Giter VIP home page Giter VIP logo

pursuanceproject / pursuance Goto Github PK

View Code? Open in Web Editor NEW
133.0 28.0 15.0 41.34 MB

Pursuance: end-to-end encrypted task management optimized for large numbers of volunteers. We are building a vast and formidable ecosystem of opposition to institutionalized injustice.

Home Page: https://pursuanceproject.org/

License: Other

Shell 1.04% PLpgSQL 3.10% HTML 0.31% CSS 21.72% JavaScript 65.48% Go 8.34%
activism task-management justice saving-the-world pursuance react postgrest barrett-brown

pursuance's Introduction

Pursuance


What is Pursuance?

Pursuance is open source software for effectively organizing groups and individuals to achieve a shared mission.

At its core, Pursuance is end-to-end encrypted task management software designed to facilitate mass collaboration/coordination, and that has a number of unique features.

The Big Picture

Pursuance enables participants to: create action-oriented groups called "pursuances", securely discuss how best to achieve their mission, rapidly record strategies and ideas in an actionable form (namely as tasks), divvy up those tasks among one other, share files and documents, get summoned when relevant events occur (e.g., when they are assigned a task, or when mentioned), request help from others, receive social recognition for their contributions (via karma points), and to delegate tasks to other pursuances in this ecosystem in order to harness its collective intelligence, passion, and expertise.

Pursuance can be used for a great many things. But we, its creators, have certain interests. Specifically, we are focused on organizing activists, journalists, and non-profits in order to help solve serious problems we face as a society -- the surveillance state, the police state, the drug war, and many more.

Fundamentally, we aim to confront and correct, via an energetic, global network of forward-thinking individuals, the injustices imposed on society by criminalized institutions the world over.

To learn more, please see https://pursuanceproject.org/ or follow us on Twitter at @PursuanceProj.

See the next section to learn more about what makes Pursuance unique, or look below that for how to run or contribute to the software yourself.

Software components: LeapChat and Pursuance

The software that makes up the Pursuance System has 2 major features/components: secure chat, and task management.

The task management functionality can be found at https://github.com/PursuanceProject/pursuance . This pursuance repo uses LeapChat (currently via an iframe, though this will change); LeapChat can be found in its own GitHub repo at https://github.com/cryptag/leapchat .

So, to be clear, we have:

  1. LeapChat -- end-to-end encrypted chat in the browser (which we've already launched; see LeapChat.org), and

  2. Pursuance -- end-to-end encrypted task management optimized for large groups of volunteers.

The Interplay Between Chat and Task Management

Each pursuance has many associated tasks. Each task has its own LeapChat room attached to it for discussing the details of what should be done, how best to achieve that task, etc.

Unique Features

Aside from the unique aspects mentioned on our June-July 2018 Kickstarter campaign, here are some features that differentiate the Pursuance System from other task management-centric software:

Task/Participant Auto-pairing and Recruitment by Skill Set

When you have a non-trivial number of people participating in a pursuance, they're not going to know each other's skill sets, and therefore won't know who they should assign a task that they think someone should complete, or that they personally need done as a sub-task of whatever they are working on.

Other task management systems do not scale in the ways we need them to.

In Pursuance, when a new task is created and the skills necessary to complete it are specified (by tag), participants within that task's pursuance who have all of the requisite skills will be notified and asked if they'd like to be the assignee. (Users will add their skills to their respective profiles so that this pairing can occur.)

We'll also build in skill-based recruitment that lets users request help from users who are on the same server as the pursuance you're recruiting from and who have opted into creating a server-wide profile that includes their skills and interests.

Assigning Tasks to Other Pursuances

Other systems think it terms of teams. What is a team? A small group of closely-knit people who know each other's names, skill sets, and so on. But a team is also a silo cut off from the rest of the world.

Pursuance does not see the world this way. By enabling pursuances to assign tasks to other pursuances, we are enabling a federation of politically-aligned organizations/groups/projects asking each other for help, perhaps specializing within the ecosystem, and offering their unique talents and knowledge to other pursuances with whom they partner.

Automatic Task Reassignment

Volunteers are flaky. Someone will often volunteer for a task, or otherwise have a task assigned to them, and not do it.

When a task's assignee hasn't made recent progress, Pursuance will either ask the task's creator or reviewer if they want to ask its assignee for a status update, or Pursuance could automatically, periodically ask for said updates from assignees without first asking the reviewer if these messages should be sent out. But the interesting part is: an unresponsive or otherwise seemingly not-working-on-the-task assignee can be given, say, 24 hours (or a dynamic amount of time depending on the "velocity" of the pursuance, which we can measure by tracking changes in the task phases) to respond or to make progress or do something, after which, if nothing is done, our software can automatically reassign this task to, say, the last person who logged in who has all of the skills required by the task, or to the person with the most karma points with all the requisite skills, or to the person who invited the current assignee to the pursuance in the first place, or some other auto-calculable variant.

