16 ms·
Republishing a fork of the sanctioned Tornado Cash repositories
- pimlottc 4y agoA small title revision suggestion (hyphens are your friends): > A republished fork of the banned-on-sanction-order Tornado Cash repositories
- jessaustin 4y agoCould also be "...banned (on sanction order)..." Or probably a better link would be to "Tornado-Repositories: an archival fork of the Tornado Cash source code" [0]. [0] https://github.com/tornado-repositories https://github.com/tornado-repositories
- Andrew_nenakhov 4y agoThanks, edited. In fact, I struggled a bit to fit in the original text from the tweet - the character limit is rather harsh.
- dang 4y agoI've edited it to something that I think is more readable. If anyone has a better suggestion we can change it again.
- CharlesW 4y agoThe repo/code was not sanctioned or banned by the U.S. Department of the Treasury. The Tornado Cash mixer was sanctioned or banned by the U.S. Department of the Treasury (the Office of Foreign Assets Control). Those are different things. The GitHub account of Tornado Cash developer Roman Semenov was suspended by GitHub.
- absolutelynobo 4y agoAnd developer Alex Pertsev has been arrested in the Netherlands for his open-source contributions to the project.
- CharlesW 4y agoHe was apparently arrested for actual criminal activity related to the mixer, and not for code contributions. Jeffrey Blockinger, general counsel at Quadrata, says most developers don’t need to be concerned about an arrest. “While privacy concerns are legitimate, this arrest is reportedly focused on evidence of actual criminal activity,” he told Protocol. https://www.protocol.com/newsletters/protocol-fintech/tornado-cash-alexey-pertsev https://www.protocol.com/newsletters/protocol-fintech/tornad...
- notch656a 4y agoWhat's stopping the government from blocking this in the same way some "open-source" firearm designs can't be exported under ITAR?
- toolz 4y agomaybe a more pragmatic question: what's stopping people from ignoring the governments restrictions on digital resource blocks? The government doesn't have the means to enforce blocking firearm designs or decentralized cryptocurrencies. In my opinion an unenforceable law is detrimental and erodes the credibility of the authorities that impose such restrictions.
- A4ET8a8uTh0 4y agoThis is where it gets fun. OFAC is very much enforceable and, more importantly, it is entrenched and practiced in many parts of US institutions including various gatekeepers like banks. Now whether it is an overreach is an interesting discussion, but do not for one second think that it cannot be enforced. Right now it is just a choice that just this particular service was targeted. And note how most reasonable people would hesitate to just click a link to that code.. when it is not even the sanctioned TC. The chilling effect alone makes it enforceable.
- toolz 4y agoYou can't enforce a crime when you don't know the criminal. It's trivial to keep your identity separated from various digital assets.
- A4ET8a8uTh0 4y agoIs it? I do not want to sound condescending, but extraordinary claims like these require extraordinary proof. Actual security is hard and even that only needs one slip. That said, I am always eager to learn. Would you be willing to share trivial steps that keep your identity separated?
- rvz 4y agoWhat is the point of republishing it on Github? They (GitHub / Microsoft) will just remove it and ban it again after announcing it. A better way instead, would be to do what all other projects like GNOME, KDE, Tor, wireguard, etc have done before and that is to just self-host the repositories instead.
- oceanstone 4y agoHopefully the government can identify any forks that achieve meaningful TVL and taint the coins
- ipaddr 4y agoWhat would that for you? Why the hope?
- encryptluks2 4y ago
- oceanstone 4y agoI'm hoping the government makes money laundering harder. North Korea laundered a billion dollars through Tornado: https://markets.businessinsider.com/news/currencies/north-korea-launder-treasury-ethereum-us-billion-sanctions-tornado-cash-2022-8 https://markets.businessinsider.com/news/currencies/north-ko...
- A4ET8a8uTh0 4y agoIt may sound a little odd, but you do not think existing AML regime is already working in overdrive mode punishing regular people ( all while actual big fish manage to get away undetected or, worse, protected )?
- EddySchauHai 4y agoThat's almost 0.3% of the money estimated to be laundered in the US through traditional means, and 0.05% of the estimated money laundered globally.
- oceanstone 4y agoTornado needs TVL to effectively launder money for criminals. Forks without much TVL don't seem that dangerous
- amluto 4y agoA piece of code on GitHub has zero TVL. It's just a bunch of files. (I would assume the treasury department only gets involved when there is actual money involved. Sending money to a contract on the blockchain is finance. Just posting the code somewhere is speech.)
