00:00 Hello, I'm Seth For Privacy, and welcome to Season 2, Episode 10 of Opt Out. Opt Out's a show where I sit down with passionate people to learn why privacy matters to them, the tools and techniques they've found and leveraged, and where we encourage and inspire others towards personal privacy and data sovereignty. Have you heard about I2P but aren't sure where it fits into your network privacy toolkit? This episode, we're sitting down with Sadie and IDK from I2P to chat about I2P's approach to privacy, its use cases, and how it compares to similar tools like the Tor network.

Welcome on to Opt Out, Sadie and IDK. Hi. Thanks for that. Thank you all both for joining. Definitely excited to learn a little bit more about I2P myself because it's something that I really feel like a lot of people in the privacy community have heard of, but I haven't run into many people that really deeply understand what it is and how it compares to other tools that often get kind of put alongside of it. So really looking forward to diving more deeply into it, talking a little bit about how it's architected, and just letting listeners learn if it's a tool that will fit into their privacy toolkit.

But for those who aren't familiar with the two of you or with I2P, do you mind just introducing yourselves and telling us a little bit about what I2P does? Okay. I'm IDK. I work on the I2P project in various capacities. One of the things I do the most of is I try to make it easier to get applications configured with I2P, whether that means building them with I2P support built in or writing documentations of how to adapt them or anything in between, in particular browsers.

And I also work with Sadie on usability. That's me. My name is Sadie, and I've worked with the project for a very long time. My role mostly centers around being an end user advocate, trying to keep our documentation in line, and usability. I recently launched the I2P Usability Lab, which is supporting better onboarding through our documentation and obviously our UX and the core Java software. Awesome. Thank you all for both introducing yourselves there.

And before we dive too deeply into I2P itself, I'm always curious to hear what it was that woke the two of you up to the need for personal privacy, because obviously there's something driving you there to work on a project like I2P. So I'd love to hear just a little bit more about each of you. Well, for me, I think it's actually kind of, and I'm going to answer with a sort of inversion of the question. I think we're not really woken up to personal privacy.

I think most people have given up on personal privacy, and that's a little bit different. I think most people realize that personal privacy is important, because it's actually something that for the most part is drilled into us. It's a thing that is kind of a pretty powerful feature of being a human being, the ability to know when another entity knows something about you or not. That's something that not a lot of other animals have, and it's kept us safe since before we were really people.

Privacy is actually wired into us. It's the default. It was the default for our primate ancestors. Our first form of privacy was hiding from predators. That's a really fascinating angle there. I do like that idea that we have that inherent, again, not even like a right necessarily, even though obviously privacy is a right that we each have, but it's an inherent piece of kind of each of our identities, but that a lot of people have given up on trying to protect it.

Definitely an interesting angle there. How about you, Sadie? I feel like this to take IDK's point a little further that in my experience, I feel like I came from having kind of this innate privacy, kind of not wanting people to necessarily know certain things and feeling like I had the right to, to being in this more paradoxical landscape. I feel like I'm not going to be able to do that. I feel like I'm not going to be able to do that. I feel like I'm not going to be able to do that.

I feel like I'm not going to be able to do that. social media and things like this that where you're kind of encouraged to perhaps overshare or or engage with browsers or any of the things that we're using to access information online where you can obviously see where your history is being recorded or people can access things about you and so privacy has become a very different thing i think with the internet for me uh to um to reinforce uh sadie's point here too she actually she used this word oversharing and i think um that pattern is something that has been uh has been explored in many ways on a scientific level by entities like facebook um and and if your if your brain says that privacy is what you can expect from your environment then um then what what's happened here is that uh an externality has been introduced into people's environment that's um that's actually uh a ubiquitous dark pattern uh everywhere there is uh there there is this omnipresent infrastructure of surveillance and uh and

