BitTorrent Tracker Blocks 'Infringing' Hashes | Hacker News Reader

BitTorrent Tracker Blocks 'Infringing' Hashes

torrentfreak.com

69 pointsgslin28 comments

It's funny really, I ran a substantial amount of Tor exit nodes in Germany since 2014 and everytime I got into touch with the police about stuff happening on them, they asked me to "filter" things going through it. The thing is that as per TMG §8.1.3: "Service providers are not responsible for third-party information that they transmit in a communication network or for which they provide access for use, provided that they [...] did not select or modify the transmitted information."

Essentially, if an operator was to "do a good thing", they'd legally become liable for all traffic. That was quite a learning experience for me.

So this is basically the inverse of the Good Samaritan law? If you do /something/ you might become liable because you did not do enough?

Good Samaritan isn’t a blanket protection. If you have ANY knowledge or training you can be sued anyway. Unfortunately due to that law and others things, there’s absolutely no way I’m touching or helping anyone. Blame the litigious American society

Do you have any examples? The few states I just read through (Washington, New York, Colorado) have explicit carveouts for the situation you're describing as long as they had no professional obligation to the patient.

Here's Colorado's:

> Any person licensed as a physician and surgeon under the laws of the state of Colorado, or any other person, who in good faith renders emergency care or emergency assistance to a person not presently his patient without compensation at the place of an emergency or accident, including a health care institution as defined in section 13-64-202 (3), shall not be liable for any civil damages for acts or omissions made in good faith as a result of the rendering of such emergency care or emergency assistance during the emergency, unless the acts or omissions were grossly negligent or willful and wanton. This section shall not apply to any person who renders such emergency care or emergency assistance to a patient he is otherwise obligated to cover.

IANAL, but as I understand it, the basic idea is like how saying sorry can be an admission of guilt/responsibility in some legal systems. Once you start moderating, you admit it's within your ability and it's your responsibility to do so (and usually at the scale most service providers it's not realistically feasible to moderate all content). So either you're responsible for moderating all the content, or you moderate non of it.

Edit: clarity

It's arguably the difference between being a utility (the phone company passes all calls through; if someone makes a death threat through it that's not their problem) and a publisher (if the NYT publishes an editorial calling for the murder of some random person, that's very much the NYT's problem). Definite fuzziness around the edges, tho.

EDIT: Though now I think of it, even with this analogy, blocking phone numbers when directed to by the government wouldn't normally threaten a phone company's status...

Yep, it's basically the reasoning behind why Section 230 of the Communications Decency Act was created in the states:

In Cubby, Inc. v. CompuServe Inc. they didn't moderate and were not liable as a publisher because they did not have any direct knowledge of the defamatory content as they just transmitted it.

In Stratton Oakmont, Inc. v. Prodigy Services Co. they did moderate some things and were liable due to the editorial control they had over it.

Section 230 fixed that by letting services filter offensive content without incurring liability for everything else. Without it you'd have to either do no moderation at all or perfect moderation, letting nothing offensive/defamatory/etc through.

does the tor anonymizing process not count as modifying the information?

In that case TLS or similar would also trigger it.

It's just a different method of routing - wrapping the original packet in more and more envelopes.

Reminds me of an 2007 talk from CCC, sadly in German: https://media.ccc.de/v/24c3-2355-de-trecker_fahrn

It's how they wrote one of the first "performing trackers" as most others around the time where python or php based. https://en.wikipedia.org/wiki/Opentracker And it seems OpenTrackr from the article is based on Opentracker software.

It's an really entertaining talk. They destroyer a router from hetzner when they first rented a server because of the traffic.

> It's an really entertaining talk. They destroyer a router from hetzner when they first rented a server because of the traffic.

Would magnet torrents fit in DNS TXT records? Seems like an interesting way to distribute load across global DNS servers.

https://news.ycombinator.com/item?id=36945177 ("Show HN: File distribution over DNS: (ab)using DNS as a CDN")

Open trackers like this don't distribute the torrent files themselves-- all they do is help you find the swarm for a torrent given a hash as input.

A magnet hash is little more than a hex-encoded infohash along with a few trackers to use for coordination and a filename wrapped in a URI, so DNS TXT wouldn't provide much compression (~30B DNS record to ~200B magnet URI).