- oceanstone 4y agoObviously, the threat is deployed forks with high TVL
- chrisco255 4y agoIs it? Given that the original code still exists on mainnet and cannot be taken down. I suppose the main use case of a high TVL fork would be for Americans who wanted to legally regain their privacy without risking a sanctioned contract interaction. Anyone who doesn't care can still use the original.
- notch656a 4y agoI mean couldn't I also argue TVL is speech like source code? Or does code have to be without value to be protected?
- Retr0id 4y agoTVL is not a property of the source code.
- deleted 4y ago[deleted]
- charcircuit 4y agoThis is a fork of the code. It's not a new deployment.
- btown 4y agoSay what you will about the project and the space in general - the idea that any code licensed to you under an open source license can cause your derivative work to be subject to sanctions that were intended for the code’s original authors… would have a chilling effect on innovation.
- darig 4y ago[dead]
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- jacooper 4y agoMore details here: https://www.eff.org/deeplinks/2022/08/code-speech-and-tornado-cash-mixer https://www.eff.org/deeplinks/2022/08/code-speech-and-tornad... > In keeping with our longstanding defense of the right to publish code, we are representing Professor Matthew Green, who teaches computer science at the Johns Hopkins Information Security Institute, including applied cryptography and anonymous cryptocurrencies. Part of his work involves studying and improving privacy-enhancing technologies, and teaching his students about mixers like Tornado Cash. The disappearance of Tornado Cash’s repository from GitHub created a gap in the available information on mixer technology, so Professor Green made a fork of the code, and posted the replica so it would be available for study. The First Amendment protects both GitHub’s right to host that code, and Professor Green’s right to publish (here republish) it on GitHub so he and others can use it for teaching, for further study, and for development of the technology.
- mmaunder 4y agoRepresenting how? What action are they anticipating?
- guipsp 4y agoWell, they expect OFAC-based legal action by the government, of course.
- mmaunder 4y agoGreen wouldn’t have standing for EFF to participate if USA goes after MS. So I’m curious what they’d go after Green for.
- mikeyouse 4y agoHe's the maintainer on the repository - so presumably that. (https://github.com/tornado-repositories https://github.com/tornado-repositories)
- altairprime 4y ago
- yieldcrv 4y agonice, hot code, clone and move on
- Temasik 4y ago
- k__ 4y agoShould have been uploaded to Radicle.
- asojfdowgh 4y agoDoes one really need to teach zero knowledge proofs in the context of money laundering?
- mhluongo 4y agoMoney laundering: the concealment of the origins of illegally obtained money, typically by means of transfers involving foreign banks or legitimate businesses. Tornado Cash isn't for laundering money, it's for breaking the chain of public transactions on block explorers. It doesn't make withdrawn fees look "legitimate". Tired of these goal posts getting moved.
- asojfdowgh 4y ago"breaking the chain of public transactions" sounds remarkably similar to "concealment of the origins of" for some reason.
- rattlesnakedave 4y agoI deposit 100 ETH to tornado, wait a while, and withdraw in 10 ETH increments. There is still no explanation for the origin of the funds. Money laundering is made up of placement, layering, and integration. Tornado did only one of these (kinda).
- saalweachter 4y agoNow imagine you use those anonymous 10ETH chunks to buy NFTs from yourself, or invest in your own ICO, etc etc etc.
- deleted 4y ago[deleted]
- marcell 4y agoIt's only money laundering if you are concealing the origins of money from an illegal activity. I can use Torando Cash to conceal the origins of my paycheck, for example to preserve my privacy when transacting with peers.
- narrator 4y agoThe censorship of the idea of Tornado cash thing reminds me of the old quote: "Ideas are more powerful than guns. We would not let our enemies have guns, why should we let them have ideas." - Joseph Stalin
- ajross 4y ago> The censorship of the idea of Tornado cash thing No one "censored" anything. The Department of the Treasury didn't sanction an "idea". GitHub took down an actively-maintained software project on their own servers that was in use in practice as a money laundering tool. Now, should the source code to that project be available from other, more trustworthy maintainers? Maybe. I tend to agree with the EFF here that this is something that needs to be allowed. But the idea that this is some kind of oppression of innocent open source hackers is... really not what's happening. And pretending otherwise seems unserious to me.
