10 ms·

Show HN: Every single torrent is on this website

138 points by tdjsnelling 1y ago

avidiax 1y ago
> Many crawlers and indexers continuously pick random or sequential infohashes and announce themselves so they can later detect other announcers I can't follow the logic here. How does this detect other announcers?
- aspenmayer 1y ago
  The way I understand it, these extraneous infohashes are functional honeytokens. https://en.wikipedia.org/wiki/Honeytoken https://en.wikipedia.org/wiki/Honeytoken > In the field of computer security, honeytokens are honeypots that are not computer systems. Their value lies not in their use, but in their abuse.
  - avidiax 1y ago
    So they are basically detecting bots that indiscriminately try to download any detected infohash, right? That's not detecting "announcers", but maybe more like detecting "indexers".
    - aspenmayer 1y ago
      > That's not detecting "announcers", but maybe more like detecting "indexers". I think you’re correct, as the secondary freebooting indexers are adding their tracker(s) after the fact of the private torrent’s creation/origination to the original prefilled list of trackers, and inserting their tracker(s) to the reuploaded, usually public, torrent, and sometimes even removing the original private trackers so as to not phone home and tell on themselves. I’m happy to be corrected, but private trackers typically bind the downloading IP of the torrent to the announcing tracker to validate legitimate clients. Private trackers don’t consider any extra trackers (announcers in this context) as valid or authorized. I have heard that modded BitTorrent clients can intentionally misreport upload stats to fudge the numbers for gaming your quota, as many private trackers/torrent sites enforce a positive >1.0 or higher minimum ratio. I’ve heard of ways that folks with legitimate access to the private torrent tracker and torrents clone the IPs of other clients and then use a secondary torrent client to request blocks, bypassing the tracker entirely and not reporting any downloads (or uploads, for that matter), so the quota of the first legit client is not affected positively or negatively.
- tdjsnelling 1y ago
  By announcing itself, the indexer makes itself more likely to be handed out as a peer to anyone else interested in that infohash. Every connection attempt it subsequently receives is evidence of another peer announcing or joining that torrent. In effect, it "baits" peers into revealing themselves
gwbas1c 1y ago
I think this would be an even better joke if the site was a setup for plausible deniability for piracy. "I didn't share that! It was on infohash.lol first!"
- redsparrow 1y ago
  The All The Music project is something like that, but for melodies. They created all possible melodies of a 7 note diatonic scale and wrote them to disk as MIDI files, copyrighting them in the process. The melodies were dedicated to the Creative Commons Zero so that people could freely use them without worrying about being sued by someone else who had used that melody previously. More details here: https://allthemusic.info/faqs/ https://allthemusic.info/faqs/
bArray 1y ago
Does anybody know what they are using in the browser to perform DHT? In theory this could be used to share torrent links by a different reference (ideally you could also add an anchor too). Somebody else could have a page that takes keywords and points you to pages hosted on the site.
- tdjsnelling 1y ago
  https://www.npmjs.com/package/bittorrent-dht https://www.npmjs.com/package/bittorrent-dht is used on the server. DHT crawlers/indexers already exist to perform that function; they crawl and store infohashes (+ metadata when they receive it) and allow users to search that metadata to return relevant infohashes
- crumpled 1y ago
  The page is making a WebSocket connection to the server and getting the peer info through the WebSocket connection. I think the magic happens on the server. This is a sample of the client-side code I found handling that: https://infohash.lol/_next/static/chunks/pages/p/%5Bpage%5D-b53445673a06cebd.js https://infohash.lol/_next/static/chunks/pages/p/%5Bpage%5D-...
hackingonempty 1y ago
> There is no validation that an infohash corresponds to a real torrent—any client can announce anything. Many crawlers and indexers continuously pick random or sequential infohashes and announce themselves so they can later detect other announcers, and malicious clients or poorly written bots can spam the network with anything they like. There are also valid clients for completely unrelated protocols using the BitTorrent DHT to find each other.
- sneak 1y ago
  Which? I'm always fascinated by the use of public p2p nets to serve other protocols. The first complete standalone program I wrote was a gnutella p2p client.
  - 1dom 1y ago
    I have the same fascination. You might find https://github.com/dmotz/trystero https://github.com/dmotz/trystero quite interesting - it's fun to play around with, also can use torrent DHT for discovery.
  - pluto_modadic 1y ago
    https://github.com/pubky/pkarr https://github.com/pubky/pkarr is another one
  - aquariusDue 1y ago
    iroh does too: https://www.iroh.computer/docs/concepts/discovery https://www.iroh.computer/docs/concepts/discovery
recursive 1y ago
I don't understand why so many people seem so fascinated by constructions like the library of Babel. Yes it contains the answers to all your questions, but there are some significant drawbacks. * It has more wrong information than right information, with no way to tell the difference. * If you had an oracle that could tell you how to get to the book you need, the navigation instructions to get to the book will be at least as long as the book, on average.
