Hacker News Reader

Comment by yasp | Hacker News Reader

How do services like Sia handle illegal content?

How does http handle illegal content? Is there any reason that content should be blocked at a protocol level instead of punishing the person who created it through existing regulations? If Sia has a way to remove such content it loses its decentralized nature, which is the whole reason it exists in the first place.

Should it exist? Well sometimes important content is illegal, such as political content in China. It’s good to have a way to publish important illegal content, even if bad stuff slips through.

What if someone posts illegal violent or sexual content? That is unfortunate, but it means that a real person took the time to post such content on the network. Keeping them from speaking will not change their warped beliefs, it will just hide them from the world and keep people from remembering that evil people exist. The person who published the content should be punished through existing regulations and the content should stay on the network to remind us that some people are horrible. Hopefully no one accesses it.

Perfectly said. Removing "illegal" content does not solve the fact that the content exists. The problem should be tackled at the source.

I believe that censorship resistance is a key value proposition for decentralized file storage. So its agnostic handling of illegal content is a feature, not a bug.

In the spirit of blockchain and decentralization, I think you're right. But practically, explaining that to the authorities will probably not be a pleasant experience if they manage to find cp or other illegal data on your hard drive.

The data is encrypted by the client, so that's theoretically impossible. Neither you nor the authorities have the ability to determine what file fragments (whole flies aren't stored; just fragments) are on your PC.

It's not theoretically impossible for law enforcement to discover the encryption keys to some illegal files on someone's computer. Then they could go around arresting people who host the chunks. Of course those people wouldn't have known about those files in particular, but they were knowingly running software that enables hosting illegal files. A judge would have to decide if that's OK.

Doesn't AWS also have the same problem? Someone could upload encrypted illegal content, then later law enforcement could discover the key. Why hasn't AWS gotten in trouble for that yet?

No large cloud provider allows anonymous usage. They take down content on request and assist law enforcement in catching the non-anonymous people doing illegal things on their platforms.

Okay, bad example. AWS is a paid service so obviously they have more information about their users than most. What about Dropbox or OneDrive? Both of those services allow files to be stored and shared with no requirement to identify yourself when you're creating an account, beyond providing an email address.

Both Dropbox and OneDrive scan your content to determine if it matches known illegal content (be it illegal pornography, DRM content, etc) and will remove it and remove you from their service.

See https://www.microsoft.com/en-us/photodna

If someone pre-encrypts data and then uploads that to Dropbox, it gets more complicated and AFAIK involves more of monitoring the IP addresses that things are coming from and/or being shared to.

Same argument for Bitcoin, cash etc. You have a thousand degrees of slippery slope in what constitutes "enable". Does paying your workers in cash for tips enable tax evasion?

Also, I'm not sure what scenario in which you would be able to find the encryption key, yet not have access to the wallet controlling the contracts? Even if you did, I'm not sure why hosts could not assist in cancelling contracts in a similar fashion to cloud providers taking down content on request.

US has strong third party protection laws. If it doesn't, HN could be held accountable for illegal files that were converted to base64 and then posted in the comments.

I am not a lawyer and this is not legal advice, but as a third party you are not responsible for illegal data uploaded to your server/machine so long as you are not aware that it is illegal data. Once you are informed that there is illegal data on your machine, you have 24 hours to remove it.

Someone could upload data to you then later reveal the keys. If the authorities have the metadata and keys they can determine who is storing the data.

So basically Jeffrey Epstein gives you a CD full of encrypted files and asks you to hold on to them for him? Shouldn't be any problem with that.

I wonder about whether it's right to be renting your storage space away without knowing what it's being used for. I don't want to directly contribute toward bad things happening.

We need to move away from centralised internet.

You don't have any real proof that Company XYZ aren't using your money to do bad things.

You would stop participating if it turned out the Sia network was mostly used for bad things. In the same vein, you may choose not to use Amazon because it is unfairly treating warehouse workers.

It's fine then because you'd only be indirectly contributing. Just like paying your taxes or buying fast food and clothes.

All data is fragmented and encrypted, so it's impossible to know whether a particular host is storing a fragment of illegal content or not. I suppose if you somehow _did_ find out you were hosting a fragment of illegal content you could breach the storage contract (and pay the resulting penalty) but that's very unlikely because, again, all content is encrypted.

Encryption on Sia happens on the client-side, so the host has no guarantee that the file is actually encrypted.[1]

For encrypted data, I think it will be similar to the situation with other storage providers. If law enforcement searches your computer and discovers that you've uploaded illegal content in encrypted form to S3/GCS/Mega (especially Mega because they make it so easy to upload client-side encrypted data), then law enforcement will order the provider to destroy all copies of the data.

It will be interesting to see what happens if the provider is a Sia host. Law enforcement entities have standard processes for reporting illegal content to Amazon/Google/Mega/etc, and those companies have teams responsible for handling those requests. Casual Sia hosts currently wouldn't know how to handle such a request. The outcome might be that the compliance costs are too big for casual home users, so hosting on Sia becomes a specialized task that only dedicated companies can provide.

[1] https://lukechampine.com/irresponsible.html

I think someone technically skilled enough to run a Sia host would also be skilled enough to know how to delete delete a specific file off their hard drive. Sia could even provide a UI to make that easy. Though if Law Enforcement has access to the client's encryption keys, I think chances are it'd be way easier for them to just issue a delete command to the Sia network directly.