and it's actually defying people's expectations and all but the most uh in all but the most strict sense um you know people give their quasi-informed consent when they sign up to these networks and that's about it yeah i loved uh something that a previous guest talked about when we were talking about kind of social media and how it's become an expectation that as a member of society you engage with social media and you overshare and that if you choose not to overshare you kind of are opting out of access to a lot of modern society um so i definitely do see that that piece where it's a dark pattern where these these companies have a financial incentive to push us to overshare and push us to to to continue to sit on their platform for as long as possible and like you said they've done some crazy research studies to to further their own mission to to kind of uh destroy individual privacy because they know that it's a it's an avenue to um to money quite insidious actually because i would have noticed

specifically over the last few years as well with not being able to shop or you know go out as much is that so many people have moved their obviously their online presence even more online with shops and things like that so people using things like instagram um to promote products or sell things and you can't even access certain social media platforms if you don't sign up for them so you're giving your and so you're giving so much more away just to try to um engage with maybe a seller or somebody like a florist in your neighborhood it's it's quite insidious yeah it drives that that trackable model and ensures that they have a a identity obviously it's not necessarily your personal identity but some sort of identity of of who you are online before you can even engage with those platforms which is definitely not a necessity but um drives their their mission forward for sure um and obviously i2p is is a technology that is is there to help with network privacy and i i really am curious to learn a little bit more about the creation of

i2p um because there's always really fascinating stories behind tools like this and specifically behind open source projects um so do you mind walking through a little bit of of what it was that prompted the creation of i2p so uh free net was actually probably the first of those these uh three tools that often sort of get lumped together free net i2p and tor um and uh free net has this distributed data store model but it doesn't um do onion routing between the nodes so free net needed a transport layer that was onion routed and i2p kind of has its roots in that and then uh at various points in time it's pivoted uh from a a from what it was in the past to what it is today uh the first pivot was to the invisible irc

10:00 network, you can still find some artifacts of the website and the source code. It's all on SourceForge out there someplace. And then finally the network that we know today emerges out of that, and that's the Invisible Internet Project. And we ever did make our way back to being a free net transport. We eventually came up with our own thing. Now there's not been much interest in that ever since. Thanks for walking through that. I know the history can get murky with a project that's this old and has this much history behind it. So I'd like to learn a little bit more about that.

There was also a pretty big exodus at one point. The original lead developer, Sword of Bale, just disappeared. It originally said he was going to go work on one of the subprojects, an application called Cindy. And then nobody knew where he was for a while. And then eventually dug up one of the people who was one of the original lead developers around 2014. But there's actually a pretty, there was actually a little bit of a gap in the history there as well.

Now, do you mind walking through a little bit of kind of what I2P is and how it works? Maybe just a basic architecture around what it is? Well, it sort of starts with this. It starts with a couple of sort of data structures, so to speak. There's one called the router info and one called the lease set. And then there's this other thing called the network database. And it is a specialized DHT that we use to organize router infos and lease sets among all the participants in the I2P network.

And the trick is that we have to make sure that, at least in the cryptographic sense, the router info and the lease set are decoupled from each other. It's not possible to link one to the other by having some kind of knowledge of one key or the other, so to speak. And once you have this, we use this structure to build tunnels. And those tunnels are built between any router that can receive incoming connections. So the fundamental difference for us between us and Tor is often kind of this.

Everybody who can receive a connection is potentially a router. Although, if you don't share much bandwidth or if you don't have much speed or you are behind certain kinds of NAT, you might end up sharing a little less than others because you're just kind of less able to. And that, so we build these tunnels and they have characteristics that most people will probably find pretty, the obvious one is that they have multiple hops. But these tunnels are actually tunnel pools.

They're groups of tunnels, all of which have multiple hops. And all of which might potentially be used to transport your information. So there's a bit of redundancy involved here as well. And ultimately, what we end up presenting to the users is sort of, I think of it like Netcat if I were talking to sysadmins. But it's really just a way of plumbing connections between the network that's built out of these tunnels and local applications running on your machine.

So for users who jump in and get started using I2P, what's kind of the focus of what you'd want them to get from using I2P? There's a bunch of answers to that questions because on a certain level, we're not just one thing. We're a sort of generic that gets adapted to many different types of networking applications. Most people get familiar with Tor through the Tor browser, but we aren't really like that. We are sort of app agnostic on a certain level.

