21 ms·

OnionShare makes it easy to publish anonymous, uncensorable websites

620 points by input_sh 7y ago

aabbcc1241 7y ago
How is it comapre to zeronet ?
- icebraining 7y ago
  Zeronet is sites-over-bittorrent: you connect to people seeding the site, download it, and then you also become a seeder for other people. By default everyone can tell you (that is, your public IP) are serving a particular site, but you can use Tor to make it much harder to find out what is your IP. OnionShare is just a regular webserver (every visitor accesses the site by connecting to a single machine: yours), but it automatically only serves it behind Tor, for the same reasons as above. The advantage of this seems to be mostly simplicity (both in implementation and in setting Tor and such up) and possibly speed of first download for lightly used sites. The advantage of Zeronet is that more people can serve the site, even if the original machine is offline or overwhelmed.
t0mbstone 7y ago
very cool!
StavrosK 7y ago
That's a great initiative. I was hoping IPFS would be the de facto way to publish uncensorable websites, but I have grown more and more disappointed in it, as it fails a lot for me in its most basic purpose (fetching files). Hopefully one of the other competitors will do better, but IPFS got a bunch of theoretical stuff right, in my opinion (mainly immutability of objects).
- dmix 7y ago
  Why does it have trouble fetching files?
  - neuralzen 7y ago
    Maybe OP is talking about IPNS? Which is unfortunately quite slow... I had to fuss with my TXT entries in DNS a bit to speed things up to an acceptable level (and reference the site via IPFS instead of IPNS)
    - StavrosK 7y ago
      Unfortunately even normal fetching is iffy. Content I add to some content isn't discovered by other nodes quickly.
      - tylersmith 7y ago
        Yeah that's IPNS as the GP suspected. It's definitely the hardest part of working on top of the IPFS ecosystem. Direct IPFS lookups are much, much better. On the OpenBazaar project we're experimenting with a centralized IPNS record server that is used to provide a fast response while a real IPNS lookup is done in the background to ensure we're not censoring. Because records are signed the only thing we could do is censor newer IPNS records and serve old ones, but then nodes just revert back to the slower-to-update records like they had before.
        StavrosK 7y ago
        I'm not talking about IPNS, I'm talking about normal IPFS lookups. Hopefully this will improve (maybe has improved, I haven't tested lately), but it used to be bad, to the point where some gateways wouldn't discover content that already existed on other gateways.
  - StavrosK 7y ago
    I'm not sure why, but if you have a node that has been running for a while and you add some files to it, some gateways will find them right away and others will keep timing out for many minutes. Discovery seems to be very hit-or-miss, and it's the most important component of IPFS...
- PureParadigm 7y ago
  From what I can tell, one of the main goals of IPFS is decentralization. Anyone can be hosting the file you want and it will download from any of the peers. Does OnionShare do this? As you mentioned, I've also found IPFS to be fragile, particularly in that it is unlikely for stuff to stay up reliably, as ironic as that is. If I'm trying to host a website with not too much traffic (nobody else replicating), I have to keep my computer online or it will become inaccessible.
  - shadowgovt 7y ago
    > Does OnionShare do this? IIUC, it's onion-routing request traffic to your computer, but your computer is still acting as the sole server of the website. Turning off your machine gives incoming requests nowhere to resolve to.
    - p4bl0 7y ago
      In practice it is the case for IPFS too most of the time.
  - icebraining 7y ago
    > it is unlikely for stuff to stay up reliably, as ironic as that is Well, it's kinda inevitable with these systems, since there's limited available space. Freenet lets you "insert" data into the network (copy to other nodes) and disconnect your computer, but if nobody requests that data, it'll also eventually disappear from every node.
  - momack2 7y ago
    There's an annoying misconception that IPFS is "free storage" - it's not. If you care about something sticking around on the network, you need to take action to ensure that happens: either as an individual pinning it to a persistent node you run, as a developer paying a distributed pinning service to host your dapp data, or as a community creating a social agreement to all peer their nodes to replicate each other's data. All these solutions are doable today, but you shouldn't expect others to host your content for free (if it isn't popular enough for other people to be proactively caching it). IPFS is the distributed network for addressing files, you have to bring, buy, or share your own storage - anything else (ex forced hosting of content you don't choose) would have problematic liabilities!
- jmeyer2k 7y ago
  I've worked with IPFS and I completely agree with you here. There are so many basic bugs that haven't been fixed because of the over abstraction of LibP2P. Currently, it connects to bootstrap nodes and tries to discover peers asynchronously. Obviously, it doesn't handshake with the bootstrap nodes in time for it to start discovering peers so it waits another 1-5 minutes depending on the setting to try discovering again. Startup usually takes a few minutes due to this trivial problem and an issue has been open for it since May: https://github.com/ipfs/go-ipfs/issues/5953 https://github.com/ipfs/go-ipfs/issues/5953
  - momack2 7y ago
    IPFS person here - there are a ton of improvements to the libp2p DHT in the works (many which also relate to bootstrapping efficiency), but a key component of shipping these to an active 100K+ node network like IPFS is testing and validation, so it's taking us longer to ship these improvements while we build a testground able to simulate network conditions to increase network _reliability_ as well as performance. IPFS is still actively WIP and directly focused on improving performance, reliability, and usability - so feedback and collaborators welcome to help us address these issues head-on. =]
    - rosybox 7y ago