- alasdair_ 4y ago>that was in use in practice as a money laundering tool. Visa, Mastercard, Western Union, Paypal and plenty of others are also "in use in practice as a money laundering tool" and yet for some reason they are not shut down.
- nl 4y agoIt's actually pretty rare for these to be used as money laundering tools.
- from 4y agoWestern Union has actually paid some substantial settlements to the government regarding AML and sanctions violations. Liability for AML stuff mostly falls on card issuers and is largely related to large cash sales of prepaid cards so Visa and Mastercard aren't really on the hook for that. If you followed the El Chapo trial you may remember the stories about prepaid cards: https://www.reuters.com/article/bc-finreg-money-laundering-idUSKCN1QN218 https://www.reuters.com/article/bc-finreg-money-laundering-i....
- helsinki 4y ago
- bumblebritches5 4y ago[dead]
- dimensionc132 4y agoAgain on Github???? Why not be smart, and host the repo on Codeberg, away from the US of A
- dekhn 4y agothe point is to force the US government to not take down repos that have legitimate educational use. He already said that if github takes it down, he'll host it on a university server.
- mat0 4y agoHonest question, why does it have “legitimate educational use”? For me that’s not a given. You could teach how to build a bomb or how to cook meth. I’m sure there are a lot of students who would benefit from that kind of knowledge and would use it for good. I’m also sure that we would have a bunch of Walter White wanna bes. How is this different?
- braingenious 4y ago> You could teach how to build a bomb or how to cook meth… Professionals legally create explosives (military, demolition, mining etc) and literally “cook” meth (the brand name for legal prescription methamphetamine is Desoxyn in the US). These necessary and legitimate jobs require educated individuals.
- dekhn 4y agoI'm sure somebody asked how the model train railroad club at MIT was for legitimate educational use, but it helped lead to modern computing. We want to have a bunch of americans who understand crypto- the underlying technology- as a long-term competitive edge. Generally we trust the people who go down these paths to be fairly responsible, and MIT as well as JHU are examples of long-term responsible exploration of things that may not seem to be legitimate educational use in the short-term.
- dimensionc132 4y agosome dude, protesting by using Github isn't going to force the US Gov to do anything other than to exert their power and crush
- cammikebrown 4y agoIs the government gonna shut down Monero? Is that even possible?
- EGreg 4y agoCan the US government say stuff like "anyone found transacting with <insert cryptocurrency network here> will face prison time / fines"? How about "Anyone using https will face prison time" OFAC may be overstepping its mandates.
- hbbio 4y agoInitially, the US wanted something quite equivalent to banning https (forbidding its export, i.e. not available on Internet). Https was only made possible thanks to the legal battle fought by Phil Zimmermann. https://www.theregister.com/2021/06/08/pgp_at_30/ https://www.theregister.com/2021/06/08/pgp_at_30/
- deleted 4y ago[deleted]
- brian-armstrong 4y agoWhy would it need to? If Monero transactions can't meet AML/KYC compliance (they can't), then exchanges in the US can't serve as an offramp for Monero/USD transactions. Isn't that sufficient?
- paddlepop 4y agoPerson that has worked on the defensive side of Money Laundering here. The Tornado Cash sanction has been fascinating to watch and my key takeaway has been that there are two camps: that TC is a Money Laundering service or a Privacy service. Both are talking past each other, when it can in fact be both. Each camp see the service as their primary concern and consider the other camp as an unintended secondary. I am seeing a lot of bad takes. "Money laundering requires all three aspects" particularly irks me because you can just point to KYC regulations to disprove that. "Code is just code" is another, but that is just because the code isn't why someone would be sanctioned or arrested. In the same way that The Pirate Bay was just code, its is how complicit they were in the offence that will get them. Ultimately, the dichotomy feels like a problem unique to public blockchains, and will only be solved with a ZK L1 chain, whatever that looks like. The solution would require the blockchain equivalent of end-to-end encryption, one where intermediaries have zero knowledge but doesn't require co-mingling of dirty and clean money. While I think money laundering is a more serious crime than piracy (at least the predicate offenses can be). Watch this play out like Megaupload, never ending legal issues for the first parties, and a technical solution like Mega.
