6 ms·

How do services like Sia handle illegal content?

by yasp 7y ago

jameslevy 7y ago
I believe that censorship resistance is a key value proposition for decentralized file storage. So its agnostic handling of illegal content is a feature, not a bug.
- yazan94 7y ago
  In the spirit of blockchain and decentralization, I think you're right. But practically, explaining that to the authorities will probably not be a pleasant experience if they manage to find cp or other illegal data on your hard drive.
  - Ajedi32 7y ago
    The data is encrypted by the client, so that's theoretically impossible. Neither you nor the authorities have the ability to determine what file fragments (whole flies aren't stored; just fragments) are on your PC.
    - modeless 7y ago
      It's not theoretically impossible for law enforcement to discover the encryption keys to some illegal files on someone's computer. Then they could go around arresting people who host the chunks. Of course those people wouldn't have known about those files in particular, but they were knowingly running software that enables hosting illegal files. A judge would have to decide if that's OK.
      - Ajedi32 7y ago
        Doesn't AWS also have the same problem? Someone could upload encrypted illegal content, then later law enforcement could discover the key. Why hasn't AWS gotten in trouble for that yet?
        modeless 7y ago
        No large cloud provider allows anonymous usage. They take down content on request and assist law enforcement in catching the non-anonymous people doing illegal things on their platforms.
        Ajedi32 7y ago
        Okay, bad example. AWS is a paid service so obviously they have more information about their users than most. What about Dropbox or OneDrive? Both of those services allow files to be stored and shared with no requirement to identify yourself when you're creating an account, beyond providing an email address.
        txcwpalpha 7y ago
        Both Dropbox and OneDrive scan your content to determine if it matches known illegal content (be it illegal pornography, DRM content, etc) and will remove it and remove you from their service. See https://www.microsoft.com/en-us/photodna https://www.microsoft.com/en-us/photodna If someone pre-encrypts data and then uploads that to Dropbox, it gets more complicated and AFAIK involves more of monitoring the IP addresses that things are coming from and/or being shared to.
        lmpostor 7y ago
        Same argument for Bitcoin, cash etc. You have a thousand degrees of slippery slope in what constitutes "enable". Does paying your workers in cash for tips enable tax evasion? Also, I'm not sure what scenario in which you would be able to find the encryption key, yet not have access to the wallet controlling the contracts? Even if you did, I'm not sure why hosts could not assist in cancelling contracts in a similar fashion to cloud providers taking down content on request.
      - Taek 7y ago
        US has strong third party protection laws. If it doesn't, HN could be held accountable for illegal files that were converted to base64 and then posted in the comments. I am not a lawyer and this is not legal advice, but as a third party you are not responsible for illegal data uploaded to your server/machine so long as you are not aware that it is illegal data. Once you are informed that there is illegal data on your machine, you have 24 hours to remove it.
    - wmf 7y ago
      Someone could upload data to you then later reveal the keys. If the authorities have the metadata and keys they can determine who is storing the data.
    - empath75 7y ago
      So basically Jeffrey Epstein gives you a CD full of encrypted files and asks you to hold on to them for him? Shouldn't be any problem with that.
- pradn 7y ago
  I wonder about whether it's right to be renting your storage space away without knowing what it's being used for. I don't want to directly contribute toward bad things happening.
  - arbol 7y ago
    We need to move away from centralised internet. You don't have any real proof that Company XYZ aren't using your money to do bad things. You would stop participating if it turned out the Sia network was mostly used for bad things. In the same vein, you may choose not to use Amazon because it is unfairly treating warehouse workers.
  - brokenmachine 7y ago
    It's fine then because you'd only be indirectly contributing. Just like paying your taxes or buying fast food and clothes.
Ajedi32 7y ago
All data is fragmented and encrypted, so it's impossible to know whether a particular host is storing a fragment of illegal content or not. I suppose if you somehow _did_ find out you were hosting a fragment of illegal content you could breach the storage contract (and pay the resulting penalty) but that's very unlikely because, again, all content is encrypted.
- alexkcd 7y ago
  Seems like this could be a common use case for pirates. Similar to how Megaupload or Fileshare worked a few years ago. Sia's encryption doesn't protect the file hosts, if the uploader posts a link + decryption keys for pirated content to a public file sharing forum. Does the take down notice go to everyone that hosts a fragment of the file? Who is liable if the uploader can't be traced?
