10 ms·

An insightful nugget at the very end, for anyone missing it: >In a response [another copyright advocate caught 'stealing'] issued a press release stating that

An insightful nugget at the very end, for anyone missing it: >In a response [another copyright advocate caught 'stealing'] issued a press release stating that their IP-addresses were spoofed. A very unlikely scenario, but one that will be welcomed by BitTorrent pirates worldwide. In fact, we encourage Sony, Universal and Fox to say something similar. After all, if it’s so easy to spoof an IP-address, then accused file-sharers can use this same defense against copyright holders. Could such a defense be expected to work ? Has it ever ?

Jach 15y ago
It's not exactly a knockdown argument by itself, but it just adds a little more to the pool of thought saying an IP address doesn't correspond to an individual. That viewpoint seems to be gaining more and more momentum, e.g. somewhat recently: http://torrentfreak.com/ip-address-not-a-person-bittorrent-case-judge-says-110503/ http://torrentfreak.com/ip-address-not-a-person-bittorrent-c...
- MichaelGG 15y ago
  I thought that BitTorrent used TCP? If so, spoofing a connection requires being in a position where you can intercept the return packet in order to be able to complete the TCP handshake. Possible, but requires a spoofer to be very well connected.
  - Jach 15y ago
    I don't think they mean spoof in such a technical way. I think they just mean it as "the You Have Downloaded website could be just generating files to go with IPs", and similarly "any torrent logs may have been spoofed/made up." Obviously the next step for the You Have Downloaded site is to track in real-time and say "This IP is currently downloading x,y,z."
  - skymt 15y ago
    You don't need to spoof a TCP connection to register a spoofed IP address on a tracker. The tracker GET request has an optional `ip` field, the contents of which is registered as the client's address, regardless of the source address of the actual request. So it's trivial to write a Bittorrent client that reports a false address to the tracker. http://bittorrent.org/beps/bep_0003.html http://bittorrent.org/beps/bep_0003.html
    - ay 15y ago
      So does this optional parameter fully override the peer's address in the reporting ?
      - skymt 15y ago
        Probably. When the tracker responds with a list of peers, each peer only has an id, an ip & a port; there's no real_ip or reported_ip parameters. Of course there could be tracker software in the wild that ignores the ip parameter entirely; it's just a spec, not a contract.
        ay 15y ago
        Thanks for the clarification. This makes it entirely possible to spoof someone's address then by a third party.
    - MichaelGG 15y ago
      Wow, that's very interesting. Thanks!
- ay 15y ago
  If you do layer 4 network address translation (NAT) - then a single IPv4 address can theoretically be used by circa 64000 people at the same time; depending on how multiplexing is done, by maybe even more. The large-scale translators on the headends are the reality for quite a few service providers already. So, the "IP address does not correspond to an individual" is not just a mere viewpoint gaining momentum, but an emerging hard technical fact. ;-)
  - Jach 15y ago
    Tinfoil hat Just wait, once the US government at large finally understands IPv4 networking, someone with too much power will look at IPv6 and the phrase "Look we don't have to do NAT anymore!" Then the government will assign a unique IPv6 address or two to every citizen to use as ID (they'll need a replacement anyway once they get rid of social security). Then they mandate the ISPs to track IPs, and they make it illegal to share or mask IP/IDs since that's something only pirates and thieves and other bad people do anyway. And we'll look back and say "Remember The Right to Read? rms was right again!"
    - kiloaper 15y ago
      Unique internet IDs are far from a conspiracy theory. They're being actively developed in China and South Korea to name a few. While the South Korean one has faced setbacks it's only a matter of time before they become common place in other countries in my opinion.
    - ay 15y ago
      If governments were to do that, they would also be forced to solve the problem of the routing table explosion. Which is a hard problem. As for unique ID - it's already doable and being done without any IPv6. Read up on evercookie. There was an article on HN a while ago about a bunch of advertisers doing just that. This is worse than the government having it - not only it gets abused, but someone gets rich on this.
  - tedunangst 15y ago
    There are 16 million IPs in 10.x.x.x.
jrockway 15y ago
It depends on the TCP stacks on each side; some crappy TCP stacks let you forge connections rather easily. I don't think Bittorrent works over UDP, but if it does, that's very easy to forge in theory (assuming your ISP doesn't do egress filtering). The best excuse is probably, "I installed some malware and I guess it turned my box into a torrent gateway".
- VMG 15y ago
  The best excuse is probably, "I installed some malware and I guess it turned my box into a torrent gateway". Unless the law says that you are responsible for everything that happens on your internet connection. I don't know if or where this is the case, but it seems realistic and even reasonable.
  - babebridou 15y ago
    It is the case in France. You could see it the same way as a car insurance, you're responsible for any damage it does, except your car can be safely locked in your garage when someone else wrecks it into a porcelain store, and you can't possibly prevent it from happening nor prove that it wasn't yours.
  - darksaga 15y ago
    Which would be easy to dump off on the provider. "I have a firewall and anti-virus, what more can I be responsible for if my provider isn't securing THEIR network?" Ignorance of the law isn't a plausible defense in the eyes of the law, but you when you have so many parties besides yourself involved, I would think it would be easier to claim it was something on their end.
  - jrockway 15y ago
    In the US, you aren't responsible for crimes you didn't commit. That means if someone uses your computer to commit a crime, and you didn't intend to help them, you didn't do anything wrong.
    - tbrownaw 15y ago
yread 15y ago
I might have worked at one of the mentioned companies and employees were running their own servers with torrents in company's racks. Not to mention that couple of the boxes were parts of botnets and spam farms.