- Llamamoe 1y ago
  I wonder if there is some way to create a latent-space Library of Babel in which you only find incoherent gibberish with extremely long keys, with the shortest ones pointing specifically to the most common/likely strings of text, in manageable computational complexity.
  - recursive 1y ago
    Reproducing the text of a book in the library is a synonym for identifying the book. So this is really called "text compression", which is a well-studied field.
  - samsartor 1y ago
    In a library of all possible strings, this is just text compression (as the other comment observes). But in a finite library it gets even simpler, in a cool way! We can treat each text as a unique symbol and use an entropy encoding (eg Huffman) to assign length-optimized key to each based on likelihood (eg from an LLM). Building the library is something like O(n log n), which isn't terrible. But adding new texts would change the IDs for existing texts (which is annoying). There might be a good way to reserve space for future entries probabilistically? Out of my depth at this point!
  - lxgr 1y ago
    That's arguably just a regular library :)
- cryzinger 1y ago
  To your first bullet, I believe this is one of the central points of the original Borges story :)
wongarsu 1y ago
For a more practical version (containing only infohashes that are observed on the dht) there is bitmagnet [1]. No public instances though, you have to self-host 1: https://github.com/bitmagnet-io/bitmagnet https://github.com/bitmagnet-io/bitmagnet
- skoll43 1y ago
  how to go straight to jail 101
  - wongarsu 1y ago
    You are only downloading metadata, and csam content is filtered. But yes, I would also rate it as a legally risky activity
    - IlikeKitties 1y ago
      > csam content is filtered Filtered how? By some keywords I don't want to know? What about encrypted zips of CSAM? There's no way to filter that in reality. If you want to learn more about why and you can either speak German or can handle youtubes auto translate i recommend this documentation on the matter[0]. The Pedo Criminals are using scene methods to share their illegal content. [0] https://www.youtube.com/watch?v=Ndk0nfppc_k https://www.youtube.com/watch?v=Ndk0nfppc_k
      - wongarsu 1y ago
        Yes, a simple keyword list in the classifier, matched on the torrent name and file names. Easy enough to find in the source if you look for it. That filter won't help against people uploading CSAM as documents.7z. But any filter that would want to do something against that would require downloading the content, which would be even more illegal (in addition to being wildly impractical)
      - knowaveragejoe 1y ago
        Would it matter if it's metadata-only until you download?
throwaway894345 1y ago
Is this legal? I’m of the impression that publishing infohashes to copyrighted content is illegal under DMCA?
- pessimizer 1y ago
  The site doesn't publish any, except the two legal torrents that are on the front page. Any others you have to either request specifically, or are simply randomly generated.
- freetonik 1y ago
  Assuming the web server does not actually store and serve pages in a conventional sense, but rather acts like an application that can render the results of parsing and processing user's input, I wonder what are legal implications. I can generate a Google link with an infohash in the same fashion: https://www.google.com/search?q=1548262051907755713575797913521592584027261648&oq=1548262051907755713575797913521592584027261648 https://www.google.com/search?q=1548262051907755713575797913...
  - extraduder_ire 1y ago
    A few years ago, google stopped returning good links for strings that looked like bittorrent infohashes. Prior to that, it was actually a useful way to find information on and potentially trackers for an infohash you had Yandex is the only search engine that's even marginal useful for that now.
- reorder9695 1y ago
  I wonder how hosting a torrent is different to google showing a link to a pirated movie, both are just holding data that tells you where to find the content, not the content itself
  - akimbostrawman 1y ago
    neither "hosts" the content. they both just point to the destination with the content.
freetonik 1y ago
Love this idea of generating pages based on some strictly defined enumeration. Reminds me of https://everyuuid.com/ https://everyuuid.com/
- tdjsnelling 1y ago
  Me too. That's listed as an inspiration on the index page!
  - zikduruqe 1y ago
    Or every bitcoin public and private address. https://keys.lol https://keys.lol
mikepurvis 1y ago
I wonder how many times on average you'd need to click the "random" button in order to stumble on a page that contains a real torrent.
lxe 1y ago
So there is almost zero chance that opening up a particular page is going to land on an actual torrent.
ratelimitsteve 1y ago
shades of my younger days on kazaa, excitedly download a file called 'hacking-tool-every-possible-ip-address.txt"
mk12345 1y ago
Very cool, reminds me of the library of Babel (of which you also made a version! [1]). I made something similar a while ago, the Hdd of Babel [2], which contains all possible files(*) , and wrote down some thoughts on it [3]. I really like how it makes us think about the nature of information. [1] https://libraryofbabel.app/ https://libraryofbabel.app/ [2] https://mkaandorp.github.io/hdd-of-babel/ https://mkaandorp.github.io/hdd-of-babel/ [3] https://dev.to/mkaandorp/this-website-contains-pictures-of-your-vacation-next-year-audio-of-your-last-words-and-a-description-of-the-end-of-humankind-3fob https://dev.to/mkaandorp/this-website-contains-pictures-of-y...
noman-land 1y ago
All the torrents are in π.

