# P2P Published articles for P2P. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Attacking P2P Networks: Liveness Attacks on the GossipSub and DOG Gossip Protocols DevFeed: [Attacking P2P Networks: Liveness Attacks on the GossipSub and DOG Gossip Protocols]() Original publisher: [Read original article]() Author: Jiaheng Li, Anton Paramonov, Yann Vonlanthen Published: 2026-11-03T05:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security]() Topics: [network security](), [P2P](), [mesh networking](), [cyber resiliency](), [Publish-subscribe pattern]() Tags: [abstract](), [actions](), [adversary](), [analyze](), [arxiv](), [attack](), [attacks](), [can](), [churn](), [communication](), [cost](), [cs-cr](), [decentralized](), [delivery](), [distributed](), [dog](), [ethereum](), [first](), [networks](), [p2p](), [protocols]() ### AI overview The paper reports liveness attacks that block fresh messages from reaching honest nodes without forging or altering messages. In GossipSub, a constant number of geographically distributed adversarial nodes with a fixed latency advantage can dominate the "First Message Deliveries" peer-scoring term and separate a constant fraction of nodes from the honest mesh; the authors say this separation can persist under realistic churn. For DOG, route filtering can disconnect dissemination even without failures or Byzantine participants. A practical attack using one physical node, a constant number of identities, and legitimate actions disables all forwarding routes, leaving only direct publisher-to-neighbor delivery and separating the full network. The DOG attack is verified in simulation; the abstract says the paper also analyzes costs, assumptions, and possible mitigations. ### Source excerpt arXiv:2611.03509v1 Announce Type: new Abstract: Peer-to-peer (P2P) networks form the communication layer of large decentralized systems such as Ethereum, and the correctness of higher-level protocols depends on the gossip layer delivering messages to honest nodes. We study the robustness of two gossip protocols against adversaries whose only goal is to violate liveness, that is, to prevent honest nodes from receiving fresh messages, without forging, altering, or invalidating any message. For GossipSub, the publish-subscribe protocol used by Ethereum, we show that an adversary operating a constant number of geographically distributed nodes with a fixed latency advantage can take over the ``First Message Deliveries'' peer-scoring term and separate a constant fraction of nodes from the honest mesh. We analyze the attack under a geographical model, address the random-peer and outbound-connection mechanisms, and show that the separation can be maintained under realistic churn. For DOG, a transaction-dissemination protocol designed for CometBFT, we first give simple counterexamples in which route filtering disconnects the dissemination graph even without failures or Byzantine participants, and then present a practical attack that uses only a single physical node with a constant number of identities and legitimate actions to disable every forwarding route, separating the full network while allowing only direct publisher-to-neighbor delivery. We verify the attack in a simulated network and analyze its cost, assumptions, and possible mitigations. ## Unmasking fraud networks: How graph-grounded Copilots stop P2P fraud in Microsoft Fabric DevFeed: [Unmasking fraud networks: How graph-grounded Copilots stop P2P fraud in Microsoft Fabric]() Original publisher: [Read original article]() Author: Keaton Crowe Published: 2026-10-30T15:43:30Z Content type: article Language: en Sources: [Neo4j]() Topics: [Payment Fraud](), [multi-accounting fraud](), [Neo4j](), [Graph Mining](), [Artificial Intelligence](), [graph-database](), [Graphs](), [Purview](), [Azure](), [Microsoft]() Tags: [account](), [agents](), [ai](), [ai-agent](), [algorithms](), [analytics](), [architecture](), [authentication](), [azure](), [banks](), [behavior](), [device](), [fabric](), [financial-services](), [fraud](), [fraud-detection](), [graph](), [graph-database](), [ip](), [microsoft-fabric](), [networks](), [p2p](), [transactions]() ### AI overview The excerpt describes a Microsoft Fabric and Neo4j approach to P2P fraud investigations: OneLake consolidates data in Delta tables, Neo4j turns those tables into property graphs, and graph algorithms help distinguish strong links from noisy shared infrastructure. Relational joins can treat a shared private card and a public Wi-Fi IP alike, creating many false leads. Neo4j can filter high-traffic hubs, focus on rare identifiers and payment paths, and use Graph Data Science algorithms such as Weakly Connected Components to group strongly connected accounts. In the example, accounts A-102, A-104, A-106, and A-107 are grouped with fraudulent A-101, while A-103 is excluded based only on shared coffee shop Wi-Fi. The resulting graph metrics can be written to OneLake for Fabric Data Agents and Copilots to query with network context. The excerpt also names Fabric governance features and describes enabling Neo4j through the Workload Hub or Azure Marketplace. ### Source excerpt Every second, financial networks log millions of data points across disconnected internal systems: debit transactions, peer-to-peer (P2P) transfers, device fingerprints, phone numbers, and IP addresses. But when organized crime