Review: Not a WASTE of effort

– by Lee Schlesinger –
Nullsoft last month released Waste, an application “designed to permit secure distributed collaboration and communications for small trusted groups of users,” according to the developers. Nullsoft corporate parent AOL Time Warner yanked the software from Nullsoft’s site within a day, saying it had been illegally posted. The software is still available on mirror sites, however, so, open source mavericks that we are, we thought we’d give it a spin. Waste is a simple implementation of secure peer-to-peer networking that gives widely dispersed workgroups most of the secure instant messaging and file transfer tools they need.

First, about that name. It appears to be an acronym from Thomas Pynchon’s The Crying of Lot 49. In that novel, it stands for We Await Silent Tristero’s Empire, and represents a secret underground communication system. That seems appropriate, in that this Waste (general preference and our editorial style guide deplore all caps) communicates outside of common network instant messaging and file transfer channels.

Waste was written for Windows clients, but enterprising third parties have already coded a Linux version. We tried the “official” Windows version for this review. (Hopefully NewsForge readers can chime in with comments about the Linux version.) Despite the statement in the design document that comes with the program’s source code that claims the program is for power users, Windows installation is simple. After you agree to the GPL, Waste copies files and installs shortcuts to Windows’ Start menu. It walks you through generating or importing a private/public key pair and specifying download and upload directories.

The keys are, um, key to the product. Without the security they represent, you might as well use one of the many public instant messaging networks, which offer all of Waste’s other functionality and more. With the keys, which you must first exchange with those you want to communicate with, you can send messages and files encrypted using RSA and Blowfish algorithms, and the transaction isn’t mediated by any central server.

Look and feel

When Waste starts it displays two windows. The main Waste window is a slim list of other Waste users, similar in appearance to other instant messaging products’ user lists. The Network Status window shows the status of connections between your computer and another. This window is initially empty, but if you’ve connected to another Waste client before, the connection comes back automatically when you start the program again.

Any user who has tried any other instant messaging program will be instantly comfortable with Waste’s IM capabilities. You click on a user name to send a message to that user, or on a small button to create a shared chat room. A list of existing chat rooms appears beneath the user list; you can also create invisible chat rooms that don’t appear on the list.

Once you connect to another user you can bring up the Waste Browser window. In it you choose a user, and can then look over all the files in the directory the remote user made available for sending to others. You can upload or download a file to and from directories you specify from a Preferences choice on the main window’s File menu. While a transfer is in progress you can watch its status in a separate Transfers window.

Waste provides only rudimentary security options besides encryption. You can specify IP addresses to allow or deny. You can also limit inbound and outbound traffic streams to specified throughput levels to avoid impacting more important traffic.

In its initial release, Waste is simple and useful. It’s not especially powerful, however. It lacks at least a couple of key features I’d like to see. I’d like to be able to specify user-level privileges on my file transfer directories, to let some but not all of those on my Waste network access particular files. And I’d love the ability to synchronize two directories on machines across the network. Other simple enhancements will probably follow in future releases (if any), such as audible and visual cues on chat events such as users joining or leaving the network.

Waste is not designed for the enterprise; its design doc warns “the amount of traffic on the network scales more than linearly with the number of users.” Waste traffic may be broadcast to and routed through any nodes on a given private Waste network. But for a 1.0 product, it’s well-thought-out and a great base for building on. I hope we see future versions with expanded capabilities.