6 ms·

How do I not unwittingly get CP being stored on my device?

by coob 14y ago

StavrosK 14y ago
You don't. Why?
- lrem 14y ago
  Maybe he actually cares about the children?
  - StavrosK 14y ago
    This is equivalent to boycotting companies that sell cameras, hard disk manufacturers, computer vendors, ISPs, etc, to "think about the children".
    - alistair77 14y ago
      There is a big difference; using this system you could directly facilitate the distribution of data that you do not want to be associated with. Buying a camera doesn't directly help the creation or distribution of info you consider to be immoral or unethical. Obviously you may want to use a camera maker or ISP that actively discourages such behaviour. I'm sure you would feel extremely guilty if someone used storage facilities that you controlled to spread CP. On the other hand, I've never felt guilty about buying a camera as I've never let anyone use my camera for such purposes.
      - StavrosK 14y ago
        But this system doesn't allow you to distinguish between files. You either use the whole thing, or don't use it at all. In the camera example, you have the option of not letting people use your camera your nefarious purposes, which isn't the case here. It's more akin to supporting the camera manufacturer, who, in turn, makes things that might be used by people for crime.
      - icebraining 14y ago
        I'm sure you would feel extremely guilty if someone used storage facilities that you controlled to spread CP. If I didn't know? Definitively not.
        alistair77 14y ago
        OK, interesting. I guess it's a personal thing. For me it's not just a question of whether I know or not. I also have to consider if there is anything I could reasonably do to prevent such things from happening. If there isn't, then I would consider whether I really need to use the system (for example, is this my only option because I live under an oppressive regime?). I think this was the point of the GP asking, "How do I not unwittingly get CP being stored on my device?".
        icebraining 14y ago
        So you wouldn't work on a company like Dropbox or any other of those file storage systems? Or a VPS/cloud provider? Or an image hoster? And what about physical things? If you're working on a retail job, the customer buying piece of rope may be planning on using it for tying people up. The guy renting a car may be planning to use it on a hit. Ultimately, it's not possible to keep track of everything people do with the services we offer.
        coob 14y ago
        Even if you were wilfully ignorant?
      - marquis 14y ago
        Even the most ethical manufacturer uses raw products down the line that in some way have passed through unethical processes. Consumer choice and vocal dissent is only one part of the equation, the other is active support of prevention and awareness programs. Privacy for us means privacy for all, but you can still help: https://www.google.com/q=child+abuse+prevention https://www.google.com/q=child+abuse+prevention
      - danielweber 14y ago
        I'm sure you would feel extremely guilty Lots of people have no sense of guilt whatsoever. It's not a good thing, but with an enabling community saying "it's not your fault" it's awfully easy for people to pretend there was nothing they could do.
        Goronmon 14y ago
        Or it's just that some people are rational about what it is worth feeling guilty about.
  - yuvadam 14y ago
    If he _actually_ cares about the children he'll do something about it, like acting against child abuse in his community, rather than caring if CP is somehow encrypted in data located on his computer.
- bmm6o 14y ago
  Maybe he doesn't want to risk jail time. And that's not even supposing he doesn't want to aid the distribution of it.
deleted 14y ago
[deleted]
valdiorn 14y ago
you get "something" stored on your device. You don't know if it's a students English paper, home made pornography, nuclear launch codes... or CP. You just get a block of bytes that sits on your drive, and maybe, somebody somewhere has the key to unlock it. Until that happens, you don't know, you don't need to know, and you can't know, that's the whole point.
- drcongo 14y ago
  Pretty sure this makes it illegal in the UK under our crazy encryption laws [1]. I definitely wouldn't want to be the one to test it. [1] http://news.ycombinator.com/item?id=4234614 http://news.ycombinator.com/item?id=4234614
  - mseebach 14y ago
    It might well be illegal under crazy laws, but not the one you link to: Beneath the vitriol a very important point was made: The prosecution has to prove beyond reasonable doubt that you have the key and that you're refusing to hand it over. The presence of software like this, traces of your participation in such a network is reasonable doubt. Even with this proven, refusing to decrypt is what they get you for, not what they think you've got encrypted.
  - sturd 14y ago
    If you only have portions of alleged illegal files on your machine, you won't be able to decrypt it. As far as the blocks of data goes on your machine, it's indecipherable rubbish.
  - conductor 14y ago
    That's it! The governments take our privacy and freedoms one by one, and we are afraid to fight it or even say NO... They have won. The people is already under total control, nobody can take the power from the people ruling this world.
__alexs 14y ago
This is the reason that there is no public Tahoe-LAFS network also. To run a node on a network like this you need to be brave, much braver than even operating a Tor exit node. The addition of the long chain activity log may perhaps add some disincentive to upload CP in the first place but getting the economics of that (e.g. ease of getting upload privileges) right sounds like a difficult balance though.
- soult 14y ago
  As someone who ran the public facing node with web-interface for the public grid for a while, I can assure you that it is less concerning than running a Tor exit. You will know the IP address of everyone who downloads and uploads from you via the web-interface, and you won't know the data of those who only use your node for storage. The only complaint I ever received was from Sony after those "Geohot revenge hacks", in which they claimed that a hacked user database from one of their services was copyrighted by them, while at the same time they denied that it actually was the real user database. We did some searches for the URL of the webinterface and discovered that it indeed was mostly used by "Anonymous" as a Pastebin alternative, at which point it was decided that we did not want to aid in the spread of personal information, which is why it was shut down.[1] So you are right, there is no public grid because of unwanted files, but not because of Child Porn, but because of some script kiddies. 1: http://article.gmane.org/gmane.comp.file-systems.tahoe.devel/5718/ http://article.gmane.org/gmane.comp.file-systems.tahoe.devel...
JulianMorrison 14y ago
Going by the description, if you know a file's plaintext, you know both its plaintext hash (decryption key) and its encrypted hash (storage key). The communication to request files uses the storage key. It would be rather easy to identify by statistical means, people who request files of a common type, for example known CP images. Forwarding a few requests for CP or having it stored doesn't indicate anything. Reading or writing a lot of known CP would be probable cause for a search. This is especially easy because the majority of CP is not new and FBI presumably has the whole damn lot on a hard disk somewhere. They can easily pre-compute hashes and just sit monitoring. As a result, this network would be useless for CP-mongers, they'd get caught about as easily as using plain old FTP. On the other hand, I do think the ability to pre-compute hashes is a flaw that massively reduces this network's usefulness to dissidents. It is quite effective as a "publish a manifesto network" with a secret writer and overt readers - the original write is of a never-before-seen file, there is no hash to monitor. It's unsafe as a "store my pirated stuff" network, writers of a well known file can be tracked. And it would take very little statistical monitoring to reveal the interests of a reader.
- maxerickson 14y ago
  It would be trivial for a user to layer some encryption on top of the service, preventing anyone on the network from doing any analysis of what they are transmitting.
  - JulianMorrison 14y ago
    Not if it has to be decrypted as soon as it reaches the forwarding nodes - the way to monitor it, is to run black-hat nodes.
    - maxerickson 14y ago
      If I publish gibberish, all you know is that I have published gibberish.
    - engtech 14y ago
      index sites could have password encoded rar files of AwesomeNewMovie-1080P-SceneHipsters.rar (like they already do if they're using file lockers) wouldn't the hash be different for every rar password used? I guess the problem is once any copy infringing hash is found it is trivial to search the network and find everyone who has transferred it? edit: although if the only writer is the uploader, would you be able to tell who read the copy infringing copy vs who just has it because their part of the network?