...and in writing this, I just realized that the tasks's reviewer, not just assignee, could be auto-reassigned in the same fashion if a task is finished but the reviewer doesn't mark it as done for some period of time.

End-to-end Encryption

For private pursuances, tasks will be encrypted, in which case the server will not be able to see the title, description, deliverables, etc of a task in unencrypted form, just its relation to other tasks, who it's assigned to, who its reviewer is, and its phase/how close it is to being completed.

The crypto library we are currently using is miniLock, which has undergone a thorough security audit by the venerable Cure53. miniLock enables us to deterministically generate a passphrase from (1) a username or email address and (2) a passphrase. From the user's perspective, they will sign into Pursuance as they would sign into any other website or app (other than us requiring a stronger password), but in this case we are generating a keypair for that user, which JavaScript running in their browser (and, later, their native app) uses to encrypt and decrypt content.

Each private pursuance is associated with 3 top-level passphrases, each of which used to generate a unique keypair using miniLock. That passphrase is generated in the browser/on the device of the user who created that pursuance. When some other user is invited to a private pursuance, the invite includes a passphrase that can be used to decrypt an encrypted copy of the top-level-key-generating passphrase (using the same technique as miniShare, which we also built, and that has been launched at https://minishare.io), depending upon which permissions level they were invited at.

Tech Stack

Pursuance is all React on the frontend and Go + Postgres + PostgREST on the backend. (Adding TypeScript to the React code would be nice to do at some point, though I'm not sure when.)

The strategy: write React code once, begin on-boarding users into a web app version of Pursuance by June 2018, make a bunch of improvements based on user feedback, add various features, then reuse 80% of that code to build a React Native version for Android and iOS, and also a native desktop version using Electron. And then we'll have a 3rd party security audit done.


Running Pursuance

WARNING

Do not expose the server in this branch (develop) to the world; for the moment, it is meant for presentation/demonstration purposes only, as we are preparing to demo this software and to have users test it locally before adding a combination of cryptographic auth and PostgREST's JWTs (JSON Web Tokens). Hang tight!

Linux Quickstart

If you're trying to run Pursuance on an Ubuntu server that does not already have Go installed, then just run this one command:

curl https://raw.githubusercontent.com/PursuanceProject/pursuance/develop/install_linux.sh | bash

You'll be asked to type in your sudo password, then to type two other commands, but after that, Pursuance should be running on your system!

Getting Started

Install Go

If you're on Linux or macOS and if don't already have Go version 1.8 or newer installed ($ go version will tell you), you can install Go by running:

curl https://raw.githubusercontent.com/PursuanceProject/install-go/master/install-go.sh | bash
source ~/.bashrc

Then grab and build the pursuance source:

go get github.com/PursuanceProject/pursuance

macOS Instructions

If you don't already have Postgres 9.5 or newer installed and running, install it with Homebrew:

brew install postgresql

Next, you'll need three terminals.

In the first terminal, run database migrations, download postgrest, and have postgrest connect to Postgres:

cd $(go env GOPATH)/src/github.com/PursuanceProject/pursuance/db
createdb
sudo -u $USER bash init_sql.sh
wget https://github.com/begriffs/postgrest/releases/download/v0.4.3.0/postgrest-v0.4.3.0-osx.tar.xz
tar xvf postgrest-v0.4.3.0-osx.tar.xz
./postgrest postgrest.conf

In the second terminal, run Pursuance's Go backend:

cd $(go env GOPATH)/src/github.com/PursuanceProject/pursuance
go build
./pursuance

In the third terminal, install JavaScript dependencies and start Pursuance's auto-reloading dev server:

cd $(go env GOPATH)/src/github.com/PursuanceProject/pursuance
npm install
npm run build
npm run start

Pursuance should now be running on http://localhost:8080!

Linux Instructions (for Ubuntu; works on Debian if other dependencies met)

If you don't already have Node 7.x installed (node --version will tell you the installed version), install Node by running:

curl -sL https://deb.nodesource.com/setup_7.x | sudo -E bash -
sudo apt-get install nodejs

If you don't already have Postgres 9.5 or newer installed and running, install it by running:

sudo apt-get install postgresql postgresql-contrib

Next, you'll need three terminals.

In the first terminal, run database migrations, download postgrest, and have postgrest connect to Postgres:

cd $(go env GOPATH)/src/github.com/PursuanceProject/pursuance/db
sudo -u postgres bash init_sql.sh
wget https://github.com/begriffs/postgrest/releases/download/v0.4.3.0/postgrest-v0.4.3.0-ubuntu.tar.xz
tar xvf postgrest-v0.4.3.0-ubuntu.tar.xz
./postgrest postgrest.conf

In the second terminal, run Pursuance's Go backend:

cd $(go env GOPATH)/src/github.com/PursuanceProject/pursuance
go build
./pursuance

In the third terminal, install JavaScript dependencies and start Pursuance's auto-reloading dev server:

cd $(go env GOPATH)/src/github.com/PursuanceProject/pursuance
npm install
npm run start

Pursuance should now be running on http://localhost:8080!