      I like where IPFS is going and I think it's an important bit of software, so it's good to hear you're working on it. I do have a question though on the immutability, how do you address problems where people contribute harmful content, such as revenge porn pictures, or doxing someone? If the content is immutable, it means these things would always exist and never be removable? Is there any moderation that can stop this kind of stuff? Just wondering, I still like the idea, it's just a question I have been thinking about.
      - pault 7y ago
        Unfortunately if you want an uncensorable network you won't be able to censor the nasty stuff either.
      - 7y ago
- dooglius 7y ago
  IPFS has built-in denylists so it isn't very uncensorable.
  - momack2 7y ago
    Not sure where you got that info, but AFAIK that is incorrect. While everyone running their own infra has the responsibility to comply with local laws (or face local consequences) - there is no central network allow/denylist. Every single node has the power to decide what content they pin and make accessible to other nodes in the network, or how to consume content coming from other nodes (ex they might choose to filter out certain types of content). There is no central ipfs authority involved in any of that. If an individual node wanted to opt-in to a collaborative denylist (ex to block spam, etc), this is the most recent proposal for how that might work: https://github.com/ianjdarrow/content-decider https://github.com/ianjdarrow/content-decider (still in design phase)
    - dooglius 7y ago
      https://github.com/ipfs/faq/issues/36#issuecomment-140567411 https://github.com/ipfs/faq/issues/36#issuecomment-140567411 My understanding is that it is not possible for Tor nodes to block (or even know about) what you are accessing.
      - deleted 7y ago
        [deleted]
      - schoen 7y ago
        A Tor exit node can block destinations openly by declaring limitations in its exit policy (in principle by IP address or port, although I don't know if any exit policies use IP address this way) or by simply firewalling connections from itself to particular destinations. In the latter case, the node may be marked as a BadExit if a scanner detects that it intentionally blocked a connection that it offered to relay. A node in an earlier position in a circuit can't know the ultimate destination of the circuit, or the content exchanged over it, although it could in theory blacklist individual nodes as a next hop (which doesn't typically really accomplish anything for content-blocking purposes, and could also be detected if it were a pervasive practice). I think in HSv2 (the old hidden services protocol) there were a number of different opportunities for relays to selectively disrupt hidden service connections, while in HSv3 (the new revision) there are fewer. A difference between Tor and IPFS in regard to what you're mentioning above is that in Tor, a specific entity (a specific clearnet or hidden service site operator) has to continue actively hosting a resource in order for it to remain accessible at its original location, while in IPFS, it's more like that there need to be some participants who haven't actively declined to host it, but they don't have to be the same as the original publisher.
- JoshuaMulliken 7y ago
  Unfortunately, I think projects like this that make it easy to create onion resources are quite dangerous. The reduction of friction to host material online in a completely anonymous way only enables adverse actions like the sharing of CP or other illegal content. Please look here for a good explaination of friction in this space -> https://stratechery.com/2019/child-sexual-abuse-material-online-the-problem-with-community-towards-more-friction/ https://stratechery.com/2019/child-sexual-abuse-material-onl... If it is used by political or marginalized communities, then this project is also not useful. It does not have the support or attention required to enable it to be secure enough like the TOR project does. This application opens up legitimate users to incredible risk. If I were a dissident, I would take my time and do the research required to set up a system like this in the correct way. This project may give people a sense of false security.
  - DuskStar 7y ago
    Ah, yes. The good old "don't make that tool because bad people might use it" argument. Similarly, we should ban sharing information on hacking/security because bad people might use it, and require that all communications be visible to the government to prevent abuse.
    - JoshuaMulliken 7y ago
      That is not the argument being made. It is an argument that having friction in the process to do something that may have dangerous outcomes is sometimes positive. It is much the same as arguments that there should be gun training required to purchase a firearm. Adding friction to a process sometimes provides positive benefits.
      - DuskStar 7y ago
        > That is not the argument being made. It is an argument that having friction in the process to do something that may have dangerous outcomes is sometimes positive. The argument being made, as far as I can tell, is that this tool will make doing bad things easier, and thus this tool should not be made. As any tool to resist censorship will also enable said bad things, I do not find this to be a valid concern. (And since some governments would list censorship resistance itself as one of those bad things, this is always going to be true) > It is much the same as arguments that there should be gun training required to purchase a firearm. I think the tech equivalent to this would be mandating a "don't sexually exploit children" class before allowing purchase of a computer. (As you might guess, I'm not a fan) > Adding friction to a process sometimes provides positive benefits. Sure, but you have to make sure the collateral damage is minimized AND that you're actually catching the offending segment of the population. Mandating gun training before purchase is actually a great comparison here - the vast majority of gun crime in the US is committed with illegally acquired weapons (which would be unaffected by the mandate), just like I imagine that the majority of CSE imagery shared on the internet uses something more robust than OnionShare. So in both cases you'd have high collateral damage with minimal impact to the population you actually care about affecting...
- Erlich_Bachman 7y ago