Jach 15y ago

It's not exactly a knockdown argument by itself, but it just adds a little more to the pool of thought saying an IP address doesn't correspond to an individual. That viewpoint seems to be gaining more and more momentum, e.g. somewhat recently: http://torrentfreak.com/ip-address-not-a-person-bittorrent-case-judge-says-110503/ http://torrentfreak.com/ip-address-not-a-person-bittorrent-c...

MichaelGG 15y ago
I thought that BitTorrent used TCP? If so, spoofing a connection requires being in a position where you can intercept the return packet in order to be able to complete the TCP handshake. Possible, but requires a spoofer to be very well connected.
- Jach 15y ago
  I don't think they mean spoof in such a technical way. I think they just mean it as "the You Have Downloaded website could be just generating files to go with IPs", and similarly "any torrent logs may have been spoofed/made up." Obviously the next step for the You Have Downloaded site is to track in real-time and say "This IP is currently downloading x,y,z."
- skymt 15y ago
  You don't need to spoof a TCP connection to register a spoofed IP address on a tracker. The tracker GET request has an optional `ip` field, the contents of which is registered as the client's address, regardless of the source address of the actual request. So it's trivial to write a Bittorrent client that reports a false address to the tracker. http://bittorrent.org/beps/bep_0003.html http://bittorrent.org/beps/bep_0003.html
  - ay 15y ago
    So does this optional parameter fully override the peer's address in the reporting ?
    - skymt 15y ago
      Probably. When the tracker responds with a list of peers, each peer only has an id, an ip & a port; there's no real_ip or reported_ip parameters. Of course there could be tracker software in the wild that ignores the ip parameter entirely; it's just a spec, not a contract.
      - ay 15y ago
        Thanks for the clarification. This makes it entirely possible to spoof someone's address then by a third party.
  - MichaelGG 15y ago
    Wow, that's very interesting. Thanks!
ay 15y ago
If you do layer 4 network address translation (NAT) - then a single IPv4 address can theoretically be used by circa 64000 people at the same time; depending on how multiplexing is done, by maybe even more. The large-scale translators on the headends are the reality for quite a few service providers already. So, the "IP address does not correspond to an individual" is not just a mere viewpoint gaining momentum, but an emerging hard technical fact. ;-)
- Jach 15y ago
  Tinfoil hat Just wait, once the US government at large finally understands IPv4 networking, someone with too much power will look at IPv6 and the phrase "Look we don't have to do NAT anymore!" Then the government will assign a unique IPv6 address or two to every citizen to use as ID (they'll need a replacement anyway once they get rid of social security). Then they mandate the ISPs to track IPs, and they make it illegal to share or mask IP/IDs since that's something only pirates and thieves and other bad people do anyway. And we'll look back and say "Remember The Right to Read? rms was right again!"
  - kiloaper 15y ago
    Unique internet IDs are far from a conspiracy theory. They're being actively developed in China and South Korea to name a few. While the South Korean one has faced setbacks it's only a matter of time before they become common place in other countries in my opinion.
  - ay 15y ago
    If governments were to do that, they would also be forced to solve the problem of the routing table explosion. Which is a hard problem. As for unique ID - it's already doable and being done without any IPv6. Read up on evercookie. There was an article on HN a while ago about a bunch of advertisers doing just that. This is worse than the government having it - not only it gets abused, but someone gets rich on this.
- tedunangst 15y ago
  There are 16 million IPs in 10.x.x.x.

jrockway 15y ago

It depends on the TCP stacks on each side; some crappy TCP stacks let you forge connections rather easily. I don't think Bittorrent works over UDP, but if it does, that's very easy to forge in theory (assuming your ISP doesn't do egress filtering). The best excuse is probably, "I installed some malware and I guess it turned my box into a torrent gateway".

VMG 15y ago
The best excuse is probably, "I installed some malware and I guess it turned my box into a torrent gateway". Unless the law says that you are responsible for everything that happens on your internet connection. I don't know if or where this is the case, but it seems realistic and even reasonable.
- babebridou 15y ago
  It is the case in France. You could see it the same way as a car insurance, you're responsible for any damage it does, except your car can be safely locked in your garage when someone else wrecks it into a porcelain store, and you can't possibly prevent it from happening nor prove that it wasn't yours.
- darksaga 15y ago
  Which would be easy to dump off on the provider. "I have a firewall and anti-virus, what more can I be responsible for if my provider isn't securing THEIR network?" Ignorance of the law isn't a plausible defense in the eyes of the law, but you when you have so many parties besides yourself involved, I would think it would be easier to claim it was something on their end.
- jrockway 15y ago
  In the US, you aren't responsible for crimes you didn't commit. That means if someone uses your computer to commit a crime, and you didn't intend to help them, you didn't do anything wrong.
  - tbrownaw 15y ago

yread 15y ago

I might have worked at one of the mentioned companies and employees were running their own servers with torrents in company's racks. Not to mention that couple of the boxes were parts of botnets and spam farms.