  - Ajedi32 7y ago
    Good question. I suppose that would only work if whatever keys the pirate needed to publish to allow the data to be downloaded wouldn't _also_ give the keyholder the ability to delete that data. Otherwise the copyright holder could just issue the command to delete the file themselves. I'm not sure if Sia works that way or not; would be interesting to see.
    - alexkcd 7y ago
      Since they say their intent is to compete on price with S3 / CDNs, it seems possible to be able to download a file without having permissions to delete that file. If that were not the case, then Sia would be limited to personal backup only.
      - ragle 7y ago
        It's confusing, because they refer to themselves as a potential competitor to S3 several times in the linked article, but I thought I read somewhere that conceptually what they're building is actually just the data persistence layer of a service like S3? A complete S3-like service would require a third-party tool on top of Sia. Goobox[1], for example, uses sia as a storage backend and provides an S3-compatible API[2]. In other words, right now - I think if you are interacting with Sia directly you can do whatever you want with the files you have access to. Not 100% sure about that. [1] - https://goobox.io/ https://goobox.io/ [2] - https://doc.goobox.io/#section/Why-you-should-choose-Goobox-S3-API-over-the-other-REST-APIs https://doc.goobox.io/#section/Why-you-should-choose-Goobox-...
uwuhn 7y ago
It doesn't. The last real application of Sia that I heard of during the previous crypto boom basically sounded like renting your HD space out to people who would potentially use it to store illegal content.
- arcticbull 7y ago
  That's the biggest risk of permissionless / decentralized -- you learn quickly why permissioning and centralization are important.
  - hanniabu 7y ago
    Can you provide some of the reasons?
    - arcticbull 7y ago
      Otherwise encrypted illegal content is stored on everyone's computers, and technically makes them potential felons. And thanks to the magic of the blockchain, it's indelibly recorded forever.
      - camjohnson26 7y ago
        What’s to stop a hacker from planting such content on your computer?
        arcticbull 7y ago
        Infosec usually, the difference here is you're taking on the risk and data knowingly and willfully. "Officer, it's part of a blockchain thing called Sia" is unlikely to satiate them.
- antpls 7y ago
  The next step is to fight the idea of "illegal content". Bits are just bits, some just upset the elites, just like nipples.
galaxyLogic 7y ago
I find the concept of "Illegal Content" conceptually questionable. Authorities do not care much, I assume, if you possess illegal content. What they care about is if you share illegal content. Say you have a pro-democracy pamphlet on your hard-drive in China. If they find it they would imprison you no doubt but they don't care so much to look for it, and it is hard to find if you never share it with anybody. SIA provides private storage so if your only crime is possessing illegal content but never sharing it with anybody no big deal (I would assume). But if you share it then SIA can not protect you because the exchange must happen somewhere outside of SIA.
- dymk 7y ago
  > Authorities do not care much, I assume, if you possess illegal content. What they care about is if you share illegal content. You'd be wrong - people get nabbed for having or creating child porn, not just distributing it.
  - galaxyLogic 7y ago
    I am sure. It would be an interesting case for the Supreme Court. Did you do something illegal by allowing SIA to store encrypted data on your hard-disk not knowing what it was?
  - camjohnson26 7y ago
    Which is stupid. If I were a member of a foreign government I’d use sophisticated hackers to plant that kind of content on anyone I didn’t like. Automatic jail for life.
camjohnson26 7y ago
How does http handle illegal content? Is there any reason that content should be blocked at a protocol level instead of punishing the person who created it through existing regulations? If Sia has a way to remove such content it loses its decentralized nature, which is the whole reason it exists in the first place. Should it exist? Well sometimes important content is illegal, such as political content in China. It’s good to have a way to publish important illegal content, even if bad stuff slips through. What if someone posts illegal violent or sexual content? That is unfortunate, but it means that a real person took the time to post such content on the network. Keeping them from speaking will not change their warped beliefs, it will just hide them from the world and keep people from remembering that evil people exist. The person who published the content should be punished through existing regulations and the content should stay on the network to remind us that some people are horrible. Hopefully no one accesses it.
- Fornax96 7y ago
  Perfectly said. Removing "illegal" content does not solve the fact that the content exists. The problem should be tackled at the source.
anonymous5133 7y ago
All data is encrypted automatically before it is uploaded to the network. It is impossible for individual hosting nodes to see what is being stored.

