6 ms·

BitTorrent Tracker Blocks 'Infringing' Hashes

69 points by gslin 3y ago

19h 3y ago
It's funny really, I ran a substantial amount of Tor exit nodes in Germany since 2014 and everytime I got into touch with the police about stuff happening on them, they asked me to "filter" things going through it. The thing is that as per TMG §8.1.3: "Service providers are not responsible for third-party information that they transmit in a communication network or for which they provide access for use, provided that they [...] did not select or modify the transmitted information." Essentially, if an operator was to "do a good thing", they'd legally become liable for all traffic. That was quite a learning experience for me.
- beAbU 3y ago
  So this is basically the inverse of the Good Samaritan law? If you do /something/ you might become liable because you did not do enough?
  - asylteltine 3y ago
    Good Samaritan isn’t a blanket protection. If you have ANY knowledge or training you can be sued anyway. Unfortunately due to that law and others things, there’s absolutely no way I’m touching or helping anyone. Blame the litigious American society
    - itishappy 3y ago
      Do you have any examples? The few states I just read through (Washington, New York, Colorado) have explicit carveouts for the situation you're describing as long as they had no professional obligation to the patient. Here's Colorado's: > Any person licensed as a physician and surgeon under the laws of the state of Colorado, or any other person, who in good faith renders emergency care or emergency assistance to a person not presently his patient without compensation at the place of an emergency or accident, including a health care institution as defined in section 13-64-202 (3), shall not be liable for any civil damages for acts or omissions made in good faith as a result of the rendering of such emergency care or emergency assistance during the emergency, unless the acts or omissions were grossly negligent or willful and wanton. This section shall not apply to any person who renders such emergency care or emergency assistance to a patient he is otherwise obligated to cover.
  - DistractionRect 3y ago
    IANAL, but as I understand it, the basic idea is like how saying sorry can be an admission of guilt/responsibility in some legal systems. Once you start moderating, you admit it's within your ability and it's your responsibility to do so (and usually at the scale most service providers it's not realistically feasible to moderate all content). So either you're responsible for moderating all the content, or you moderate non of it. Edit: clarity
  - rsynnott 3y ago
    It's arguably the difference between being a utility (the phone company passes all calls through; if someone makes a death threat through it that's not their problem) and a publisher (if the NYT publishes an editorial calling for the murder of some random person, that's very much the NYT's problem). Definite fuzziness around the edges, tho. EDIT: Though now I think of it, even with this analogy, blocking phone numbers when directed to by the government wouldn't normally threaten a phone company's status...
  - Scion9066 3y ago
    Yep, it's basically the reasoning behind why Section 230 of the Communications Decency Act was created in the states: In Cubby, Inc. v. CompuServe Inc. they didn't moderate and were not liable as a publisher because they did not have any direct knowledge of the defamatory content as they just transmitted it. In Stratton Oakmont, Inc. v. Prodigy Services Co. they did moderate some things and were liable due to the editorial control they had over it. Section 230 fixed that by letting services filter offensive content without incurring liability for everything else. Without it you'd have to either do no moderation at all or perfect moderation, letting nothing offensive/defamatory/etc through.
- sanktanglia 3y ago
  does the tor anonymizing process not count as modifying the information?
  - pests 3y ago
    In that case TLS or similar would also trigger it. It's just a different method of routing - wrapping the original packet in more and more envelopes.
TekMol 3y ago
The article says that OpenTrackr is a significant and reliable player in the BitTorrent ecosystem and that it sees near daily peaks of 500,000 connections per second and that it is monetized via Patreon. So I had a look at their Patreon page, curious how much they make. It turns out to be ... $51.63 per month. Is that what you make these days, when you help millions of people on the internet? I'm not sure what a "torrent tracker" is though. I would have thought it is a website to find torrents. But Similarweb says the website only sees 50k users per month. So it is probably something different which is not accessed by users but by ... software? Ah yes. Asking ChatGPT, it says a torrent tracker is kind of an index service. And this service is used by torrent client software. Not by users via a browser.
- wut42 3y ago
  "Tracker" is a bit abused. A tracker just keeps track of peers on a given hash. Websites offering an index aren't the same thing. No-one directly uses the website opentrackr.org, they just put the UDP tracker in their torrents
- aqfamnzc 3y ago
  BitTorrent is a peer-to-peer way of distributing files. Trackers are services that tell your client software who your peers are. Indeed, they are typically only accessed by BT client software, not by a browser.
- Mashimo 3y ago
  Everyone can create a .torrent file. While you create it you can enter one or multiple URLs of trackers that everyone connects to when they open the torrent file. (Or none, there is also a decentral why of doing torrents) Clients just send a hash to the tracker URL and get a list of urls back with other people who send in a request with the same hash. The tracker does not care how you share those torrent files. I think it's just a list of hashes and URLs. This might not be 100% correct, but I hope you better understand it :)
- 0x457 3y ago
  There are multiple things to get confused: indexers and trackers. Indexers are what people that don't have sonarr/radarr/etc interact with directly - a collection of magnets and/or .torrent files. Trackers are what download clients interact with, usually magnet/.torrent has multiple trackers included in metadata. All these do is match hash to peers. You technically don't need it with DHT, but they speed up peer discovery by a lot compared to just DHT. Indexers (really often just a forum) often act as trackers as well, but they don't have to. Trackers often remove .torrent files and magnets at request, but leave enough information for you, you to create new magnet link and use their tracker for peer discovery.
deleted 3y ago
[deleted]
Mashimo 3y ago
Reminds me of an 2007 talk from CCC, sadly in German: https://media.ccc.de/v/24c3-2355-de-trecker_fahrn https://media.ccc.de/v/24c3-2355-de-trecker_fahrn It's how they wrote one of the first "performing trackers" as most others around the time where python or php based. https://en.wikipedia.org/wiki/Opentracker https://en.wikipedia.org/wiki/Opentracker And it seems OpenTrackr from the article is based on Opentracker software. It's an really entertaining talk. They destroyer a router from hetzner when they first rented a server because of the traffic.
- toomuchtodo 3y ago
  > It's an really entertaining talk. They destroyer a router from hetzner when they first rented a server because of the traffic. Would magnet torrents fit in DNS TXT records? Seems like an interesting way to distribute load across global DNS servers. https://news.ycombinator.com/item?id=36945177 https://news.ycombinator.com/item?id=36945177 ("Show HN: File distribution over DNS: (ab)using DNS as a CDN")
  - Scaevolus 3y ago
    Open trackers like this don't distribute the torrent files themselves-- all they do is help you find the swarm for a torrent given a hash as input. A magnet hash is little more than a hex-encoded infohash along with a few trackers to use for coordination and a filename wrapped in a URI, so DNS TXT wouldn't provide much compression (~30B DNS record to ~200B magnet URI). Given an infohash, a torrent client has to find a swarm member (or DHT) to download the full torrent metadata.
    - deleted 3y ago
      [deleted]
MuffinFlavored 3y ago
Change a byte? :P
- dns_snek 3y ago
  You can do that, but then you lose all current seeds who will see an error in their torrent client unless they choose to track down the new magnet link to continue seeding.
- squarefoot 3y ago
  Or distribute hashes printed on t-shirts:) Anyone recalls of the infamous De-CSS suit, and all the ways the community found to distribute that code? http://www.cs.cmu.edu/~dst/DeCSS/Gallery/index.html http://www.cs.cmu.edu/~dst/DeCSS/Gallery/index.html
  - Tommstein 3y ago
    I think I still have my T-shirts somewhere.
rolph 3y ago
lots of ways to deflect hash matching.
jiveturkey 3y ago
i was afraid this might happen some day. like how ipfs links (hashes) on gateways are often blocked.
- fsflover 3y ago
  Consider using torrents in I2P to avoid this.
botanical 3y ago
I've asked this before but why is this legally allowed or enforced? How is a hash of something equal to being the thing? Do copyright laws have specific sub-laws when it comes to digital media? DMCA seems more like a hammer abused by corporations. It seems like laws are written solely for corporations.
- kube-system 3y ago
  OpenTrackr can remove whatever they want from their tracker. Rights owners are free to ask them to take down material. They can then either challenge that request or do it. There is a legal concept of "Contributory copyright infringement" which can make people liable for damages if they knowingly contribute, cause, or induce others to infringe on copyright. https://en.wikipedia.org/wiki/Contributory_copyright_infringement https://en.wikipedia.org/wiki/Contributory_copyright_infring... Does running a tracker do this? Maybe. OpenTrackr could find out what their court thinks by challenging rights owners until a case ends up there. Do they want to? Doesn't sound like it, so they remove the material.

69 points by gslin 3y ago

19h 3y ago

It's funny really, I ran a substantial amount of Tor exit nodes in Germany since 2014 and everytime I got into touch with the police about stuff happening on them, they asked me to "filter" things going through it. The thing is that as per TMG §8.1.3: "Service providers are not responsible for third-party information that they transmit in a communication network or for which they provide access for use, provided that they [...] did not select or modify the transmitted information." Essentially, if an operator was to "do a good thing", they'd legally become liable for all traffic. That was quite a learning experience for me.

beAbU 3y ago
So this is basically the inverse of the Good Samaritan law? If you do /something/ you might become liable because you did not do enough?
- asylteltine 3y ago
  Good Samaritan isn’t a blanket protection. If you have ANY knowledge or training you can be sued anyway. Unfortunately due to that law and others things, there’s absolutely no way I’m touching or helping anyone. Blame the litigious American society
  - itishappy 3y ago
    Do you have any examples? The few states I just read through (Washington, New York, Colorado) have explicit carveouts for the situation you're describing as long as they had no professional obligation to the patient. Here's Colorado's: > Any person licensed as a physician and surgeon under the laws of the state of Colorado, or any other person, who in good faith renders emergency care or emergency assistance to a person not presently his patient without compensation at the place of an emergency or accident, including a health care institution as defined in section 13-64-202 (3), shall not be liable for any civil damages for acts or omissions made in good faith as a result of the rendering of such emergency care or emergency assistance during the emergency, unless the acts or omissions were grossly negligent or willful and wanton. This section shall not apply to any person who renders such emergency care or emergency assistance to a patient he is otherwise obligated to cover.
- DistractionRect 3y ago
  IANAL, but as I understand it, the basic idea is like how saying sorry can be an admission of guilt/responsibility in some legal systems. Once you start moderating, you admit it's within your ability and it's your responsibility to do so (and usually at the scale most service providers it's not realistically feasible to moderate all content). So either you're responsible for moderating all the content, or you moderate non of it. Edit: clarity
- rsynnott 3y ago
  It's arguably the difference between being a utility (the phone company passes all calls through; if someone makes a death threat through it that's not their problem) and a publisher (if the NYT publishes an editorial calling for the murder of some random person, that's very much the NYT's problem). Definite fuzziness around the edges, tho. EDIT: Though now I think of it, even with this analogy, blocking phone numbers when directed to by the government wouldn't normally threaten a phone company's status...
- Scion9066 3y ago
  Yep, it's basically the reasoning behind why Section 230 of the Communications Decency Act was created in the states: In Cubby, Inc. v. CompuServe Inc. they didn't moderate and were not liable as a publisher because they did not have any direct knowledge of the defamatory content as they just transmitted it. In Stratton Oakmont, Inc. v. Prodigy Services Co. they did moderate some things and were liable due to the editorial control they had over it. Section 230 fixed that by letting services filter offensive content without incurring liability for everything else. Without it you'd have to either do no moderation at all or perfect moderation, letting nothing offensive/defamatory/etc through.
sanktanglia 3y ago
does the tor anonymizing process not count as modifying the information?
- pests 3y ago
  In that case TLS or similar would also trigger it. It's just a different method of routing - wrapping the original packet in more and more envelopes.

TekMol 3y ago

The article says that OpenTrackr is a significant and reliable player in the BitTorrent ecosystem and that it sees near daily peaks of 500,000 connections per second and that it is monetized via Patreon. So I had a look at their Patreon page, curious how much they make. It turns out to be ... $51.63 per month. Is that what you make these days, when you help millions of people on the internet? I'm not sure what a "torrent tracker" is though. I would have thought it is a website to find torrents. But Similarweb says the website only sees 50k users per month. So it is probably something different which is not accessed by users but by ... software? Ah yes. Asking ChatGPT, it says a torrent tracker is kind of an index service. And this service is used by torrent client software. Not by users via a browser.

wut42 3y ago
"Tracker" is a bit abused. A tracker just keeps track of peers on a given hash. Websites offering an index aren't the same thing. No-one directly uses the website opentrackr.org, they just put the UDP tracker in their torrents
aqfamnzc 3y ago
BitTorrent is a peer-to-peer way of distributing files. Trackers are services that tell your client software who your peers are. Indeed, they are typically only accessed by BT client software, not by a browser.
Mashimo 3y ago
Everyone can create a .torrent file. While you create it you can enter one or multiple URLs of trackers that everyone connects to when they open the torrent file. (Or none, there is also a decentral why of doing torrents) Clients just send a hash to the tracker URL and get a list of urls back with other people who send in a request with the same hash. The tracker does not care how you share those torrent files. I think it's just a list of hashes and URLs. This might not be 100% correct, but I hope you better understand it :)
0x457 3y ago
There are multiple things to get confused: indexers and trackers. Indexers are what people that don't have sonarr/radarr/etc interact with directly - a collection of magnets and/or .torrent files. Trackers are what download clients interact with, usually magnet/.torrent has multiple trackers included in metadata. All these do is match hash to peers. You technically don't need it with DHT, but they speed up peer discovery by a lot compared to just DHT. Indexers (really often just a forum) often act as trackers as well, but they don't have to. Trackers often remove .torrent files and magnets at request, but leave enough information for you, you to create new magnet link and use their tracker for peer discovery.

deleted 3y ago

[deleted]

Mashimo 3y ago

Reminds me of an 2007 talk from CCC, sadly in German: https://media.ccc.de/v/24c3-2355-de-trecker_fahrn https://media.ccc.de/v/24c3-2355-de-trecker_fahrn It's how they wrote one of the first "performing trackers" as most others around the time where python or php based. https://en.wikipedia.org/wiki/Opentracker https://en.wikipedia.org/wiki/Opentracker And it seems OpenTrackr from the article is based on Opentracker software. It's an really entertaining talk. They destroyer a router from hetzner when they first rented a server because of the traffic.

toomuchtodo 3y ago
> It's an really entertaining talk. They destroyer a router from hetzner when they first rented a server because of the traffic. Would magnet torrents fit in DNS TXT records? Seems like an interesting way to distribute load across global DNS servers. https://news.ycombinator.com/item?id=36945177 https://news.ycombinator.com/item?id=36945177 ("Show HN: File distribution over DNS: (ab)using DNS as a CDN")
- Scaevolus 3y ago
  Open trackers like this don't distribute the torrent files themselves-- all they do is help you find the swarm for a torrent given a hash as input. A magnet hash is little more than a hex-encoded infohash along with a few trackers to use for coordination and a filename wrapped in a URI, so DNS TXT wouldn't provide much compression (~30B DNS record to ~200B magnet URI). Given an infohash, a torrent client has to find a swarm member (or DHT) to download the full torrent metadata.
  - deleted 3y ago
    [deleted]

MuffinFlavored 3y ago

Change a byte? :P

dns_snek 3y ago
You can do that, but then you lose all current seeds who will see an error in their torrent client unless they choose to track down the new magnet link to continue seeding.
squarefoot 3y ago
Or distribute hashes printed on t-shirts:) Anyone recalls of the infamous De-CSS suit, and all the ways the community found to distribute that code? http://www.cs.cmu.edu/~dst/DeCSS/Gallery/index.html http://www.cs.cmu.edu/~dst/DeCSS/Gallery/index.html
- Tommstein 3y ago
  I think I still have my T-shirts somewhere.

rolph 3y ago

lots of ways to deflect hash matching.

jiveturkey 3y ago

i was afraid this might happen some day. like how ipfs links (hashes) on gateways are often blocked.

fsflover 3y ago
Consider using torrents in I2P to avoid this.

botanical 3y ago

I've asked this before but why is this legally allowed or enforced? How is a hash of something equal to being the thing? Do copyright laws have specific sub-laws when it comes to digital media? DMCA seems more like a hammer abused by corporations. It seems like laws are written solely for corporations.

kube-system 3y ago
OpenTrackr can remove whatever they want from their tracker. Rights owners are free to ask them to take down material. They can then either challenge that request or do it. There is a legal concept of "Contributory copyright infringement" which can make people liable for damages if they knowingly contribute, cause, or induce others to infringe on copyright. https://en.wikipedia.org/wiki/Contributory_copyright_infringement https://en.wikipedia.org/wiki/Contributory_copyright_infring... Does running a tracker do this? Maybe. OpenTrackr could find out what their court thinks by challenging rights owners until a case ends up there. Do they want to? Doesn't sound like it, so they remove the material.