Hacker News Reader

Comment by dfc | Hacker News Reader

Its unfortunate that they were not distributed via bittorrent and/or a tor hidden service. The files are large enough that downloading them with the "free download" option is a terribly long wait. I do not understand how this has so many upvotes after being up for such a short time. Have that many people actually downloaded the files already?

Does anyone have any guesses about the string at the end of the announcement? Is that something Anonymous normally does?

  6693b5c82009cdf9a2abf2fc80d0aeab25aa8a3a5d5d33ec24dd1c5a3038fee0b10a8460d4b3cf922ce77e2abda13ca6d3fd0c18081be3c7626587c767fb7d7b

View on HN

It’s not straightforward to distribute via Bittorrent anonymously.

What hurdles/risks are present in bittorrent that are not incurred when uploading to a free file hosting service? I do not think bittorrent and/or free file services provide any serious level of anonymity against a group with pockets as deep as the CoS. Let's not forget these are the people that brought down anon.penet.fi...

N.B.: I also updated my post to include using a tor hidden service. I thought I had included it originally.

From the responses I have read it seems that I should have been more clear that I was also taking censorship resistance into consideration.

Just use Tor bundle and that’s it. The only way you can shoot yourself in foot is if you use flash uploader and that bypasses Tor (fortunately plugins are disabled in Tor bundle AFAIK).

Seeding via Tor? You need to configure Torrent client to use Tor, make sure it doesn’t leak anything (DNS lookups, publishing to DHT or tracker, some stuff on the protocol level was a problem as well). There’s nothing that comes working out of the box. Of course it’s not rocket science, it’s just a bit more work.

Hosting just via hidden service is actually worse than uploading to random locations on clearnet:

1) Still no way to do load balancing with hidden services

2) It’s usually slower anyway

3) If your server gets compromised you’re toasted, unless you use hacked servers, or buy your servers with Bitcoins or stolen CCs.

The best network for publishing that kind of leaks would be Freenet or I2P + Tahoe. But those are not nearly as popular (and secure) as Tor.

I was assuming someone from anonymous could handle figuring out how to setup tor to seed.

More importantly hosting via hidden service is not worse than uploading to depositfiles. Hidden services protects both the uploader's and the downloader's anonymity and it is much, much, much more resistant to censorship. I am not sure what "hosting gets breached" has to do with the discussion.

I guess it’s not a major issue when just hosting some static content, but still if someone gets access to your server sitting behind Tor, you better make sure you don’t have any activity that can tie you to that server.

This is how some people running CP sites via Tor were caught.

In order to get access to your server they need to circumvent the anonymity that tor provides. Hopefully if you go through the trouble to publish via hidden descriptors you know not to include your name/SSN/gps/cell-number in your apache headers;)

This is completely tangential, but can you point me to the Tor investigations? The interaction of tor/law-enforcement is something I am extremely interested in.

> In order to get access to your server they need to circumvent the anonymity that tor provides.

Not necessarily, the CP sites were hacked using PHP vulnerabilities or something similar, not to mention your hosting provider could just get interested in your network activity for whatever reason.

> This is completely tangential, but can you point me to the Tor investigations?

Nothing I have bookmarked, sorry.

Thanks for checking. Sadly the bookmarks always go missing...

Another thing is that you shouldn't really do BT over Tor. The network is not set up for it and you consume a great deal of resources.

Because uploading it to a free file hosting service can easily be done via a compromised machine and/or tor (don't know how well uploading large files over tor works though) - maybe even a library/public computer, making it quite hard to trace (though when using a public computer you need to take other precautions, like avoiding surveillance cameras). Also since nothing is made public instantly you have time to erase any traces.

With bittorrent you need at least one seeder that is available long enough to feed the swarm (in decent time), during that time a lot of things can go wrong (if anything goes wrong when uploading to a free hosting service you just start over, nothing lost).

And when the hosting service receives the inevitable take down notice from CoS? CoS lawyers brought down anon.penet.fi I am sure they can convince depositfiles that they do not want to go to court.

By that time everyone that wants it has it ;)

There's nothing stopping people from uploading the files to bittorrent. It's only the hackers' anonymity that matters.

  > With bittorrent you need at least one seeder that is available long enough to feed the swarm (in decent time), during that time a lot of things can go wrong (if anything goes wrong when uploading to a free hosting service you just start over, nothing lost).

Don't most clients support web seeding[1] these days?

[1]: https://en.wikipedia.org/wiki/BitTorrent_(protocol)#Web_seed...

Well, would that be easier to do than just seed it yourself? (with the added risks mentioned above)

I'm guessing that few hosting companies make that easy to do, since you often have to go through some form of queue to even get the ticket needed to download it.

That’s actually pretty good way to bootstrap torrent anonymously. The issue is just keeping webseeds alive long enough, which can be tricky if the upload is fairly big.

512 bits, most likely a hash, probably sha-512 for its ubiquity.

If you've ever met or known anyone into Scientology then you'd get why it has so many up votes this quick. I up voted before reading the emails because I know as I'm sure others do how important it is to expose their acts. But yeah, a torrent wouldve been nice but oh well.

>The files are large enough that downloading them with the "free download" option is a terribly long wait.

Do you have to actually _wait_ for them to download?

Reply on news.ycombinator.com