 Mon Sep 17 00:00:00 2001 From: hosted-fornet Date: Thu, 18 Jan 2024 12:55:27 -0800 Subject: [PATCH 02/10] move sentences onto their own lines --- src/networking_protocol.md | 12 ++++++++---- src/pki.md | 8 ++++---- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/src/networking_protocol.md b/src/networking_protocol.md index 3f254f49..65e17d79 100644 --- a/src/networking_protocol.md +++ b/src/networking_protocol.md @@ -26,7 +26,8 @@ A new key transaction may be posted at any time, but because agreement on networ Therefore, all nodes must have robust access to the onchain PKI, meaning: multiple backup options and multiple pathways to read onchain data. Because it may take time for a new networking key to proliferate to all nodes, (anywhere from seconds to days depending on chain indexing access) a node that changes its networking key should expect downtime immediately after doing so. -Nodes that wish to make direct connections must post an IP and port onchain.The registry contract has one IP slot per node, which the owner address of a node can update at will. +Nodes that wish to make direct connections must post an IP and port onchain. +The registry contract has one IP slot per node, which the owner address of a node can update at will. The contract has four port slots, one each for WebSockets (`ws`), TCP, UDP, and WebTransport (`wt`). Each port slot can be updated individually by the owner address of a node. Indirect nodes must leave these slots blank, and instead fill out a `routing` field, which contains a list of nodes that are allowed and expected to route messages to them. @@ -115,7 +116,8 @@ pub struct RoutingRequest { ``` The `protocol_version` is the current protocol version, which is 1. The `source` is the initiator's node ID, as provided onchain. -The `signature` must be created by the initiator's networking public key. The content is the routing target's node ID (i.e., the node which the initiator would like to establish an e2e encrypted connection with) concatenated with the router's node ID (i.e., the node which the initiator is sending the `RoutingRequest` to, which will serve as a router for the connection if it accepts). +The `signature` must be created by the initiator's networking public key. +The content is the routing target's node ID (i.e., the node which the initiator would like to establish an e2e encrypted connection with) concatenated with the router's node ID (i.e., the node which the initiator is sending the `RoutingRequest` to, which will serve as a router for the connection if it accepts). The `target` is the routing target's node ID that must be signed above. [TODO document the rejection/acceptance of RoutingRequests] @@ -153,7 +155,8 @@ Every message sent over the connection is a `KernelMessage`, serialized with Mes When listening for messages, the protocol may ignore messages other than Binary, but should also respond to Ping messages with Pongs. -When a Binary message is received, it should first be decrypted using the keys exchanged in the handshake exchange, then deserialized as a `KernelMessage`. If this fails, the message should be ignored and the connection must be closed. +When a Binary message is received, it should first be decrypted using the keys exchanged in the handshake exchange, then deserialized as a `KernelMessage`. +If this fails, the message should be ignored and the connection must be closed. Successfully decrypted and deserialized messages should have their `source` field checked for the correct node ID and then passed to the kernel. @@ -184,7 +187,8 @@ Messages do not have to expect a response. If no response is expected, a networking-level offline or timeout error may still be thrown. Local messages will only receive timeout errors if they expect a response. -If a peer is direct, i.e. they have networking information published onchain, determining their offline status is simple: try to create a connection and send a message; it will throw an offline error if this message fails. If a message is not responded to before the timeout counter expires, it will throw a timeout. +If a peer is direct, i.e. they have networking information published onchain, determining their offline status is simple: try to create a connection and send a message; it will throw an offline error if this message fails. +If a message is not responded to before the timeout counter expires, it will throw a timeout. If a peer is indirect, i.e. they have routers, multiple attempts must be made before either an offline error is thrown. The specific implementation of the protocol may vary in this regard (e.g. it may try to connect to all routers, or limit the number of attempts to a subset of routers). diff --git a/src/pki.md b/src/pki.md index fca20152..1013a61a 100644 --- a/src/pki.md +++ b/src/pki.md @@ -26,11 +26,11 @@ These router nodes communicate between indirect nodes and the network at large. ## Name Registration -The `DotNecRegistrar` (AKA `.os`) is responsible for registering all `.os` domain names. -It is also responsible for authorizing alterations to `.os` node records managed by the KNSRegistryResolver. (Todo: just confused by this) -`DotNecRegistrar` implements ERC721 tokenization logic for the names it is charged with, so all `.os` names are NFTs that may be transferred to and from any address. +The `DotOsRegistrar` (AKA `.os`) is responsible for registering all `.os` domain names. +It is also responsible for authorizing alterations to `.os` node records managed by the KNSRegistryResolver. (TODO: just confused by this). +`DotOsRegistrar` implements ERC721 tokenization logic for the names it is charged with, so all `.os` names are NFTs that may be transferred to and from any address. There is currently a minimum length of 9 characters for Kinode IDs. -`DotNecRegistrar` allows users to create subdomains underneath any `.os` name they own. +`DotOsRegistrar` allows users to create subdomains underneath any `.os` name they own. Initially this grants them control over the subdomain, as a holder of the parent domain, but they may choose to irreversibly revoke this control if they desire to. This applies at each level of subdomain. From 8a53033403732b6c15f2354fbeb9431e02ae6f89 Mon Sep 17 00:00:00 2001 From: hosted-fornet Date: Thu, 18 Jan 2024 20:08:41 -0800 Subject: [PATCH 03/10] `kinode node` -> `Kinode` --- src/apis/websocket_authentication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/apis/websocket_authentication.md b/src/apis/websocket_authentication.md index b7abb943..2a32692b 100644 --- a/src/apis/websocket_authentication.md +++ b/src/apis/websocket_authentication.md @@ -15,7 +15,7 @@ const api = new KinodeEncryptorApi({ nodeId: window.our.node, // this is set if the /our.js script is present in index.html processId: "my_package:my_package:template.os", onOpen: (_event, api) => { - console.log('Connected to kinode node') + console.log('Connected to Kinode') // Send a message to the node via WebSocket api.send({ data: 'Hello World' }) }, From 2dc5d8dbe1948488aebac38aa788852cf57f8471 Mon Sep 17 00:00:00 2001 From: hosted-fornet Date: Thu, 18 Jan 2024 20:08:48 -0800 Subject: [PATCH 04/10] mfa: fixes --- src/my_first_app/chapter_1.md | 56 +++++++++++++++++++++-------------- src/my_first_app/chapter_2.md | 11 ++++--- 2 files changed, 38 insertions(+), 29 deletions(-) diff --git a/src/my_first_app/chapter_1.md b/src/my_first_app/chapter_1.md index 55532ef2..6b08cced 100644 --- a/src/my_first_app/chapter_1.md +++ b/src/my_first_app/chapter_1.md @@ -47,7 +47,7 @@ Options: -a, --package Name of the package [default: DIR] -u, --publisher Name of the publisher [default: template.os] -l, --language Programming language of the template [default: rust] [possible values: rust, python, javascript] - -t, --template