  Does IPFS even try to provide anonymity? Even if it would be technically "censorship-resistant", what good is it when everyone can see who hosts the content, track them down, and subpoena/arrest them?
  - derefr 7y ago
    No, anonymity isn't a goal of IPFS. If you add anonymity (for both consumers and publishers) to IPFS, you get the design of its older sibling: FreeNet.
ddtaylor 7y ago
It's good to see Tor becoming more easily accessible to non-technical people.
DigitalVerse 7y ago
Nice! I feel like this project is mirroring the development of the internet itself. :D
dang 7y ago
Url changed from https://blog.torproject.org/new-version-onionshare-makes-it-easy-anyone-publish-anonymous-uncensorable-websites-0 https://blog.torproject.org/new-version-onionshare-makes-it-..., which points to this.
kodablah 7y ago
Shameless plug (that I haven't had much time to work on lately), you can also programmatically do similar in a few lines of Go: https://github.com/cretz/bine https://github.com/cretz/bine
tunnuz 7y ago
Amazing!
Gys 7y ago
Next thing we need is a search engine specifically for those websites, hosted in the same way. Reinventing the internet all over again!
- icebraining 7y ago
  There are a few already :) https://www.reddit.com/r/onions/ https://www.reddit.com/r/onions/ has some .onion links on the sidebar to search engines. They aren't decentralized, though; some people are running YaCy (a decentralized search engine) over Tor to create a decentralized index of onion sites: http://wiki.yacy.net/index.php/En:YaCy-Tor http://wiki.yacy.net/index.php/En:YaCy-Tor
- deleted 7y ago
  [deleted]
wpietri 7y ago
It would be nice to at least see some hazy consideration of the impact of this. I know a probation officer for sex offenders and she tells me trying to keep up with their technology use is a nightmare. I can only imagine how this complicates her job. That's not saying that on balance this shouldn't exist. There are of course good uses of technology like this. But I'd at least like to see builders grappling with that balance. Especially given recent prominent reporting around this: https://www.nytimes.com/interactive/2019/09/28/us/child-sex-abuse.html https://www.nytimes.com/interactive/2019/09/28/us/child-sex-...
- faissaloo 7y ago
  Fredrick Brennan calls this the "Pedo Problem", whenever you create a free space for people, pedophiles will flock to it.
- commandlinefan 7y ago
  Got to be honest, that was my first thought - if anybody actually comes up with something that's actually anonymous and actually uncensorable, it will be shut down, by whatever means necessary, by the government with the full blessing and support of the public.
  - fishtacos 7y ago
    The Tor network hasn't been shut down, has it? Dark sites of all types still continue to run uninhibited for the most part. From my readings, the major or at least known/researched security holes have been plugged already by the developers, and the rest of convictions have happened because of user error, not the technology involved. If memory serves me correctly, one particular pedophile abuser was caught after years of being investigated because he was identified through skin marks (I want to say it was freckles on his hand, though I don't recall the exact details of the article) that led investigators to him, not anything technological. I'm a proponent of total anonymity online because it allows for whistleblowers to leak information that is untraceable to them (again, without consideration of human error). In the case of Wikileaks, for example, even though they weren't on an anonymous network, it still led to the largest classified information leaks known, from NSA tools to national and international communications between heads of states, diplomats and everyone in between. The general consensus was that it was a good thing. I don't necessarily agree with that, but one can't discount its value.
companyhen 7y ago
Sounds like http://arweave.org http://arweave.org
- penguinpalace 7y ago
  Definitely. OnionShare requires your own computer to be connected to the interwebs - the data is only accessible while your OnionShare app is running. With Arweave the hosting is taken care of (the data/website/etc is hosted on the Weave). Plus, OnionShare sites are not verifiable/ reliable as they are a website running on someone's computer. An Arweave site is timestamped and unforgeable; it's also resilient (replicated on many nodes) and permanently stored.
lcfcjs2 7y ago
Republicans rejoice!
peterashford 7y ago
I've been in tech my whole life. I really enjoy technology, I'm pleased with the career I chose. But man am I tired of technologists "moving fast and breaking things" without any concern whether those things being broken might be better left whole. Just because you can smash social norms, doesn't mean you should.
- luckylion 7y ago
  The social norm that is "privacy is bad"?
  - yters 7y ago
    Sometimes it is.
  - peterashford 7y ago
    Privacy for pedophiles is bad. Privacy for terrorists is bad. Privacy for illegal acts is often bad (this is entirely the point of whistle-blower legislation, after all)
    - luckylion 7y ago
      Sure, sure, my basic assumption is that you can't have privacy for certain acts only. If the idea is that somebody watches and completely ignores all legal behavior but steps in when they witness illegal behavior, that's not privacy, it's something else. Privacy means that nobody watches, so if you want to build tools for privacy, you'll always end up also enabling people to use them for illegal things. We (as Western societies) have mostly decided that general privacy is so valuable to citizens that we accept the collateral damage of crime being possible. I've not heard a lot of arguments against privacy in general, the arguments tend to be "I don't need privacy in this particular part of life, so it better be removed".
sealthedeal 7y ago
So, I used to be on-board with these type of things, but now I dont understand what the true purpose of an uncensorable website? It just seem like a place for hate groups to unite and bad things to happen... I would love a different perspective on this :)
- big_chungus 7y ago