We do in fact already make it trivial to remove content from your host. Law enforcement can provide a list of hashes, which you pass as parameters to a CLI command that deletes them.

Seems like this could be a common use case for pirates. Similar to how Megaupload or Fileshare worked a few years ago.

Sia's encryption doesn't protect the file hosts, if the uploader posts a link + decryption keys for pirated content to a public file sharing forum.

Does the take down notice go to everyone that hosts a fragment of the file? Who is liable if the uploader can't be traced?

Good question.

I suppose that would only work if whatever keys the pirate needed to publish to allow the data to be downloaded wouldn't _also_ give the keyholder the ability to delete that data. Otherwise the copyright holder could just issue the command to delete the file themselves. I'm not sure if Sia works that way or not; would be interesting to see.

Since they say their intent is to compete on price with S3 / CDNs, it seems possible to be able to download a file without having permissions to delete that file. If that were not the case, then Sia would be limited to personal backup only.

It's confusing, because they refer to themselves as a potential competitor to S3 several times in the linked article, but I thought I read somewhere that conceptually what they're building is actually just the data persistence layer of a service like S3?

A complete S3-like service would require a third-party tool on top of Sia. Goobox[1], for example, uses sia as a storage backend and provides an S3-compatible API[2].

In other words, right now - I think if you are interacting with Sia directly you can do whatever you want with the files you have access to. Not 100% sure about that.

[1] - https://goobox.io/

[2] - https://doc.goobox.io/#section/Why-you-should-choose-Goobox-...

A complete S3 service on top of Sia is what SiaPrime[0] is doing.

[0] - https://siaprime.net/

Depends on how it's implemented though, does it not? Eg, I can encrypt a file and give it to 10 people and they'll be clueless of what is in it, yes. But, because of how I encrypted it it is clear that the contents are the same on those 10 people.

So if I am busted and my key/etc compromised, it is possible that those hosts are compromised as well.

This says nothing of Sia's implementation, just that encryption itself does nothing to prevent a party from being prosecuted from illegal content.

Couldn't the same thing happen with AWS? You encrypt an illegal file, store it on AWS, then get busted? Why would those 10 people in your example get in trouble but not AWS?

Well that too depends on implementation, I imagine. AWS has channels for communicating information about their part in illegal content. So does Reddit/Youtube/etc. Even early IPFS plans[1] included channels to take down content you may be hosting.

Though, I feel like you're injecting meaning into my reply. I was replying to your comment about how authorities wouldn't know if content on my computer (a Sia host) was illegal. My point was simply illustrating that encryption by itself does not prevent me from being the host of illegal or illicit content.

[1]: probably not implemented yet.

I find the concept of "Illegal Content" conceptually questionable. Authorities do not care much, I assume, if you possess illegal content. What they care about is if you share illegal content.

Say you have a pro-democracy pamphlet on your hard-drive in China. If they find it they would imprison you no doubt but they don't care so much to look for it, and it is hard to find if you never share it with anybody.

SIA provides private storage so if your only crime is possessing illegal content but never sharing it with anybody no big deal (I would assume). But if you share it then SIA can not protect you because the exchange must happen somewhere outside of SIA.

> Authorities do not care much, I assume, if you possess illegal content. What they care about is if you share illegal content.

You'd be wrong - people get nabbed for having or creating child porn, not just distributing it.

Which is stupid. If I were a member of a foreign government I’d use sophisticated hackers to plant that kind of content on anyone I didn’t like. Automatic jail for life.

I am sure.

It would be an interesting case for the Supreme Court. Did you do something illegal by allowing SIA to store encrypted data on your hard-disk not knowing what it was?

It doesn't. The last real application of Sia that I heard of during the previous crypto boom basically sounded like renting your HD space out to people who would potentially use it to store illegal content.

The next step is to fight the idea of "illegal content". Bits are just bits, some just upset the elites, just like nipples.

And some of it is child porn. Does that only upset the elites?

Child porn is the emotional argument, the only possible case where most people might agree that some content can be illegal. A more representative scenario is illegal copies of music or a political pamphlet in China.

Sorry, how is child porn only an appeal to emotion?

Never said it was "only" an appeal to emotion, just that it's not representative. It's meant to stop discussion before it starts.

A question that you can’t answer isn’t the same as one meant to shut down discussion

Open questions :

1) If childporn was not banned, how many people would consume that content anyway?

2) What about hyper-photorealistic childporn movies with fictional characters and future rendering technologies? How will you tell the video is true or not and worth to be removed?

Technological progress will not stop because some people abuse the technology.

That's the biggest risk of permissionless / decentralized -- you learn quickly why permissioning and centralization are important.

Can you provide some of the reasons?

Otherwise encrypted illegal content is stored on everyone's computers, and technically makes them potential felons. And thanks to the magic of the blockchain, it's indelibly recorded forever.

What’s to stop a hacker from planting such content on your computer?

Infosec usually, the difference here is you're taking on the risk and data knowingly and willfully. "Officer, it's part of a blockchain thing called Sia" is unlikely to satiate them.

All data is encrypted automatically before it is uploaded to the network. It is impossible for individual hosting nodes to see what is being stored.

Reply on news.ycombinator.com