And so you can do almost anything with I2P. You can transport just about anything if you can figure out how to do it, how to get it configured. So I suppose there's an answer for people that's practical, that's in practice. Go look at Hidden Services Manager. Download the Firefox bundle to make sure that you get your browser configured correctly. And those kind of concrete things. But what I'd really like people to get out of I2P is a sense that they can start decoupling the things that they take for granted from the, not to sound paranoid, but corporate surveillance behemoth.

Yeah, so at its core, it's really offering network privacy in a way that's easily integrated with lots of different things. It can be a browser, like you mentioned with the Firefox bundle. It can be used to browse to other sites. But it can also just be something that helps you to provide network privacy to other applications. Like I know in the Monero network, there's native support for I2P as a network for the peer-to-peer connections, the node syncing, that sort of communication, and for sending transactions.

So I know that's another way that it can be integrated there. Would you say it's kind of similar in practice to the Tor daemon itself, not the Tor browser, but the Tor daemon, in kind of the way that it can help to protect network traffic of any service or tool that can integrate with it? Yes. Yeah, that's more or less the case. We do several things very differently from Tor, but at its core, I think we have mostly the same goals, and the mechanics that we present to people are pretty similar on a lot of levels.

What are some of the kind of practical use cases that a more entry-level person, like not a dev for a project who wants to integrate with I2P, but for just a regular user who's looking to improve their network privacy? What are some kind of practical use cases or tools that utilize I2P that you kind of envision or that you recommend for people? Right now, I think my dream is kind of a matrix-style network, probably an actual matrix server federation within I2P.

That is a pretty important goal, I think, for us. Asynchronous end-to-end encrypted messaging with anonymity would be a huge win. But that's not a real thing yet. For the most part, right now, what I think are we have very good anonymous chat capabilities, and we have very good potential for something that actually comes up in your questions a little later, I think. Self-hosting. I think self-hosting is a stepping stone to making the I2P network more viable because it's an in-network network.

We don't have exit traffic as a feature. It's a plugin. So we need to move things into the network to make it more viable. And I think Nextcloud is a really good example of a thing that works pretty well in I2P and is a thing that people might be interested in self-hosting. And also, I think people should have fun. I think that social networking is valid. It's just done very poorly in its current context. And things like video games. It's, you know, we support interactive connections.

I think that we should...

20:00 know that we should do things that are things that are basically benign too so I've got some like battle for West not type things going on on I to P just to let people have fun browser quest that Mozilla thing from way back when web web sockets were new that actually works as an ITP plug-in you don't even have to you don't even have to install anything you can just download it and put it up on a site and say hey everybody let's go you know crawl a dungeon or something yeah I think it's it's a important point that doesn't get touched on a lot is that like these privacy networks or privacy tools aren't things that are just being used for sneaky stuff but it can also be used for really good normal everyday fun things it's not something that's really restricted to the you need to avoid the nation-state stuff it really can fit into a lot of different use cases there and obviously you touched on self hosting so I do want to just kind of jump into that I guess I have two questions around that really because one is how can people self host I to P nodes or I to P

software itself and then how does I do P play well with self hosting other services you briefly mentioned Nextcloud but I'd love to hear a little bit more about what I to P can offer to people who are who are self hosting tools well actually sort of by definition when you install I to P you start self hosting I to P because we're a peer to peer network you you actually pretty much immediately start making connections to peers your first connection is technically to a bootstrap mode but everything after that is good connection to appear and so when you install I to P you automatically become a self host of I to P as a feature of the network the the the after that point we have this thing called the router console which is just a it's a web UI that shows up on localhost 7657 for folks who know what that is it'll pop up automatically after you install it though don't you don't need to worry about that for people who are listening who don't um and that will um and and that will present to you a a selection of apps and there's like a

