Hacker News Reader

Comment by Ajedi32 | Hacker News Reader

All data is fragmented and encrypted, so it's impossible to know whether a particular host is storing a fragment of illegal content or not. I suppose if you somehow _did_ find out you were hosting a fragment of illegal content you could breach the storage contract (and pay the resulting penalty) but that's very unlikely because, again, all content is encrypted.

View on HN

Encryption on Sia happens on the client-side, so the host has no guarantee that the file is actually encrypted.[1]

For encrypted data, I think it will be similar to the situation with other storage providers. If law enforcement searches your computer and discovers that you've uploaded illegal content in encrypted form to S3/GCS/Mega (especially Mega because they make it so easy to upload client-side encrypted data), then law enforcement will order the provider to destroy all copies of the data.

It will be interesting to see what happens if the provider is a Sia host. Law enforcement entities have standard processes for reporting illegal content to Amazon/Google/Mega/etc, and those companies have teams responsible for handling those requests. Casual Sia hosts currently wouldn't know how to handle such a request. The outcome might be that the compliance costs are too big for casual home users, so hosting on Sia becomes a specialized task that only dedicated companies can provide.

[1] https://lukechampine.com/irresponsible.html

I think someone technically skilled enough to run a Sia host would also be skilled enough to know how to delete delete a specific file off their hard drive. Sia could even provide a UI to make that easy. Though if Law Enforcement has access to the client's encryption keys, I think chances are it'd be way easier for them to just issue a delete command to the Sia network directly.

We do in fact already make it trivial to remove content from your host. Law enforcement can provide a list of hashes, which you pass as parameters to a CLI command that deletes them.

Seems like this could be a common use case for pirates. Similar to how Megaupload or Fileshare worked a few years ago.

Sia's encryption doesn't protect the file hosts, if the uploader posts a link + decryption keys for pirated content to a public file sharing forum.

Does the take down notice go to everyone that hosts a fragment of the file? Who is liable if the uploader can't be traced?

Good question.

I suppose that would only work if whatever keys the pirate needed to publish to allow the data to be downloaded wouldn't _also_ give the keyholder the ability to delete that data. Otherwise the copyright holder could just issue the command to delete the file themselves. I'm not sure if Sia works that way or not; would be interesting to see.

Since they say their intent is to compete on price with S3 / CDNs, it seems possible to be able to download a file without having permissions to delete that file. If that were not the case, then Sia would be limited to personal backup only.

It's confusing, because they refer to themselves as a potential competitor to S3 several times in the linked article, but I thought I read somewhere that conceptually what they're building is actually just the data persistence layer of a service like S3?

A complete S3-like service would require a third-party tool on top of Sia. Goobox[1], for example, uses sia as a storage backend and provides an S3-compatible API[2].

In other words, right now - I think if you are interacting with Sia directly you can do whatever you want with the files you have access to. Not 100% sure about that.

[1] - https://goobox.io/

[2] - https://doc.goobox.io/#section/Why-you-should-choose-Goobox-...

A complete S3 service on top of Sia is what SiaPrime[0] is doing.

[0] - https://siaprime.net/

Depends on how it's implemented though, does it not? Eg, I can encrypt a file and give it to 10 people and they'll be clueless of what is in it, yes. But, because of how I encrypted it it is clear that the contents are the same on those 10 people.

So if I am busted and my key/etc compromised, it is possible that those hosts are compromised as well.

This says nothing of Sia's implementation, just that encryption itself does nothing to prevent a party from being prosecuted from illegal content.

Couldn't the same thing happen with AWS? You encrypt an illegal file, store it on AWS, then get busted? Why would those 10 people in your example get in trouble but not AWS?

Well that too depends on implementation, I imagine. AWS has channels for communicating information about their part in illegal content. So does Reddit/Youtube/etc. Even early IPFS plans[1] included channels to take down content you may be hosting.

Though, I feel like you're injecting meaning into my reply. I was replying to your comment about how authorities wouldn't know if content on my computer (a Sia host) was illegal. My point was simply illustrating that encryption by itself does not prevent me from being the host of illegal or illicit content.

[1]: probably not implemented yet.

Reply on news.ycombinator.com