5 ms·

> Another screenshot featuring a torrent related to a 2022 movie reveals the URL of yet another third-party supplier tracker. Some basic queries on that URL lea

> Another screenshot featuring a torrent related to a 2022 movie reveals the URL of yet another third-party supplier tracker. Some basic queries on that URL lead to even more torrent sites. And from there, more, and more, and more – revealing torrent passkeys for every single one on the way. What is this torrent passkey used for? My understanding is that torrent trackers were all about sharing peers. You want tracker info to spread. I'm not understanding what this vulnerability exposes. Edit: It looks like it's actually explained earlier: > One begins with a GET request to another tracker, which responds with a torrent file. It’s then uploaded to the requesting site which updates its SQL database accordingly. > From there the script starts checking for any new entries on a specific RSS feed which is hidden away on another site that has nothing to do with torrents. The feed is protected with a passkey but that’s only useful when nobody knows what it is. > The same security hole also grants direct access to one of the sites tracker ‘bots’ through the panel that controls it. So I think the issue is that keys to authorize control of the automated software to propagate tracker info is being leaked. It sounds like the end result is someone can write spoofed or spam info into torrent trackers.

martinald 4y ago
Some torrent sites have ratios, eg you must upload as much as you download. The passkey allows the tracker to keep track of what you've uploaded and downloaded for your ratio. These torrents also have peer discovery and DHT disabled on private trackers.
- Manuel_D 4y ago
  Whatever, I was never a fan of private trackers anyway. The whole point of P2P is that it's power scales with more users.
  - lfodofod 4y ago
    This is not correct, swarms on good private sites are way better than on public trackers. With real world torrent clients, you’d much rather have a swarm with 100 dedicated servers on 1gbps+ connections than a swarm with a million Indian residential connections.
    - Manuel_D 4y ago
      Sure, but why not have 100 dedicated servers and a million residential connections? Potential upload bandwidth is strictly larger.
      - lfodofod 4y ago
        Because your torrent client will never find those dedicated servers, and instead wastes all of it’s connection slots on the Indian residential connections. Also because there’s no incentive for anybody to seed public tracker content on servers. Your host will get abuse reports and you will not be rewarded in any way, on private sites you won’t receive abuse reports and you have to seed in order to maintain access.
      - luckylion 4y ago
        Public trackers are the slums where people shit in the streets. You don't want to walk there and look for the things you want. Private trackers are the communal libraries where enthusiasts work hard to improve the collective archives. They sort out the people who cannot behave and the whole experience is a lot better: rules regarding organization and filenames etc are being followed, tags are added so that you can search efficiently, requests are filled, quality is ensured, holes are plugged, people don't upload duplicates, you'll find help and exchange in forums about the tracker's topic etc etc, all because it's a private club which includes the possibility that your membership ends if you pee into the kitchen.
        Manuel_D 4y ago
        > communal libraries where enthusiasts No, it's private libraries closed to the broader community. The millions of Indians in the aforementioned comment are precisely the people who'd benefit most from free flow of information, but they're excluded. This is like setting up a premium subscription library to keep poor people out - the "slums" are precisely the people who benefit from a public library the most. Tagging and removal of duplicates can be done without making a tracker private. Public torrents have been plenty fast enough for me, I'm not sure why people are complaining. Maybe they're not sophisticated enough to up the connection limits on their torrent software, which is why slow peers are hampering their speeds.
  - thrdbndndn 4y ago
    I hate private trackers, but there is no deny in terms of both seeding sustainability and higher quality (or rarer) resource, they're miles above "public" trackers.
    - lfodofod 4y ago
      Why hate private trackers? That’s where all the good quality content on public trackers comes from. Without private trackers, it’s not obvious that anyone would have bothered to extract Widevine keys and set up decryption pipelines for all the streaming sites. (So far zero scene groups seem to have achieved this)
      - thrdbndndn 4y ago
        > Without private trackers, it’s not obvious that anyone.. The piracy scene (with 0-day FTP etc.) worked fine before BT was even well-known. And there are more than enough groups directly release their content on public trackers for anything remotely popular (any Netflix series fall into this category). You (or they) don't need PT for that. PT is kinda essential if you're interested in obscure/niche content though, I agree. I hate private trackers purely due to (my personal) value. I think it's a violation of "piracy spirit", and it somehow enables lots of people/groups' superiority complex or unnecessary gatekeeping behaviors (emphasis on "unnecessary": I know by definition it's not gateless). But I do acknowledge it's probably the most practical way nowadays.
        lfodofod 4y ago
        > And there are more than enough groups directly release their content on public trackers for anything remotely popular (any Netflix series fall into this category) Name one! Or link a torrent. I’m pretty sure you will only find shit quality webrips made with capture cards and not actual decrypted streams. > The piracy scene (with 0-day FTP etc.) worked fine before BT was even well-known. The TV scene has been reduced to nothing because none of the groups could figure out Widevine. Just look at any pre feed. Private tracker groups did though, and now everybody depends on them.
  - denkmoon 4y ago
    Not if all of those peers download their "free" movie then disappear. Compare the number of orphaned torrents on something like TPB to that of a private tracker. Private community allows rules that incentivise behaviour that allows the community and its content to persist long term.