How do services like Sia handle illegal content?

by yasp 7y ago

How do services like Sia handle illegal content?

I believe that censorship resistance is a key value proposition for decentralized file storage. So its agnostic handling of illegal content is a feature, not a bug.

yazan94 7y ago
In the spirit of blockchain and decentralization, I think you're right. But practically, explaining that to the authorities will probably not be a pleasant experience if they manage to find cp or other illegal data on your hard drive.
- Ajedi32 7y ago
  The data is encrypted by the client, so that's theoretically impossible. Neither you nor the authorities have the ability to determine what file fragments (whole flies aren't stored; just fragments) are on your PC.
  - modeless 7y ago
    It's not theoretically impossible for law enforcement to discover the encryption keys to some illegal files on someone's computer. Then they could go around arresting people who host the chunks. Of course those people wouldn't have known about those files in particular, but they were knowingly running software that enables hosting illegal files. A judge would have to decide if that's OK.
    - Ajedi32 7y ago
      Doesn't AWS also have the same problem? Someone could upload encrypted illegal content, then later law enforcement could discover the key. Why hasn't AWS gotten in trouble for that yet?
      - modeless 7y ago
        No large cloud provider allows anonymous usage. They take down content on request and assist law enforcement in catching the non-anonymous people doing illegal things on their platforms.
        Ajedi32 7y ago
        Okay, bad example. AWS is a paid service so obviously they have more information about their users than most. What about Dropbox or OneDrive? Both of those services allow files to be stored and shared with no requirement to identify yourself when you're creating an account, beyond providing an email address.
        txcwpalpha 7y ago
        Both Dropbox and OneDrive scan your content to determine if it matches known illegal content (be it illegal pornography, DRM content, etc) and will remove it and remove you from their service. See https://www.microsoft.com/en-us/photodna https://www.microsoft.com/en-us/photodna If someone pre-encrypts data and then uploads that to Dropbox, it gets more complicated and AFAIK involves more of monitoring the IP addresses that things are coming from and/or being shared to.
        lmpostor 7y ago
        Same argument for Bitcoin, cash etc. You have a thousand degrees of slippery slope in what constitutes "enable". Does paying your workers in cash for tips enable tax evasion? Also, I'm not sure what scenario in which you would be able to find the encryption key, yet not have access to the wallet controlling the contracts? Even if you did, I'm not sure why hosts could not assist in cancelling contracts in a similar fashion to cloud providers taking down content on request.
    - Taek 7y ago
      US has strong third party protection laws. If it doesn't, HN could be held accountable for illegal files that were converted to base64 and then posted in the comments. I am not a lawyer and this is not legal advice, but as a third party you are not responsible for illegal data uploaded to your server/machine so long as you are not aware that it is illegal data. Once you are informed that there is illegal data on your machine, you have 24 hours to remove it.
  - wmf 7y ago
    Someone could upload data to you then later reveal the keys. If the authorities have the metadata and keys they can determine who is storing the data.
  - empath75 7y ago
    So basically Jeffrey Epstein gives you a CD full of encrypted files and asks you to hold on to them for him? Shouldn't be any problem with that.
pradn 7y ago
I wonder about whether it's right to be renting your storage space away without knowing what it's being used for. I don't want to directly contribute toward bad things happening.
- arbol 7y ago
  We need to move away from centralised internet. You don't have any real proof that Company XYZ aren't using your money to do bad things. You would stop participating if it turned out the Sia network was mostly used for bad things. In the same vein, you may choose not to use Amazon because it is unfairly treating warehouse workers.
- brokenmachine 7y ago
  It's fine then because you'd only be indirectly contributing. Just like paying your taxes or buying fast food and clothes.