bit torrent client and there's an email client and then there is this thing called the hidden services manager and what that is is a um is a graphic interface for deciding the properties that you want out of your hidden service tunnel so if you um if you want your tunnel to be sort of short and wide and be able to transport a lot of traffic really you know relatively quickly and reliably uh you might have your you might set your tunnel length to one here and your um and your uh your tunnel quantity like three or four so you have some backups um and that and that's where uh your that's where managing your hidden services uh actually comes in and if you want to be uh you know pretty thoroughly anonymous you probably need to set things up with two or three hops um one thing to note is that uh because we're a hidden service network and we're in network all the time uh there are two through two or three hops on your client side and on your server side so there's total you know of maybe uh four to six depending on how you

have your how you have your tunnels configured and then there is an entirely separate set of tunnels that comes back uh the other way so so i i feel like i've lost the plot on the question a little bit here i'm i'm getting into getting into the little nitty-gritty details and so i'm going to find my way back i promise um but this is the but yes the hidden services manager is the is the place to go to learn how to connect your connect your local services your Nextcloud on port 8080 to your uh you know whatever dot b32 dot itp perfect so you can when you're hosting the itp node like for instance on the same computer where you're hosting a Nextcloud instance you can expose it over itp without having to punch punch holes in your firewall or anything like that and expose that on a privacy preserving network for other itp users to to access who have that address right yeah or even just for yourself one other thing that we do um have is this thing we call encrypted lease sets where the lease set that you actually

push into the net db is encrypted with a key that you uh submit out of band uh to i to either the admin or the user depending on the style of key that you're using um and without this key you can't decrypt the lease set and you can't find tunnel end point that gets you back to uh the hidden service so if you want to run a hidden service that's only for yourself say you want to be able to ssh back to your house which is behind a bunch of oppressive double mat bullshit um the uh then an encrypted lease set might be the way to make sure that nobody is you know poking at your ssh server while you're not looking that's really interesting functionality that i've heard of so essentially even if someone happened to know the the i2p address of whatever you set up they couldn't access it without that key that's i think some really useful functionality for sure let's take a quick break from this episode to chat about the sponsors of opt-out Cake Wallet and LocalMonero Cake Wallet is a key tool that i use daily as it

allows me to easily and quickly use monero for private by default payments it's available in both ios and android it is a fantastic way to get started buying and using monero with a simple and easy to understand user experience i regularly onboard new users to Cake Wallet and hope that it will help simplify and ease your journey into cryptocurrency if you're interested in purchasing monero for the first time or helping to bring others into a parallel economy i'd recommend you look at using local monero like i do to buy and sell monero while maintaining your privacy and avoiding invasive exchange surveillance LocalMonero is entirely peer-to-peer and is an important part of opting out of the surveillance state and into a parallel economy thank you to both sponsors for their incredible support and partnership and i hope you'll take a moment after the episode to learn more in the show notes or at optoutpod.com sponsors you walked through a little bit of the features that people should dive into

when they first spin up itp and start using it um were there any other features within that web ui or other things within itp that you'd recommend people to take a look at or become a little bit more familiar with when they start using itp not not me uh except that i'd recommend that they they make sure that they see it um you know they they try a couple of things and see it sort of holistically because a lot of the options are very similar uh across the different types of services and um if you try and you know if you set up a couple of them you'll you'll start to notice the patterns that you need to look out for and that's uh that's important awesome and then uh just another question around kind of the feature set of itp we've talked about some of the good ways that it can be used and the things that it provides namely network privacy to the things that you either host yourself or connect to within the itp network um but what are some limitations with itp that users should be aware of um well the big one is uh we

are a peer-to-peer network so uh on a certain level or on a certain level it's it's very easy to determine that you are running itp by running a bunch of itp nodes and waiting for you to connect to them um it's if for most people um hiding that they're running i2p uh particularly from an active sort of attacker is not uh is not very feasible um the caveat there is though though is that um we yes for you know maybe 99 percent of the network um this you're not hiding that you're running i2p um but for another much smaller percentage of the network we actually do um for people who are in dangerous situations um as defined by mostly freedom of the press foundation having a list of uh countries that don't have internet freedom right now or it might not be freedom of the press foundation it's one of those though um the uh we actually placed them into a mode where they don't participate in routing traffic for other people

30:00 They don't make connections to other nodes except as a client. And they won't make connections to nodes that are in the same country as them. And they won't make connections to nodes that are also in hidden mode and things like that. And so we have this tradeoff here where the people who aren't in hidden mode are helping the people who are. And that's sort of by design. So in a way, it's kind of hard to characterize as a limitation. But yes, people know that you're running I2P if you're running I2P in most of the world.

I can add something just from a usability perspective. And this is just speaking about the core I2P Java router and software. Is that people who are interested in privacy, kind of new to privacy tools, often encounter kind of a difficulty with pattern matching with familiar workflows and the way that things look. And some of the more admin heavy interfaces and configuration options. And some of perhaps some of the language that is used in our onboarding documentation and within the console itself.

And we always we joke now that, you know, it's free software, but free as in puppy, not beer, because there are there's a learning curve. And so I'm not sure that that's necessarily a bad thing, but it's definitely a place where you can bump your knee when you kind of start interacting with I2P. Yeah, we are gradually reducing. Well, sometimes rapidly, but mostly gradually. We're doing our best. We got 30 steps off of the install process. We have a new user install guide, too.

Yeah. And that's one of those things that that really does improve as more people start using the software, too. Because, I mean, once you have users digging through and you have a wide swath of users, not just highly technical users. Hopefully those users are also providing good feedback to to help to drive user interface and user experience improvements over time and even contributing to the project itself, if possible. But definitely something that that hopefully improves over time as more people of different backgrounds and different technical abilities dive in and start playing around with I2P.

Absolutely. The getting out of the lateral kind of feedback loop has definitely kind of we found some blind spots, I guess. Lots of them and lots of assumed knowledge in our and kind of our onboarding that we're doing our best to get that fixed. There was one other limitation that you briefly mentioned earlier, IDK, and I think it's one that's important for people to understand, especially in the difference between I2P and Tor. You briefly mentioned that there's no kind of exit node functionality within I2P.

That users using I2P stay within the I2P network and can connect to things that are hosted within I2P, but not outside of that. Is there anything more you want to add on that specific limitation or design choice, obviously, depending on how you want to look at it? Yeah. Well, strictly speaking, what it is is that there's not really built-in official exit functionality. There is sort of one side of exit functionality implemented, which allows you to specify an HTTP proxy running as an I2P service or a SOX proxy.

I think those are the only two that are allowed, at least for that sort of app, to act as the intermediary between you and the clear net, so to speak. But we don't have the financial or legal infrastructure to support a network of exit nodes like Tor does. So since we don't volunteer that to the people hosting out proxies, they're pure volunteers. They do this strictly out of their own motivation. And so there are only about five right now, although that number is going to increase here in a little bit because there is a nonprofit that's interested in spinning up a cluster.

And so we have this functionality, but we don't have the exit of it in an official sense because we're not going to just set up a default based on some poor hapless volunteer without their permission. That would be really bad. So there's also this other functionality called out proxy plugins. And we can add different kinds of software to act as out proxies for sort of specific traffic. And there are things like there are MT proto out proxies to speak to the Telegram network and things like that that are pretty popular in places where Telegram is popular, but also blocked.

And there are other kinds of out proxies that are a little bit more purpose specific as well. So it's not actually that we don't have exit functionality. It's that we kind of try to encourage exit functionality to follow application specific patterns. It's a little bit safer for people to do things like act as a Tor bridge or relay Telegram messages through an MT proto proxy than it is for them to just sit in a SOX proxy on their own PC and say, Oh, I'm an I2P proxy now when the cops come knocking at their door.

Yeah, there's definitely a lot more nuance there than I realized. So I'm glad you walked through that. And I think you did a great job of explaining the details. And like you mentioned, there's just there's so many legal and just troublesome things that come with hosting something like an exit node on Tor. So I definitely understand that not being a focus. And there's so much value in the native network itself that I think it's definitely not something that is a necessity.

But it's good that people understand that it's something that can be done. But obviously, it's not the focus of I2P and is definitely not the default for anyone who spins up the I2P software. They're not just going to magically become an exit node that gets used by other people. So very important there. Yeah, that would be that would be very dangerous. Definitely, definitely would be problematic. And we we've compared a lot of just kind of I2P and Tor specifically, it's come up in lots of places.

I know, obviously, most people who have heard of I2P have heard it compared to Tor and just kind of see them as synonymous. But I would love it if you all don't mind kind of breaking down maybe a little bit more in depth what the differences are between Tor and I2P, especially from a user's perspective. Okay, the big thing that separates us on a technical level is that is that I2P strives to make everybody who is involved in participating in the network also a relay.

So to become a Tor relay, you go and configure the relay flag and Tor RC and restart the daemon. And then, you know, after a little while, your relay might ramp up. But with I2P, that's sort of on by default. And that makes our network sort of flatter and to use the term that's used loosely more distributed than Tor. And that has, you know, that has some byproducts. We have a lot of relay diversity and we have a lot of path diversity. So we can support things like peer-to-peer traffic in ways that Tor has been hesitant to do in the past.

And so that's one advantage that we have over Tor. But because we're making everybody a relay by default, we also have to rely on sort of heuristic methods for detecting clusters of malicious nodes like Sybil attack.

40:00 And so we've got to measure characteristics of the nodes to determine if they're doing things like dropping every message that they receive. And we have to do that in a way that doesn't reveal a great deal of information about those nodes to the rest of the network. And we have to do it all client-side, more or less. There is a method of distributing a global block list of all the bad nodes, but we only do that about once every four months, unless there's an emergency.

Whereas with the Sybil attack analysis tools, it's all kind of done dynamically locally on the client side. So our differences are basically encapsulated in us being a peer-to-peer network and that we have this increased relay capacity at the cost of having these sort of sophisticated and oblique ways of trying to detect if someone is attacking the network. I just wanted to add sort of maybe something that would be maybe a summary of what IDK has kind of said from a user perspective is that maybe like where Tor has found more of a primary use case in building this trustworthy relay guard and exit node for providing access to the web.

I2P has evolved into more of an analysis-resisting peer-to-peer network that has built-in metadata-obfuscating capabilities. Yeah, that makes a lot of sense that the focus has been a bit different there between the two networks, especially with you all focusing less on the exit node capability and then not being as much of the central focus within the project. So definitely makes sense there. Are there key differences there in how metadata is protected between Tor and I2P?

The fundamental principles are fairly similar. You know, you protect geolocation metadata by onion routing. You protect timing metadata by making sure that people's clocks are synchronized and things like that. So the methodologies are adapted in different ways, but the principles are pretty familiar. Makes sense. And a thing that you mentioned there, and I think it's a really key one that I've heard people mention with I2P and that obviously has been a big focus for the Tor project themselves and for people using Tor as well as a bunch of security researchers and other people.

But can you walk through a little bit of what the I2P network does to handle Sybil attacks and other malicious nodes? Well, there are a couple of defenses. For one thing, and this is the one I'm actually about to describe is actually it's vulnerable to what we call a pre-computation attack. So we have to do some other stuff after this. But the NetDB itself requires a re-key that happens between all the flood fill routers at midnight UTC. And at this point, everyone in the NetDB sort of gets shuffled around.

And the flood fill router that answers the request for your lease set will change. And so if someone is conducting the most common type of Sybil attack on I2P, which is what's called an eclipse attack, they will no longer be positioned to block out your node, as they say. And so that's what that is for. But obviously, you know what day it is going to be tomorrow. So if you have sufficient computing power, you can pre-compute the position of all your flood fills for the next few months and then just throw away the ones that you don't want anymore.

Or pick out the day that you're going to be able to do your attack. And so that's not ideal. So what happens after that is a sort of live analysis tool exists within the Java I2P router. And it measures things like the closeness of router IP addresses. And it organizes routers into families that are run by known operators. There's one run out of the University of New York. And there's one in Germany. And I've got one. I think Sadie's got one. So we have these people who declare that they're running groups of routers that provide the network with this extra piece of information.

And it uses that to sort people in this Sybil attack tool and make sure that these nodes stay away from each other in the network. And then there's things like if you're in the same slash 8 or the same slash 16 or the same slash 24. Or if your router was created on the same day as a bunch of other routers in the same slash 8 or whatever. So these kind of heuristics are designed to make sure that you only keep the piers that you're going to build tunnels through that you think are reasonably safe to build tunnels through.

So everyone who's running an I2P node, a part of the node itself is actually doing these checks to make sure that when it reaches out, when it builds those tunnels, it's making sure to choose the best nodes possible based on all of those parameters, right? Yeah, that's what the Sybil attack tool does. And then there's also a thing called peer slices, which is how we decide whether a peer is fast or slow. And then when they participate, we decide on which kind of traffic we're going to send through the fast ones and which kinds of traffic we're going to send through the slow ones and things like that.

Definitely glad to hear that there's a focus there. I mean, that's always an issue in these sorts of anonymity networks, because obviously anyone can just start running an I2P node. There's no permission that's necessary. There's no authentication. There's no identity tied with it, which is obviously paramount to it providing strong privacy. But when you do have that ability for anyone to run a node, attacks like Sybil attacks or Eclipse attacks are always a threat there.

So it's good to hear a little bit more about the model and the approach that's being taken by I2P to deal with that. And then the last kind of network related question I have is, and this one, I think a lot of people are always curious about how privacy tools related to network privacy pair together. So it probably is not something that's a commonly done thing, but any kind of tips or recommendations for how I2P pairs with a VPN? Anything to avoid, if that's something you should never do or is fine, that kind of thing.

Oh, we can actually make this question pretty interesting. So there's a couple of different things here to unpack. First of all, the basic one, I2P is totally possible to use behind a VPN. You can forward a port through most VPNs. You'll have to do it manually, but you can absolutely connect I2P from behind a VPN. And if that's your bag, then that's something that you're totally allowed to do. It's not like I've never done it. But there may be relatively little benefit to it as there is relatively little benefit to connecting a VPN before Tor.

The more interesting thing that comes up are these sort of hybrid physical, logical mesh VPNs like Yggdrasil is one of the big ones that is getting more integrated with I2P. Sort of as an emergent process, there are a lot of Yggdrasil users that seem to be also interested in I2P. And that's an interesting development for us because here's this network that is doing its own thing to do in some ways the opposite of what we're doing. The nodes on Yggdrasil are identified by keys and in some sense authenticated because of that.

But they're interested in providing privacy in network using our technology, so we're working.

50:00 on things like identifying IGDRAZIL addresses and then handing those out in reseeds to-- - Interesting. - In reseeds to I2P routers that are already connected to IGDRAZIL and maybe even reseeding over IGDRAZIL. Reseding is what we call our bootstrap process. I just realized I hadn't mentioned that. - Yeah, IGDRAZIL is not something that I'm deeply familiar with. Do you mind just giving a very brief intro to what that is so listeners can maybe better understand why that pairing between I2P and IGDRAZIL is kind of coming about?

- Well, it's sort of coming about, I think, because there's a little bit of overlap between the communities of people who are interested in IGDRAZIL and the people who are interested in I2P. But IGDRAZIL is, I think, the best way to explain it to end users is like, imagine if you're, instead of being connected to shoot. It's sort of like a great big virtual LAN. - I know it's way outside the scope of this talk anyways, but it's something that I don't really understand how it works, so definitely I'm curious.

- Yeah, I'm trying to give the very basic version of it and not go off on some stupid tangent. But it's a great big virtual private network constructed between these things called IGDRAZIL nodes. And they assign you an address. It's an IPv6 address that's made from, I think concatenating the hash, or not concatenating, truncating the hash of a public key to the length of an IPv6 address and then prepending one of the local ranges to it. And they use this network to build this big internal, interconnected VPN where people can run their services and participate in the network.

And the neat thing about it is that it's encrypted even below the layer of TLS and things like that. It's the encryption is actually happening between the nodes. And the other cool thing about it is, at least from what I understand, it can run either over physical or virtual links. It can run over the internet or you can hook two routers together with it. - Thanks. I know that was very much an aside, but curious to hear an answer on that one, kind of on the spot.

But to summarize, you were saying basically that the VPN usage with I2P is fine and it definitely can happen, but there's no real clear advantage to using I2P over a VPN, correct? - Yeah, not that I can tell. - Perfect. Yeah, that's what I was expecting, but definitely something I wanted to clarify as I know a lot of people are going to be curious about that one. So that was, I think, the last technical question I had, but wanted to dig into a little bit more about how I2P is an organization and a project is able to fund and make themselves sustainable.

So I'd be curious to hear a little bit more about maybe how the project or organization that controls the project is organized or run, and then just how the funding and sustainability works there. - Well, we're actually a community project. There isn't, strictly speaking, a single organization running the show. You know, there are groups of people who act in their interest, but there's nobody really in single control of any particular thing. And that's sort of by design.

You know, we're decentralized from top to bottom. - How does the kind of the funding or sustainability work? Is it relying on just kind of volunteer contributions like some other open source projects, or is there some sort of funding model, whether it's donations or something like that, that helps to drive forward things that cost money? - For funding, I mean, we've worked with NGOs currently. You know, we've had some support from OTF in the past for help with some of our onboarding.

So that sort of thing. And as far as sustainability, I think it's just about creating our own frameworks to encourage and make things more accessible for different kinds of users with different kinds of use cases to begin familiarizing themselves with the network capabilities and with the on-ramps through the available applications and configuration options so that they can participate in further tool building and refinement in a way that can suit needs that we perhaps don't have ourselves.

So that is where my sustainability models are focused, are more on facilitating those interactions. - One thing that comes up a lot is also if we take donations, and currently the core project does not take donations. You're welcome. People who want to donate should probably donate to I2P applications that they're interested in or simply hire someone to work on I2P in their own time. This actually has happened before. It's actually how I got started in the community.

I was first hired by a Canadian company to integrate with their software with I2P before I joined the core project. - Yeah, the funding and sustainability is always a fun one to walk through with projects like I2P, which are decentralized. It obviously looks very different from a very centrally controlled project or very different from something like Tor, which obviously has a huge organization that centrally manages. obviously it's an open source project and there's a lot of other people contributing, but there's a large organization that helps to drive Tor forward.

So things that are more broadly decentralized and more loosely organized like I2P and like the Monero project was something that I'm also very familiar with. The funding and sustainability gets a little interesting there, but I definitely love that recommendation of finding people that you can pay or provide for to work on I2P, especially when it's something that you want integrated into an application that maybe you're building or your community is building.

It can be a good way for you to help to fund further I2P development along the way. The last question I have for you all is really just how listeners can jump in and help to support what you're doing with I2P and the project more generally. Well, everybody who runs I2P is contributing to the network. Just installing it is a contribution, but as far as specific services that we could have people run outside the network, we have a handful of what are called reseed servers, and these are sort of bootstrap nodes and they're where you get your initial set of peers to join the I2P network.

And we could probably use some people to run some more of those. And if you get an I2P installed and you're interested, get in touch with us at ZZZ.ITP. I'd like to add that people can help out with localization efforts. We're always trying to make I2P as successful and available to as many people as possible. I run all kinds of opportunities for people to join work groups and do testing. You can always test applications. There's always something new happening.

So feedback is always great. Awesome. Well, thank the two of you so much, Sadie and IDK, for jumping in and walking through I2P with myself and with the listeners. I think there's a lot of value in learning all of the different tools that are out there for network privacy. And I think I2P is one of the ones that's less understood. I know that I really didn't understand a lot about I2P coming into this conversation. So I have learned an absolute ton and very curious to dig in more and continue running the I2P node that I run and just start to use it a little bit more to maybe expose some of the services that I run for the community as well.

But thank you all both for coming on tonight. Thank you for having us. Thank you. Thanks for listening. And I hope you enjoyed this episode of Opt Out. If you did, please take a moment and subscribe to the podcast, or if you're already subscribed, share it with one friend or family member this week. As always, you can check out the link to the guest content and contact info, as well as links to all of the tools we discussed in today's episode.

1:00:00 Now get out there and opt out this week.