6 ms·

Best of luck to the author! My understanding is that anything that makes large file sharing easy and anonymous rapidly gets flooded with CSAM and ends up shutte

by Arubis 2y ago

Best of luck to the author! My understanding is that anything that makes large file sharing easy and anonymous rapidly gets flooded with CSAM and ends up shuttering themselves for the good of all. Would love to see a non-invasive yet effective way to prevent such an incursion.

KomoD 2y ago
> ends up shuttering themselves for the good of all mostly because it's difficult to handle all the abuse reports
- aranelsurion 2y ago
  I wonder how that'll play out in this case, since everything uploaded here expires at maximum 3 days. Maybe they can "handle" abuse reports by simply auto-responding in 3 days that it is now removed.
Vinnl 2y ago
I've been using this version for a while, presumably it's just gone under the radar enough. So please don't upvote this too much, haha.
ghostly_s 2y ago
If it's truly e2e how would they even know what's being shared on it?
- immibis 2y ago
  Because some people would tell them. For example, the FBI would look at a child porn sharing forum and observe a lot of people sharing Send links. Then they would go to the operators of Send servers, and "strongly suggest" that it should shut down.
  - KomoD 2y ago
    > and "strongly suggest" that it should shut down. I don't know about that, is there any documented case of that? I feel like they'd probably just contact them and ask for removal of the file(s) and to forward any logs?
    - jasonjayr 2y ago
      "We know that this link includes material that is illegal to possess, and it is on your server." "We don't know the contents of the files on our server, so we can't know that is was illegal" "Fine, delete that file, and we won't charge you for possession this time. Now that you know your service is used for this illegal material, you need to stop hosting material like that." "How, if we don't know what's in the file sent to our server?" "... maybe don't take random files you don't know about, and share them on the open web with anonymous users?"
      - snowe2010 2y ago
        That’s not how csam reporting works at all. You aren’t punished for csam being on your server, as long as you do something about it. You can easily set up cloudflare to block and report csam to the NCMEC (not the FBI) and it will all be handled automatically.
        immibis 2y ago
        Maybe a judge would see it that way, but FBI agents aren't required to act like judges.
        snowe2010 2y ago
        The fbi literally only investigates if the ncmec tells them to. https://www.fbi.gov/investigate/violent-crime/vcac https://www.fbi.gov/investigate/violent-crime/vcac
chasil 2y ago
I have been using both Swisstransfer.com and filetransfer.io since Firefox Send shut down. How have they dealt with this?
plingbang 2y ago
For a case when file sharing is intended between individuals or small groups there's an easy solution: Anyone who got the link should be able to delete the file. This should deter one from using the file sharing tool as free hosting for possibly bad content. One can also build a bot that deletes every file found on public internet.
- giancarlostoro 2y ago
  That then ruins perfectly valid use cases that someone could maliciously delete the file for.
  - atoav 2y ago
    But it allows sending. That might be an okay tradeoff, depending on what you're aiming for. Anonymous file hosting isn't something I'd be keen to offer, given the nhmber of people who would happily just abuse it.
    - ajsnigrutin 2y ago
      But people would abuse the delete button too. Imagine some computer work with a class of high school kids, where a teacher has to send them a file... there will be maybe three full downloads max, before someone presses the "delete" button.
      - terribleperson 2y ago
        For a lot of use cases, simply sending the address of the deleter to whoever sent the file would suffice. Next time, just don't send it to them, or apply real-world consequences. Sure, it wouldn't work for a large public setting... but it'd work for many other settings.
      - bastawhiz 2y ago
        Sending files anonymously and sending files easily seems like mutually exclusive problems. If it's easy and anonymous, it's too easy to abuse. The teacher should just be using file storage that is tied to an account: it's not as though they're trying to stay hidden from their students
lovethevoid 2y ago
For Firefox Send, it was actually malware and spearfishing attacks that were spread. The combination of limited file availability (reducing the ability to report bad actors), as well as Firefox urls being inherently trusted within orgs (bypassing a lot of basic email/file filtering/scanning), was the reason it became so popular for criminals to use. Like we've seen in the spearfishing attacks in India[1]. [1]: https://www.amnesty.org/en/latest/research/2020/06/india-human-rights-defenders-targeted-by-a-coordinated-spyware-operation/ https://www.amnesty.org/en/latest/research/2020/06/india-hum...
neilv 2y ago
Do we know whether this uploading is motivated by actual pedo reasons, by anti-pedo honeypot reasons, by sociopathic trolling reasons, by sabotage reasons (state, or commercial), or something else? It's discouraging to think that privacy&security solutions for good people might end up being used primarily by bad people, but I don't know whether that's the situation, nor what the actual numbers are.
- Barrin92 2y ago
  It is just pedophiles. A user posted here on HN a while ago that they ran a Tor exist node and the overwhelming majority of it was CSAM or other cybercrime. Here in Germany they busted some underground forum and a single individual had 35TB worth of it at home. There's no great conspiracy, the criminal underworld is huge and they use every service that doesn't clamp down on it in some form.
  - jmorenoamor 2y ago
    Naive question. Isn't tor supposed to be private? How can you know the contents of the communication just by running a node?
    - LikesPwsh 2y ago
      If it's an exit node, you know what the user is connecting to but not which user.
  - neilv 2y ago
    That's discouraging, if true. I don't mind doing the occasional on-principle thing (like running Tor Browser for general-purpose browsing, and Tor as the VPN plugin on my phone), and maybe it's a citizen-technologist obligation to do my share of that. But I'd rather not have some Orwellian Bayesian system flagging me for using Tor.
    - 1oooqooq 2y ago
      run a node. but never an exit one.
qudat 2y ago
Checkout https://pipe.pico.sh https://pipe.pico.sh which is a system for networked Unix pipes using ssh.
jart 2y ago
If governments and big tech want to help, they should upload one of their CSAM detection models to Hugging Face, so system administrators can just block it. Ideally I should be able to run a command `iscsam 123.jpg` and it prints a number like 0.9 to indicate 90% confidence that it is. No one else but them can do it, since there's obviously no legal way to train such a model. Even though we know that governments have already done it. If they won't give service operators the tools to keep abuse off their communications systems, then operators shouldn't be held accountable for what people do with them.
- kevindamm 2y ago
  The biggest risk with opening a tool like that is that it potentially enables offenders to figure out what can get past it.
  - jart 2y ago
    So they publish an updated model every three months that works better.
  - marpstar 2y ago
    Fair point, but wouldn’t we rather they be spending their time doing that than actively abusing kids?
  - cr125rider 2y ago
    So security by obscurity? Man, open source software must suck…
- blackoil 2y ago
  Perpetrators will keep tweaking image till they get score of 0.1
  - amelius 2y ago
    How about the government running a service where you can ask them to validate an image? Trying to tweak an image will not work because you will find the police on your doorstep.
INTPenis 2y ago
I had a Send instance exposed online for years, but I changed it to 1 day retention and I never had any issues. It was literally just to send large files between friends so more than 1 day was redundant.