martinald 4y ago

Some torrent sites have ratios, eg you must upload as much as you download. The passkey allows the tracker to keep track of what you've uploaded and downloaded for your ratio. These torrents also have peer discovery and DHT disabled on private trackers.

Manuel_D 4y ago
Whatever, I was never a fan of private trackers anyway. The whole point of P2P is that it's power scales with more users.
- lfodofod 4y ago
  This is not correct, swarms on good private sites are way better than on public trackers. With real world torrent clients, you’d much rather have a swarm with 100 dedicated servers on 1gbps+ connections than a swarm with a million Indian residential connections.
  - Manuel_D 4y ago
    Sure, but why not have 100 dedicated servers and a million residential connections? Potential upload bandwidth is strictly larger.
    - lfodofod 4y ago
      Because your torrent client will never find those dedicated servers, and instead wastes all of it’s connection slots on the Indian residential connections. Also because there’s no incentive for anybody to seed public tracker content on servers. Your host will get abuse reports and you will not be rewarded in any way, on private sites you won’t receive abuse reports and you have to seed in order to maintain access.
    - luckylion 4y ago
      Public trackers are the slums where people shit in the streets. You don't want to walk there and look for the things you want. Private trackers are the communal libraries where enthusiasts work hard to improve the collective archives. They sort out the people who cannot behave and the whole experience is a lot better: rules regarding organization and filenames etc are being followed, tags are added so that you can search efficiently, requests are filled, quality is ensured, holes are plugged, people don't upload duplicates, you'll find help and exchange in forums about the tracker's topic etc etc, all because it's a private club which includes the possibility that your membership ends if you pee into the kitchen.
      - Manuel_D 4y ago
        > communal libraries where enthusiasts No, it's private libraries closed to the broader community. The millions of Indians in the aforementioned comment are precisely the people who'd benefit most from free flow of information, but they're excluded. This is like setting up a premium subscription library to keep poor people out - the "slums" are precisely the people who benefit from a public library the most. Tagging and removal of duplicates can be done without making a tracker private. Public torrents have been plenty fast enough for me, I'm not sure why people are complaining. Maybe they're not sophisticated enough to up the connection limits on their torrent software, which is why slow peers are hampering their speeds.
- thrdbndndn 4y ago
  I hate private trackers, but there is no deny in terms of both seeding sustainability and higher quality (or rarer) resource, they're miles above "public" trackers.
  - lfodofod 4y ago
    Why hate private trackers? That’s where all the good quality content on public trackers comes from. Without private trackers, it’s not obvious that anyone would have bothered to extract Widevine keys and set up decryption pipelines for all the streaming sites. (So far zero scene groups seem to have achieved this)
    - thrdbndndn 4y ago
      > Without private trackers, it’s not obvious that anyone.. The piracy scene (with 0-day FTP etc.) worked fine before BT was even well-known. And there are more than enough groups directly release their content on public trackers for anything remotely popular (any Netflix series fall into this category). You (or they) don't need PT for that. PT is kinda essential if you're interested in obscure/niche content though, I agree. I hate private trackers purely due to (my personal) value. I think it's a violation of "piracy spirit", and it somehow enables lots of people/groups' superiority complex or unnecessary gatekeeping behaviors (emphasis on "unnecessary": I know by definition it's not gateless). But I do acknowledge it's probably the most practical way nowadays.
      - lfodofod 4y ago
        > And there are more than enough groups directly release their content on public trackers for anything remotely popular (any Netflix series fall into this category) Name one! Or link a torrent. I’m pretty sure you will only find shit quality webrips made with capture cards and not actual decrypted streams. > The piracy scene (with 0-day FTP etc.) worked fine before BT was even well-known. The TV scene has been reduced to nothing because none of the groups could figure out Widevine. Just look at any pre feed. Private tracker groups did though, and now everybody depends on them.
- denkmoon 4y ago
  Not if all of those peers download their "free" movie then disappear. Compare the number of orphaned torrents on something like TPB to that of a private tracker. Private community allows rules that incentivise behaviour that allows the community and its content to persist long term.