Given an infohash, a torrent client has to find a swarm member (or DHT) to download the full torrent metadata.

I've asked this before but why is this legally allowed or enforced? How is a hash of something equal to being the thing? Do copyright laws have specific sub-laws when it comes to digital media?

DMCA seems more like a hammer abused by corporations. It seems like laws are written solely for corporations.

OpenTrackr can remove whatever they want from their tracker. Rights owners are free to ask them to take down material. They can then either challenge that request or do it.

There is a legal concept of "Contributory copyright infringement" which can make people liable for damages if they knowingly contribute, cause, or induce others to infringe on copyright. https://en.wikipedia.org/wiki/Contributory_copyright_infring...

Does running a tracker do this? Maybe. OpenTrackr could find out what their court thinks by challenging rights owners until a case ends up there. Do they want to? Doesn't sound like it, so they remove the material.

Change a byte? :P

You can do that, but then you lose all current seeds who will see an error in their torrent client unless they choose to track down the new magnet link to continue seeding.

Or distribute hashes printed on t-shirts:) Anyone recalls of the infamous De-CSS suit, and all the ways the community found to distribute that code?

http://www.cs.cmu.edu/~dst/DeCSS/Gallery/index.html

I think I still have my T-shirts somewhere.

lots of ways to deflect hash matching.

i was afraid this might happen some day. like how ipfs links (hashes) on gateways are often blocked.

Consider using torrents in I2P to avoid this.

The article says that OpenTrackr is

    a significant and reliable player in the BitTorrent ecosystem

and that it sees

    near daily peaks of 500,000 connections per second

and that it is monetized via Patreon. So I had a look at their Patreon page, curious how much they make. It turns out to be ... $51.63 per month.

Is that what you make these days, when you help millions of people on the internet?

I'm not sure what a "torrent tracker" is though. I would have thought it is a website to find torrents. But Similarweb says the website only sees 50k users per month. So it is probably something different which is not accessed by users but by ... software?

Ah yes. Asking ChatGPT, it says a torrent tracker is kind of an index service. And this service is used by torrent client software. Not by users via a browser.

"Tracker" is a bit abused. A tracker just keeps track of peers on a given hash. Websites offering an index aren't the same thing. No-one directly uses the website opentrackr.org, they just put the UDP tracker in their torrents

BitTorrent is a peer-to-peer way of distributing files. Trackers are services that tell your client software who your peers are. Indeed, they are typically only accessed by BT client software, not by a browser.

Everyone can create a .torrent file.

While you create it you can enter one or multiple URLs of trackers that everyone connects to when they open the torrent file. (Or none, there is also a decentral why of doing torrents)

Clients just send a hash to the tracker URL and get a list of urls back with other people who send in a request with the same hash.

The tracker does not care how you share those torrent files. I think it's just a list of hashes and URLs.

This might not be 100% correct, but I hope you better understand it :)

There are multiple things to get confused: indexers and trackers.

Indexers are what people that don't have sonarr/radarr/etc interact with directly - a collection of magnets and/or .torrent files.

Trackers are what download clients interact with, usually magnet/.torrent has multiple trackers included in metadata. All these do is match hash to peers. You technically don't need it with DHT, but they speed up peer discovery by a lot compared to just DHT.

Indexers (really often just a forum) often act as trackers as well, but they don't have to.

Trackers often remove .torrent files and magnets at request, but leave enough information for you, you to create new magnet link and use their tracker for peer discovery.

The first few points you made are really great, this is often confused, but:

> Indexers (really often just a forum) often act as trackers as well, but they don't have to.

Indexers might operate a tracker (and often include their tracker by default in all their torrents/magnet links, but they're still not the same thing.

> Trackers often remove .torrent files and magnets at request, but leave enough information for you, you to create new magnet link and use their tracker for peer discovery.

No, I don't think that's true.

> Is that what you make these days, when you help millions of people on the internet?

Yup. https://arstechnica.com/information-technology/2014/04/tech-... "OpenSSL typically receives about $2,000 in donations a year and has just one employee who works full time on the open source code." (This was in 2014, things have improved there.)

Log4J is run by volunteers. https://www.technologyreview.com/2021/12/17/1042692/log4j-in...

There is a generally recognized funding problem. https://stackoverflow.blog/2021/01/07/open-source-has-a-fund...

Reply on news.ycombinator.com