Production Deployment Build

Same as the Linux commands above, with two modifications.

Replace:

npm run start

with

npm run build

Replace:

go build
./pursuance

with

go build
sudo setcap cap_net_bind_service=+ep pursuance
./pursuance -prod -domain YOURDOMAINNAMEGOESHERE.com -http :80 -https :443

To send email notifications to users, run PursueMail as instructed in its README.

Conventions

Please follow these naming and spacing conventions when submitting a pull request: React + Redux Conventions.

Code style and format

We use a combination of Prettier and Eslint. Prettier is an opinionated code formatter but does not care about code-quality rules. It only concerns formatting rules. This is why we use Eslint for code-quality rules but not for formatting rules. Read more about the difference between linters and Prettier here: https://prettier.io/docs/en/comparison.html. Not ever do we want formatting rules in the .eslintrc configuration file. Not implicitly or explicitly. To make sure of that we have a NPM script called verify-eslint-rules (npm run verify-eslint-rules) that gives an error if there are Eslint rules somewhere in our .eslintrc configuration that conflicts with Prettier's formatting rules.

Before submitting PRs, please fix and format your code using npm run lint.

NPM scripts

Besides from the script generated by create-react-app (npm start, npm test, npm run build and npm run eject) we have several custom scripts as well:

  • lint - Runs linting with the --fix flag AND formats the code with Prettier (please run this against your code before submitting PRs).
  • lint:check - Just checks the code for lint errors (Eslint only).
  • format - Automatically fixes the code to fit Prettier's format rules.
  • format:check - Just checks the code for format errors (Prettier only).
  • ci - The purpose of this script is to be executed in a CI platform for every pull request. It checks linting, code format and makes sure that there are not any Eslint rules that conflicts with Prettier format rule.

Partners and Sponsors

Hypothesis

Hypothesis logo

We are in the process of integrating with Hypothesis, the web annotation platform, so that our users can coordinate crowdsourced investigative resource more effectively.

BrowserStack

BrowserStack logo

We use BrowserStack to ensure the cross-browser compatibility of Pursuance on both mobile and desktop. Thank you BrowserStack for sponsoring us!

pursuance's People

Contributors

claire-peters avatar elimisteve avatar martytheemartian avatar moe-shoman avatar novwhisky avatar seabassgonzalez avatar spetastian avatar v-stickykeys avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

pursuance's Issues

Travis CI integration

  • Enable Travis CI support for this repo
  • Create initial .travis.yml file
  • Fix .travis.yml to support both Go and Node
    • Ensure that npm run build runs before go test

Consider using Ansible + rkt + systemd for deployments

We want to make Pursuance as trivial to automatically deploy as possible, and that means using extremely reliable technology.

Docker? Not in Production

I have a non-trivial amount of experience with Docker and yet I've had serious issues with it even doing simple things. I consider Docker to be developed by irresponsible engineers with no regard for backward compatibility; it still doesn't seem production-ready for that reason and others.

The architecture of having a central Docker daemon that all containers on that machine rely on -- containers that must be killed in order to upgrade the daemon, or containers that will be spontaneously killed if the daemon crashes, or if it needs to be rebooted (I've needed to fixed way too many Docker issues this way) -- is fundamentally flawed.

Docker in development? Sounds good to me ๐Ÿ‘

That said, when it comes to development, if new contributors could run 1 command and have a usable dev environment up and ready, that would be very valuable -- but only if there's a folder that shows up on disk on the host that can be edited using the dev's normal text editor/IDE.

rkt > Docker... but do we even need containers?

rkt is made by CoreOS, who really knows what they're doing. They learned a lot from Docker and didn't make the centralized daemon mistake.

Containers are great for having a consistent runtime environment everywhere, but unless they're either helping us bootstrap the ~immutable environment idea that @ageis mentioned to me -- which we should totally do -- or helping us shard more cleanly[1], then I'm not sure we need them at all.

[1] The idea here is that we could start out with different clusters of pursuances living in different containers on the same machine, so that, when we have our first large and very active pursuance, we can simply move it to its own physical machine without fundamentally changing any of Pursuance's backend architecture. But this will only work if we can route traffic to different containers over localhost in the same way that we would route to them over the network. (And now this is starting to sound like Kubernetes...)

(But OK, back to the containers-or-not discussion:)

We can have a staging server that runs the production build exactly as the production server is about to, right after we test staging and deploy to production, and if using containers would help this -- which is probably the case -- then could run rkt in staging and production?

Ideally we run exactly the same stack everywhere -- no exceptions -- which suggests to me that either running rkt everywhere or nowhere (and not using containers at all) is the right answer.

rkt can't natively run on Windows or even macOS, and requiring Vagrant to dev on Pursuance on a Mac seems pretty lame to me.

...so maybe we're back to running rkt in staging and production, and only optionally when dev'ing?


Simple example of creating a systemd service that runs a rkt container, and sets that up with Ansible: https://github.com/charleskorn/rkt-runner

Feature: create new pursuance

Fields:

  • Pursuance Name (name)
  • Mission (mission)
  • Private / Public (?) (is_encrypted)
    • Create a help/? icon they can click (like on LeapChat) to learn more; should trigger a modal

[Research] Feature suggestion: make it easy to take notes within Pursuance

A technical user requested that we let people attach notes to tasks to further capture the context of a task, and that these notes be available as first-class items rather than trapped inside tasks as task descriptions or the like.

Interesting idea...

This makes me think of the following idea: we could create a tasks.why or tasks.motivation column that describes why it's important for this task to be done.

Feature: Create Task form

Fields:

  • Title (text)
  • Description (text)
  • Reviewer (drop-down/autocomplete based on user)
  • Assignee (drop-down/autocomplete based on user)
  • Deliverable (text)

UX: User Stories

From her favorite pursuance's, Ashley clicks New Task, then specifies the title, description, assignee, reviewer, skills necessary to complete it, and deliverables.

Feature idea: let user keep private notes about other users

Use case: easier to keep track of who's who in a large group; digital equivalent of jotting down a note on the back of someone's business card after meeting them and talking to them so you remember who they are when seeing them later.

Security: ensure all rendered user input is properly sanitized on output

I believe it is, but let's check.

Is https://github.com/rlidwka/render-readme/blob/6b74013ce0388f962a27ae487bc55a5f25b2b9f1/lib/sanitize.js any good for this job?

Also, I'd like to use https://github.com/cryptag/leapchat/blob/9e34e2535d7661fa0632eababbd324ff2741f69d/src/utils/link_attr_blank.js rather than using react-markdown like we are at e67fc5c#diff-2892c62769bae556aeb0715ee3fffbb4 , but I'm not sure how to do that without using the {html: false} letting followed by React's dangerouslySetInnerHTML, but it's not clear whether that's safe; I don't know the degree to which {html: false} sanitizes/doesn't allow certain things.

Implement 2FA

Probably use https://github.com/pquerna/otp ? LGTM from the docs. I haven't checked the crypto.

EDIT: https://github.com/sec51/twofactor also looks fine at first glance.

@ajvb @ageis Let's think of very secure ways of storing these per-user 2FA/OTP secrets -- perhaps stored on disk encrypted with a public key whose corresponding private key never does disk.

I'm all in favor of ideas for optional 3FA in the future, too. We can probably learn a lot from https://motherboard.vice.com/en_us/article/kz74ym/google-gmail-advanced-protection-security-keys-yubikey and a bit from https://protonmail.com/blog/protonmail-vs-gmail-security/ .

User testing: Questions for users/info we want

  • Do they like the color scheme?
  • Do they know how to create a task?
  • Do they know how to create a pursuance?
  • Do they know how to go to the chat room associated with a task?
  • Can they delete a task?
  • Can they assign a task to a user?
  • Can they assign a task to a pursuance?
  • Can they set the due date of a task?

Feature: list public pursuances at /pursuance/all

@Moe-Shoman Do a GET to getJSON("/pursuances?is_encrypted=is.false") to get a list of all public pursuances. Show each name, mission, and created date

Later we'll also display how many members each pursuance has.

(This page should not require the user to be authenticated, but most of the others we've made should.)

Design how redux should store task information

tasks: {
  1: { // <pursuance_id>
    hierarchy_view: {
      root_tasks: [{id: ..., title: ..., deliverables: ..., tasks: [...]}, ...]
    },
    list_view: [taskid, taskid2, ...],
    unsaved: {
      taskname1: {title: ..., assigned_to: ..., due_date: ...},
      taskname2: {title: ..., assigned_to: ..., due_date: ...},
    }
  }
}

Use LeapChat-style cryptographic auth

...but with a twist: do the securer version, which generates a 2nd key pair from the user's primary/useful keypair that is used just for auth, so that auth tokens are encrypted with a different public key (miniLock ID) than that user's data.

Write 2 extensive Selenium tests

  • Create task, create sub-task, ensure both show up
  • Create a pursuance + make sure it shows up on the Dashboard
  • (Later) ...something auth-related
  • (Later) Join a pursuance + make sure it shows up on your Dashboard
  • (Later) After creating tasks, delete both and make sure neither show up

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.