  Sure. Basically, it all comes down to whether or not you trust the government to be good, always. If you believe this is the case, you're fine. If you don't, you will probably prefer un-censorable technologies. America has (historically) tended to fall pretty far to the "free speech" side of the line, though there is a push to change that. Even if you trust the American government, people in repressive regimes can still make use of this. This could enable a western news outlet to make itself accessible to those who are brainwashed by state media. Trying to prevent "hate groups" from congregating or criminals from opening marketplaces doesn't usually work, either. It's the prohibition principle: if you ban the tech, criminals will use it, but an American NGO won't be able to reach those with censored internet. You may not use it, but I don't see why your "being on board with it" ought to affect what others create.
  - kevin_thibedeau 7y ago
    Even if you have "free speech" you could still end up on some form of subversive persons list. We're not far from McCarthy 2.0.
  - filoleg 7y ago
    >Even if you trust the American government, people in repressive regimes can still make use of this. I think an important point to make is that just because you trust the American government now, doesn't mean that this won't change in the future. Which is why the core tenets of free speech and privacy should be protected at all costs.
- DennisP 7y ago
  It's easy to feel that way in, say, the U.S., where only hate groups are getting censored right now, and even that only by private companies. If you think about a country like China, where for example it's hard to find anything online saying a massacre at Tiananmen Square ever happened, then the purpose of these things becomes more obvious. The time to set up uncensorable communications is before you're being censored. After, it's a lot harder to get traction.
jstrieb 7y ago
Very cool! I created urlpages [0] as a proof-of-concept with a similar goal. It is always interesting to read about how others try to solve the same problem. [0]: https://github.com/jstrieb/urlpages https://github.com/jstrieb/urlpages
hnuser54 7y ago
I love Tor, but it's almost suspicious how fast it's become, like I'm wondering who's paying for all this bandwidth. Home, businesses, hotels, you name it, Tor Browser almost never takes more than 2x as long to load anything on the web as the raw connection does. I admit don't have an understanding of how Tor works mathematically. There are organizations funding Tor exits and relays (torservers.net, Emerald Onion, Tor Project itself) but has anyone added up the bandwidth they provide and compared it to the total?
- arthurcolle 7y ago
  Don't all those crazy FBI/CMU/(NSA..?) correlation attacks require you to control some majority percentage of the relays and/or exit nodes? It would definitely be interesting to actually come up with some estimates of how much was being spent in aggregate bandwidth costs, say, 7 years ago, and compare it with what is being spent at present, and see if it matches what would be expected with 'normal user growth' although normal user growth for a relatively niche project like this would be pretty hard to quantify.
  - throwaway66920 7y ago
    I wonder if there aren’t multiple us agencies competing for a majority share Unbeknownst to each other, all of them limiting the abilities of the others, all of them making it a better platform for those wishing to remain anonymous
    - heavyset_go 7y ago
      They're most likely working together.
      - arthurcolle 7y ago
        In modern times I bet you are right but historically information-sharing wasn't common across the IC (based on my understanding of post-9/11 reality)
    - 7y ago
blacksmith_tb 7y ago
It's very elegant implementation, I wonder though if it's accurate to call it "uncensorable" when there's a single point of failure? Given that searching or seizing the machine hosting the site is still possible (even if that's just by coincidence)? Obviously for the side of the aisle here who are thinking of criminal uses, that's a feature not a bug, but for a dissident who is disappeared that looks different...
angel_j 7y ago
If only it was this easy to publish a website from your home computer to the web regular.
- rohan1024 7y ago
  Yeah a small Raspberry Pi hosting the website at home is my dream
  - angel_j 7y ago
    The book I am reading, main character is named Rohan. #synchronicity
    - rohan1024 7y ago
      What book are you reading?
      - angel_j 7y ago
        It was "The Invincible" by Stanislaw Lem
birracerveza 7y ago
To everyone saying "but this will be used for child porn!"... guess what else is used for that? The internet. Should we just ban the internet as a whole? I understand the sentiment, but I hard disagree with it. Especially because this tool (and similar to it) can be used for good, and might be necessary in the future. Try to see the glass half-full.
- yters 7y ago
  But what is the need for Tor outside of illegal activity?
  - johnnyRose 7y ago
    Plenty of reasons. The most obvious use that comes to mind is to avert government censorship. Then there are whistleblowers. There are more reasons to desire anonymity than illegal activity. Edit: also, ISPs can sell your browsing information now: https://www.usatoday.com/story/tech/news/2017/04/04/isps-can-now-collect-and-sell-your-data-what-know-internet-privacy/100015356/ https://www.usatoday.com/story/tech/news/2017/04/04/isps-can...
    - yters 7y ago
      Don't those governments just block Tor?
      - KnMn 7y ago
        You can use the Tor network through bridge nodes and in fact the Tor Browser Bundle will ask you if you need to connect this way on first run.
  - thecrash 7y ago
    The more illuminating question is "what is the need for anonymity outside of illegal activity"? One answer is that you might someday like to say something which some other party would have a problem with. We might say that if you truly believe in what you're saying, the principled course would be to say your piece and let the other party be upset. But if the other party has a lot of power (for example a parent, an employer, a university, a government official, etc) they can threaten retribution for your words. If the threat is serious enough, you will likely decide not to speak. The ability to say things anonymously removes the threat of retribution. It helps people speak who otherwise wouldn't, increasing the range of perspectives and information the rest of us have access to. This doesn't mean that it's beneficial in every single case, but on balance it's a social good - in fact, it's a necessary component of a free society.

