3 ms·

You are going to post illegal stuff (signed by you) then somehow convince someone to raid my server in the hopes of that illegal thing being on my hard disk. Re

You are going to post illegal stuff (signed by you) then somehow convince someone to raid my server in the hopes of that illegal thing being on my hard disk. Relays don’t have to store any message on disk, they relay stuff real time over websockets. Even if you store messages you can trivially wipe them every 24h? Then you are going to convince a judge that the thing on my disk belongs to me, because judges are apparently braindead. If this is the protocol’s glaring vulnerability then every server in the world has this vulnerability.

Semaphor 4y ago
But your server was distributing the illegal thing. It doesn’t matter, that it might not be there anymore, here in Germany there is a decent chance of getting a police visit and possibly getting your hardware impounded. This is also the case for tor exit nodes, which is why those here are all hosted by organizations with lawyers. As you distribute the content here, unlike with tor, you would essentially act as a user generated content provider and would have to take steps to prevent the abuse from occurring again… probably after an involved court case. This is not like "every server" because not every server distributes what anyone publishes to it. Though a lot of that might not be an issue in jurisdictions with saner laws, I don’t know specifics.
nine_k 4y ago
> signed by you Signed by a private key which has no connection to my legal identity, and which can be generated in a split second. Signatures give strong pseudonymity. > Relays don’t have to store any message on disk This is a good idea, as long as messages are relatively few, which may be hundreds of thousands if they are short. There's no promise of availability, so an infrequent reboot is free to erase them. > Then you are going to convince a judge that the thing on my disk belongs to me I'm afraid it can be the other way around, if the material is sensitive enough. You'd have to explain to the judge how it ended up on your computer. > every server in the world has this vulnerability No, only a server that allows users to upload UGC without requiring enough background information to let the law enforcement find out their real identities if need be. Should be an adequate explanation to the judge in a civilized country where governmental censorship is not a thing.
- drexlspivey 4y ago
  > No, only a server that allows users to upload UGC without requiring enough background information to let the law enforcement find out their real identities if need be. Should be an adequate explanation to the judge in a civilized country where governmental censorship is not a thing. So just to be super clear, you don’t upload images on a relay, nostr messages are just signed json blobs i.e text. If you want to post an image you just post a link to it and the image is hosted elsewhere. If there is such a thing as an illegal text string that is illegal to have on your hard drive then I can do the same attack on any webserver by having the illegal string in my user agent and it’s going to be saved to the hard disk in the logfile. Then according to your plan I can raid the server with the illegal string and put the server owner to jail. Does that make sense to you?
  - wkat4242 4y ago
    What about base64 encoded images? Nntp doesn't support binaries but it's sure distributing a hell of a lot of them these days.

Semaphor 4y ago

But your server was distributing the illegal thing. It doesn’t matter, that it might not be there anymore, here in Germany there is a decent chance of getting a police visit and possibly getting your hardware impounded. This is also the case for tor exit nodes, which is why those here are all hosted by organizations with lawyers. As you distribute the content here, unlike with tor, you would essentially act as a user generated content provider and would have to take steps to prevent the abuse from occurring again… probably after an involved court case. This is not like "every server" because not every server distributes what anyone publishes to it. Though a lot of that might not be an issue in jurisdictions with saner laws, I don’t know specifics.

nine_k 4y ago

> signed by you Signed by a private key which has no connection to my legal identity, and which can be generated in a split second. Signatures give strong pseudonymity. > Relays don’t have to store any message on disk This is a good idea, as long as messages are relatively few, which may be hundreds of thousands if they are short. There's no promise of availability, so an infrequent reboot is free to erase them. > Then you are going to convince a judge that the thing on my disk belongs to me I'm afraid it can be the other way around, if the material is sensitive enough. You'd have to explain to the judge how it ended up on your computer. > every server in the world has this vulnerability No, only a server that allows users to upload UGC without requiring enough background information to let the law enforcement find out their real identities if need be. Should be an adequate explanation to the judge in a civilized country where governmental censorship is not a thing.

drexlspivey 4y ago
> No, only a server that allows users to upload UGC without requiring enough background information to let the law enforcement find out their real identities if need be. Should be an adequate explanation to the judge in a civilized country where governmental censorship is not a thing. So just to be super clear, you don’t upload images on a relay, nostr messages are just signed json blobs i.e text. If you want to post an image you just post a link to it and the image is hosted elsewhere. If there is such a thing as an illegal text string that is illegal to have on your hard drive then I can do the same attack on any webserver by having the illegal string in my user agent and it’s going to be saved to the hard disk in the logfile. Then according to your plan I can raid the server with the illegal string and put the server owner to jail. Does that make sense to you?
- wkat4242 4y ago
  What about base64 encoded images? Nntp doesn't support binaries but it's sure distributing a hell of a lot of them these days.