rings strike, standard relational databases hit a wall trying to trace... Read more -> ## FeatureArc: Benchmarking Coding Agents on Evolving Features DevFeed: [FeatureArc: Benchmarking Coding Agents on Evolving Features]() Original publisher: [Read original article]() Author: Yunlong Wang, Alyssa Wu, Cuiyun Gao, Jia Feng, Songyuanyi Lu, Zhichao Hu Published: 2026-10-28T04:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence](), [arXiv: Software Engineering]() Topics: [agentic-coding](), [Software Testing](), [AI-assisted coding]() Tags: [agents](), [benchmarking](), [coding-agents](), [contracts](), [cs-ai](), [cs-se](), [defects](), [dependencies](), [errors](), [evaluation](), [evolution](), [external](), [fail](), [features](), [feedback](), [interface](), [language](), [languages](), [p2p](), [pipeline](), [rollback](), [stage]() ### AI overview FeatureArc tests whether coding agents can extend a feature across multiple stages while preserving earlier behavior. Its repository-history pipeline builds tasks with dependencies, explicit requirements and interface contracts, and executable checks in four languages; it validates tests for new behavior (fail-to-pass) and retained behavior (pass-to-pass). In 73 manually reviewed tasks of 2-10 stages, 10 agents worked in persistent sessions and workspaces without external test feedback or rollback. Pooled success dropped from 62.7% at the first stage to 28.5% on the completed feature. Inherited defects appeared in 72.9% of failed later stages; after a failure, agents missed the earlier error about 95% of the time, and self-tests rarely revisited prior stages. The results indicate that autonomous feature evolution remains difficult under this evaluation setup. ### Source excerpt arXiv:2610.37434v1 Announce Type: cross Abstract: A software feature usually evolves over time: developers extend its first version as new use cases and requirements arrive, and each extension builds on code written earlier. Most feature benchmarks evaluate a single request on a fixed codebase. Feature evolution requires evaluating successive extensions on an agent's own earlier code and checking whether the feature remains correct. We introduce FeatureArc to evaluate coding agents on evolving features, together with a pipeline that constructs its tasks from repository histories. The benchmark combines dependencies between successive stages of the same feature, explicit requirements and interface contracts, and executable checks across four programming languages. The pipeline validates fail-to-pass (F2P) tests for new behavior and pass-to-pass (P2P) tests for existing behavior on the reference code before and after each stage. We evaluated 10 coding agents on 73 manually reviewed tasks of 2 to 10 stages. Each agent works in one persistent session and workspace without external test feedback or rollback. The evaluation reveals a gap between first-stage and whole-feature success: pooled success falls from 62.7% at the first stage to 28.5% when the whole feature is tested on the final code. Trajectory analysis identifies inherited defects as a common failure mechanism, present in 72.9% of failed later stages. These earlier errors often remain undetected: in stages following a failure, agents leave the earlier error unnoticed about 95% of the time, and their self-tests rarely revisit earlier stages. Evolving a feature autonomously, without human checks between stages, therefore remains a substantial challenge for current coding agents. At Tencent, the pipeline extends internal evaluations to this setting and guides the development of Hunyuan, Tencent's family of large language models. ## Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses DevFeed: [Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses]() Original publisher: [Read original article]() Author: The Hacker News Published: 2026-10-27T06:34:47Z Content type: news Language: en Sources: [Cyber Newsroom]() Topics: [network security](), [Security](), [Vulnerabilities](), [known exploitable vulnerabilities](), [P2P]() Tags: [account](), [alert](), [attack](), [auth](), [authentication](), [authentication-bypass](), [backdoor](), [brute-force-attacks](), [cameras](), [campaign](), [cve](), [cyber-attack](), [cyber-espionage](), [dahua](), [hijack](), [iot-security](), [ip](), [network-security](), [p2p](), [remote](), [surveillance](), [ukraine](), [video](), [vulnerabilities](), [vulnerability]() ### AI overview CERT-UA reports unauthorized access to Dahua cameras and DVRs, including video viewing, configuration changes, and creation of third-party accounts. Attackers can use Dahua's Easy4IP P2P cloud relay: device serial numbers follow a predictable pattern that can be guessed at scale, exposing devices with P2P enabled even when they are not directly internet-accessible. Weak or known passwords and authentication bypass flaws in outdated firmware, including CVE-2021-33044 and CVE-2021-33045, can defeat authentication. Indicators include unfamiliar accounts, unauthorized configuration changes, and DVRIP authentication events from 127.0.0.1. CERT-UA advises disabling P2P when unnecessary, avoiding direct internet exposure, and updating software. It did not disclose the number of affected devices, timing, targets, or responsible party. The article also cites separate Hunt.io campaigns involving other camera and router vulnerabilities, including a reported large-scale Dahua campaign. ### Source excerpt Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP camer ... Read more Published Date: Oct 27, 2026 (3 hours, 57 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2025-31702 CVE-2024-57049 CVE-2024-53375 CVE-2021-36260 CVE-2021-33045 CVE-2021-33044 CVE-2020-25169 CVE-2020-25078 CVE-2017-7921 ## Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero's P2P Network! DevFeed: [Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero's P2P Network!]