- JumpCrisscross 4y ago> solution would require the blockchain equivalent of end-to-end encryption, one where intermediaries have zero knowledge but doesn't require co-mingling of dirty and clean money How would you draft a statutory safe harbor for GitHubs and Coinbases when it comes to handling mixers as well as the wallets connected to them?
- paddlepop 4y agoAs someone else has stated elsewhere in this discussion, I don't think GitHub have much to worry about. Tornado Cash the service was sanctioned, and MS would choose to censor the repo out of an abundance of caution. In the same way that the pair that open-sourced the ransomware PoC didn't get arrested because they are further away from the offenses. I have mixed thoughts on safe harbor for centralised exchanges, they are the closest thing we have to banks in cryptoland. Mostly because with grey areas like that, a prosecution is only going to be pursued with clear evidence they knew but did nothing.
- alfiedotwtf 4y agoI'm not American, nor a lawyer, but this seems like a cut and dry First Amendment issue. Glad Matt is going to put up the fight.
- deleted 4y ago[deleted]
- paulpauper 4y agoThe far bigger threat is not the code going away but it being censored at the network level. Already, a single miner has censored tornado transactions, that being EtherMine, which has 28% of hashpower. If the next two biggest miners censor it too, assuming hashrates do not change, then all tornado funds will be frozen. Very bad situation for tornado users. POS may change this but no guarantee. People should be mad at EtherMine, not at the US govt.
- HappyTypist 4y agoNo, it won't. A single miner has chosen to *not include* TC transactions in their blocks, but they are not *censoring* TC transactions in the sense that they will validly build upon blocks built by others that feature TC transactions. As long as 1% of miners include TC transactions, even if 99% choose to not include, TC transactions will still be part of the blockchain, albeit not as timely. When miners start actively REFUSING to build on blocks that feature TC problems, that is an issue. For what it's worth, the ethereum development community is actively exploring features that make active censorship a network violation (with censored blocks not being accepted by the network), although this is an area of active research. Current proposals include PBS+crList.
- edf13 4y agoCan you point me at the relevant discussions for this (exploring features to prevent censorship). It’s an interesting area…
- throw101010 4y agoIt's also as simple as paying the appropriate fees for including this transaction... everyone has a price, even (especially) miners.
- jrm4 4y agoThis seems dumb, to keep relying on the Microsoft company when we got a whole internet and distributed filesystems etc. exactly for this sort of thing. Specifically, it seems dumb to continue the idea of "github is where all the code is."
- px43 4y agoThis is a collaboration between Matt and the EFF to make a point to Microsoft. The goal here isn't to ensure a safe place for Tornado development. There are plenty of options there. The hope is that Microsoft will maybe learn their lesson and quit fucking developers for stupid reasons.
- jrm4 4y agoFair, and I still think dumb. I guess I'm an old timer, but it really seems to me the much smarter thing to do is route around Github entirely (and encourage others to do the same) then to play little tricks inside their walled garden.
- Zamicol 4y agoMatthew Green did a recent podcast episode on Bankless: https://www.youtube.com/watch?v=WBddJ18rACU https://www.youtube.com/watch?v=WBddJ18rACU
- JaggerFoo 4y agoI deleted my TC repository clones, before the shit hit the fan, when I was studying TC's use of Zero-Knowledge Proofs. I'm glad they still exist, but if not there are other repos like Zcash. There are research papers that show that TC withdrawals can be linked to TC deposits with a good level of confidence. I'm sure a great deal of analysis was done by the US, which led to their actions, like it or not. There are knee-jerk reactions in the Crypto Community fearing that they will be next, and restricting access to their projects. No self-awareness of the truth about the "Decentralized" nature of their projects. Cheers
- null0pointer 4y agoInteresting, could you link some of those papers?
- JaggerFoo 4y agoAnalysis of Address Linkability in Tornado Cash on Ethereum: https://link.springer.com/chapter/10.1007/978-981-16-9229-1_3 https://link.springer.com/chapter/10.1007/978-981-16-9229-1_...
- null0pointer 4y agoThanks!
- phaust 4y ago
- landofredwater 4y agoI hope this sees court or at least a high authority, because then it has a chance of once again proving that code is speech. Maybe we need to print some books with the code inside a-la PGP (ISBN 0-262-24039-4)
- lottin 4y agoPublishing code is not the issue that regulators should be concerned about. Running the code is the issue. Regulators should treat cryptocurrency "miners" as money transmitters and make them comply with the existing regulations that apply to money transmitters. Despite the claims that cryptocurrencies are "peer-to-peer electronic money", that's not entirely accurate. A peer can't send cryptocurrency to another peer. They need an intermediary to do that, which is the so-called "miner". Therefore a "miner" is to all effects and purposes a money transmitter.
