Collapsing P2P Networks

Andrew writes "I'm a undergraduate at the University of Washington, and after seeing this article on Salon, I dusted off a paper I had written last year. I examined P2P networks under a model usually used in describing animal populations, and found that it may be possible to cause a collapse in the network based on the intrinsic nature of the technology. Just as in animal populations, P2P networks require a sizable "critical mass" of users, and overharvesting can cause a systemic collapse - what if this were done on purpose? Quite ominously, my second recommendation on disruption was carrying damaged or incorrectly named files. You can read theabstract and the actual paper"

Comments

Aiding the enemy, huh?

[ObviousGuy]

You know what we do with those types, don't you?

Re:Aiding the enemy, huh?

[governorx]

Well if it isn't bad enough already I must say that a lot of files on a p2p network are already incorrectly named. Ever tried to download pr0n and find out that whats actually in the video is quite the opposite to whats in the filename. Seriously though, Ive seen people with files on their computers that are false in a certain way.

So we have to go through the points of the author and refute them.

1. Incorrectly named files. Been Done. Been done on purpose. People keep on d/ling. For some reason this example comes to mind: Busy Child from Chemical Brothers sounds exactly the same a Busy CHild from Crystal Method. And I have the Crystal Method cd. BTW, before the Napster fiasco ended, it was possible to crypt filenames.

Also if you name a file incorrectly, the search engines on p2p clients will probably never hit them anyway. And if the filename is misleading other sources can be checked and if nothing else, the filesize/dates of modification can be compared.

2. Broken files. It happens very often. But there are multiple sources on a p2p network so even assuming that clients get baited they will delete the useless/damaged file and re-d/l it from another source. Comparing filesizes before downloading is also a good strategy.

3. As for overharvesting, its just a way to block some traffic and I doubt that this would be legal. If an organisation put resources to this end, many surfers will get a slower service than what they expect and cause backlash. If I get a group of people and we block an street intersection the cops would surely interfere. Essentially what he is saying is lets spam the p2p network to hell until its abandoned. Too bad we all know what we think about spam.

Die llama spammers.

Re:Aiding the enemy, huh?

[hagardtroll]

Will the real slim shady please shut up!

You'll have to excues my P2P ignorance, never used it, but couldn't a rating system like E-Bay, or even Karma on Slashdot be used to label bad hosts and good hosts for the desired files? Then, the spoofing done by different members could be identified.

Re:Aiding the enemy, huh?

[bwt]

Aiding the enemy, huh?

Only if you believe in security through obscurity.

If these weaknesses exist, then sooner or later the RIAA & MPAA will find them. The RIAA will probably hire some "experts" and pay them big wads of cash for "consulting" to find such weaknesses. I wouldn't expect them to monitor Slashdot for research relevent to the P2P battles -- they are far too arrogant for that. Consider their CSS encryption scheme and misguided attempts to use watermarking, which were derided as buffoonery here. This is a battle that will be won by the side that has the better scientific analysis, and I believe that open discussion is a better scientific analysis paradigm.

I think that ultimately, the weaknesses this author discusses must be addressed through some kind of peer review/rating system. A desireable attribute of a P2P system would be robustness to "attack". The internet has posed tremendously interesting problems in "signal-to-noise" improvement, and making networked systems filter noise better is a very desirable feature with important societal implications. Analysis like this can only spur the drive for solutions. If that drive is stronger on the P2P side than the publisher's side, then P2P will perpetually be ahead.

An open forum might be able to achieve a state of "innovation dominance" over a "proprietary" opponent if a critical mass is achieved such that the opponent's practical capability is maximized only if they spend all of their time trying to "keep up" with innovations available in the open forum. Knowledge is power, so the more knowledge that enters the fray via an open forum, the closer that forum is to innovation dominance.

Re:Aiding the enemy, huh?

[Anonymous Coward]

Lay off the crack, man.

Re:Aiding the enemy, huh?

[Anonymous Coward]

> If these weaknesses exist, then sooner or later
> the RIAA & MPAA will find them. The RIAA will
> probably hire some "experts" and pay them big
> wads of cash for "consulting" to find such
> weaknesses.

I'll post this anonymously, as I'm not exactly sure how much of a secret this is... But there are already companies contracting with record labels to disrupt the P2P networks.

These companies place their custom clients into the network at *many* points. Those clients are looking for keywords on incoming searches. If the record label has paid to block that keyword, the fake client either drops the search, or malforms it (mispellings, etc) or just returns false results, pointing to IP's that don't exist. This is not hypothetical, it is reality.

Fun, don't you think?

Re:Aiding the enemy, huh?

[Anonymous Coward]

Ya, well...Rob's got a family to consider now. True P2P and making $$$ don't mix.

Re:Aiding the enemy, huh?

[bwt]

I have no doubt that such disruptive practices occur.

What the publishers probably don't yet understand is how to predict the results of a given level of attack. For example, I'm willing to bet that they distribute their attacks over the various P2P networks. It seems obvious from this paper that a focused attack that uses all available resources on one P2P network is probably more effective than splitting resources over all the networks. It's clearly a non-linear disruption to attack resources curve. In some sense, an attack that doesn't kill the network is useless when viewed as a long term battle.

Re:Aiding the enemy, huh?

[andrewchen]

(I am the author of the paper)

While it's true that some of these strategies are cropping up already, perhaps naturally, my point is that a CONCERTED effort, causing these problems to be quite common, could shut down the network.

For example, for broken files, it may be true that for now, comparing filesizes is a good strategy. How about if there were false clients that reported correct filenames but incorrect data? You think you can use MD5 to fix this? How about if they report false MD5 ids (based on what other nodes are reporting)?

This escalation of conflict causes the systems to be annoying to use, and by turning off the casual user, the goal has been accomplished.

Interesting document, any realworld links?

[jukal]

As you have spent some time studying this field, you have probably run into realworld P2P happenings that follow the "rules" stated in your paper, could you name these, causes and results and the services in question?

Re:Interesting document, any realworld links?

[Anonymous Coward]

Read page 17 and 18.

Re:Interesting document, any realworld links?

[Anonymous Coward]

could you name these, causes and results

Oh man...nobody said nothing about a TEST!

Re:Interesting document, any realworld links?

[jukal]

Yeah, there was something about gnutella. I got greedy and wanted more.

Re:Interesting document, any realworld links?

[sgtsanity]

Actually this is happening. However, it's more from modified user software than anything else. For example, if you search for anything, and don't have your gnutella client filter the results based on your original search, then you get a lot of junk files. What's happening is that certain corrupt clients are sending back that result for every search, even though they never meet any of the search criteria.

While your client is able to filter these erronous results out, the traffic reporting back the results is still being sent over the network. And that's the problem. This technique, taken to an extreme, could crash any network with an open protocol. And that's what the major problem, aside from being able to handle future growth, is for widely-available P2P networks.

It just makes you sentimental for the good old days when all de-centralized networks had to worry about was Soviet nuclear attack.

animal population requires food

[maf212]

There will never be a lack of "food" available as long as enough peoople share their files. So, I don't see a point where there will be too many users. More users just equals more files available. And with things like the new WinMX 3.0 you dl off of multiple people at one time, so if you find a song that, say, 30 different people all have, then chances are it is gonna be the real song with no problems.

Re:animal population requires food

[apt142]

Well, the information is the food. Like in the real world, food is abundant and replenishable. You could say that information is the same. Creative people (artist, musicians, etc.) grow the information in much the same way as a farmer.

The thing you have to remember here is that information is only needed once. For example: You only need to download your favorite song once. What good is two copies of the same thing? This works for software too. Why have multiple software that does exactly the same thing? Plus, if information is something that is learnable then once you have learned it, it becauses useless to you. You can't learn it again (barring any mental disorders).

Let's consider the overhunting issue. With so many users sharing information, you won't have to look far to find what you want. Meaning, you will be able to dl everything you want. With such access, you would have a pretty big store of information yourself, just by dl'ing what you look for. So, The more you have the less you will need.

Sure there will always be more stuff to download. But, you would need to download much less once you reach that saturation point.

Re:animal population requires food

[Anonymous Coward]

Well, the information is the food. Like in the real world, food is abundant and replenishable. You could say that information is the same. Creative people (artist, musicians, etc.) grow the information in much the same way as a farmer.

The thing you have to remember here is that information is only needed once. For example: You only need to download your favorite song once. What good is two copies of the same thing?

Unfortunately your analogy fails. You say we only need information once. You're confusing your metaphysics here. We only need one specific piece (an instance?) of information once.

When we eat, we only eat a specific piece of food once (an instance of food, like that dish of fried chicken I had last night). However, food (in general) is abundant and replenishable, and constantly in need.

The proper analogy is that we are in need of information (in general) all the time as well, and it is over-abundant.

Sure there will always be more stuff to download. But, you would need to download much less once you reach that saturation point.

Nobody ever told my father that he wouldn't need newspapers once he was saturated.

Having said all that, what was the point of that analogy anyway? The paper was a valid application of theory, and was an interesting extrapolation from population models to a p2p network. The despensation model described seems to be a rapid cull of population (harvesting), and has no direct connection with food (except as a means of culling?).

Re:animal population requires food

[Anonymous Coward]

This is completely proposterous. Nowhere in the world of carbon-based life will you find an entity that copies itself without resources.

The world of "stuff" is one of scarcity.

The world of computing is one of abundance.

Business has absolutely no use for abundance. That's why noone is selling air. It's so abundant that it has no market. It's only after something becomes scarce that it's marketable.

So in principle, the better a technology is, the more business needs to cripple it. Otherwise it just becomes free...like air.

Re:animal population requires food

[andrewchen]

What you seem to be arguing is that there is no limit to the number of users. In animal populations, food is only one determinant of the carrying capacity of the environment, along with overcrowding, susceptibility to disease, other resources (water, places to rest, etc.).

In the case of P2P networks, the carrying capacity is probably determined mostly by bandwidth constraints. At the very least, there is a minimum amount of internet bandwidth, and so there must be some maximum number of users. In the paper I discuss this further, citing problems with P2P broadcasts clogging up the network, etc.

Start of a bad trend

[rattler14]

True, the music industry could make tons of phony user aliases and bombard the servers with numerous useless queries and corrupt files. But where does it stop? This same technique could be used by companies to overload a competitors internet servers and capabilities... This method, though very possible, seems more like a mild virus attack that could potentially lead to a backlash of similar attacks from some pretty pissed off users.

Seems like a plausible solution, with some negative side effects.

Re:Start of a bad trend

[Anonymous Coward]

With the legislative convergence of "terrorism" and "hacking", you probably don't want to be the one instigating such an attack, unless you're damn sure your victims aren't going to go to the cops.

Re:Start of a bad trend

[oakbox]

Isn't that the point though? You can't go to court suing Sony because they created a lot of damaged versions of their songs. How does this sound?

"I was trying to download an illegal copy of their copyrighted music and it was damaged!"

I think this is one case where they could simply set up some distributed PC's (different IP's in different class C's) and just have P2P clients serving 'bad' versions of their own copyrighted music. Set up a little consortium of several different records companies, and it becomes DAMN hard to apply an effective filter.

You might counter by setting up a central key list of 'correct' MD5 checksums, but then THAT list becomes a target of litigation from the RIAA.

I don't like it, but it is an elegant solution. Use the power of P2P against itself. Anonymity works both ways.

Re:Start of a bad trend

[ColaMan]

I think this is one case where they could simply set up some distributed PC's (different IP's in different class C's) and just have P2P clients serving 'bad' versions of their own copyrighted music.

Somebody is already doing this ,to some extent.
Searches on gnutella (for just about anything) bring up hits with file names like "your search terms.MPG" ... at 20k or so, I'm not interested. But still, it means somebody's written a client that replies to the P2P network with flawed data deliberately.

Re:Start of a bad trend

[Saeger]

Er, no, that's a result of a gnutella worm. That file is probably a something.jpg.vbs script and it propgates by being dl'd and executed by "morons" who don't look at file extentions.

--

Re:Start of a bad trend

[Saeger]

Sorry, I linked to the 8K .exe worm; it's another one that uses vbscript... here

--

Re:Start of a bad trend

[rattler14]

I'm not disagreeing with you that users of P2P software (usually downloading pirated software/music/movies) are not in the wrong here. I'm just saying that the ideas of network combat, like overloading servers with faulty queries, is a dangerous game that might spread to other internet arenas. Say a competiting online forum is bashing you... Do you write up a program to create a whole bunch of users and flood the message boards with gibberish? Or forget about forums, how about the online support area for another company? Flood those servers so that customers of that company think that they have crappy service.

Point being. Yes, most P2P is used illegally, but the tactics that an orginization like the RIAA would like to impliment to stop these could easily be misused.

Re:Start of a bad trend

[Anonymous Coward]

> You might counter by setting up a central key
> list of 'correct' MD5 checksums, but then THAT
> list becomes a target of litigation from the
> RIAA.

This, of course, is the only effective solution to the problem of mislabeling the files.

A much more useful way to implement it, however, is as a public review/comment site, where the MD5 checksum (possibly in combination with the filename) is the key to the reviews and comments. This could be offered independently of any P2P system as a service like the CDDB. I can't see how this would be actionable by the RIAA or anyone else.

One cool side-effect of this would be the ability for people to post reviews and recommendations of particular songs. If you find a reviewer who likes the same music you do, then you can see the list of songs he recommends that you haven't heard yet, and go looking for them.

The P2P protocols would have to change a bit to also transfer the MD5 checksum, but once that happens you'd be able to see a song you want, click the "reviews" button and see what others have to say about it. If the rating was zero stars and all the comments were "RIAA pollution," you wouldn't retrieve it.

Re:Start of a bad trend

[Anonymous Coward]

Actually, it's incredibly easy. Ever heard of eDonkey2000? Well, it uses HASHES instead of filenames to d/l files. What does that mean? Well, you can set up a site (preferably out of the grasp of USian authorities) where people can submit hashes of files. That makes it damn hard to put in fake files (unless you either hack the client or poison the hash list - both are hard to do). And in most countries other than the us, there is nothing illegal about such a list (you could easily use it for legal purposes - such as finding illegal files - which in most courts outside of the us is OK). They don't take up much bandwidth, and you can even distribute them via the same network, so they are hard to shut down.

Re:Start of a bad trend

[oakbox]

I was at a hacker meeting where one of the participants was describing how he made an online game community operator's life a living hell. It was a constant battle between the admin's building walls and this guy breaking through them.

I *think* that all the admin really had to do was call up the FBI and tell them about the attack on his systems. The hacker would have to be very VERY good to hide his information deep enough that server logs wouldn't eventually yield a name.

The whole of the internet works because most of us play nice online. There are a few trouble makers out here, but, in the main, not that many bad guys.

What I'm saying is, when the activity being worked against is illegal (I'm leaving the arguments about right and wrong for another thread), then there is no one to complain to. If you are a company or individual doing something legitimate, you have legal recourse against the attackers. And, thanks to the DMCA, a very BIG stick.

Re:Start of a bad trend

[GodInHell]

I think this is one case where they could simply set up some distributed PC's (different IP's in different class C's) and just have P2P clients serving 'bad' versions of their own copyrighted music. Set up a little consortium of several different records companies, and it becomes DAMN hard to apply an effective filter.

Time to build the undernet.
The issue with the internet today is that everyone is welcome, as it should be. But it also mean that when devising open ended software systems, any user can recieve and make use of those tools, and by the same token, any user can misuse those tools.

The solution would be an undernet. Existing alongside the current internet, it would rely on some extenssions to the Protocol that are not made widely available. Software could then be written that would function only for memebers of the undernet. Now, change the phrasing slightly, to undernets. Append a group identifier to all packet headers sent by undernet members to other undernet members. If abstracted widely enough, it could even allow different members to remain connected while cycling through spoofed IPs.

This is most clearly desireable when the group that supports the undernet is working toward common goals or ideas. Then if members begin to polute the data-pool with broken files, picking out and removing the offender becomes both easier, and more effective.

I'm sure a one of the IP wizards could come up with something more graceful and effective, so don't judge the superficiality of the proposed solution, so much as the concept of the closed group with regulated, but anonomous, access.

-GiH

Re:Start of a bad trend

[Nehemiah S.]

Isn't that the point though? You can't go to court suing Sony because they created a lot of damaged versions of their songs. How does this sound?

"I was trying to download an illegal copy of their copyrighted music and it was damaged!"


No, but it seems like an independent recording artist would have grounds for a nice lawsuit if he was using P2P as a distribution source. Esp. if there is collusion between multiple companies involved.

Re:Start of a bad trend

[Anonymous Coward]

The quake community I am a member of had this happen... it is moderated, so no cussing or cheating is allowed, and a "hacker" came on with an aimbot and got banned.

He decided to DOS the servers.

The attacker no longer goes to college at the university he was at when he made this poor decision, and is quite lucky that the owner of the community decided not to press criminal charges.

Re:Start of a bad trend

[phoenix123]

oh what the heck...
FINALLY someone points that out.

he is right, AND fasttrack (kazaa, grokster et al) also use HASHES of some sort to download a file.
and there already are some forums where information about dead filenames is collected. for that, its only important for long video files, mp3's so small, false downloads don't matter much.

Re:Start of a bad trend

[NaDrew]

it would rely on some extenssions to the Protocol that are not made widely available.

1. How do you keep those extensions out of the hands of the people you're trying to keep out?
2. Isn't nonstandard extensions to standard protocols exactly what people are up in arms about Microsoft doing with things like Java and HTML?

Re:Start of a bad trend

[netik]

I think there's a way around that too!

You don't need to maintain a centralized list of known good MD5 checksums. Transmit the MD5 along with the song. The song you want is the one that most users have with the same MD5. Alternately, compute and show the number of users who have that song with that md5.

This eliminates bogus uploading of music as most people will delete or destroy bogus copies. If a single user attempts to create hundreds of accounts with garbage data, then filter this against source IP or some identifying factor.

cheap music please

[oever]

All these P2P programs can have a lot of problems:
- music downloaded can be wrong or low quality
- music is often illegal
- download is speed is really slow

What labels should do is let users download music for a small fee. For example by buying 100 songs for 100 bucks. Songs to be chosen by the user at any time.

I think a service like this can be really succesfull. The labels do not need to be affraid of piracy because of the crappy quality or low survival rate of these programs.

Re:cheap music please

[Anonymous Coward]

For anyone to buy into that the major label would have to distribute the wav file of the CD track, not the lossy mp3 or some other lossy format. Even then the fee can be no more than 50 cents a track. I won't pay $1 a track because at that rate I can just go out and buy the god damn CD and CDs are already overly artificially inflated compared to cassette tapes. They would have zero distribution costs besides bandwidth so the cost should be MUCH less than a CD in a store. No cover art, no jewel cases, no distribution costs.

Re:cheap music please

[ranulf]

What labels should do is let users download music for a small fee.

Good point. I actually very much approve of these tactics being used to hinder people freeloading, despite being shocked how expensive music and films are too buy.

However, I am very much for record compaies distributing music via the internet. By cutting out the end retailer, who typically take 50% of the final price of the CD, and removing the cost of media manufacture, there is no reason why these goods shouldn't be available for those that want to download them. There'll always be the hardcore fans who want the boxed editions (check out special edition box sets, etc..) but a lot of people also are only concerned about the actual music. In fact, it could probably even be argued that if music companies sold the music in MP3 formats, the die-hard music afficionardos would still buy the real CDs just for the quality difference.

But back to the P2P issue. You get what you pay for. If you expect to download things for free, you can hardly complain when those things aren't what you expected. If you use a warez search engine, chances are you'll spend the next 10 minutes closing all the popup windows, even if you never actually downloaded anything! You don't see many people up in arms about that.

And if you think the record companies don't deserve their profits, think again... Why do you think there are always scores of new bands signing up to these labels? Because the record companies invest heavily in lots of bands, many of whom will flop dismally. They invest in advertising, gigs, promotional CDs, PR parties, you name it. If they end up making 10 times the profit you think is far on a particular band, bear in mind that there were probalby four other bands that they promoted that didn't make it that got the chance.

Re:cheap music please

[MoneyT]

There's a slight difference here between the Warez sites and these new "tactics".

With the warez sites, the ads are there because these guys can't find anyone else to host them, so they need the money for the ads. The ads are not being put up by Bungie, or Blizzard or EA or any of the other companies.

As for the p2p networks however, these files are being placed with the intent of misleading the consumer. Unfortunately for the people trying to use this tactic is in the same way that moderation works on slashdot, so does moderation work in p2p. If a file is a crappy sound loop, no one (or very few people) will keep the file. They will simply go back out untill they find the right file. Then once they have it, they'll keep it. So picture it like this.

The company distributes 100 sound loop files. After a month or so, the number of soundloop files is probably still 100 give or take (and with certain programs like Limewire, identical files are grouped). Now, as soon as one person buys the CD, there is a legit copy (legit meaning real). One person downloads his copy, now there are 2. One person downloads from each of them, 4. One download from each of them, 8. 16, 32, 64, 128. Etc etc etc. In the mean time, the sound loop is still at 100.

Sure the soundloop tactic would be effective maybe for the first few weeks, but afterwards, it's more a waste of money.

Re:cheap music please

[andrewchen]

I want to point out that distributing these sound loop files is only one of MANY different strategies available.

In your scenario, some entity is distributing fake sound files for a little while, and then they stop. Is this realistic? Why would they want to do that??

More realistically, I would expect that they park fake clients on the network 24/7, and distribute fake files all through the day. Then many of the files downloaded would be fake, although not all. As this slowly started to annoy people more and more, Gnutella would gain more of a reputation for having too much noise, pushing out potential users. This would make the # of false users grow percentage wise, which would feed into a loop.

Re:cheap music please

[MoneyT]

I can't wait to see the RIAA on this one. The reason I assumed a singular distribution, or at least a limmited distribution is because I assumed that like all business entities, these companies would want to save money. To provide a constant stream of these files would have a rather heavy cost associated with them. Of course, we can safely assume that this would just be reflected back to the consumers in the form of higher prices and will be justified with graphs and charts showing how the evil napster pirates are costing the industry (whoops, I mean the artists) all of their money.

Re:cheap music please

[andrewchen]

According to the RIAA, this piracy is costing BILLIONS. If continuous distribution of corrupted files is what it takes to shut down the networks, I'm sure that's what they will pursue.

However, I don't even think this would be very costly - writing a program that dynamically generates corrupt MP3s and modifying some clients would probably be pretty cheap, IMO.

Re:cheap music please

[MoneyT]

Yeah, but the costs of not only the programmer, but then the machines, the cost of producing the first corrupt file (these appear to be manufactured) and then tag on the costs of bandwidth, besides, even if it doesn't cost that much, they could say it does. More revenue, and who's any the wiser?

Music industry strikes back?

[kraven_73]

As stated in Salon there are a lot of bogus files. As for now there is enough stuff out there to get the song you want. However, maybe this is just a first try of the music industry to frustrate users of p2p networks. When they get things going they could probably flood the networks with songs, without any means to distinguish them from the good ones.

sinister motive?

[potcrackpot]

The practice of flooding the system with bad files is far more sinister than most of us realise.

This is actually the next step in the Taliban's fight against capitalism. They are continuing their religious war, attempting to reduce our morale by preventing us listening to music, except in short frustrating bursts of the same 10 seconds.

Their aim is to reduce us, to bring us down from within by sabotaging our right to Good Music In MP3 Format.

We Will NOT give in.

Uh, wait. Why did they start with 'No Doubt'?

Re:sinister motive?

[Anonymous Coward]

No it isn't: capitalism is prevening us from listening to music too.

Re:sinister motive?

[Anonymous Coward]

Touché!

Re:sinister motive?

[apt142]

Would we notice if they went to Britney Spears next?

Re:sinister motive?

[denladeside]

Techno and Dance is *supposed* to sound like that :-)

Re:sinister motive?

[macdaddy357]

No we wouldn't notice. People who listen to Britney Spears are too stupid to use a computer. They actually buy the CDs.

Re:sinister motive?

[colmore]

reminds me of a friend's review of Daft Punk:

"Yeah, that is true, but I think it's *supposed* to suck"

Animal Zoo

[dazdaz]

So does that include my Goldfish and Parrot disrupting p2p?

User moderate shared files

[Albanach]

Would a Slashdot style system of user moderation of shared files be a solution? Perhaps public and private keys to sign files as your online handle. Well known names would sson spring up and their signature could be used to verify the quality of the shared file before downloading. Of course there are many reasons people wouldn't want to sign files they might be sharing or have downloaded...

Re:User moderate shared files

[k4m3]

The problem is that as soon as a registry with file signatures is done, RIAA will strike back saying "you can identify the faulty files, so do it".

Re:User moderate shared files

[Cally]

what's needed, then, is a /distributed/ modeeration system - perhaps a bolt-on to the Gnutella protocol? RIAA/MPAA can't sue Gnutella, Inc., cos they don't exist - there are just people writing code and people running code. Yes?

Re:User moderate shared files

[Joakim A]

Yes. Distributed networks without central servers is the way to go. A protocol for fingerprinting of all files and user moderation would be really neat. Might be pretty hard to implement though as we can't trust client side software to calculate the fingerprint. Especiallay as we want to check the file before it is downloaded. Signing might be the way to go but then you can tie the rip to the 'creator', don't want that...

Anyway, these things tend to get solved by smart people who have way to much spare time. I am truly amazed of the amount of work dedicated to cracking and warez..

/J

Re:User moderate shared files

[big_hairy_mama]

This was discussed last time slashdot covered this, and it seems like the consensus was that it would be trivial for an organization to create thousands of bogus users and stuff the balots.

To me, a web of trust makes more sense. It would take some time to get "into the web", but it take even longer for an organization to build up enough trust to effectively distribute bogus files. As soon as they start, their trust is ruined, and everyone knows not to download from that person.

Re:User moderate shared files

[Hellkitten]

what's needed, then, is a /distributed/ modeeration system

And how do you intend to stop them from 'spamming' this distributed system with fake moderations?

Re:User moderate shared files

[trumpetplayer]

The good thing the Internet has is the power to CHOOSE the contents you access. Moderate music files and you will have much more Spice Girls than Dizzy Gillespie. To eat "contents that people like / want to see" we usually just turn on the TV.

Re:User moderate shared files

[FatAlb3rt]

How about a database of checksums for "good" files?

Re:User moderate shared files

[harmonica]

Someone trustworthy would have to provide it, so there wouldn't be too many databases, which would give the RIAA & Co. a way to sue the DB providers ("the database's major purpose is to find copyrighted material"). They'll find a way...

Re:User moderate shared files

[Mizery De Aria]

How about a p2p blacklist filtering out known "bad" files?

Re:User moderate shared files

[Anonymous Coward]

I am truly amazed of the amount of work dedicated to cracking and warez..

That's because you're incorrectly diagnosing it as "dedicated to cracking and warez." That just happens to be what a lot of it is currently used for. But these tools have other uses as well, and these other uses are what motivates the toolmakers.

Do not forget: In the United States, a cartoon depicting someone in a sexual act, where the character appears to be less than 18 years old, is a crime. In Germany, speaking favorably of Nazis is a crime. In France, crypto is(was?) a crime. And don't get me started on the middle east...

RIAA/MPAA are just the convenient enemies. But deeper, darker and more powerful evil lurks in this world, and samizdat-distribution tools are needed to oppose it. Perhaps not today, but for the coming apocalyptic battle of the Internet. The war on drugs, the war on terror, the next war is on you.

Re:User moderate shared files

[dustmote]

Would it really be necessary to have the fingerprinting and the P2P network integrated so closely? Something akin to the CDDB, only for individual songs, might be effective as something that could be accessed by the client program, but not built into the client itself. After long enough to get the first few identifying seconds of the file, it would compare song title and length, rename if necessary or cancel download if incomplete. You would probably have to set some sort of range for that last, so you don't miss getting the sng because the last .5 seconds are cut off. I was always amazed that no one had done something like this before, so no doubt there is some sort of reason this is not feasible, but it would work, at least for a while. It would also provide for some interesting legal battles.

Re:User moderate shared files

[Joakim A]

There is a problem if the first 90% of the song is ok and the rest is corrupt.
What about this: When you request a file it is split into 5-10 parts which can be downloaded in random order selected by the _client_. Each part has a corresponding hash stored in the equiv of CDDB. This way you can cancel download when a 'block' with the wrong checksum is dl'ed. The 'block' hashes would probably have to be stored indexed under a hash of the complete file which has to be provided by the server side. This again makes it necessary for user moderation. Would be a cool protocol..

Although a single network may collapse...

[GnomeKing]

P2P as a concept is unlikely to collapse

Networks come and go, and encounter obstacles as the number of people using the network increases, but as one reaches "critical mass" another is born because the first became too unstable

There are a large number of p2p networks at the moment, some are more successful than others, but importantly they use very different technologies, some of which are less affected by increasing numbers of users
The fasttrack model appears quite comfortable with several million users, when the orignal gnutella protocol couldnt cope with that number (iirc)

I'm sure that a number of p2p protocol designers will attempt to use the ideas in the paper to avoid the various pitfalls

Re:Although a single network may collapse...

[andrewchen]

While it's true that the P2P concept is here to stay, I argue that in the long term, it may not yield the type of easy filetrading that mainstream audiences need to continue using it.

The same way that in general, the average computer don't use IRC or newgroups because of all the clutter and technical difficulty, P2P networks may also become inaccessible to that group.

I remember back when Napster was still in full force - you could find almost any file. Now on Gnutella, it takes much more time and there is a lot more noise than before. P2P networks may eventually be relegated to a second class citizen, used mostly to trade warez, and no longer a threat to digital media companies.

Re:errors

[Assassin17]

not to mention the first two sentences:

"Peer to peer networks have generated significant attention in the recent past, especially file trading networks such as Gnutella commonly found and Morpheusin ecological models of fish and birds. If the mode."

still an interesting read, though :)

Re:errors

[ObitMan]

HAH. I read the article but not the blurb. Is that a /. first?
The paper is a year old.
I wonder what the review of it was or if the prof or assistant even caught it.

Well, atleast we know who skipped maths lessons

[GnomeKing]

In particular, our analysis of the model leads to three potential strategies, which can be used in conjunction:

1. Randomly selecting and litigating against users engaging in piracy
2. Creating fake users that carry (incorrectly named or damaged files)
3. Broadcasting fake queries in order to degrade network performance
4. Selectively targeting litigation against the small percentage of users that carry the majority of the files

Re:Well, atleast we know who skipped maths lessons

[treat]

choices 4 and 1 are the same.

Re:Well, atleast we know who skipped maths lessons

[Saeger]

1. Randomly selecting and litigating against users engaging in piracy

countermeasure: encryption + the bad press that randomly sueing upstanding citizens would bring.

2. Creating fake users that carry (incorrectly named or damaged files)

countermeasure: webs of trust & md5 hashes.

3. Broadcasting fake queries in order to degrade network performance

countermeasure: evolve to shun the DoS nodes (again, webs of trust & a 'witness system' needed).

4. Selectively targeting litigation against the small percentage of users that carry the majority of the files

countermeasure: This being the most effective [scare] tactic of the four, the best way to deflect it would be hiding your identity, or somehow spreading everything available very thin (freenet style) for plausible deniability, or serving from offshore, or rotating selections...

--

Re:Well, atleast we know who skipped maths lessons

[LordLucless]

Yes, you can probably counter all these tactics, but they would still do their job.

If the labels can force p2p networks into a more complex model, it culls the less technically able users. I think if the p2p music sharing networks evolved into systems requiring md5 hash lookups, trust networks and other countermeasures, Joe Schmoe wouldn't be bothered using them. He wants something he can just hook up to, grab stuff, and leave.

Music piracy has always happened. Its just booming now. They just want to stop the boom, not eradicate it entirely.

Re:Well, atleast we know who skipped maths lessons

[Anonymous Coward]

5. Monopolize internet access so you can squeeze the bandwidth out of p2p.

countermeasure: ????

Re:Well, atleast we know who skipped maths lessons

[Anonymous Coward]

Wireless!!!!!

viva la revolution!

if you dont mind the packetloss and the lag of hundreds of wireless AP hops it will be greaT!!

Re:Well, atleast we know who skipped maths lessons

[Dr. Manhattan]

2. Creating fake users that carry (incorrectly named or damaged files)

countermeasure: webs of trust & md5 hashes.

Hmmm. My understanding is you can't compute an MD5 hash until you've got the whole file. So if the malicious host lies about the MD5 sum, you can't know until after you've downloaded the file.

A workaround would be to publish checksums for 1/4 of the file, and 1/2 of the file, and 3/4 of the file, etc. If the MD5 sum fails to match, you abort further downloading. Perhaps the victim publishes a notification that a damaged file was found. (But then you have to worry about invalid, forged warnings.)

This doesn't even solve the problem, it only limits the time wasted. Malicious hosts can create files that are accurate for the first 50%, and get the user to waste 50% of their time. Half a song is a lot less than half as valuable as a full song. Perhaps you add a "resume" function like FTP so that the user can try to download only the remainder of the song elsewhere, again comparing intermediate checksums along the way.

Re:Well, atleast we know who skipped maths lessons

[dachshund]

If the labels can force p2p networks into a more complex model, it culls the less technically able users

That really depends how complex the user experience becomes. Napster was far more technically complex than the traditional "download from a website" model, but it still attracted millions of regular users. That's because all of that complexity was hidden behind a cute little easy-to-install UI. Kazaa is even more complex than Napster, but the user experience is almost exactly the same (excepting the spyware, of course.)

Many of the countermeasures suggested above would be fairly easy to integrate in a transparent way, and I imagine they will be. In the long term, I think this is a losing game for the record companies. The cost of maintaining the "war" on p2p systems is going to be far, far higher (by many orders of magnitude) than the cost of building a smarter p2p network (and for many p2p coders, it isn't even about cost.) Also, the more successful the labels are, the tougher and more resistant the p2p networks will become.

In the short term, on the other hand, it might make sense. If the labels make a strong effort to pull people into cheap, legal music download services now, this sort of disruption will serve them well. But I'm not particularly confident that the labels have their act together on this. (And even if they do, the battle will still go on over video downloads.)

Re:Well, atleast we know who skipped maths lessons

[runswithd6s]

And this is where the "web of trust" is built. If you download a file from a malicious host, time to label that host as a black hole. Let's say you're using gnutella and assume that it has implemented the following feature. If you find that host A is malicious, you ignore the hostmask, similar to IRC host matching ("ignore host-a.domain.tld" or "ignore *.domain.tld"). Now, whenever a query arrives from that host, your client replies something like "440: I'm ignoring you, because you have a poisoned share file(s): weird_al-eatit.mp3."

It's a simplistic approach, but it helps avoid the "unknown" on a first download from that host. It gives the user a course of action for future interaction with that host.

Re:Well, atleast we know who skipped maths lessons

[pmineiro]

> countermeasure: encryption + the bad press that randomly sueing upstanding citizens would bring.

...

> countermeasure: webs of trust & md5 hashes.

look at gnutella protocol sometime. every node is a router. it is easy to modify packets as your routing them, and mediadefender.com is almost certainly doing this. it's the ultimate man-in-the-middle.

if you want to attach a cryptographically secure signature to each of your packets which verifies the source, that makes it easier to litigate against you. since a sizeable fraction of the capacity of the network is contained in a relatively small number of high bandwidth ("university") nodes, these signatures could have a chilling effect on the entire network.

as for bad press, the evil pirates who are stealing music and trading child porn have always faired worse than the media conglomerates who control the nightly news.

i'm not saying these problems are insurmountable, but these questions do not have trivial answers, and should be taken very seriously.

-- p

Re:Well, atleast we know who skipped maths lessons

[SN74S181]

Yes, but the 'garbage generators' from the Music industry won't just exist on the server side, they'll also have rogue clients out there labelling legitimate download sites as 'bad.' Client-side labeling to identify 'black holes' won't be validated, to do so does away with anonymnity, requiring a central validating body subject to attack. Sony hires 150 people to mislabel the legit sharers. Those 150 people each adopt 24 different identities to make their trouble, etc. etc.

P2P relies on a consensus model, just like much of the Internet as a whole. Consensus models don't scale very well to huge communities.

Re:Well, atleast we know who skipped maths lessons

[yoyoyo]

MD5 hashes could be completely transparent to users. A trusted server or set of servers could contain hashes of all the most requested/likely-to-be-spoofed files. Since there is nothing litigatable (new word?) about md5 hashes, there is no reason to farm out the hashes. New versions of p2p software would simple not return results that failed the hash--new users would never even know there was checking going on.

Re:Well, atleast we know who skipped maths lessons

[ender1598]

Another thing to consider is that not every file will be exactly the same when created but may still be a perfect copy of the original. What if you make your mp3 with an extra .5 sec of silence at the end or normalize it. Any change will affect the checksum but the file will still be perfectly valid and discarding it just because it doesn't match up to the standard you selected isn't necessarily the smartest thing to do. Same thing applies to divx rips too.

Re:Well, atleast we know who skipped maths lessons

[jafac]

5. As a content-provider, buy a cable company (AOL/TW?), control massive broadband marketshare, and cap upstream bandwidth, deny static IP's, and tip off the FBI to folks to illegally violate copyright.

Re:Well, atleast we know who skipped maths lessons

[alonsoac]

The complexity would increase in the network protocols not in the way the saoftware it used by the people. So the programs could still be simple (are they simple now?) and provide all this nice counter measures. Maybe someday we would use intelligent agents which one teaches what kind of files one wants to get and they go and find them. Maybe just select a profile or a type of music and the program would take care of searching and selecting based on ones preferences.

Ask a silly question...

[CaptainAlbert]

From the introduction in the paper:

> This paper aims to address the following
> questions:
> 1. How must the depensation model be modified
> in order to account for conceptual
> differences between P2P networks and animal
> populations?
> 2. What are the conditions necessary to cause
> catastrophes in P2P networks?
> 3. What does the model imply about other ways
> to limit or stop P2P networks?
> 4. What is the most effective method to stop
> P2P networks?

I bet if you'd set out to answer a more interesting question, you'd have obtained a more interesting answer.

Natural populations are well known for their ability to adapt to their environment; to mutate or change their behaviour in response to stimuli (threats) in their surroundings. If you truly wish to study P2P networks as if they are ecosystems or populations, there are plenty of more productive entymological questions to be asked.

This paper reads like a biologist saying "given, say, fish - how can we go about killing them?"

Nice to see *some* scientific analysis of this subject, however misdirected.

Re:Ask a silly question...

[capt.Hij]

Some native populations have an amazing capacity for rebounding. This is especially true of insect populations which have a reputation of getting through population bottlenecks better than any other animal. However, the "Allee effect" is a well known biological phenomenon.

Many populations have a critical population level, and if they fall below that level they have a low probability of rebounding. For example, fruit fly maggots are more efficient when eating in groups and cannot survive if they cannot get enough eggs on the same fruit.

By the way if you pick up an ecology journal you are likely to find at least one paper on this subject. Trying to understand the Allee effect is an important aspect of understanding an organism and how it interacts with its environment.

Re:Ask a silly question...

[PhilHibbs]

This paper reads like a biologist saying "given, say, fish - how can we go about killing them?"

Not really, it's more like "Given this species and it's environmental factors, what change in those factors could lead to it's extinction?" which is an entirely reasonable and useful question to ask.

Re:Ask a silly question...

[Anonymous Coward]

No biologist would ever write that. You've got too many apostrophes.

Re:Ask a silly question...

[0x0d0a]

Some native populations have an amazing capacity for rebounding

Okay, fine. At least the major P2P networks (Gnutella, Napster) have a fair amount of diversity, providing resistance against a community-wide single attack wiping out the community.

Furthermore, all of them can rebound quickly. A patch can be distributed across the network very quickly -- in a week or so, updates can be installed by the majority of users. That's *fast* compensation, allowing easy rebounding.

gnutella has already been dos'd..

[Anonymous Coward]

a few years ago a denial of service attack was launched against the gnutella p2p network. this was done by sending out large 'ping' packets, which were then sent all throughout the network, effectively using up the entire bandwidth of many slower nodes. i don't recall how this was stopped, perhaps by a client update, or maybe the attackers just stopped. if the later is the case, gnutella is probably still vulnerable to such attacks.

+5 Not Funny

[cca93014]

overharvesting can cause a systemic collapse

trying
very
hard
to
think
of
porn
joke

Why don't they....

[HowlinMad]

Just make a Beowolf cluster of these networks then?

Re:Why don't they....

[julesh]

" (Score:1, Interesting) "

Err, hello, moderator... that was a 'lets make a beowulf cluster' joke, and not in the remotest 'interesting'.
:-)

Pythonesque...

[Anonymous Coward]

...Our four, four! potential strategies are:

Definition?

[Mr_Silver]

Whilst one man alone is not going to change things I get a little annoyed by the fact that people call Napster a peer-to-peer application.

In fact, it was really a client server application which only on downloading a file did it actually make any connection with any other user.

True P2P has no server and needs no server. Napster had and needed such a thing to work.

Personally I wouldn't call it peer-to-peer at all, but if I was forced to, I'd far rather call it a hybrid P2P and Client/Server solution.

Re:Definition?

[Anonymous Coward]

The index servers were peers. Therefore it is peer-to-peer just like every other network in existance.

Re:Definition?

[bankman]

The most commonly used term is 'brokered P2P", because that's essentially what the server does: It brokers the connections of the clients. The clients are still peers and talk directly to each other, very much like the old phone system, where operators functioned as the brokering server (well, I will work on my metaphors).

Re:Definition?

[Anonymous Coward]

Napster is called P2P because the content/resources are stored and distributed by the peers. It isn't a pure P2P network, but I can't think of too many things that are. Gnutella even uses super-nodes and 'leaf'-nodes' which behave in a client-server fashion. There is a good article on about the definition of P2P here

Re:Definition?

[Heisenbug]

I guess you're right, but it doesn't seem that significant ... from the user's perspective there's not much of a difference between Napster and Gnutella. The searches look essentially the same, you're still downloading from other users, and the concept that makes these services work (every file you download is now available for upload) is still there. Since this article deals with the user bases of sharing services rather than their internal architecture, I think it's fair to refer to them by an umbrella term, and P2P is certainly easier to write than anything else ...

I have to say this, so sorry...

[Graspee_Leemoor]

Because everyone knows but none have yet said it.

Sharereactor/Edonkey cannot be flooded with damaged or renamed files and neither can any other network/client that relies on hashes of the downloads to ensure the file is the same.

As for using loads of bandwidth by doing loads of useless searches in an automated way, it would be very interesting to see how the different networks coped with this, especially the "next gen" edonkey, which is called "flock" and is in beta, and is supposed to use no servers...

graspee

Re:I have to say this, so sorry...

[Anonymous Coward]

"Sharereactor/Edonkey cannot be flooded with damaged or renamed files and neither can any other network/client that relies on hashes of the downloads to ensure the file is the same."

Yes they can. It's trivial to (re)write a client that send out "the right" hash for any given file that matches a search. The user then have to download it before he notises that the file is a fake.

To find the right hashes, you just have to monitor the searches and grab the results.

So, even with hashes you can decrease the efficiency of the network.

Re:I have to say this, so sorry...

[lfourrier]

Yes, but the client can be required to prove it's integrity, by a hash on himself. Of course, it needs to know the key, and this is reverse engeenerable, but if some major do that, some norvegian or russian can throw them the DMCA.

Re:I have to say this, so sorry...

[Anonymous Coward]

Goooooo Nooorway!

We rule d;-D

Re:I have to say this, so sorry...

[wheany]

On eDonkey every part is hashed individually, so your client will notice that a part has been corrupted and will download it again. Of course it slows the process, but it's faster to re-download 10(?) megs than 650 megs...

What a guy..

[Sapphon]

it seems that a simple and relatively inexpensive measure, which Herron says requires no more than "an intern in a room," might be worth serious consideration on the part of the recording industry.

Further questions about the proposed intern scheme were referred by Stacey Herron to her associate Mr William Clinton, recently put in charge of seeing the 'preferred files replicate and populate'

shuuuuut uuuuup!

[los furtive]

You'll ruin it for all of us!

Corporate Strategy Revealed!

[Sapphon]

if a user doesn't like a previewed track, "then the industry and that record would have benefited from [that user's] ignorance."

I'm suprised the record labels let Britney Spears have any time at all in that case - hell, think of the teenage boy market if all they knew was what she looked like *grin*

Re:Corporate Strategy Revealed!

[Anonymous Coward]

Hell, I'm no where near being a teen anymore but I love Britney videos... with "mute" on of course.

Re:errors HAHAHA

[liloconf]

i just redownloaded his paper and he fixed some of his errors, seems he doesn't want a few thousand people seeing how much of a tard he is :)

Time to re-vamp P2P specs

[wackysootroom]

The RIAA will use this to their advantage if they are not doing so already. If the P2P community does not stay one step ahead, the RIAA will literally make Gnutella and other file sharing systems useless.

Re:Time to re-vamp P2P specs

[macdaddy357]

If they kill P2P, they will just send teens to the flea market to buy pirated CDs. They are tying their own noose! http://www.dontbuycds.uncoveror.com/piracy.htm

Re:Time to re-vamp P2P specs

[MoneyT]

P2P is in an ever evolving state. Before Napster bit the dust, doomsayers were saying it would be the end of filesharing. Whoops, they missed the mark there. It's sort of like the Hydra. Cut off one head and 2 more take it's place. And in essence that's what will happen. IF the RIAA ever managed to kill gnutella (arguably the largest system currently), a whole bunch of people would be scrambling to create new networks. The result would be 3 or 4 new and effective networks. Sure they'd be smaller, but only temporarily.

Like it or not, P2P is here to stay. It's a system with legal and illegal uses. The legal nature is what keeps the creation of a complete ban impossible, and the illegal nature is what keeps the system evolving.

MD5, etc.

[Slashamatic]

The problem always existed with P2P networks that they could be poisoned, with misleadingly named files for multimedia files and viruses for wares.

A system that permits sharing of copyrighted material is hardly going to provide a simple way back to resolve the real originator of the material. It is difficult to prove but probably likely that many bad files come from persons connected with the production and distribution of the original material.

There are several sites now that publish checksums and sizes of P2P files. If you trust the site, then you have a way of validating files.

The main issue remains is so-called leaching. That is, those who take but do not give. This may be out of fear or out of selfishness or it may even be just that the user is new. The community response seems to allow small downloads to anyone but to restrict larger downloads to those who do share themselves. I believe there are even some automated tools that will perform this check.

Re:MD5, etc.

[jawtheshark]

The main issue is so-called leaching.

While I agree entirely with the fact that leeching is a problem, you should consider these facts:

• Not many people have the bandwith to share. I don't, I share nevertheless but restrict upload speed to 3KByte/second and 2 allowed connections. Why? I have only DSL 256/64kbps, which means I have about 8Kbyte/second upload and I give away a potential 6. I find that generous. This is however not enough! People do not have the patience to wait at these speeds, most of the time uploads that start on my machine (I check that from time to time) about 99% are cancelled by the remote side.
  Yet, I download! Most of the time pr0n, and from time to time music (usually when I heard a good song on the radio).
• Firewalls. I have a firewall... and I will not in any case turn it of because I want to run Gnucleus. This effectively reduces my own choices to download: anyone who runs a firewall too is not able to communicate with my machines. If everyone runs a firewall, P2P networks like Gnutella would become useless. PUSH only works when the receiver does not have a firewall.

So technically this makes me a leech: I want to share files but due to bandwidth restrictions and due to firewall issues my sharing-abilities are clearly diminished. I have the goodwill but not the resources.
It wouldn't be the first time a P2P client advertising T1 performance aborts me and I find that very frustrating. Probably people using the tools you mentioned, and considering me a leech. Nice... :-(

Oh, and one thing about the whole P2P thing I don't like are the insanely large filenames filled with idiot keywords. Keywords in filenames....tsss.... Better would be a kind of database that associates keywords with files you chose on your harddisk. At least that way your files could have halfway decent-length filenames. Of course maintaining that would be a bit of work, but maintaining a filesystem filled with junk-filenames isn't any better.

Finally a little question for the P2P junks out there: many people claim they get to learn new kinds of music by P2P sharing. I won't say it isn't true, but how? You still need a handle to search new stuff? You just type in random keywords, or what? Just curious, because I'd like to broaden my musical horizonts a bit.

Re:MD5, etc.

[Saeger]

people claim they get to learn new kinds of music by P2P sharing. I won't say it isn't true, but how?

The best way is simply having people with eclectic tastes recommend random shit to you -- either IRL, IM, on message boards, etc. Another way, which I like, is using Amazon's recommendation system.

Also, some file sharing apps have a "Browse User" option, and this is very handy for queueing up bands you've never heard of from a user with possibly similar tastes.

Not everyone likes being spoonfed engineered culture...

--

Re:MD5, etc.

[catenos]

Finally a little question for the P2P junks out there: many people claim they get to learn new kinds of music by P2P sharing. I won't say it isn't true, but how? You still need a handle to search new stuff? You just type in random keywords, or what? Just curious, because I'd like to broaden my musical horizonts a bit.

First, if you hear one song on radio or so and manage to remember the interpret(?) or tile, you can relatively easy search for other songs and test listen (meanwhile that works with quite some online shops, too, e.g. amazon).

The second, and probably what people claim, is the possibility (at least in edonkey) to view the file list of others. I.e. download some songs, then, if you notice someone having several of the songs, choose their file list and browse for other stuff (in edonkey you have to add them as friend first).

Re:MD5, etc.

[Mr F J Musical-Troll]

• Finally a little question for the P2P junks out there: many people claim they get to learn new kinds of music by P2P sharing. I won't say it isn't true, but how? You still need a handle to search new stuff? You just type in random keywords, or what? Just curious, because I'd like to broaden my musical horizonts a bit.

Some suggestions:

• Read music magazines to get an idea of bands you might like.
• Do a search for a band/song you like, and then, for the users that give results, search those users' music collections and download stuff you don't know.
• Random words in the search terms.
• Search by style. E.g. "Jazz" might bring up "The Best Of 20th Century Jazz" or "Acid Jazz Hits" albums, or something along those lines.
• Internet radio stations. They often have a larger range of music than normal radio, and often split by style. Example: Radio Free Virgin.
• Hang out on #mp3 channels on IRC and wait for the requests and sends to appear on the channel. Pick and choose any that sound interesting.
• Seach lyrics sites by random words, and download those songs (useful when you want to fit a song to a specific purpose, say on a film or presentation.)

I have had a lot of success with these methods.

Re:MD5, etc.

[prefect42]

I've always just done searches for "unplugged" and "live", taken wild guesses looking at the results and had a listen. That's given me some damn fine music that I never would have got near otherwise. Probably only bought 4-5 albums off the back of it, but that's out of at most 10 I bought in a year.

jh

Re:MD5, etc.

[Anonymous Coward]

if you refuse to open the port needed for sharing on your firewall then you are lying. you are NOT willing to share.

quit trying to sooth your ego and think you are a nice guy when in reality you are not.

Open the fucking port on your firewall.

Note: gnutella clients shoud detect this and refuse connection to any client that has it's request port closed. that'll fix these self ritious buttheads.

Re:MD5, etc.

[SN74S181]

The best way is simply having people with eclectic tastes recommend random shit to you -- either IRL, IM, on message boards, etc. Another way, which I like, is using Amazon's recommendation system.

Neither of those is at all inherently related to P2P sharing. Amazon's recommendation system would exist if there was no P2P system at all, and the same with IRL, IM, and message boards.

Re:MD5, etc.

[ny_p]

I stopped using P2P since napster went out of buisness.. Why ? for all the reasons you mentioned. I decided to make friends with ppl that i traded with and buit up a web of contacts. Now i trade exclusively with ppl with ftp servers. These ppl themselves have good contacts with others so i usually have a pretty good assortment of the latest stuff. Also they dont put stuff out that is bad quality or incomplete. regarding your question of broadening your musical horizons. If you know few ppl that share similar tastes then chances are you are going to see a lot of stuff you have not heard before. just start building trust with ppl that you share with in many cases they recommned stuff and i do the same. the result is i spend less time looking for stuff and usually go with recommendations.

Re:MD5, etc.

[pgh_raver_dave]

You still need a handle to search new stuff?
I joined email lists that discuss the type of music I'm interested in. DJ's will post playlists or exclaim how wonderful such and such track is.

Re:MD5, etc.

[Heisenbug]

I don't use filesharing networks to actually discover new music, but they're great for looking into music you've heard about somewhere else. My favorite is internet radio -- most streams will tell you what you're currently listening to, and then you can download other tracks by the same artist. I found an artist that way a few days ago and ordered his CD ...

Re:MD5, etc.

[Slashamatic]

I run DSL too (a faster version though) and limit my uploads to 2, I find that better than bandwidth throttling. The router/firewall shares the bandwidth nicely, so both uploads go reasonably quickly at about 8KB/sec each (thats bytes).

Your point about file names is a given. Fast-track might be scumware but allows you to meta-tag files which is useful. This what I miss most when I use Gnutella.

OTOH, I allow inbounds for P2P on my firewall and I have no problems sharing files.

Re:MD5, etc.

[jawtheshark]

I allow inbounds on my firewall and I have no problems sharing files

Just a question: is this a firewall/NAT setup or a standalone machine? On a standalone machine I understand how to allow this. However I don't know how to allow this on firewall/NAT. You can see which ports I have open in another post around here, but it still is beyond me how the NAT is supposed to "know" where to redirect the incoming request. (I don't run a filesharing app on the server of course, besides it doesn't have enough diskspace for that)

I need this NAT setup: I have about 7 computers, 2 for me and one for each one in my family. Yup, I spoiled them ;-)

You're welcome in hinting me the rules in need to add to pf.conf in order to allow inbound Gnutella requests for my clients scattered around my intranet.

Re:MD5, etc.

[Slashamatic]

By default, NAT allocates outbound connections dynamically but typically you also have the ability to configure static inbounds.

This will map an inbound connect to a particular IP address on your local nextwork. You can only configure one port/protocol combo to a particular local address, but it works fine, whether you have a local Web server or a P2P application on your side of the firewall.

Re:MD5, etc.

[jawtheshark]

Yup, I know NAT does allocate outbound connections dynamically. That's no problem, besides, PUSH woudn't work without it, isn't it? Besides: PUSH works perfectly, only, most people cancel the download (actually upload *grin*) after 5%, probably due to the speed.
I also know about "rdr" in nat.conf. I had to use it in order to set up the ftp-proxy. However neither of this is going to help me: it is just not possible to know who is going to be using the filesharing service. Could be me, my sister my brother or even me on my laptop...they all got different IP addresses (obviously). Static mapping is not an option.

Now that I think of it: the only thing that would be useful would be some kind of gnutella-proxy. Run the proxy (on the server) which itself does not do filesharing. However my clients connect to it and the proxy provides the outbound connections for people that want to get my files. Just an idea, perhaps it already exists.

Re:MD5, etc.

[Slashamatic]

If there is more than one using the file sharer, I agree that you have a problem. However if you are sharing via UDP, it shouldn't really be an issue.

What I do is somewhat cruder because one system serves files (it has a shared file area) and runs a p2p client. Other systems use the common file area for downloads. Without private filesystems for Pp2p, it makes it kind of difficult for my son to grab pr0n.

However, I had heard something about a Gnutella proxy on their site but I have no idea what is happening about it.

Impotent by Nature

[Bumpy bits]

The failiar of ANY system is ultimatly inevitable. Best bet is to play with it while it still works

choices 1 and 4 are different...

[GnomeKing]

Choice 4 is much more likely to give "good" results since more of the major holders of illegal material are targetted

Holywood would get better results by shutting down illegal DVD manufactureres of spiderman in korea (or wherever they are) rather than someone who makes a copy for his friends

Choice 1 gives everyone the same chance of being targetted and thus small time distributers/downloaders will be hit a higher percentage of the time and not have as great an effect on the overall level of content available

Re:choices 1 and 4 are different...

[scumdamn]

I've actually seen the VCD of Spiderman here in India and it's rotten. Asian subtitles, bad color, stretched vertically, terrible sound, etc. VCDs are really popular here, though, because the population simply couldn't afford the exhorbitant prices the MPAA would want to charge them.

What you MEANT to say

[Anonymous Coward]

"music is often illegal"

Today's pop music is so bad it OUGHT to be illegal.

Re:What you MEANT to say

[Anonymous Coward]

why do you keep stealing it, then?

Solution: Decentralized Collaborative Filters

[jake_the_blue_spruce]

Collobarative Recommendations such as Amazon.com uses, (or Eigentaste or RecTree in academia) finally have algorithms that make it fast enough for an average PC to perform the operations. A decentralized version would not only foil spoofing and spamming, but would let you discover new things beyond the industry marketing machine. Does anyone have information on such work?

Re:Solution: Decentralized Collaborative Filters

[Fizyx]

Does anyone have information on such work?

The ratings info is merely additional content that is to be shared P2P.

I imagine that P2P CF would be organized like Francis Heylighen's "Superorganism".

Disrupting P2P networks - legal?

[CoderByBirth]

I agree that it would probably be possible to quite easily kill any P2P network; imagine one of the nodes in any Gnutella-type network sending faked information all over the place or something similar, or some kind of malignant Direct Connect client.

But let's say that the music industry/whoever did this, would it be legal just because P2P networks are "possibly used" for distributing copyrighted material?

I don't see the difference between sinking someones Direct Connect hub and launching a DoS attack against a webserver.

Er, what?

[Rogerborg]

This is hardly news. I can't remember the last time that I shared a music file from gnutella that was correctly named, labelled, untruncated and not a radio edit (mea non culpla, the first thing that I do is to fix the damn things, before making them available for re-sharing).

For exe's, it's even worse. There seems to be a deliberate misnamimg of some files, e.g. GTA2 labelled as GTA3, or in some bizarre cases files named as "game Foo (actually game Bar)". What on earth is the point of that? If you're warning that there are misnamed versions out there with this filesize, then say that, otherwise just name it correctly and be done with it.

Porn is the worst of all. I've lost count of the number of god damn bangbus promos (or worse, trailers that spawn popups) that I've shared and ditched, and I'm now so sick of it that I won't download anything under 5MB (most of the trailers are smaller than that).

What I can't understand in all this is that I'm sharing these from other gnutella users. Sure, they are injected through malice (or avarice), but what is wrong in the heads of users that they don't understand that this is our network, and our responsibility to clean up the file naming? Nobody is going to step in and do it for us. It's only going to get worse over time, and I'd rather download three different but accurately named versions of the same file than one misnamed version that turns out to be another badly encoded asian lipstick lesbian popup spawning commercial.

Repeat the mantra: our network, our responsibility.

Re:Er, what?

[Saeger]

(or worse, trailers that spawn popups)

Yeah, but that only happens with MS's wonderful ASF format. I got annoyed with that too and wrote a simple util that strips out all the ASF "Script_Command_Object's". No more popups.

but what is wrong in the heads of users that they don't understand that this is our network

Why do people piss in the pool? Why do punks tag bridges? Same thing.

--

Re:Er, what?

[Skidge]

What I can't understand in all this is that I'm sharing these from other gnutella users. Sure, they are injected through malice (or avarice), but what is wrong in the heads of users that they don't understand that this is our network, and our responsibility to clean up the file naming? Nobody is going to step in and do it for us. It's only going to get worse over time, and I'd rather download three different but accurately named versions of the same file than one misnamed version that turns out to be another badly encoded asian lipstick lesbian popup spawning commercial.

I think the problem is that people are pretty lazy and with big fat hard drives now pretty standard, what's the use of bothering to clean stuff up (other than keeping your porn downloads from others using your computer)? It's easier just to queue up a bunch of downloads and forget about the crap ones when you are done then it is to clean up the file names of the good ones and get rid of the bogus ones.

Maybe once it gets difficult to get even a few good downloads, people will start becoming more responsible with their sharing, but I doubt it. They will just give up and say it just doesn't work anymore.

Re:Er, what?

[Anonymous Coward]

Repeat the mantra: our network, our responsibility, and someone else's content.

Re:Er, what?

[mrdogi]

What I can't understand in all this is that I'm sharing these from other gnutella users. Sure, they are injected through malice (or avarice), but what is wrong in the heads of users that they don't understand that this is our network, and our responsibility to clean up the file naming? Nobody is going to step in and do it for us. It's only going to get worse over time, and I'd rather download three different but accurately named versions of the same file than one misnamed version that turns out to be another badly encoded asian lipstick lesbian popup spawning commercial.

Looks like it's already working on at least one person

Re:Er, what?

[Anonymous Coward]

>culpla

culpa

Re:Er, what?

[Vagary]

The difference with punks tagging bridges is that at least they can pretend they're Stick'n It to The Man. But P2P filesharing networks are anonymous enough to be without social relationships and homogeneous enough to be without a class structure. Clearly Rogerborg's observations are more similar to pissing in pools, which I believe is a much less complex (and therefore much more mysterious?) phenomenon than punks tagging bridges.

Re:Er, what?

[dlakelan]

Pissing in pools:

Being submerged in water causes a hormonal change to reduce the quantity of ADH (anti diuretic hormone) this causes you to need to pee several minutes after being submurged. It's a phenomenon well known to SCUBA divers.

The question is "why don't people get out of the pool and do it?" Well for one thing when they get back in it starts all over again.

For another, most people can't really comprehend how much water is in a pool. it seems like nearly infinite, and therefore their pee is just too small a fraction to matter in their mind. (of course if there are hundreds of people....)

Also I think adults rarely pee in pools. It's usually children.

Plus there may in fact be some sort of built in instinct like response to being submerged. For example there's the "mammalian diving reflex" which causes mammals to hold their breath when submerged, even babys do it. Peeing may be a similar instinct.

As for P2P networks. I think it comes down to time, money, and understanding. Computers ARE difficult to use. There's just so many things you can do with them. Geeks spend a SIGNIFICANT fraction of their life learning these things. Others don't, they spend time doing other things.

So it comes down to people valuing their time more than valuing a clean hard disk. And since they don't know enough about computers to make cleaning their hard disk less time consuming they share broken files.

This is a problem that can be solved though. Technology and trust networks....

Only morons download a 10 second mp3 clip

[Anonymous Coward]

Yes.. there are plenty of morons on the P2P
networks.
Hell.. the majority of the files out there
are incomplete and/or corrupt and yet....
none of the morons sharing them ever delete them.

Gee... sounds a lot like the crap you have to
go through on a daily basis with live people.

Another technology hampered by Morons. Figures.

Re:Only morons download a 10 second mp3 clip

[Anonymous Coward]

Is there a utility that will scan my mp3 collection for truncated songs and delete them?

it's the Vast Right Wing Conspiracy...

[pixelpusher220]

from the Salon article:

"All it takes is an intern in a room."

Isn't that how a President was brought down? ;-)

Re:it's the Vast Right Wing Conspiracy...

[Russ Steffen]

That actually required an intern in a room, under a desk. That last part is important.

Re:it's the Vast Right Wing Conspiracy...

[Anonymous Coward]

"All it takes is an intern in a room."

Installing a tape recorder?

Oops, wrong President. :)

Ah!

[Grendel Drago]

You've noticed this too? Is there any trend to the IPs of machines sharing these? Are they all at sony.com or something? (Hey, they could be grievously stupid...) In any case, perhaps some provider like Gnucleus could provide a realtime ban-list of this kind of abuse. Centralizing this information wouldn't have any legal ramifications, and while it's a flawed, stopgap solution, it would work, at least for a while.

I wonder if those results are virii or something. I usually just filter them out by requiring filesizes about 100k...

Have you noticed the "[searchterms] free bangbus passes.htm" and .url files you get sometimes? I think it's just spammers doing some of this, and not the actual media industries.

--grendel drago

"Black Ops".

[Grendel Drago]

Please. If the corps employed black hats for any reason, do you think they'd admit it? Unless there's firm evidence to link the corp to the attack---which there's no reason for them to leave---there's no way to touch 'em. Bastards.

--grendel drago

Re:"Black Ops".

[funkhauser]

Let me guess... you've been reading a lot of cyberpunk fiction lately?

Slashdot linking - legal?

[jbf]

I don't see the difference between sinking someones Direct Connect hub and launching a DoS attack against a webserver.

So do you have a problem with /. linking to webservers that are likely to go down due to the load?

Unlike traditional web site DoS attacks, based on sending malformed messages (provable intent), DoS attacks in P2P can look like normal requests from normal clients that just come in really fast. IANAL, but much criminal law arises from intent, and the web DoSers (or bounce DoSers) clearly have intent. P2P networks just have a high-overhead protocol.

I don't think, in the end, that you can rely on laws to stop such problems. If you design a flooding mechanism into a protocol, you better be sure to rate-limit somehow... Maybe make people do some amount of work to perform a flood (though precomputation becomes problematic, because you want it to some extent, but not too extreme an extent).

Re:errors

[ObitMan]

How can the first post to note this fact be redundant?
Moronic moderator alert

Attack of the Giant Leeches!

[r_barchetta]

The main issue remains is so-called leaching. That is, those who take but do not give.

You mean like how people take music for free and do nothing to reward the person who created it?

Labels be damned, just give something back to the people doing the actual work.

-r

Re:Attack of the Giant Leeches!

[Slashamatic]

You mean like how people take music for free and do nothing to reward the person who created it?

I do. I live in Germany where we have a home recording tax on all recordable media including CD-R.

Rating system.

[Grendel Drago]

The problem would be---what makes the rating system any more trustworthy than the files themselves? Remember, both eBay and Slashdot have centralized control, a metasystem above the individual users.

Such a metasystem, in a P2P environment, would need to be decentralized and yet trustworthy. (It's must not be as easy for a spoofing client to say "I'm trustworthy" as it is for them to say "I have files to share! Download my pustulent VBS payload!".) This is a complex research question, to which there's no one simple answer. A lot of people are trying, though... see some of the threads on this story for good links on the subject.

--grendel drago

This is exactly how i do it.

[Unknown Poltroon]

Works great too.

P2P is dying!*

[teamhasnoi]

P2P has offically said, "Hey, we're dying over here!" You don't need to be a Kreskin to predict *P2P's future. The hand writing is on the wall: *P2P faces a bleak no-future because *P2P is laying in a ditch somewhere, and doesn't have any ID, so we don't know who to call. In fact we can hear the screams of pain out there because*P2P is dying.

Things are looking very bad for *P2P. As many of us are already aware, *P2P continues to lose market share, and it's car keys all the time. Red ink flows like a river of blood, and a river of blood would be pretty cool, but not when it's *P2P's blood. FreeP2P is the most endangered of them all, and since I've never even heard of it, it must be hurtin'.

Umm, something about a charnel house being turned over, and 2 usenet post about P2P, and bought out by someone who ruined everything. Yeah. And so P2P for all practical purposes is dead. Long live P2P!

Re:P2P is dying!*

[MoneyT]

P2P aint dying, it may however revert back to it's old form of personal ftp servers however (a la hotline)

Compare to the Tsetse fly approach

[iiii]

The comparison of P2P use and animal populations is fascinating, and although the parallels will be limited it might yield some useful ideas.

The most interesting parallel animal model has got to be the experiment designed to reduce (or eliminate) Tsetse fly (and other insects ) populations by releasing large numbers of sterilized males into the natural population.

The process of P2P sharing would correspond to mating, since you have to have two participants. A successful mating would correspond to a user getting the file they wanted, and therefore being more likely to use the service in the future. Getting a dud file is like a wild female mating with a sterilized male. Yields no offspring, user is less likely to continue using service. One or two cases of sterile matings have no impact, but when it is a significant percentage the population will decline, I'm sure the parallel with P2P holds.

The author seems focused on studying the best way to eliminate P2P, though, so he's probably hoping to get research grant money from RIAA.

Popups from video files?

[Inoshiro]

Sounds like a client side problem. I don't have popups in my browser. I can only wonder what messed up program would put popups in video files. Mplayer sure doesn't have that problem :-D

Re:Popups from video files?

[Anonymous Coward]

What are you talking about. Media player pops up crap on me all the time.

Re:Popups from video files?

[Anonymous Coward]

Media player pops up crap on me all the time.

I have never heard of that program. Is that a fork of mplayer, or xine, or what?

Re:Popups from video files?

[peter]

That would be Microsoft's "Windows Media Player" (included with their Windows OS). I had no idea that they had stooped so low as to allow popup adds to be embedded in video files. I would assume that most free software video players don't handle popups in ASF streams.

Contradication..

[MosesJones]

Within so few sentences...

countermeasure: webs of trust & md5 hashes

and

the best way to deflect it would be hiding your identity

Put simply you cannot hide identity and be a trusted partner in a transaction. And the cost of setting up "trust" mechanisms should be understated, I can generate my own CA and own X509s from openssl. How will you know what CA to trust ? Commerical ones cost money.

it is already happening

[Lumpy]

most downloads you try on any p2p network fail. because the user is too stupid to open up their firewall, or they intentionally closed it so it looks like you are sharing files but you really aren't, or they fill it with bogus files, etc...

I have had to resort to a harvester approach on gnutella. set the bot looking for XY without Z and snag everything that matches this until I stop it. Yes I end up downloading that song 35 times, but out of those 35 files, maybe 2 are acceptable... so deleting I go.

It's getting worse based on lazyness and pure stupidity and including pure greed. (I downloaded an mp3 that was nothing but a porn site advertisment.. EVERYTHINg from this one user was that same porn advert.. and he had at least 60 files all named popular band/song)

unregulated P2P sucks and is getting worse. Most of us old-timers are reverting back to IRC and private ftp stashes (20-30 friends all dropping files there, retrieving etc...)

Re:it is already happening

[kyoko21]

I hear ya. I am old school and will always be old school. The hay days of P2P networks was 'mainstreamed' by napster. Gnutella was cool but with ease of use and mainstream word of mouth, the quality of users has exponentially decreased within the last 12 months. More and more are we seeing individuals using P2P networks as a means to spread spam/p0rn and by having to resort to counter measures to simply retrieve a piece of media, it almost makes you wonder if your time is worth price that you pay wasting away sitting in front of a computer. Rather, it would almost seem cheaper to just buy it yourself.

Granted, elementary, middle, and high schoolers have an infinite amount of time these days to spend sitting in front of the computer IMing their childhood away and leech like there is no tomorrow, perhaps it is another reason why as the online community grow, the communities that was once brick and mortar will continue to dwindle by the way side.

I wouldn't be surprised if eventually, the collapse of P2P networks will come from the annoying p0rn adverts flooding the networks.

In the end, we will all go back to IRC: the original P2P network. Reason being? Quality is constantly maintained and p0rn adverts are blocked by users and individuals that run the IRC networks and/or channels.

I for one do not use 'p2p' software mainly because there is just too much garbage to sift through. Besides, why would anyone want anything other than 0-hour anyways? :-) LOL.

people change

[Nehemiah S.]

seriously, "joe schmoe" today is a whole lot different than "joe schmoe" will be in 5 years. People change; technology that today seems bleeding edge will tomorrow be an electric can opener. Not even noticed as "technology" by most people.

Also, as software evolves, "md5 lookups" will not be as difficult as they are now, and when the average person realizes that "md5 lookup" means the same thing as "click the box for trusted search" they will click the dang box (or it will be built in to the software so that there isn't even be a box to click). KaZaA etc suck right now; they are at the stage in software development as, say, ms works for DOS 1.0. Compare that to a modern word processing program and extrapolate a bit, and you'll have some idea of where p2p apps are headed.

this shit that we call "technology" really isnt that hard to get a basic grasp of. When my wife needs to know how to do this stuff in order to read the latest stephen king book, or my daughter needs to know it to listen to {boy band x} she will learn it.

Illegal use clauses?

[nurb432]

What if there is a AUP applied to the p2p network that forbids 'flooding' 'advertisements', etc.

Then Sony/etc would be libel for 'damages' caused by resorce usage that fell outside the agreement?

Just a thought.. It works for other areas.. why not here? Perhaps finally a USEFUL AUP...

How to find new music

[nurb432]

Well for starters you can read music magazines, then get names of groups to *sample* that way...

Its how i did it.. or you browse other files on that users machine to see what else they listen too.. bet a lot of the time they have similar interststs...

Not saying im 100% legit either, but i have fonud several groups id never have spent money on 'just to see', but DID after i heard a few tracks..

And no.. some lameass partial track sampling system wouldnt have got me to buy it..

poisson distribution

[Anonymous Coward]

It is already well known that modeling the network as a Poisson distribution allows analysis of the cluster lifetime. This was first done in pandurangan et al "Building Low Diameter P2P Networks" and much developed in Liben-Nowell et al "Observations on the dynamic evolution of peer-to-peer networks." See "Half-life lower bound" at http://www.cs.rice.edu/Conferences/IPTPS02/187.pdf

Collapse Through Spyware

[hopews]

A large number of p2p networks don't need any more sabotage than the creators do themselves by bundling the sharing programs with spyware. Nothing has hurt my p2p use more than the difficulty in finding decent p2p programs without malicious malware attached. I'm all for sharing files, but not at the expense of my privacy and system stability. I almost wonder if the Record companies didn't suggest this business model to the p2p software companies deliberately.

MOD PARENT UP!

[teamhasnoi]

As a big bunch of CRAP! HaHA! I have seen though your clever FACADE! You will never work in this town again!

Leave it to the users

[xinit]

Aren't the users of these networks already doing this all on their own? I've seen versions of songs performed by bands that were dead by the time the song named in the title was actually written, Beethoven Symphonies attributed to nearly everyone else, etc. 99% of any group of users knows crap, and they seek to prove it at every turn, and yet these networks haven't killed themselves off from inside yet.

from the easier-then-pie dept.

[FrankDrebin]

So this paper makes it easier to bring down a P2P network, then, after your efforts, you settle down and have a nice piece of pie for dessert.

It's already underway

[inburito]

As an experiment:
Try to download eminem's without me from gnutella. You get a lot of matches but only a small percentage of files are working.

It seems like someone is running a bot that's looking over what kind of eminem files are being shared. After this it uses the name and file size to share the same file except with random data.

Gnucleus combines files with same size and name for multipart downloading and thus is deeply affected by this. Even if some part is correct chances are that it is going to discard that specific part (overlap test) and use the corrupted data. If whoever is doing this has a fast connection and accepts a lot of downloads they can seriously affect the ability to transfer specific files.

Reply to AC...

[jawtheshark]

So you think I try to soothe my ego? Look, you don't know my setup: I have an OpenBSD box on a DSL line doing NAT/Firewall and this 24/24 7/7. The Gnutella clients are behind this NAT on other machines. I do open a few ports (6300, 6344, 6345, 6346, 6347, 6348, 6349) ...exactly those that the Gnutella network needs (according to the clients) and note that I was pretty lax.

Besides, do you have a firewall yourself? (A serious one) Do you check your logs from time to time? Well, I do and there is no way in hell I will leave an unprotected box on the internet.

Re:Reply to AC...

[Anonymous Coward]

I havve windows 2000. I don't need a firewall. Its only unix people who kneed firewalls.

"Undernets"

[Anonymous Coward]

Hmm... how would you control who has access to the undernet? If access was given out by a central authority or privileged users, then it would be difficult to get the critical mass needed to start the service. On the other hand, if access is free, well it's not really an undernet, is it?

I think that the solution would involve many small "undernet" groups, each group pruning its own users, and then linking these undernets together. If an undernet is hit with a load of RIAA spammers, then have your undernet ignore all traffic from it. If your undernet is spammy, join a new one.

The theory is that if the Gnutella network could be cut into autonomous but smaller sections, it would be easier to authenticate users. Ultrapeers are already starting to partition.

I don't think this needs to be done on the IP level. OpenSSH or Kerberos could be used to create Undernet UDP/TCP connections that would be secure.

Of course, it's all pie-in-the-sky since i'm too busy to code it.

Difference between Animals and P2P

[NitroWolf]

While the P2P networks may be similar to flesh and blood animals, the biggest difference is that evolution in P2P networking software occurs on timescales a biological system could not hope to match.

Given a threat to its existance, a P2P network can adapt in a matter of hours at best, weeks or months at worst. To change the behavior, defenses, etc... of a biological animal would take thousands of years at best. The flip side is that new threats are developed almost as fast. But the bottom line is, eventually the signal:noise ratio on a P2P system can be tuned enough to allow a signal to get through, no matter what problems might plague it.

Worst case scenario is that you have a voting system that allows *very* different users to vote on certain file share hosts, the ones with the most votes are generally going to be a valid source of the files... while this will present a higher profile target for the major corporations, if you have 10,000 of these high vote people, it's going to be financially problematic.

Even if you have one or two, (or 50) cases of ballot box stuffing when it comes to high vote hosts, an authorized admin of some sort could flag that particular host as being bogus.

There are many, many spin offs of this concept that would make it next to impossible for any single entity to compromise the P2P network into non-existance. It may be cumbersom, but it would work.

Re:Difference between Animals and P2P

[andrewchen]

(I'm the author of the paper)

I agree that if a group of dedicated people wanted to maintain a P2P network for a relatively small number of people, that's certainly feasible.

What I'm saying, however, is that the concept of P2P for the masses may be quite difficult. For example, the comment that I am replying to discusses how quickly P2P networks can change to new threats - have you thought about what that would mean in the real world, for distribution? It takes weeks, if not months for most people to update to new versions of clients, and with that much hassle, the userbase of "casual" users would collapse.

Then it's mission accomplished!

Re:Difference between Animals and P2P

[NitroWolf]

Any given piece of P2P software would collapse *right now* yes... but after the huge upheaval of 'evolution' occured, the casual user would start trickling back in slowly as more and more realize that the service is more robust than it's competition.

I'm not saying it's inconcievable we will see the end of a P2P networks, or that current P2P networks are invulnerable (far from it), but that I don't believe P2P networks will be going away, regardless of any actions taken to squash it.

Any given P2P software will have it's ups and downs as the evolution process takes place and a viable model for a bullet-proof (or as bullet proof as practically feasible) P2P software set emerges.

I liken any actions taken by RIAA (or other entities) to destroy the P2P idea as similar to DirecTV phasing out the H card. Will it stop *some* of the pirates? Yes. But in the end, the only thing it's going to do is to hasten the decline of the Hu as a "more secure" platform. Rumors of the P4 switch out even from Hu are going to FURTHER hasten the decline of the P4.

But again, the flip side of this is, DSS can't sit back and do nothing, they must move forward, thereby pushing the DSS pirates forward.

Must the RIAA move foward with trying to crush P2P? Maybe, maybe not... that's a topic for another discussion. However, as I digress into other things, trying to get back on track; the P2P software out there now will evolve into newer, more robust software that eventually will yeild a greater effort:reward scenario for anyone to try to collapse. It will get to the point that it's more effort to collapse a given network than the resulting reward will yield. It's not question of if, but when.

Re:Difference between Animals and P2P

[andrewchen]

I think you have great points in your comment.

I agree that this conflict will make the P2P model and software stronger in the long run. However, that doesn't mean that whatever commercial entities that are willing to engage the networks like this won't succeed.

For example, if there is a constant escalation in the conflict, so that P2P continually has to adjust to new ways to get files, the lag to fix those errors will drive out the casual users, and decrease piracy. That in itself may be enough!

Whahahahaha!

[jawtheshark]

Sure kiddie.... I actually have this Unix machine to *protect* my Windows 2000 machines. Come back when you're really good at trolling, okay?

XP comes with a firewall builtin...Many people run ZoneAlarm and similar applications. Go and have a check at Shields Up and check at least if your netbios ports aren't open. Okay? Kind advice of this lame Unix-guy...

Doesn't this just assume p2p networks don't scale?

[fcrick]

There is no reason why this has to be true. There are software solutions to this that work fine.

Where are they? They are coming...and they will be here. Just wait and see.

p2p chat

[Anonymous Coward]

Still waiting for someone to impliment a decentralized user location system. Limewire already has a basic basic chat interface.

OT (Re:Collapse Through Spyware)

[Anonymous Coward]

I was struck by the applicability of the general strategy to a p2p network like al-qaida remnants. And relieved that there are ways to skin this cat...

>>
1 Randomly selecting and litigating against terrorists that we are able to capture ;

2 Creating fake terrorists (plants) that carry (damaged plans/trojans) ;

3 Broadcasting fake information in the known clusters (recruiting nodes like mosques) in order to degrade network performance ;

4 Selectively targeting capture/litigation against the small percentage of terrorists that carry disproportionate authority within al-qaida.

Interesting Concept

[jawtheshark]

This is an interesting concept indeed. I do this too occasionally with good friends. I open up the ftp ports and disable the ftp-proxy temporarly to allow them access to my ftp server. However, not many people run ftp servers, actually I only know one and that is me ;-) Of course this only when I'm online myself and can keep an eye on the logs.
Of course I just could tell my friends to install some kind of W32 ftp server, but I fear that they will keep it running all the time compromising their own security. Many of them aren't even capable of installing WS_FTP (a bare-bones ftp-client which I happen to like a lot) so they are not able to upload songs to my server.
Most of the time I take the easy way: I post a certain song I want to share on my webserver and give them the URL. This is much easier for non-computer inclined people. (I am aware of ftp://username@somehost.tld/ but this doesn't allow uploads) Yes, I know http has much more overhead than ftp, but it's the price I'm willing to pay. Hey, and now they even have it more easy: I don't need to give my IP anymore. Thanks to dyndns I have one of my domain names pointed directly at my server. Best 30$ I spent in ages ;-)

Thanks to all the people who replied to my post, it was truly interesting (picked your post because it was the *most* interesting). I just regret I got modded up that high. Someone modded me "Overrated" (which I deserved IMHO), which made me lose my glorious 50 Karma. Oh, well...incentive enough to try to post insightful comments ;-)

Re:Interesting Concept

[ny_p]

Thanks for the compliment.

The concept i suggested is not very newbie friendly and needs patience. Also it has taken me a while to build up my contacts. I'd say the main problem with this approach is that it favors ppl with large collections. You need to have something to get stuff.

i realised it was far more efficient to build up trust with ppl than to rely on P2P. You only need a few contacts to get it going. Everyone benefits from this approach as its quality in, quality out.

You are right not a lot of ppl are that ftp knowledgeable so i suppose i am lucky that my taste of music has listeners that are fairly techy. But then you can always teach ppl how to set things up and try to explain the benefits. