“bread-first search”


When last week's update went up, I was at the Internet Archive Europe HQ in Amsterdam ('HQ' makes it sound like a big shiny building. It's really a cute little house by a canal). Remember last week when I said I felt like a frog finding their special frog habitat? Well this was more frogs. Many people who I'd been looking forward to meeting, and (somewhat amazingly to me) a fair number who'd heard of Willow before. After a lot of conversation, a sensible amount of cheese, and maybe a little bit of schmoozing, I left feeling energised. For years I've been trying to find a local network of people interested in this niche field, and either I was too much of a shut-in (likely), or this community in the Netherlands has finally reached a kind of critical mass and level of interconnectedness with the broader network.
Meanwhile, I worked on willow_rs. Unfortunately (and kind of intriguingly) my work finally presented a dead end in how well Rust is able to accommodate Willow's generic and parametrised ambitions. Aljoscha has (hopefully) done a write up on this below (don't leave me hanging aljoscha). I've started working on an implementation of the Willow Drop Format (WIP pull request here), where I am practicing liberal use of the todo! macro to implement as much as possible without letting little things like not having that dependency yet weigh me down. This is like taking a breadth-first approach where instead I've always taken a depth-first approach to missing bits and pieces.
~sammy
Why is it called worm-blossom?!

why is this website called ‘worm-blossom’? In this series we will explain why in a concise manner.
Part 6: Abuse Audit
It is 2018. A cloaked figure sits in their garden in Berkeley, California, typing away on a laptop. Upon their screen is Patchwork, an application for browsing and publishing on the Secure Scuttlebutt network. Cinnamon, a SSB regular, hits the publish buttion. Their latest post is titled “Useful idea: Abuse audit”. They propose to collectively pore through Secure Scuttlebutt “to find every single way it could be used to harm others and then go through that list one at a time and come up with ways (or list the ways that already exist) to stop or deter that behavior.”
Over the next two years, Cinnamon spearheads an abuse audit of Secure Scuttlebutt, eventually identifying 76 potential abuse vectors and compiling them to a now public spreadsheet.
Privately, Cinnamon faces resistance to their audit: this is the internet, you can’t have the benefits of open communication and expect to be sheltered from all its potential harms.
For example: “P2: Revenge porn”:
Person A publishes an image of person B without their consent.
The ideal resolution is to remove this content from the scuttle world completely, which isn't really possible.
or “P3: Doxxing”:
Person A publishes contact info of person B without their consent, with the intent to intimidate them or lead others to harm them.
The ideal resolution is to remove this content from the scuttle world completely, which isn't really possible.
Among worsening and inexplicable health symptoms, Cinnamon becomes frustrated and burnt out by the abuse audit and the apparent reluctance to — or outright impossibility of — addressing any of its identified issues. They work on an alternative safety-focused client for Secure Scuttlebutt called Oasis. But this still isn’t enough to stave off Cinnamon’s dissatisfaction with Secure Scuttlebutt.
In mid-2020, Cinnamon announces Earthstar:
I've been thinking hard about how to improve the user experience of #Oasis, and I kept finding deep things about SSB that I wanted to change:
- You can't delete messages
- You can't just download recent things first, you have to wait a long time
- You can't re-use the same account on multiple devices
That's enough to keep most people from wanting to use SSB. When people say "why can't it be better?" the answer is "sorry, it just wasn't designed to do that ¯\(ツ)/¯"
These 3 constraints all arise from SSB's security properties as an immutable append-only log with hash backlinks. But what if we didn't need immutability? Is it appropriate for a social network?
By relaxing that security property, we solve all 3 problems:
- You can delete or edit messages
- You can download any subset of things in any order
- You can use the same keypair on multiple devices. Now a keypair represents a person, not a device.
Earthstar addresses the key abuse vectors Cinnamon has identified over the past two years, and eschews big-world immutability for a plurality of small-world mutable networks. Cinnamon takes a pragmatic, productive approach to Earthstar, opting for the use of ‘boring’ technologies and a simple implementation which can run in a web browser.
But there’s one little problem. In rejecting the append-only log, Earthstar has adopted unlinked sets of items. In doing so, Earthstar has traded away Secure Scuttlebutt’s relatively simple and efficient synchronisation, with no obvious replacement. How to efficiently figure out what’s different between two devices when all you have is a bag of stuff?
Next time we head to Basel, where the imagination of a familiar bespectacled friend is captured by this puzzle.
We're listening to...

I have not been this tempted to sit down and practice a piano piece in a long while (thanks, my dearest sister). But rest easy, I’m dead inside being responsible and will work on worm-blossom things instead (not that I have the required piano technique anyways). ~Aljoscha

What is going on in Blossoquest? Since when did it even have that name? Why are we suddenly in a Western? Does the crack in the wall have any meaning? How can Sammy claim dislike for Homestuck and unfamiliarity with Hussy’s work, and yet the third panel looks like Problem Sleuth and the name like a play on Bard Quest? What is going on?!
Anyway, apparently I am supposed to write about the limitations of the Rust type system instead of investigating these mysteries. So here we go!
The Willow specs are highly generic. So naturally, our Rust implementation is full of generics as well. Because this is rather cumbersome, we are also providing a non-generic implementation of Willow’25 for application developers who shouldn’t need to care about the flexibility offered by the parameterisability of Willow.
In our previous codebase, the willow25 implementation merely provided type aliases, with the consequence that compiler messages bombard developers with all those hidden generics. So in the reboot of the codebase, we went for proper wrapper types. We even have a wrapper! macro that automatically generates the structs that wrap the underlying generic types. So far, so good.
The first problem that stems from this arrangement is that of converting between references. Suppose our generic implementation has a function that requires a &Entry<Lots, Of, Generics>. To implement the willow25 version of that function by calling the original function, we need to convert &Willow25Entry into a &Entry<Lots, Of, Generics>. Reference-to-reference conversions are not exactly the most idiomatic Rust. But this was doable, with the `wrapper!` macro even completely hiding the required unsafe and #[repr(transparent)] shenanigans that make it work. And up until Sammy’s recent implementation work, this was good enough.
The real trouble started however once we needed willow25 wrappers for generic types made up from other generic types. For example, a generic AuthorisedEntry struct consists of a generic Entry struct and a generic AuthorisationToken struct. A Willow25 wrapper around AuthorisedEntry would internally still use generic components. But for some code, we would need it to consist of (or at least to be interpreted as consisting of) a non-generic Willow25Entry and a non-generic Willow25AuthorisationToken. But for this interpret-the-generic-components-as-being-non-generic-wrapper-types business, the generics must be instantiated with types that satisfy certain constraints regarding their memory layouts. The exact details are gnarly and do not really matter, the important part is that we ended up in a situation where there would be unsafe code galore. This in itself is bad but not a showstopper, but the real problem was that the safety of this unsafe code would depend on whether you instantiated the generics in a certain way.
The compiler has no way of enforcing any invariants here. And I have never seen any code whose safety depended on properly instantiating type parameters. Calling this situation unidiomatic would not do it justice, I’d rather reach for an unholy abomination whose creators should be barred from writing Rust code ever again.
So what now? We will keep the generic code base for now, but new work will only provide willow25 APIs. Where possible, those will still make use of the underlying generic implementation, but where that does not work we will simply duplicate the generic code and then rip out the type parameters. Long-term, we will probably phase out the generic code base completely, doing concrete willow25-based implementations directly instead.
This is a bit of a shame. The genericity of the specs is a decision I still stand by, and generic implementations do have a certain elegance. But it turns out that (idiomatic) Rust is just not particularly well-suited to it. And we want to keep the codebase accessible and high-quality. The decision to move to non-generic implementations for now stings, but everything else would lead to an idiosyncratic code base that would have made Dominic Tarr proud, and scared off everyone else.
(Also, writing docs for two almost identical versions of our APIs was a pain from the very start, so I cannot truthfully report that I am entirely unhappy.)
~Aljoscha

Contributions Welcome: ufotofu Limit adaptors (Rust)
https://codeberg.org/worm-blossom/ufotofu/issues/15
Sammy needs an Ufotofu adaptor that limits how many items a wrapped producer will emit. We had an open issue for this for a while. This is a great opportunity to dive into the ufotofu codebase: small scope, not too difficult, and there even is an implementation in an older version of ufotofu to use as a basis. It would be a shame if such a good first issue had to be wasted by us implementing it ourselves. So if anyone wants to give it a try, now is the chance!
links of the week
- Traced identities: Hisashi Eguchi and the Crisis of the Tokyo Pop Image - found myself captivated by this piece on the grey area between referencing existing imagery and creating something new from the space in between. ~sammy


With that out the way I can get back to the important work of being a weird little frog. This weekend I’ll be heading to the Internet Archive’s new European Headquarters in Amsterdam for a little 

With no more slides to prepare, I returned to programming (shudder). It has been a while, and I feel clumsy and slow, especially in Rust. But I’ve started implementing the prerequisite encodings for 





Luckily I was met by friends of worm-blossom (FoWB) 