- px43 4y agoNo, not all nodes are miners. Nodes are peers. Even SPV nodes, which is what is used in mobile wallets etc. Money transmitters are also required to have custody of funds, which is never the case for nodes or miners. You know nothing about the legal side, nor the technical side of this issue, so should probably stay out of it, because now you're just spreading misinformation.
- lottin 4y agoWhen did I say that all nodes are miners? I said that miners are money transmitters.
- New_California 4y agoYou are incorrect. The miner does not intermediate transactions in any way, shape or form. Firstly, miners do not technically intermediate transactions. Transactions are fixed and sealed by the parties involved and can't be modified. Transferred funds are never in a possession of a miner, not even briefly. Miner can't take them, can't redirect them, can't change the amount, etc. Secondly, it's not a specific miner that confirms the transaction. It is the ever-growing group of miners. Transaction finality is ever only probabilistic. If you think picking by law the "first" miner then this is completely arbitrary and 1-block chain tips are routinely orphaned in all cryptocurrencies. Finally, many persons and businesses accept unconfirmed (not mined) transactions, for relatively low-risk goods and services. If you really want to regulate miners (which is making a crime running certain algorithms on your personal computer - a terrible idea), then at least please come up with a new name and new framework, because "money transmitter" or "financial intermediary" is simply incorrect.
- ipaddr 4y agoThe best outcome is github refuses to repost and this gets moved to a more open site. That site gains some attention and becomes hot for awhile and take some market share away.
- edf13 4y agoIt’ll need a thorough audit… his is a fork of a fork… it’s the perfect project for trying to obfuscate some hidden routines into!
- t_mann 4y agoshould be fairly easy to do - the original code is still on the Ethereum blockchain. just compile his code and see if the bytecode matches the original - even the slightest modification would make it fail the check. the only required knowledge are the compiler settings, but they're so few that you can brute-force them just to be sure that you're not falsely accusing him of having changed the code. (btw, I've deliberately outlined a protocol that doesn't rely on other third-party resources - if you're happy to rely eg on Etherscan you can do a simple diff against the original code)
- qikInNdOutReply 4y agoI dont know, if the freedom to circumvent the state and attack it at the cellular level is really worth defending. Oligarchs in the west had that ability since the 1960s and look what it got us. In this world going ever faster down the drain attacking something that compared to its peers seems fairly benevolent like a democratic state, looks ever more like a bunch of cocks, sitting on a manure heap, sounding the cry to battle, while the whole assembly drifts downstream in a flood.
- sneak 4y agoAs I understand it, the code was not sanctioned - the organisation that published it was. The code being published is not at issue.
- lizardactivist 4y ago
- qwerty456127 4y agoWhat sense do cryprocurrencies even make without mixing? As I understand mix-less crypto usage lets everyone know every purchase you make. Even if all you buy is an occasional pizza this information is easy for scammers and other malicious parties to misuse.
- ur-whale 4y agoFor folks won't don't have a twitter id: https://nitter.net/matthew_d_green/status/1561813046338748417 https://nitter.net/matthew_d_green/status/156181304633874841...
- anamax 4y agoIt would be a First Amendment issue if the US Govt told Github "you can't publish Tornado Cash source code." Green's claim is related. "Github is a private corporation and has no obligation to host anything." is not true when Github is acting as a US govt agent. Disclosure, if this gets past the motion to dismiss, will be interesting.
- dcow 4y agoThank you Matthew Green for dropping your usual pompous egotistical Twitter attitude for this one. Twitter thread is professional and concise. The message is clean and in my opinion incredibly important and interesting. Thank you for putting your stature to use and fighting for a good cause. ++respect.
- gumby 4y agoAnybody who clones a repo can serve it, so I don't understand comments like "I use it in a class I teach so I hope it stays up"
- LinkLink 4y agoA good takeaway from this whole thing will be that despite crypto largely being marketed as decentralized and uncensorable, in reality >50% of the validation power is in the hands of private equity and miners who will bend at the first sign of financial and legal risk.