() Original publisher: [Read original article]() Author: Ruisheng Shi, Jiaqi Zeng, Lina Lan, Shihan Zhang, Bing Han, Xiapu Luo, Qishu Jin, Wenliang Du, Qin Wang Published: 2026-10-27T04:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security]() Topics: [network security](), [Monero](), [P2P](), [Resilience](), [Blockchain]() Tags: [adversary](), [attack](), [attacks](), [blockchain](), [bootstrapping](), [cs-cr](), [eclipse](), [network](), [p2p]() ### AI overview The abstract reports that Monero nodes behind NATs can be eclipsed without inbound access. The attacks poison peer lists at reachable nodes, which relay malicious peers into unreachable nodes' whitelists; Monero's outbound connection refresh then evicts benign neighbors until the attacker controls all outbound connections. Nyx targets long-running nodes and aims for a persistent eclipse through network-wide poisoning; it was evaluated in large-scale SEED Emulator simulations. Moros targets newly joined nodes during bootstrapping and is described as stealthier and faster; it was demonstrated on mainnet against controlled targets. The authors report stable, long-lived eclipses and say they propose countermeasures. ### Source excerpt arXiv:2609.10260v2 Announce Type: replace Abstract: Eclipse attacks isolate a blockchain node by monopolizing its network connections. Existing attacks on Monero (NDSS'25), Bitcoin (USENIX'15/21, S&P'20) and Ethereum (WWW'26) implicitly assume that the adversary can establish inbound connections, thereby excluding a large and practically dominant class of nodes: \textit{unreachable nodes} operating behind NATs. Such nodes are widely believed to enjoy stronger networks. We challenge this assumption and show that unreachability does NOT imply the expected resilience! We present the first eclipse attacks tailored to unreachable nodes in Monero's P2P network. Our attacks require no inbound access to the victim. Instead, they first poison the peerlist of reachable nodes, which subsequently act as propagation relays to contaminate unreachable nodes' whitelists. The adversary then exploits Monero's built-in outbound connection refresh logic to evict benign neighbors and eventually monopolize all outbound connections. We instantiate this strategy in two attacks: Nyx, which targets long-running unreachable nodes and achieves a complete and persistent eclipse through network-wide poisoning; and Moros, a stealthier attack that exploits the bootstrapping phase to rapidly eclipse newly joined unreachable nodes. We ethically evaluate both attacks. Nyx is validated via large-scale simulations on a Monero network constructed using the SEED Emulator, while Moros is demonstrated on the Monero mainnet against controlled targets. Our results show that unreachable nodes can be reliably driven into stable, long-lived eclipse states. We also propose countermeasures. ## Startup doxx.net hands the network controls to AI DevFeed: [Startup doxx.net hands the network controls to AI]() Original publisher: [Read original article]() Author: Sean Michael Kerner Published: 2026-10-02T17:51:23Z Content type: news Language: en Sources: [Network World]() Topics: [Virtual Private Network](), [API](), [Web](), [AI Infrastructure](), [Load Balancing]() Tags: [agentic](), [ai-agents](), [api](), [artificial-intelligence](), [artificial-intelligence-networking](), [cloudflare](), [dns](), [firewall](), [ipv4](), [ipv6](), [network](), [networking](), [p2p](), [quic]() ### AI overview Network startup doxx.net introduced an AI-managed private networking platform combining custom VPN transports, an encrypted mesh, and a separate control plane. Its agents can configure network services and infrastructure tasks, while administrators can limit or revoke their access. The company also announced a $38 million Series A round. ### Source excerpt It used to take a large team of engineers years to build a new networking startup. AI changes that game entirely. Barrett Lyon has founded (and sold) multiple networking vendors over the last two decades, including Prolexic (acquired by Akamai ), defense.net (acquired by F5 Networks), and netography (acquired by Vectra AI). Now he has turned his attention to AI with a new startup launching this week that offers the promise of Agentic Defined Networking. The platform lets users and their AI agents build private networks. The company also announced a $38 million Series A round led by Andreessen Horowitz with participation from Animo Ventures and Focal.vc. Doxx.net has its roots in the Darkflare project that Lyon created as a hobby for a TCP tunnel over Cloudflare that could tunnel through public networks in a way that helps to avoid detection and potential censorship. The response to DarkFlare led Lyon to consider a VPN that cannot be stopped and is autonomously managed by AI. "The hobby turned into an obsession, and the obsession turned into a business," Lyon told Network World. How the Agentic Defined Network platform works The platform combines custom VPN transports, a company-run mesh, and a separate control plane. Covert transports: The doxx.net client supports WireGuard and custom transports for VPN traffic over WebSocket, Session Initiation Protocol (SIP), ping, QUIC, Cloudflare and HTTPS. The transports are designed to get through firewalls. Mesh: The mesh connects every site to every site with encryption. It runs over IPv4 and IPv6 and is orchestrated through an application programming interface (API). Control plane: Lyon said the client app is a device and not a control plane. Routing, port forwarding and firewall rules are managed in a separate portal. Addressing: Devices on the mesh are not behind network address translation (NAT) or carrier-grade NAT, according to Lyon. That allows peer-to-peer (P2P) applications. DNS and certificates: The company runs it ## Streaming Encrypted Files P2P with WebRTC DataChannels and WebCrypto in TypeScript DevFeed: [Streaming Encrypted Files P2P with WebRTC DataChannels and WebCrypto in TypeScript]() Original publisher: [Read original article]() Author: SitePoint Team Published: 2026-09-19T14:38:08Z Content type: tutorial Language: en Sources: [SitePoint]() Topics: [P2P](), [WebRTC](), [backpressure](), [Encryption](), [TypeScript](), [browser](), [file](), [software-development](), [Cryptography](), [Streams](), [data](), [API]() Tags: [api](), [backpressure](), [build](), [development](), [download](), [encrypted](), [encryption](), [end-to-end-encryption](), [file](), [javascript](), [p2p](), [programming](), [sha-256](), [streams](), [tutorial](), [typescript](), [vite](), [web-security](), [webrtc](), [websocket]() ### AI overview A tutorial for building a serverless, browser-based peer-to-peer file-transfer engine using WebRTC DataChannels and WebCrypto. It covers chunked streaming, backpressure, per-chunk AES-GCM encryption, and SHA-256 integrity verification in TypeScript. ### Source excerpt Build a serverless P2P browser file-transfer engine with WebRTC DataChannels, bufferedAmountLowThreshold backpressure, and AES-GCM encryption via WebCrypto. Continue reading Streaming Encrypted Files P2P with WebRTC DataChannels and WebCrypto in TypeScript on SitePoint. ## Fraud Protection for Commerce Marketplaces and P2P Platforms DevFeed: [Fraud Protection for Commerce Marketplaces and P2P Platforms]() Original publisher: [Read original article]() Author: Ben Price Published: 2026-09-18T23:00:00Z Content type: article Language: en Sources: [Sift Science]() Topics: [P2P](), [Protection](), [trust and safety](), [account takeover](), [Risk](), [Transactions]() Tags: [account-takeover](), [commerce-marketplaces](), [fraud-prevention](), [p2p](), [p2p-platforms](), [prevent-fraud](), [protection](), [risk](), [transactions](), [trust-and-safety]() ### AI overview This article explains why commerce marketplaces and peer-to-peer platforms face distinctive fraud risks. It discusses attack surfaces across buyers, sellers, renters, and payers, and identifies account takeover and marketplace-specific mechanics as important factors in fraud prevention and trust. ### Source excerpt Two-sided platforms carry a much heavier fraud burden compared to single-sided retailers. Every buyer, seller, renter, and payer is a potential attack surface, and one bad actor can hit both sides of a transaction at once. For commerce marketplaces and peer-to-peer (P2P) platforms, fraud protection functions as trust infrastructure, determining whether people keep transacting on [...] The post Fraud Protection for Commerce Marketplaces and P2P Platforms appeared first on Sift. ## Connect an ESP device and iPhone directly using Wi-Fi Aware DevFeed: [Connect an ESP device and iPhone directly using Wi-Fi Aware]() Original publisher: [Read original article]() Author: John Lee Published: 2026-08-25T00:00:00Z Content type: tutorial Language: en Sources: [Blog on Developer Portal]() Topics: [Wi-Fi](), [iOS](), [iphone](), [cross-platform](), [P2P](), [Internet of things](), [Network]() Tags: [android](), [app](), [blog](), [cross-platform](), [esp-idf](), [esp-idf-component](), [how-to](), [ios](), [iot](), [iphone](), [ipv6](), [p2p](), [pairing](), [practitioner](), [security](), [wi-fi](), [wi-fi-aware]() ### AI overview This tutorial explains how to connect an ESP device directly to an iPhone using Wi-Fi Aware. It describes service discovery, mandatory six-digit PIN pairing, and an encrypted IPv6 data link without an access point, DHCP server, or internet connection. On supported devices running iOS 26 or iPadOS 26, the connection can operate concurrently with normal Wi-Fi connectivity. ### Source excerpt iOS 26 brings Wi-Fi Aware™ support on iPhone 12 and later, enabling compatible devices to securely discover, pair, and communicate directly. This requires no Access Point and does not affect iPhone's network connectivity over Wi-Fi. This article walks through the steps to set up an ESP device and an iPhone so they can pair and connect using Wi-Fi Aware. ## I Rebuilt a Minimal BitTorrent Client in Go to Understand Peer-to-Peer Choking Algorithms DevFeed: [I Rebuilt a Minimal BitTorrent Client in Go to Understand Peer-to-Peer Choking Algorithms]() Original publisher: [Read original article]() Author: hello@ankit-rana.com Published: 2026-08-02T00:00:00Z Content type: tutorial Language: en Sources: [Ankit Rana | Mechanical Sympathy]() Topics: [Algorithms](), [P2P](), [Go Language](), [Programming](), [Network]() Tags: [algorithms](), [bittorrent](), [distributed-systems](), [go](), [golang](), [network](), [networking](), [p2p](), [peer-to-peer](), [protocol](), [system-design]() ### AI overview A hands-on explanation of BitTorrent choking algorithms through rebuilding a minimal client in Go. The article describes choking as a decentralized bandwidth-allocation mechanism, explains the choked and interested states, and shows how upload capacity affects peer prioritization. ### Source excerpt The BitTorrent spec explains choking in two paragraphs; implementing it in Go and watching every peer choke you within 60 seconds is what makes it stick. Choking is a bandwidth allocator running independently on every node, not a courtesy flag. Upload is the scarce resource on an asymmetric link, and each connection carries just two booleans, choked and interested, whose four combinations drive the entire fairness policy of the swarm. ## Backdoors in VStarcam cameras DevFeed: [Backdoors in VStarcam cameras]() Original publisher: [Read original article]() Author: Wladimir Palant Published: 2026-01-07T13:01:48Z Content type: article Language: en Sources: [Almost Secure]() Topics: [Security](), [backdoor](), [passwords](), [P2P](), [Protocol (disambiguation)]() Tags: [backdoor](), [cameras](), [p2p](), [passwords](), [protocol](), [security]() ### AI overview An investigation of VStarcam cameras finds that firmware mechanisms systematically undermine administrator-password protection by leaking passwords and exposing cameras through internet-connected P2P functionality. The article also examines insecure firmware updates delivered over plain HTTP and recommends restricting internet access with a network firewall or using custom firmware. ### Source excerpt VStarcam is an important brand of cameras based on the PPPP protocol. Unlike the LookCam cameras I looked into earlier, these are often being positioned as security cameras. And they in fact do a few things better like... well, like having a mostly working authentication mechanism. In order to access the camera one has to know its administrator password. So much for the theory. When I looked into the firmware of the cameras I discovered a surprising development: over the past years this protection has been systematically undermined. Various mechanisms have been added that leak the access password, and in several cases these cannot be explained as accidents. The overall tendency is clear: for some reason VStarcam really wants to have access to their customer's passwords. A reminder: "P2P" functionality based on the PPPP protocol means that these cameras will always communicate with and be accessible from the internet, even when located on a home network behind NAT. Short of installing a custom firmware this can only addressed by configuring the network firewall to deny internet access. Contents How to recognize affected cameras Downloading the firmware Caveats of this survey VStarcam's authentication approach Endpoint protection Unauthenticated log access Explicit password leaking via logs Log uploading Password-leaking backdoor Establishing a timeline The impact Coordinated disclosure attempt Recommendations How to recognize affected cameras Not every VStarcam camera has "VStarcam" printed on the side. I have seen reports of VStarcam cameras being sold under the brand names Besder, MVPower, AOMG, OUSKI, and there are probably more. Most cameras should be recognizable by the app used to manage them. Any camera managed by one of these apps should be a VStarcam camera: Eye4, EyeCloud, FEC Smart Home, HOTKam, O-KAM Pro, PnPCam, VeePai, VeeRecon, Veesky, VKAM, VsCam, VStarcam Ultra. Downloading the firmware VStarcam cameras have a mechanism to deliver firmware updates (Loo ## Shipyard 2025: IPFS Year in Review DevFeed: [Shipyard 2025: IPFS Year in Review]() Original publisher: [Read original article]() Author: lidel; Shipyard Published: 2025-12-19T00:00:00Z Content type: article Language: en Sources: [IPFS]() Topics: [IPFS](), [Self-hosted](), [releases](), [browser](), [HTTP]() Tags: [2025](), [boxo](), [browser](), [decentralized](), [dht](), [distributed](), [dweb](), [ecosystem](), [helia](), [http](), [ipfs](), [kubo](), [libp2p](), [p2p](), [peer-to-peer](), [rainbow](), [releases](), [review](), [self-hosted](), [storage](), [web](), [web3](), [year-in-review]() ### AI overview A review of IPFS developments in 2025, highlighting seven Kubo releases and related ecosystem updates. It focuses on DHT Provide Sweep, AutoTLS, HTTP retrieval, and Helia-based browser retrieval as improvements for self-hosted nodes and trustless access. ### Source excerpt Seven Kubo releases made self-hosted IPFS practical. Highlights: DHT Provide Sweep, AutoTLS, HTTP retrieval, and Helia for trustless browser retrieval. ## Shipping an L1 zkEVM #2: The Security Foundations DevFeed: [Shipping an L1 zkEVM #2: The Security Foundations]() Original publisher: [Read original article]() Author: George Kadianakis Published: 2025-12-18T00:00:00Z Content type: article Language: en Sources: [Ethereum Foundation Blog]() Topics: [Security](), [Cryptography](), [Provable security](), [Ethereum](), [P2P](), [Tool]() Tags: [cryptography](), [ethereum](), [p2p](), [provable-security](), [research](), [research-development](), [security](), [tool]() ### AI overview The Ethereum Foundation outlines security foundations for building a mainnet-grade L1 zkEVM after major improvements in real-time proving. It argues for provable security at a 128-bit target, describes the tension between security and proof size, and introduces soundcalc for consistent zkVM security assessments. ### Source excerpt Thanks to Arantxa Zapico, Benedikt Wagner, and Dmitry Khovratovich from the EF cryptography team for their contributions, and to Ladislaus, Kev, Alex, and Marius for the careful review and feedback. The zkEVM ecosystem has been sprinting for a year. And it worked! We crossed the finish line for real-time... ## Provide Sweep: Solving the DHT Bottleneck for Self-Hosting IPFS at Scale DevFeed: [Provide Sweep: Solving the DHT Bottleneck for Self-Hosting IPFS at Scale]() Original publisher: [Read original article]() Author: guillaumemichel; Shipyard Published: 2025-11-26T00:00:00Z Content type: article Language: en Sources: [IPFS]() Topics: [IPFS](), [Scalability](), [Self-hosted](), [Network](), [Raspberry Pi]() Tags: [boxo](), [decentralized](), [dht](), [distributed](), [dweb](), [ecosystem](), [helia](), [ipfs](), [kubo](), [libp2p](), [p2p](), [peer-to-peer](), [performance](), [rainbow](), [raspberry-pi](), [routing](), [scale](), [self-hosting](), [storage](), [web](), [web3]() ### AI overview This article explains how Kubo v0.39's Provide Sweep becomes the default provider system for IPFS. By batching CIDs associated with the same DHT servers and systematically sweeping keyspace regions, it reports a 97% reduction in DHT lookups for a node providing 100,000 CIDs, alongside smart resume capabilities and memory optimizations. ### Source excerpt Provide Sweep: Solving the DHT Bottleneck for Self-Hosting IPFS at Scale ## An overview of the PPPP protocol for IoT cameras DevFeed: [An overview of the PPPP protocol for IoT cameras]() Original publisher: [Read original article]() Author: Wladimir Palant Published: 2025-11-05T15:11:36Z Content type: article Language: en Sources: [Almost Secure]() Topics: [Internet of things](), [Protocol (disambiguation)](), [P2P](), [Reverse Engineering](), [Security]() Tags: [cameras](), [firmware](), [iot](), [network](), [p2p](), [protocol](), [reverse-engineering](), [security-research](), [servers](), [tcp]() ### AI overview An overview of the PPPP protocol used primarily by network-connected IoT cameras. The article explains that PPPP relies on central servers while allowing bulk data transfer through direct client-to-device connections, and describes device identifiers, connection establishment, fallback mechanisms, redundant servers, and related protocol research. ### Source excerpt My previous article on IoT "P2P" cameras couldn't go into much detail on the PPPP protocol. However, there is already lots of security research on and around that protocol, and I have a feeling that there is way more to come. There are pieces of information on the protocol scattered throughout the web, yet every one approaching from a very specific narrow angle. This is my attempt at creating an overview so that other people don't need to start from scratch. While the protocol can in principle be used by any kind of device, it is mostly being used for network-connected cameras. It isn't really peer-to-peer as advertised but rather relies on central servers, yet the protocol allows to transfer the bulk of data via a direct connection between the client and the device. It's hard to tell how many users there are but there are lots of apps, I'm sure that I haven't found all of them. There are other protocols with similar approaches being used for the same goal. One is used by ThroughTek's Kalay Platform which has the interesting string "Charlie is the designer of P2P!!" in its codebase (32 bytes long, seems to be used as "encryption" key for some non-critical functionality). I recognize both the name and the "handwriting," it looks like PPPP protocol designer found a new home here. Yet PPPP seems to be still more popular than the competition, thanks to it being the protocol of choice for cheap low-end cameras. Disclaimer: Most of the information below has been acquired by analyzing public information as well as reverse engineering applications and firmware, not by observing live systems. Consequently, there can be misinterpretations. Contents The general design The network ports The device IDs The protocol variants CS2 Network Yi Technology iLnk HLP2P "Encryption" "Secret" messages Applications Changelog The general design The protocol's goal is to serve as a drop-in replacement for TCP. Rather than establish a connection to a known IP address (or a name to be resolved ## A look at a P2P camera (LookCam app) DevFeed: [A look at a P2P camera (LookCam app)]() Original publisher: [Read original article]() Author: Wladimir Palant Published: 2025-09-08T13:00:50Z Content type: article Language: en Sources: [Almost Secure]() Topics: [Security](), [Vulnerabilities](), [webcam](), [Encryption](), [P2P](), [Cloud]() Tags: [camera](), [cloud](), [encryption](), [internet](), [p2p](), [security]() ### AI overview A security analysis of internet-connected cameras managed through the LookCam app reports weak access controls, largely unencrypted PPPP communication, exposed cloud uploads, firmware security flaws, and no firmware update mechanism. The findings are presented as applying to LookCam-managed cameras and several related apps, but not LookCamPro devices. ### Source excerpt I've got my hands on an internet-connected camera and decided to take a closer look, having already read about security issues with similar cameras. What I found far exceeded my expectations: fake access controls, bogus protocol encryption, completely unprotected cloud uploads and firmware riddled with security flaws. One could even say that these cameras are Murphy's Law turned solid: everything that could be done wrong has been done wrong here. While there is considerable prior research on these and similar cameras that outlines some of the flaws, I felt that the combination of severe flaws is reason enough to publish an article of my own. My findings should apply to any camera that can be managed via the LookCam app. This includes cameras meant to be used with less popular apps of the same developer: tcam, CloudWayCam, VDP, AIBoxcam, IP System. Note that the LookCamPro app, while visually very similar, is technically quite different. It also uses the PPPP protocol for low-level communication but otherwise doesn't seem to be related, and the corresponding devices are unlikely to suffer from the same flaws. There seems to be little chance that things will improve with these cameras. I have no way of contacting either the hardware vendors or the developers behind the LookCam app. In fact, it looks like masking their identity was done on purpose here. But even if I could contact them, the cameras lack an update mechanism for their firmware. So fixing the devices already sold is impossible. I have no way of knowing how many of these cameras exist. The LookCam app is currently listed with almost 1.5 million downloads on Google Play however. An iPhone and a Windows version of the app are also available but no public statistics exist here. Contents The highlights The hardware The LookCam app The PPPP protocol The basics The "encryption" The threat model The firmware The cloud How safe are device IDs? Recommendations Further reading The highlights The camera cannot be eas ## Turso crosses the mark of 128 contributors DevFeed: [Turso crosses the mark of 128 contributors]() Original publisher: [Read original article]() Author: Glauber Costa Published: 2025-07-24T00:00:00Z Content type: article Language: en Sources: [Turso]() Topics: [Turso](), [Rust](), [SQLite](), [Open Source](), [Database](), [systems]() Tags: [code](), [database](), [engineering-culture](), [open-source](), [p2p](), [rust](), [software](), [sqlite](), [turso]() ### AI overview Turso has reached 128 contributors to its open-source, fully compatible SQLite rewrite in Rust. The article introduces bit-aloo, the 128th contributor, and describes their background, interest in SQLite internals, and positive experience with Turso's engineering culture and contribution process. ### Source excerpt Turso just crossed 128 contributors on its open SQLite rewrite in Rust. Meet bit-aloo, our 128th contributor, on contributing to database internals. ## Start netlab Tools without Changing Topology File DevFeed: [Start netlab Tools without Changing Topology File]() Original publisher: [Read original article]() Published: 2025-06-30T07:14:00Z Content type: tutorial Language: en Sources: [ipSpace]() Topics: [IS-IS](), [Network](), [Cisco](), [Tool](), [P2P]() Tags: [cisco](), [ietf](), [is-is](), [netlab](), [network](), [p2p](), [tools]() ### AI overview This article explains how to enable the Edgeshark tool in netlab without modifying individual lab topology files. It uses an environment-variable default and a reproduced IS-IS integration test to investigate interoperability with older IOSv images. The investigation finds that FRRouting and Arista EOS accept Cisco routers sending pre-standard P2P IS-IS hello messages with missing sub-TLVs. ### Source excerpt Dan Partelly figured out that we have to configure the standard (IETF) 3-way IS-IS handshake on old IOSv images. On the other hand, all IS-IS integration tests pass for IOSv and IOSvL2. I wondered what was going on. Fortunately, a few months ago, I spent some time installing the client-side Edgeshark components on my laptop. All I needed to do was enable the edgeshark tool in my lab topology and restart the lab. Read more ... ## Lightweight MQTT Broker for ESP32: Mosquitto ported to ESP-IDF DevFeed: [Lightweight MQTT Broker for ESP32: Mosquitto ported to ESP-IDF]() Original publisher: [Read original article]() Author: John Lee Published: 2025-05-28T00:00:00Z Content type: article Language: en Sources: [Blog on Developer Portal]() Topics: [ESP32](), [MQTT](), [ESP-IDF](), [Internet of things](), [Software Testing](), [Home Assistant](), [P2P](), [TLS (Transport Layer Security)]() Tags: [blog](), [broker](), [edge-computing](), [esp](), [esp-idf](), [esp32](), [home-assistant](), [iot](), [mqtt](), [p2p](), [security](), [testing](), [tls]() ### AI overview This article introduces a lightweight port of the Eclipse Mosquitto MQTT broker to ESP-IDF for ESP32 devices. It describes support for TLS and TCP transports and outlines uses including private local IoT networks, on-device MQTT testing, and bridged brokers over peer-to-peer connections. ### Source excerpt Mosquitto - the industry-standard MQTT broker - has been ported to ESP-IDF. Its lightweight version retains Mosquitto's core functionality and security features to run on resource-constrained IoT devices. This MQTT broker is ideal for edge computing, testing, and standalone IoT deployments. In this article, we will do an overview and show you how to get started. ## 🌳 IPFS Newsletter 205: HTTP, P2P in browsers, Kubo speedup & more DevFeed: [🌳 IPFS Newsletter 205: HTTP, P2P in browsers, Kubo speedup & more]() Original publisher: [Read original article]() Published: 2025-05-23T00:00:00Z Content type: news Language: en Sources: [IPFS]() Topics: [IPFS](), [HTTP](), [P2P](), [browser]() Tags: [browsers](), [http](), [ipfs](), [newsletter](), [object-object](), [p2p](), [updates]() ### AI overview The IPFS Newsletter returns with updates on HTTP support across the IPFS stack, peer-to-peer retrieval in browsers, Kubo, the Service Worker Gateway, and IPNI service improvements. ### Source excerpt The IPFS Newsletter is back, with many exciting updates to share: HTTP support across the IPFS stack, P2P in browsers, Kubo speedup, and more. ## Response: Peer-to-Peer Communication in IPv6 World DevFeed: [Response: Peer-to-Peer Communication in IPv6 World]() Original publisher: [Read original article]() Published: 2025-04-15T05:23:00Z Content type: opinion Language: en Sources: [ipSpace]() Topics: [P2P](), [Network](), [Firewall](), [WebRTC]() Tags: [firewall](), [firewalls](), [ipv6](), [nat](), [p2p](), [webrtc]() ### AI overview This article presents Daryll Swer's response about peer-to-peer communication over IPv6. It argues that native IPv6 avoids shared-address NAT and related port-exhaustion issues, while stateful firewalls can still affect connectivity. The response reports successful STUN-based IPv6 peer connections in tested applications but notes that many CGNAT deployments remain problematic. ### Source excerpt Daryll Swer posted a very informative response to my NAT Traversal Mess blog post, focusing on: Punching holes through that firewall is equivalent to establishing NAT translations. It would be a shame to let that response wither as small print at the bottom of a blog post; here it is: Read more ... ## X Money's Visa partnership could expand X into digital payments DevFeed: [X Money's Visa partnership could expand X into digital payments]() Original publisher: [Read original article]() Author: Muralikrishnan Puthanveedu, Sid Zalaki Published: 2025-02-11T00:00:00Z Content type: opinion Language: en Sources: [Thoughtworks Insights]() Topics: [P2P](), [digital](), [Users](), [App]() Tags: [crypto](), [digital-payment](), [p2p](), [payments](), [paypal](), [platform](), [scale](), [x](), [x-money]() ### AI overview The article examines X's partnership with Visa to support peer-to-peer payments through X Money. It argues that the service could improve payments for creators, deepen user engagement, and eventually broaden X's financial offerings, while noting that its potential as a super app may be overstated. ### Source excerpt From tweets to transactions: X money's bid to revolutionize payments ## Introducing the 2025 Academic Grants Round DevFeed: [Introducing the 2025 Academic Grants Round]() Original publisher: [Read original article]() Author: Shyam Sridhar Published: 2025-01-21T00:00:00Z Content type: release Language: en Sources: [Ethereum Foundation Blog]() Topics: [Ethereum](), [Algorithms](), [Cryptography](), [Formal verification](), [Network](), [P2P](), [Security]() Tags: [2025](), [academic-research](), [algorithms](), [announce](), [cryptography](), [ethereum](), [formal-verification](), [funding](), [funding-coordination](), [networking](), [p2p](), [pdf](), [security]() ### AI overview The Ethereum Foundation's Ecosystem Funding Initiative has opened its 2025 Academic Grants Round, offering $2 million for open-access academic research related to Ethereum. Proposals are due by March 16, 2025. ### Source excerpt The EF's Ecosystem Funding Initiative team is proud to announce the launch of the 2025 Academic Grants Round, a pioneering initiative aimed at empowering and expanding the frontiers of Ethereum-related academic research. With a dedicated fund of $2 million, we are eager to build upon the success of the previous... ## Eth2 Phase 0 audit completed, pre-launch bounty program announced DevFeed: [Eth2 Phase 0 audit completed, pre-launch bounty program announced]() Original publisher: [Read original article]() Author: Danny Ryan Published: 2020-03-31T00:00:00Z Content type: release Language: en Sources: [Ethereum Foundation Blog]() Topics: [Ethereum](), [P2P](), [software-development]() Tags: [announcements](), [attacks](), [audit](), [bounty](), [bugs](), [ethereum](), [p2p](), [research-development](), [update]() ### AI overview This Eth2 update reports the completion of Least Authority's comprehensive audit of the Phase 0 specifications, including patched DoS vectors and further investigation of identified concerns. It also announces a pre-launch bug bounty program with rewards of up to $10,000 and describes efforts to unify eth1 and eth2 communications. ### Source excerpt Have some fun announcements for y'all this week :) Other than the items below, client teams continue to move toward production. More on that next week! tl;dr Least Authority Phase 0 audit complete Phase 0 Pre-Launch Bounty Program 🐛 Unification of eth1+eth2 communications in the Eth R&D... [Next page]()