Hacker News Reader

Comment by sprash | Hacker News Reader

SciHub needs to be decentralized. Zeronet seems to be a good blueprint on how to do it.

I am afraid the basic problems are still not solved with regards to proof of authorship and file integrity - how do I know the pdf I’m downloading is what was published?

I’m just in a “be careful what you wish for” state of mind, if there was no one in charge of sci-hub, the publishers could go on attack and fill the database with noise, copies of papers with numbers and methods altered.

Sounds like it would be a good idea for authors to start providing checksums for their papers

Right it’s not insurmountable, authors can publish public keys and sign the files - it’s a UI/UX problem like everything else in crypto.

Keybase makes it fairly easy, but people still have to learn what it means and why it’s trustworthy - my bet is things don’t change, there is a small percentage of people who understand how to verify the source, and the general population who either believes anything or nothing.

In the context of scientists and professionals tho maybe it is achievable to do some outreach and get people on eg keybase, something user friendly

Most people I've been advocating Keybase to, just assumed it's yet another place where you create an account and hence you must trust them (now owned by zoom, boo-hoo).

I found it well explained etc, but it's hard to reach everybody.

Lets say Zoom wanted to sell Keybase. Lets say they wanted to sell it to someone like myself, who would run it in a non profit like a utility, similar to Let's Encrypt. Lets say I'd then integrate it with Stripe Identity and gov IDP providers (US: login.gov, UK: gov.uk verify). This would then allow you to publicly sign damn near everything with an identity you could choose to (but not be required to!) connect to your IRL identity.

That sounds what's needed, an extension of your IRL identity with top notch tooling to manage signatures (what PGP/GPG should've been) instead of docusign and similar that are charging an arm and a leg to "sign" PDFs with generated initials and signatures. We could go further; the signature is human readable in the rendered PDF (or whatever), and the Internet Archive takes a snapshot as an oracle notary when published, similar to Certificate Transparency for certs, but for all sorts of digital artifacts (the Internet Archive's snapshots have been used by a court of law for evidence authentication, so it's a trusted system [1]).

It ain't hard, it's just work.

[1] https://www.theregister.com/2018/09/04/wayback_machine_legit...

Unfortunately that's not practical. When you download from a uni gateway, pdfs are often auto-watermarked with the source. That way the authors have no idea what checksum you see. And the places which don't do that yet could easily start padding the end of the pdf with a random number of spaces to stop verification efforts.

It would be kind of neat if that could be layered so that one could not only verify that their source-provided copy is legit, but also that the underlying paper itself has also not been modified.

It should be pretty easy to do, to be fair. There are many ways. The easiest would be to have a compressed file (or whatever) that is signed with the source you downloaded it from (and the digest published), and the PDF itself would be signed with the authors' private key. It is not the best way to do it, but it could work.

Torrent file is a checksum.

Yes, the price we pay for the exploitation of stupid movies? Torrents should be the standard way to distribute anything.

Checksums are for error correction, I think you’re referring to digital signing, unless I’m misunderstanding the issue being referred to

In the context of sharing data between people, people use checksums with the same meaning as cryptographic hashes, as anything else would break for nearly all use-cases.

Digital signatures are actually overkill. The same infrastructure one uses to discover the authorship of a paper can distribute file hashes without any loss of autentiction, and I don't think anybody needs the non-refutation feature they bring. Maybe there is a nice use case for a paper authorship database with a PKI, but to my view the idea goes against an open scientific community that I think is much more valuable. (But again, maybe there is a way to have both.)

You can store revisions in a Merkle tree, too.

> I am afraid the basic problems are still not solved with regards to proof of authorship and file integrity

These are not basic problems. We're talking about scientific papers, not deeds to a piece of land or something.

> how do I know the pdf I’m downloading is what was published?

How do you know the paper photo-copy you have of an article is what was published? You don't 100% know, you make a reasonable assumption.

The exceptional case of needing integrity verification can have a niche solution.

A DOI to IPFS directory would be cool. Is it still a copyright violation if you write a hash, but don’t put a IPFS link?

If the argument holds that a hash is equivalent to holding/sharing the file, there’s some big problems for PhotoDNA given strict liability laws.

> A DOI to IPFS directory would be cool

Q: How open is the DOI system itself?

It's mostly freely readable. It's closed to publishing (gotta pay CrossRef or other licensees) and otherwise a pain to interface with.

All you really need is a searchable database that points you to the torrent containing the paper you want. Then just download the part of the torrent that you need.

Long as the seeders stick around, this is decentralized, simple, and very hard to block.

Pretty sure this already exists, too, though it's extremely unpolished.

Couldn't we just use something like LimeWire? (Does anything like that exist now?)

See lib gen and r/datahoarders, there are torrents available split into chunks, I think it was 77 terabytes last I checked

An interesting question I think, is what value add does Sci-Hub provide, because obviously it wasn’t happening before Alexandra made it happen, does it outgrow her or is she holding it together?

How about creating SciPubCoin, a blockchain where you get one coin from each published paper you submit!

> SciPubCoin, a blockchain where you get one coin from each published paper you submit!

Probably better to create a system that includes a reputation currency, since you can't 'spend' your reputation: https://medium.com/metacurrency-project/reputation-is-orthog...

First the interface problem needs to be solved, after that we get a good picture of adoption.

That there are gigantic torrents available is almost useless. A popcorn time type of GUI client is needed that allows search, can dl the right chunks reasonably fast, seeds the rare chunks, has tit for tad implemented for a group of torrents. Could even do full text search by downloading all possible candidates after applying some bloomfilter.

I think it's sorta decentralized. You can download the SQL files (couple GB) from the libgen site and search in it for the IPFS hashes you want, then download p2p from IPFS. A more decentralized way of searching those databases for the hashes would be trickier.

I think utilizing Chia coin would actually be a better idea. Incentivize people to donate their hardware space with real money.

Chia is proof of waste, it doesn't store anything useful.

Reply on news.ycombinator.com