by Arubis 2y ago

KomoD 2y ago

> ends up shuttering themselves for the good of all mostly because it's difficult to handle all the abuse reports

aranelsurion 2y ago
I wonder how that'll play out in this case, since everything uploaded here expires at maximum 3 days. Maybe they can "handle" abuse reports by simply auto-responding in 3 days that it is now removed.

Vinnl 2y ago

I've been using this version for a while, presumably it's just gone under the radar enough. So please don't upvote this too much, haha.

ghostly_s 2y ago

If it's truly e2e how would they even know what's being shared on it?

immibis 2y ago
Because some people would tell them. For example, the FBI would look at a child porn sharing forum and observe a lot of people sharing Send links. Then they would go to the operators of Send servers, and "strongly suggest" that it should shut down.
- KomoD 2y ago
  > and "strongly suggest" that it should shut down. I don't know about that, is there any documented case of that? I feel like they'd probably just contact them and ask for removal of the file(s) and to forward any logs?
  - jasonjayr 2y ago
    "We know that this link includes material that is illegal to possess, and it is on your server." "We don't know the contents of the files on our server, so we can't know that is was illegal" "Fine, delete that file, and we won't charge you for possession this time. Now that you know your service is used for this illegal material, you need to stop hosting material like that." "How, if we don't know what's in the file sent to our server?" "... maybe don't take random files you don't know about, and share them on the open web with anonymous users?"
    - snowe2010 2y ago
      That’s not how csam reporting works at all. You aren’t punished for csam being on your server, as long as you do something about it. You can easily set up cloudflare to block and report csam to the NCMEC (not the FBI) and it will all be handled automatically.
      - immibis 2y ago
        Maybe a judge would see it that way, but FBI agents aren't required to act like judges.
        snowe2010 2y ago
        The fbi literally only investigates if the ncmec tells them to. https://www.fbi.gov/investigate/violent-crime/vcac https://www.fbi.gov/investigate/violent-crime/vcac

chasil 2y ago

I have been using both Swisstransfer.com and filetransfer.io since Firefox Send shut down. How have they dealt with this?

plingbang 2y ago

For a case when file sharing is intended between individuals or small groups there's an easy solution: Anyone who got the link should be able to delete the file. This should deter one from using the file sharing tool as free hosting for possibly bad content. One can also build a bot that deletes every file found on public internet.

giancarlostoro 2y ago
That then ruins perfectly valid use cases that someone could maliciously delete the file for.
- atoav 2y ago
  But it allows sending. That might be an okay tradeoff, depending on what you're aiming for. Anonymous file hosting isn't something I'd be keen to offer, given the nhmber of people who would happily just abuse it.
  - ajsnigrutin 2y ago
    But people would abuse the delete button too. Imagine some computer work with a class of high school kids, where a teacher has to send them a file... there will be maybe three full downloads max, before someone presses the "delete" button.
    - terribleperson 2y ago
      For a lot of use cases, simply sending the address of the deleter to whoever sent the file would suffice. Next time, just don't send it to them, or apply real-world consequences. Sure, it wouldn't work for a large public setting... but it'd work for many other settings.
    - bastawhiz 2y ago
      Sending files anonymously and sending files easily seems like mutually exclusive problems. If it's easy and anonymous, it's too easy to abuse. The teacher should just be using file storage that is tied to an account: it's not as though they're trying to stay hidden from their students

lovethevoid 2y ago

For Firefox Send, it was actually malware and spearfishing attacks that were spread. The combination of limited file availability (reducing the ability to report bad actors), as well as Firefox urls being inherently trusted within orgs (bypassing a lot of basic email/file filtering/scanning), was the reason it became so popular for criminals to use. Like we've seen in the spearfishing attacks in India[1]. [1]: https://www.amnesty.org/en/latest/research/2020/06/india-human-rights-defenders-targeted-by-a-coordinated-spyware-operation/ https://www.amnesty.org/en/latest/research/2020/06/india-hum...

neilv 2y ago

Do we know whether this uploading is motivated by actual pedo reasons, by anti-pedo honeypot reasons, by sociopathic trolling reasons, by sabotage reasons (state, or commercial), or something else? It's discouraging to think that privacy&security solutions for good people might end up being used primarily by bad people, but I don't know whether that's the situation, nor what the actual numbers are.

Barrin92 2y ago
It is just pedophiles. A user posted here on HN a while ago that they ran a Tor exist node and the overwhelming majority of it was CSAM or other cybercrime. Here in Germany they busted some underground forum and a single individual had 35TB worth of it at home. There's no great conspiracy, the criminal underworld is huge and they use every service that doesn't clamp down on it in some form.
- jmorenoamor 2y ago
  Naive question. Isn't tor supposed to be private? How can you know the contents of the communication just by running a node?
  - LikesPwsh 2y ago
    If it's an exit node, you know what the user is connecting to but not which user.
- neilv 2y ago
  That's discouraging, if true. I don't mind doing the occasional on-principle thing (like running Tor Browser for general-purpose browsing, and Tor as the VPN plugin on my phone), and maybe it's a citizen-technologist obligation to do my share of that. But I'd rather not have some Orwellian Bayesian system flagging me for using Tor.
  - 1oooqooq 2y ago
    run a node. but never an exit one.

qudat 2y ago

Checkout https://pipe.pico.sh https://pipe.pico.sh which is a system for networked Unix pipes using ssh.

jart 2y ago

If governments and big tech want to help, they should upload one of their CSAM detection models to Hugging Face, so system administrators can just block it. Ideally I should be able to run a command `iscsam 123.jpg` and it prints a number like 0.9 to indicate 90% confidence that it is. No one else but them can do it, since there's obviously no legal way to train such a model. Even though we know that governments have already done it. If they won't give service operators the tools to keep abuse off their communications systems, then operators shouldn't be held accountable for what people do with them.

kevindamm 2y ago
The biggest risk with opening a tool like that is that it potentially enables offenders to figure out what can get past it.
- jart 2y ago
  So they publish an updated model every three months that works better.
- marpstar 2y ago
  Fair point, but wouldn’t we rather they be spending their time doing that than actively abusing kids?
- cr125rider 2y ago
  So security by obscurity? Man, open source software must suck…
blackoil 2y ago
Perpetrators will keep tweaking image till they get score of 0.1
- amelius 2y ago
  How about the government running a service where you can ask them to validate an image? Trying to tweak an image will not work because you will find the police on your doorstep.

INTPenis 2y ago

I had a Send instance exposed online for years, but I changed it to 1 day retention and I never had any issues. It was literally just to send large files between friends so more than 1 day was redundant.