138 points by tdjsnelling 1y ago

> Many crawlers and indexers continuously pick random or sequential infohashes and announce themselves so they can later detect other announcers I can't follow the logic here. How does this detect other announcers?

aspenmayer 1y ago
The way I understand it, these extraneous infohashes are functional honeytokens. https://en.wikipedia.org/wiki/Honeytoken https://en.wikipedia.org/wiki/Honeytoken > In the field of computer security, honeytokens are honeypots that are not computer systems. Their value lies not in their use, but in their abuse.
- avidiax 1y ago
  So they are basically detecting bots that indiscriminately try to download any detected infohash, right? That's not detecting "announcers", but maybe more like detecting "indexers".
  - aspenmayer 1y ago
    > That's not detecting "announcers", but maybe more like detecting "indexers". I think you’re correct, as the secondary freebooting indexers are adding their tracker(s) after the fact of the private torrent’s creation/origination to the original prefilled list of trackers, and inserting their tracker(s) to the reuploaded, usually public, torrent, and sometimes even removing the original private trackers so as to not phone home and tell on themselves. I’m happy to be corrected, but private trackers typically bind the downloading IP of the torrent to the announcing tracker to validate legitimate clients. Private trackers don’t consider any extra trackers (announcers in this context) as valid or authorized. I have heard that modded BitTorrent clients can intentionally misreport upload stats to fudge the numbers for gaming your quota, as many private trackers/torrent sites enforce a positive >1.0 or higher minimum ratio. I’ve heard of ways that folks with legitimate access to the private torrent tracker and torrents clone the IPs of other clients and then use a secondary torrent client to request blocks, bypassing the tracker entirely and not reporting any downloads (or uploads, for that matter), so the quota of the first legit client is not affected positively or negatively.
tdjsnelling 1y ago
By announcing itself, the indexer makes itself more likely to be handed out as a peer to anyone else interested in that infohash. Every connection attempt it subsequently receives is evidence of another peer announcing or joining that torrent. In effect, it "baits" peers into revealing themselves

gwbas1c 1y ago

I think this would be an even better joke if the site was a setup for plausible deniability for piracy. "I didn't share that! It was on infohash.lol first!"

redsparrow 1y ago
The All The Music project is something like that, but for melodies. They created all possible melodies of a 7 note diatonic scale and wrote them to disk as MIDI files, copyrighting them in the process. The melodies were dedicated to the Creative Commons Zero so that people could freely use them without worrying about being sued by someone else who had used that melody previously. More details here: https://allthemusic.info/faqs/ https://allthemusic.info/faqs/

bArray 1y ago

Does anybody know what they are using in the browser to perform DHT? In theory this could be used to share torrent links by a different reference (ideally you could also add an anchor too). Somebody else could have a page that takes keywords and points you to pages hosted on the site.

tdjsnelling 1y ago
https://www.npmjs.com/package/bittorrent-dht https://www.npmjs.com/package/bittorrent-dht is used on the server. DHT crawlers/indexers already exist to perform that function; they crawl and store infohashes (+ metadata when they receive it) and allow users to search that metadata to return relevant infohashes
crumpled 1y ago
The page is making a WebSocket connection to the server and getting the peer info through the WebSocket connection. I think the magic happens on the server. This is a sample of the client-side code I found handling that: https://infohash.lol/_next/static/chunks/pages/p/%5Bpage%5D-b53445673a06cebd.js https://infohash.lol/_next/static/chunks/pages/p/%5Bpage%5D-...

hackingonempty 1y ago

> There is no validation that an infohash corresponds to a real torrent—any client can announce anything. Many crawlers and indexers continuously pick random or sequential infohashes and announce themselves so they can later detect other announcers, and malicious clients or poorly written bots can spam the network with anything they like. There are also valid clients for completely unrelated protocols using the BitTorrent DHT to find each other.

sneak 1y ago
Which? I'm always fascinated by the use of public p2p nets to serve other protocols. The first complete standalone program I wrote was a gnutella p2p client.
- 1dom 1y ago
  I have the same fascination. You might find https://github.com/dmotz/trystero https://github.com/dmotz/trystero quite interesting - it's fun to play around with, also can use torrent DHT for discovery.
- pluto_modadic 1y ago
  https://github.com/pubky/pkarr https://github.com/pubky/pkarr is another one
- aquariusDue 1y ago
  iroh does too: https://www.iroh.computer/docs/concepts/discovery https://www.iroh.computer/docs/concepts/discovery

recursive 1y ago

I don't understand why so many people seem so fascinated by constructions like the library of Babel. Yes it contains the answers to all your questions, but there are some significant drawbacks. * It has more wrong information than right information, with no way to tell the difference. * If you had an oracle that could tell you how to get to the book you need, the navigation instructions to get to the book will be at least as long as the book, on average.

Llamamoe 1y ago
I wonder if there is some way to create a latent-space Library of Babel in which you only find incoherent gibberish with extremely long keys, with the shortest ones pointing specifically to the most common/likely strings of text, in manageable computational complexity.
- recursive 1y ago
  Reproducing the text of a book in the library is a synonym for identifying the book. So this is really called "text compression", which is a well-studied field.
- samsartor 1y ago
  In a library of all possible strings, this is just text compression (as the other comment observes). But in a finite library it gets even simpler, in a cool way! We can treat each text as a unique symbol and use an entropy encoding (eg Huffman) to assign length-optimized key to each based on likelihood (eg from an LLM). Building the library is something like O(n log n), which isn't terrible. But adding new texts would change the IDs for existing texts (which is annoying). There might be a good way to reserve space for future entries probabilistically? Out of my depth at this point!
- lxgr 1y ago
  That's arguably just a regular library :)
cryzinger 1y ago
To your first bullet, I believe this is one of the central points of the original Borges story :)

wongarsu 1y ago

For a more practical version (containing only infohashes that are observed on the dht) there is bitmagnet [1]. No public instances though, you have to self-host 1: https://github.com/bitmagnet-io/bitmagnet https://github.com/bitmagnet-io/bitmagnet

skoll43 1y ago
how to go straight to jail 101
- wongarsu 1y ago
  You are only downloading metadata, and csam content is filtered. But yes, I would also rate it as a legally risky activity
  - IlikeKitties 1y ago
    > csam content is filtered Filtered how? By some keywords I don't want to know? What about encrypted zips of CSAM? There's no way to filter that in reality. If you want to learn more about why and you can either speak German or can handle youtubes auto translate i recommend this documentation on the matter[0]. The Pedo Criminals are using scene methods to share their illegal content. [0] https://www.youtube.com/watch?v=Ndk0nfppc_k https://www.youtube.com/watch?v=Ndk0nfppc_k
    - wongarsu 1y ago
      Yes, a simple keyword list in the classifier, matched on the torrent name and file names. Easy enough to find in the source if you look for it. That filter won't help against people uploading CSAM as documents.7z. But any filter that would want to do something against that would require downloading the content, which would be even more illegal (in addition to being wildly impractical)
    - knowaveragejoe 1y ago
      Would it matter if it's metadata-only until you download?

throwaway894345 1y ago

Is this legal? I’m of the impression that publishing infohashes to copyrighted content is illegal under DMCA?

pessimizer 1y ago
The site doesn't publish any, except the two legal torrents that are on the front page. Any others you have to either request specifically, or are simply randomly generated.
freetonik 1y ago
Assuming the web server does not actually store and serve pages in a conventional sense, but rather acts like an application that can render the results of parsing and processing user's input, I wonder what are legal implications. I can generate a Google link with an infohash in the same fashion: https://www.google.com/search?q=1548262051907755713575797913521592584027261648&oq=1548262051907755713575797913521592584027261648 https://www.google.com/search?q=1548262051907755713575797913...
- extraduder_ire 1y ago
  A few years ago, google stopped returning good links for strings that looked like bittorrent infohashes. Prior to that, it was actually a useful way to find information on and potentially trackers for an infohash you had Yandex is the only search engine that's even marginal useful for that now.
reorder9695 1y ago
I wonder how hosting a torrent is different to google showing a link to a pirated movie, both are just holding data that tells you where to find the content, not the content itself
- akimbostrawman 1y ago
  neither "hosts" the content. they both just point to the destination with the content.

freetonik 1y ago

Love this idea of generating pages based on some strictly defined enumeration. Reminds me of https://everyuuid.com/ https://everyuuid.com/

tdjsnelling 1y ago
Me too. That's listed as an inspiration on the index page!
- zikduruqe 1y ago
  Or every bitcoin public and private address. https://keys.lol https://keys.lol

mikepurvis 1y ago

I wonder how many times on average you'd need to click the "random" button in order to stumble on a page that contains a real torrent.

lxe 1y ago

So there is almost zero chance that opening up a particular page is going to land on an actual torrent.

ratelimitsteve 1y ago

shades of my younger days on kazaa, excitedly download a file called 'hacking-tool-every-possible-ip-address.txt"

mk12345 1y ago

Very cool, reminds me of the library of Babel (of which you also made a version! [1]). I made something similar a while ago, the Hdd of Babel [2], which contains all possible files(*) , and wrote down some thoughts on it [3]. I really like how it makes us think about the nature of information. [1] https://libraryofbabel.app/ https://libraryofbabel.app/ [2] https://mkaandorp.github.io/hdd-of-babel/ https://mkaandorp.github.io/hdd-of-babel/ [3] https://dev.to/mkaandorp/this-website-contains-pictures-of-your-vacation-next-year-audio-of-your-last-words-and-a-description-of-the-end-of-humankind-3fob https://dev.to/mkaandorp/this-website-contains-pictures-of-y...

noman-land 1y ago

All the torrents are in π.