How do I not unwittingly get CP being stored on my device?

by coob 14y ago

How do I not unwittingly get CP being stored on my device?

StavrosK 14y ago

You don't. Why?

lrem 14y ago
Maybe he actually cares about the children?
- StavrosK 14y ago
  This is equivalent to boycotting companies that sell cameras, hard disk manufacturers, computer vendors, ISPs, etc, to "think about the children".
  - alistair77 14y ago
    There is a big difference; using this system you could directly facilitate the distribution of data that you do not want to be associated with. Buying a camera doesn't directly help the creation or distribution of info you consider to be immoral or unethical. Obviously you may want to use a camera maker or ISP that actively discourages such behaviour. I'm sure you would feel extremely guilty if someone used storage facilities that you controlled to spread CP. On the other hand, I've never felt guilty about buying a camera as I've never let anyone use my camera for such purposes.
    - StavrosK 14y ago
      But this system doesn't allow you to distinguish between files. You either use the whole thing, or don't use it at all. In the camera example, you have the option of not letting people use your camera your nefarious purposes, which isn't the case here. It's more akin to supporting the camera manufacturer, who, in turn, makes things that might be used by people for crime.
    - icebraining 14y ago
      I'm sure you would feel extremely guilty if someone used storage facilities that you controlled to spread CP. If I didn't know? Definitively not.
      - alistair77 14y ago
        OK, interesting. I guess it's a personal thing. For me it's not just a question of whether I know or not. I also have to consider if there is anything I could reasonably do to prevent such things from happening. If there isn't, then I would consider whether I really need to use the system (for example, is this my only option because I live under an oppressive regime?). I think this was the point of the GP asking, "How do I not unwittingly get CP being stored on my device?".
        icebraining 14y ago
        So you wouldn't work on a company like Dropbox or any other of those file storage systems? Or a VPS/cloud provider? Or an image hoster? And what about physical things? If you're working on a retail job, the customer buying piece of rope may be planning on using it for tying people up. The guy renting a car may be planning to use it on a hit. Ultimately, it's not possible to keep track of everything people do with the services we offer.
      - coob 14y ago
        Even if you were wilfully ignorant?
    - marquis 14y ago
      Even the most ethical manufacturer uses raw products down the line that in some way have passed through unethical processes. Consumer choice and vocal dissent is only one part of the equation, the other is active support of prevention and awareness programs. Privacy for us means privacy for all, but you can still help: https://www.google.com/q=child+abuse+prevention https://www.google.com/q=child+abuse+prevention
    - danielweber 14y ago
      I'm sure you would feel extremely guilty Lots of people have no sense of guilt whatsoever. It's not a good thing, but with an enabling community saying "it's not your fault" it's awfully easy for people to pretend there was nothing they could do.
      - Goronmon 14y ago
        Or it's just that some people are rational about what it is worth feeling guilty about.
- yuvadam 14y ago
  If he _actually_ cares about the children he'll do something about it, like acting against child abuse in his community, rather than caring if CP is somehow encrypted in data located on his computer.
bmm6o 14y ago
Maybe he doesn't want to risk jail time. And that's not even supposing he doesn't want to aid the distribution of it.