Ajedi32 7y ago

All data is fragmented and encrypted, so it's impossible to know whether a particular host is storing a fragment of illegal content or not. I suppose if you somehow _did_ find out you were hosting a fragment of illegal content you could breach the storage contract (and pay the resulting penalty) but that's very unlikely because, again, all content is encrypted.

alexkcd 7y ago
Seems like this could be a common use case for pirates. Similar to how Megaupload or Fileshare worked a few years ago. Sia's encryption doesn't protect the file hosts, if the uploader posts a link + decryption keys for pirated content to a public file sharing forum. Does the take down notice go to everyone that hosts a fragment of the file? Who is liable if the uploader can't be traced?
- Ajedi32 7y ago
  Good question. I suppose that would only work if whatever keys the pirate needed to publish to allow the data to be downloaded wouldn't _also_ give the keyholder the ability to delete that data. Otherwise the copyright holder could just issue the command to delete the file themselves. I'm not sure if Sia works that way or not; would be interesting to see.
  - alexkcd 7y ago
    Since they say their intent is to compete on price with S3 / CDNs, it seems possible to be able to download a file without having permissions to delete that file. If that were not the case, then Sia would be limited to personal backup only.
    - ragle 7y ago
      It's confusing, because they refer to themselves as a potential competitor to S3 several times in the linked article, but I thought I read somewhere that conceptually what they're building is actually just the data persistence layer of a service like S3? A complete S3-like service would require a third-party tool on top of Sia. Goobox[1], for example, uses sia as a storage backend and provides an S3-compatible API[2]. In other words, right now - I think if you are interacting with Sia directly you can do whatever you want with the files you have access to. Not 100% sure about that. [1] - https://goobox.io/ https://goobox.io/ [2] - https://doc.goobox.io/#section/Why-you-should-choose-Goobox-S3-API-over-the-other-REST-APIs https://doc.goobox.io/#section/Why-you-should-choose-Goobox-...

uwuhn 7y ago

It doesn't. The last real application of Sia that I heard of during the previous crypto boom basically sounded like renting your HD space out to people who would potentially use it to store illegal content.

arcticbull 7y ago
That's the biggest risk of permissionless / decentralized -- you learn quickly why permissioning and centralization are important.
- hanniabu 7y ago
  Can you provide some of the reasons?
  - arcticbull 7y ago
    Otherwise encrypted illegal content is stored on everyone's computers, and technically makes them potential felons. And thanks to the magic of the blockchain, it's indelibly recorded forever.
    - camjohnson26 7y ago
      What’s to stop a hacker from planting such content on your computer?
      - arcticbull 7y ago
        Infosec usually, the difference here is you're taking on the risk and data knowingly and willfully. "Officer, it's part of a blockchain thing called Sia" is unlikely to satiate them.
antpls 7y ago
The next step is to fight the idea of "illegal content". Bits are just bits, some just upset the elites, just like nipples.

galaxyLogic 7y ago

I find the concept of "Illegal Content" conceptually questionable. Authorities do not care much, I assume, if you possess illegal content. What they care about is if you share illegal content. Say you have a pro-democracy pamphlet on your hard-drive in China. If they find it they would imprison you no doubt but they don't care so much to look for it, and it is hard to find if you never share it with anybody. SIA provides private storage so if your only crime is possessing illegal content but never sharing it with anybody no big deal (I would assume). But if you share it then SIA can not protect you because the exchange must happen somewhere outside of SIA.

dymk 7y ago
> Authorities do not care much, I assume, if you possess illegal content. What they care about is if you share illegal content. You'd be wrong - people get nabbed for having or creating child porn, not just distributing it.
- galaxyLogic 7y ago
  I am sure. It would be an interesting case for the Supreme Court. Did you do something illegal by allowing SIA to store encrypted data on your hard-disk not knowing what it was?
- camjohnson26 7y ago
  Which is stupid. If I were a member of a foreign government I’d use sophisticated hackers to plant that kind of content on anyone I didn’t like. Automatic jail for life.

camjohnson26 7y ago

How does http handle illegal content? Is there any reason that content should be blocked at a protocol level instead of punishing the person who created it through existing regulations? If Sia has a way to remove such content it loses its decentralized nature, which is the whole reason it exists in the first place. Should it exist? Well sometimes important content is illegal, such as political content in China. It’s good to have a way to publish important illegal content, even if bad stuff slips through. What if someone posts illegal violent or sexual content? That is unfortunate, but it means that a real person took the time to post such content on the network. Keeping them from speaking will not change their warped beliefs, it will just hide them from the world and keep people from remembering that evil people exist. The person who published the content should be punished through existing regulations and the content should stay on the network to remind us that some people are horrible. Hopefully no one accesses it.

Fornax96 7y ago
Perfectly said. Removing "illegal" content does not solve the fact that the content exists. The problem should be tackled at the source.

anonymous5133 7y ago

All data is encrypted automatically before it is uploaded to the network. It is impossible for individual hosting nodes to see what is being stored.