620 points by input_sh 7y ago

aabbcc1241 7y ago

How is it comapre to zeronet ?

icebraining 7y ago
Zeronet is sites-over-bittorrent: you connect to people seeding the site, download it, and then you also become a seeder for other people. By default everyone can tell you (that is, your public IP) are serving a particular site, but you can use Tor to make it much harder to find out what is your IP. OnionShare is just a regular webserver (every visitor accesses the site by connecting to a single machine: yours), but it automatically only serves it behind Tor, for the same reasons as above. The advantage of this seems to be mostly simplicity (both in implementation and in setting Tor and such up) and possibly speed of first download for lightly used sites. The advantage of Zeronet is that more people can serve the site, even if the original machine is offline or overwhelmed.

t0mbstone 7y ago

very cool!

StavrosK 7y ago

That's a great initiative. I was hoping IPFS would be the de facto way to publish uncensorable websites, but I have grown more and more disappointed in it, as it fails a lot for me in its most basic purpose (fetching files). Hopefully one of the other competitors will do better, but IPFS got a bunch of theoretical stuff right, in my opinion (mainly immutability of objects).

dmix 7y ago
Why does it have trouble fetching files?
- neuralzen 7y ago
  Maybe OP is talking about IPNS? Which is unfortunately quite slow... I had to fuss with my TXT entries in DNS a bit to speed things up to an acceptable level (and reference the site via IPFS instead of IPNS)
  - StavrosK 7y ago
    Unfortunately even normal fetching is iffy. Content I add to some content isn't discovered by other nodes quickly.
    - tylersmith 7y ago
      Yeah that's IPNS as the GP suspected. It's definitely the hardest part of working on top of the IPFS ecosystem. Direct IPFS lookups are much, much better. On the OpenBazaar project we're experimenting with a centralized IPNS record server that is used to provide a fast response while a real IPNS lookup is done in the background to ensure we're not censoring. Because records are signed the only thing we could do is censor newer IPNS records and serve old ones, but then nodes just revert back to the slower-to-update records like they had before.
      - StavrosK 7y ago
        I'm not talking about IPNS, I'm talking about normal IPFS lookups. Hopefully this will improve (maybe has improved, I haven't tested lately), but it used to be bad, to the point where some gateways wouldn't discover content that already existed on other gateways.
- StavrosK 7y ago
  I'm not sure why, but if you have a node that has been running for a while and you add some files to it, some gateways will find them right away and others will keep timing out for many minutes. Discovery seems to be very hit-or-miss, and it's the most important component of IPFS...
PureParadigm 7y ago
From what I can tell, one of the main goals of IPFS is decentralization. Anyone can be hosting the file you want and it will download from any of the peers. Does OnionShare do this? As you mentioned, I've also found IPFS to be fragile, particularly in that it is unlikely for stuff to stay up reliably, as ironic as that is. If I'm trying to host a website with not too much traffic (nobody else replicating), I have to keep my computer online or it will become inaccessible.
- shadowgovt 7y ago
  > Does OnionShare do this? IIUC, it's onion-routing request traffic to your computer, but your computer is still acting as the sole server of the website. Turning off your machine gives incoming requests nowhere to resolve to.
  - p4bl0 7y ago
    In practice it is the case for IPFS too most of the time.
- icebraining 7y ago
  > it is unlikely for stuff to stay up reliably, as ironic as that is Well, it's kinda inevitable with these systems, since there's limited available space. Freenet lets you "insert" data into the network (copy to other nodes) and disconnect your computer, but if nobody requests that data, it'll also eventually disappear from every node.
- momack2 7y ago
  There's an annoying misconception that IPFS is "free storage" - it's not. If you care about something sticking around on the network, you need to take action to ensure that happens: either as an individual pinning it to a persistent node you run, as a developer paying a distributed pinning service to host your dapp data, or as a community creating a social agreement to all peer their nodes to replicate each other's data. All these solutions are doable today, but you shouldn't expect others to host your content for free (if it isn't popular enough for other people to be proactively caching it). IPFS is the distributed network for addressing files, you have to bring, buy, or share your own storage - anything else (ex forced hosting of content you don't choose) would have problematic liabilities!
jmeyer2k 7y ago
I've worked with IPFS and I completely agree with you here. There are so many basic bugs that haven't been fixed because of the over abstraction of LibP2P. Currently, it connects to bootstrap nodes and tries to discover peers asynchronously. Obviously, it doesn't handshake with the bootstrap nodes in time for it to start discovering peers so it waits another 1-5 minutes depending on the setting to try discovering again. Startup usually takes a few minutes due to this trivial problem and an issue has been open for it since May: https://github.com/ipfs/go-ipfs/issues/5953 https://github.com/ipfs/go-ipfs/issues/5953
- momack2 7y ago
  IPFS person here - there are a ton of improvements to the libp2p DHT in the works (many which also relate to bootstrapping efficiency), but a key component of shipping these to an active 100K+ node network like IPFS is testing and validation, so it's taking us longer to ship these improvements while we build a testground able to simulate network conditions to increase network _reliability_ as well as performance. IPFS is still actively WIP and directly focused on improving performance, reliability, and usability - so feedback and collaborators welcome to help us address these issues head-on. =]
  - rosybox 7y ago
    I like where IPFS is going and I think it's an important bit of software, so it's good to hear you're working on it. I do have a question though on the immutability, how do you address problems where people contribute harmful content, such as revenge porn pictures, or doxing someone? If the content is immutable, it means these things would always exist and never be removable? Is there any moderation that can stop this kind of stuff? Just wondering, I still like the idea, it's just a question I have been thinking about.
    - pault 7y ago
      Unfortunately if you want an uncensorable network you won't be able to censor the nasty stuff either.
    - 7y ago
dooglius 7y ago
IPFS has built-in denylists so it isn't very uncensorable.
- momack2 7y ago
  Not sure where you got that info, but AFAIK that is incorrect. While everyone running their own infra has the responsibility to comply with local laws (or face local consequences) - there is no central network allow/denylist. Every single node has the power to decide what content they pin and make accessible to other nodes in the network, or how to consume content coming from other nodes (ex they might choose to filter out certain types of content). There is no central ipfs authority involved in any of that. If an individual node wanted to opt-in to a collaborative denylist (ex to block spam, etc), this is the most recent proposal for how that might work: https://github.com/ianjdarrow/content-decider https://github.com/ianjdarrow/content-decider (still in design phase)
  - dooglius 7y ago
    https://github.com/ipfs/faq/issues/36#issuecomment-140567411 https://github.com/ipfs/faq/issues/36#issuecomment-140567411 My understanding is that it is not possible for Tor nodes to block (or even know about) what you are accessing.
    - deleted 7y ago
      [deleted]
    - schoen 7y ago
      A Tor exit node can block destinations openly by declaring limitations in its exit policy (in principle by IP address or port, although I don't know if any exit policies use IP address this way) or by simply firewalling connections from itself to particular destinations. In the latter case, the node may be marked as a BadExit if a scanner detects that it intentionally blocked a connection that it offered to relay. A node in an earlier position in a circuit can't know the ultimate destination of the circuit, or the content exchanged over it, although it could in theory blacklist individual nodes as a next hop (which doesn't typically really accomplish anything for content-blocking purposes, and could also be detected if it were a pervasive practice). I think in HSv2 (the old hidden services protocol) there were a number of different opportunities for relays to selectively disrupt hidden service connections, while in HSv3 (the new revision) there are fewer. A difference between Tor and IPFS in regard to what you're mentioning above is that in Tor, a specific entity (a specific clearnet or hidden service site operator) has to continue actively hosting a resource in order for it to remain accessible at its original location, while in IPFS, it's more like that there need to be some participants who haven't actively declined to host it, but they don't have to be the same as the original publisher.
JoshuaMulliken 7y ago
Unfortunately, I think projects like this that make it easy to create onion resources are quite dangerous. The reduction of friction to host material online in a completely anonymous way only enables adverse actions like the sharing of CP or other illegal content. Please look here for a good explaination of friction in this space -> https://stratechery.com/2019/child-sexual-abuse-material-online-the-problem-with-community-towards-more-friction/ https://stratechery.com/2019/child-sexual-abuse-material-onl... If it is used by political or marginalized communities, then this project is also not useful. It does not have the support or attention required to enable it to be secure enough like the TOR project does. This application opens up legitimate users to incredible risk. If I were a dissident, I would take my time and do the research required to set up a system like this in the correct way. This project may give people a sense of false security.
- DuskStar 7y ago
  Ah, yes. The good old "don't make that tool because bad people might use it" argument. Similarly, we should ban sharing information on hacking/security because bad people might use it, and require that all communications be visible to the government to prevent abuse.
  - JoshuaMulliken 7y ago
    That is not the argument being made. It is an argument that having friction in the process to do something that may have dangerous outcomes is sometimes positive. It is much the same as arguments that there should be gun training required to purchase a firearm. Adding friction to a process sometimes provides positive benefits.
    - DuskStar 7y ago
      > That is not the argument being made. It is an argument that having friction in the process to do something that may have dangerous outcomes is sometimes positive. The argument being made, as far as I can tell, is that this tool will make doing bad things easier, and thus this tool should not be made. As any tool to resist censorship will also enable said bad things, I do not find this to be a valid concern. (And since some governments would list censorship resistance itself as one of those bad things, this is always going to be true) > It is much the same as arguments that there should be gun training required to purchase a firearm. I think the tech equivalent to this would be mandating a "don't sexually exploit children" class before allowing purchase of a computer. (As you might guess, I'm not a fan) > Adding friction to a process sometimes provides positive benefits. Sure, but you have to make sure the collateral damage is minimized AND that you're actually catching the offending segment of the population. Mandating gun training before purchase is actually a great comparison here - the vast majority of gun crime in the US is committed with illegally acquired weapons (which would be unaffected by the mandate), just like I imagine that the majority of CSE imagery shared on the internet uses something more robust than OnionShare. So in both cases you'd have high collateral damage with minimal impact to the population you actually care about affecting...
Erlich_Bachman 7y ago
Does IPFS even try to provide anonymity? Even if it would be technically "censorship-resistant", what good is it when everyone can see who hosts the content, track them down, and subpoena/arrest them?
- derefr 7y ago
  No, anonymity isn't a goal of IPFS. If you add anonymity (for both consumers and publishers) to IPFS, you get the design of its older sibling: FreeNet.

ddtaylor 7y ago

It's good to see Tor becoming more easily accessible to non-technical people.

DigitalVerse 7y ago

Nice! I feel like this project is mirroring the development of the internet itself. :D

dang 7y ago

Url changed from https://blog.torproject.org/new-version-onionshare-makes-it-easy-anyone-publish-anonymous-uncensorable-websites-0 https://blog.torproject.org/new-version-onionshare-makes-it-..., which points to this.

kodablah 7y ago

Shameless plug (that I haven't had much time to work on lately), you can also programmatically do similar in a few lines of Go: https://github.com/cretz/bine https://github.com/cretz/bine

tunnuz 7y ago

Amazing!

Gys 7y ago

Next thing we need is a search engine specifically for those websites, hosted in the same way. Reinventing the internet all over again!

icebraining 7y ago
There are a few already :) https://www.reddit.com/r/onions/ https://www.reddit.com/r/onions/ has some .onion links on the sidebar to search engines. They aren't decentralized, though; some people are running YaCy (a decentralized search engine) over Tor to create a decentralized index of onion sites: http://wiki.yacy.net/index.php/En:YaCy-Tor http://wiki.yacy.net/index.php/En:YaCy-Tor
deleted 7y ago
[deleted]

wpietri 7y ago

It would be nice to at least see some hazy consideration of the impact of this. I know a probation officer for sex offenders and she tells me trying to keep up with their technology use is a nightmare. I can only imagine how this complicates her job. That's not saying that on balance this shouldn't exist. There are of course good uses of technology like this. But I'd at least like to see builders grappling with that balance. Especially given recent prominent reporting around this: https://www.nytimes.com/interactive/2019/09/28/us/child-sex-abuse.html https://www.nytimes.com/interactive/2019/09/28/us/child-sex-...

faissaloo 7y ago
Fredrick Brennan calls this the "Pedo Problem", whenever you create a free space for people, pedophiles will flock to it.
commandlinefan 7y ago
Got to be honest, that was my first thought - if anybody actually comes up with something that's actually anonymous and actually uncensorable, it will be shut down, by whatever means necessary, by the government with the full blessing and support of the public.
- fishtacos 7y ago
  The Tor network hasn't been shut down, has it? Dark sites of all types still continue to run uninhibited for the most part. From my readings, the major or at least known/researched security holes have been plugged already by the developers, and the rest of convictions have happened because of user error, not the technology involved. If memory serves me correctly, one particular pedophile abuser was caught after years of being investigated because he was identified through skin marks (I want to say it was freckles on his hand, though I don't recall the exact details of the article) that led investigators to him, not anything technological. I'm a proponent of total anonymity online because it allows for whistleblowers to leak information that is untraceable to them (again, without consideration of human error). In the case of Wikileaks, for example, even though they weren't on an anonymous network, it still led to the largest classified information leaks known, from NSA tools to national and international communications between heads of states, diplomats and everyone in between. The general consensus was that it was a good thing. I don't necessarily agree with that, but one can't discount its value.

companyhen 7y ago

Sounds like http://arweave.org http://arweave.org

penguinpalace 7y ago
Definitely. OnionShare requires your own computer to be connected to the interwebs - the data is only accessible while your OnionShare app is running. With Arweave the hosting is taken care of (the data/website/etc is hosted on the Weave). Plus, OnionShare sites are not verifiable/ reliable as they are a website running on someone's computer. An Arweave site is timestamped and unforgeable; it's also resilient (replicated on many nodes) and permanently stored.

lcfcjs2 7y ago

Republicans rejoice!

peterashford 7y ago

I've been in tech my whole life. I really enjoy technology, I'm pleased with the career I chose. But man am I tired of technologists "moving fast and breaking things" without any concern whether those things being broken might be better left whole. Just because you can smash social norms, doesn't mean you should.

luckylion 7y ago
The social norm that is "privacy is bad"?
- yters 7y ago
  Sometimes it is.
- peterashford 7y ago
  Privacy for pedophiles is bad. Privacy for terrorists is bad. Privacy for illegal acts is often bad (this is entirely the point of whistle-blower legislation, after all)
  - luckylion 7y ago
    Sure, sure, my basic assumption is that you can't have privacy for certain acts only. If the idea is that somebody watches and completely ignores all legal behavior but steps in when they witness illegal behavior, that's not privacy, it's something else. Privacy means that nobody watches, so if you want to build tools for privacy, you'll always end up also enabling people to use them for illegal things. We (as Western societies) have mostly decided that general privacy is so valuable to citizens that we accept the collateral damage of crime being possible. I've not heard a lot of arguments against privacy in general, the arguments tend to be "I don't need privacy in this particular part of life, so it better be removed".

sealthedeal 7y ago

So, I used to be on-board with these type of things, but now I dont understand what the true purpose of an uncensorable website? It just seem like a place for hate groups to unite and bad things to happen... I would love a different perspective on this :)

big_chungus 7y ago
Sure. Basically, it all comes down to whether or not you trust the government to be good, always. If you believe this is the case, you're fine. If you don't, you will probably prefer un-censorable technologies. America has (historically) tended to fall pretty far to the "free speech" side of the line, though there is a push to change that. Even if you trust the American government, people in repressive regimes can still make use of this. This could enable a western news outlet to make itself accessible to those who are brainwashed by state media. Trying to prevent "hate groups" from congregating or criminals from opening marketplaces doesn't usually work, either. It's the prohibition principle: if you ban the tech, criminals will use it, but an American NGO won't be able to reach those with censored internet. You may not use it, but I don't see why your "being on board with it" ought to affect what others create.
- kevin_thibedeau 7y ago
  Even if you have "free speech" you could still end up on some form of subversive persons list. We're not far from McCarthy 2.0.
- filoleg 7y ago
  >Even if you trust the American government, people in repressive regimes can still make use of this. I think an important point to make is that just because you trust the American government now, doesn't mean that this won't change in the future. Which is why the core tenets of free speech and privacy should be protected at all costs.
DennisP 7y ago
It's easy to feel that way in, say, the U.S., where only hate groups are getting censored right now, and even that only by private companies. If you think about a country like China, where for example it's hard to find anything online saying a massacre at Tiananmen Square ever happened, then the purpose of these things becomes more obvious. The time to set up uncensorable communications is before you're being censored. After, it's a lot harder to get traction.

jstrieb 7y ago

Very cool! I created urlpages [0] as a proof-of-concept with a similar goal. It is always interesting to read about how others try to solve the same problem. [0]: https://github.com/jstrieb/urlpages https://github.com/jstrieb/urlpages

hnuser54 7y ago

I love Tor, but it's almost suspicious how fast it's become, like I'm wondering who's paying for all this bandwidth. Home, businesses, hotels, you name it, Tor Browser almost never takes more than 2x as long to load anything on the web as the raw connection does. I admit don't have an understanding of how Tor works mathematically. There are organizations funding Tor exits and relays (torservers.net, Emerald Onion, Tor Project itself) but has anyone added up the bandwidth they provide and compared it to the total?

arthurcolle 7y ago
Don't all those crazy FBI/CMU/(NSA..?) correlation attacks require you to control some majority percentage of the relays and/or exit nodes? It would definitely be interesting to actually come up with some estimates of how much was being spent in aggregate bandwidth costs, say, 7 years ago, and compare it with what is being spent at present, and see if it matches what would be expected with 'normal user growth' although normal user growth for a relatively niche project like this would be pretty hard to quantify.
- throwaway66920 7y ago
  I wonder if there aren’t multiple us agencies competing for a majority share Unbeknownst to each other, all of them limiting the abilities of the others, all of them making it a better platform for those wishing to remain anonymous
  - heavyset_go 7y ago
    They're most likely working together.
    - arthurcolle 7y ago
      In modern times I bet you are right but historically information-sharing wasn't common across the IC (based on my understanding of post-9/11 reality)
  - 7y ago

blacksmith_tb 7y ago

It's very elegant implementation, I wonder though if it's accurate to call it "uncensorable" when there's a single point of failure? Given that searching or seizing the machine hosting the site is still possible (even if that's just by coincidence)? Obviously for the side of the aisle here who are thinking of criminal uses, that's a feature not a bug, but for a dissident who is disappeared that looks different...

angel_j 7y ago

If only it was this easy to publish a website from your home computer to the web regular.

rohan1024 7y ago
Yeah a small Raspberry Pi hosting the website at home is my dream
- angel_j 7y ago
  The book I am reading, main character is named Rohan. #synchronicity
  - rohan1024 7y ago
    What book are you reading?
    - angel_j 7y ago
      It was "The Invincible" by Stanislaw Lem

birracerveza 7y ago

To everyone saying "but this will be used for child porn!"... guess what else is used for that? The internet. Should we just ban the internet as a whole? I understand the sentiment, but I hard disagree with it. Especially because this tool (and similar to it) can be used for good, and might be necessary in the future. Try to see the glass half-full.

yters 7y ago
But what is the need for Tor outside of illegal activity?
- johnnyRose 7y ago
  Plenty of reasons. The most obvious use that comes to mind is to avert government censorship. Then there are whistleblowers. There are more reasons to desire anonymity than illegal activity. Edit: also, ISPs can sell your browsing information now: https://www.usatoday.com/story/tech/news/2017/04/04/isps-can-now-collect-and-sell-your-data-what-know-internet-privacy/100015356/ https://www.usatoday.com/story/tech/news/2017/04/04/isps-can...
  - yters 7y ago
    Don't those governments just block Tor?
    - KnMn 7y ago
      You can use the Tor network through bridge nodes and in fact the Tor Browser Bundle will ask you if you need to connect this way on first run.
- thecrash 7y ago
  The more illuminating question is "what is the need for anonymity outside of illegal activity"? One answer is that you might someday like to say something which some other party would have a problem with. We might say that if you truly believe in what you're saying, the principled course would be to say your piece and let the other party be upset. But if the other party has a lot of power (for example a parent, an employer, a university, a government official, etc) they can threaten retribution for your words. If the threat is serious enough, you will likely decide not to speak. The ability to say things anonymously removes the threat of retribution. It helps people speak who otherwise wouldn't, increasing the range of perspectives and information the rest of us have access to. This doesn't mean that it's beneficial in every single case, but on balance it's a social good - in fact, it's a necessary component of a free society.