deleted 14y ago

[deleted]

valdiorn 14y ago

you get "something" stored on your device. You don't know if it's a students English paper, home made pornography, nuclear launch codes... or CP. You just get a block of bytes that sits on your drive, and maybe, somebody somewhere has the key to unlock it. Until that happens, you don't know, you don't need to know, and you can't know, that's the whole point.

drcongo 14y ago
Pretty sure this makes it illegal in the UK under our crazy encryption laws [1]. I definitely wouldn't want to be the one to test it. [1] http://news.ycombinator.com/item?id=4234614 http://news.ycombinator.com/item?id=4234614
- mseebach 14y ago
  It might well be illegal under crazy laws, but not the one you link to: Beneath the vitriol a very important point was made: The prosecution has to prove beyond reasonable doubt that you have the key and that you're refusing to hand it over. The presence of software like this, traces of your participation in such a network is reasonable doubt. Even with this proven, refusing to decrypt is what they get you for, not what they think you've got encrypted.
- sturd 14y ago
  If you only have portions of alleged illegal files on your machine, you won't be able to decrypt it. As far as the blocks of data goes on your machine, it's indecipherable rubbish.
- conductor 14y ago
  That's it! The governments take our privacy and freedoms one by one, and we are afraid to fight it or even say NO... They have won. The people is already under total control, nobody can take the power from the people ruling this world.

__alexs 14y ago

This is the reason that there is no public Tahoe-LAFS network also. To run a node on a network like this you need to be brave, much braver than even operating a Tor exit node. The addition of the long chain activity log may perhaps add some disincentive to upload CP in the first place but getting the economics of that (e.g. ease of getting upload privileges) right sounds like a difficult balance though.

soult 14y ago
As someone who ran the public facing node with web-interface for the public grid for a while, I can assure you that it is less concerning than running a Tor exit. You will know the IP address of everyone who downloads and uploads from you via the web-interface, and you won't know the data of those who only use your node for storage. The only complaint I ever received was from Sony after those "Geohot revenge hacks", in which they claimed that a hacked user database from one of their services was copyrighted by them, while at the same time they denied that it actually was the real user database. We did some searches for the URL of the webinterface and discovered that it indeed was mostly used by "Anonymous" as a Pastebin alternative, at which point it was decided that we did not want to aid in the spread of personal information, which is why it was shut down.[1] So you are right, there is no public grid because of unwanted files, but not because of Child Porn, but because of some script kiddies. 1: http://article.gmane.org/gmane.comp.file-systems.tahoe.devel/5718/ http://article.gmane.org/gmane.comp.file-systems.tahoe.devel...

JulianMorrison 14y ago

Going by the description, if you know a file's plaintext, you know both its plaintext hash (decryption key) and its encrypted hash (storage key). The communication to request files uses the storage key. It would be rather easy to identify by statistical means, people who request files of a common type, for example known CP images. Forwarding a few requests for CP or having it stored doesn't indicate anything. Reading or writing a lot of known CP would be probable cause for a search. This is especially easy because the majority of CP is not new and FBI presumably has the whole damn lot on a hard disk somewhere. They can easily pre-compute hashes and just sit monitoring. As a result, this network would be useless for CP-mongers, they'd get caught about as easily as using plain old FTP. On the other hand, I do think the ability to pre-compute hashes is a flaw that massively reduces this network's usefulness to dissidents. It is quite effective as a "publish a manifesto network" with a secret writer and overt readers - the original write is of a never-before-seen file, there is no hash to monitor. It's unsafe as a "store my pirated stuff" network, writers of a well known file can be tracked. And it would take very little statistical monitoring to reveal the interests of a reader.

maxerickson 14y ago
It would be trivial for a user to layer some encryption on top of the service, preventing anyone on the network from doing any analysis of what they are transmitting.
- JulianMorrison 14y ago
  Not if it has to be decrypted as soon as it reaches the forwarding nodes - the way to monitor it, is to run black-hat nodes.
  - maxerickson 14y ago
    If I publish gibberish, all you know is that I have published gibberish.
  - engtech 14y ago
    index sites could have password encoded rar files of AwesomeNewMovie-1080P-SceneHipsters.rar (like they already do if they're using file lockers) wouldn't the hash be different for every rar password used? I guess the problem is once any copy infringing hash is found it is trivial to search the network and find everyone who has transferred it? edit: although if the only writer is the uploader, would you be able to tell who read the copy infringing copy vs who just has it because their part of the network?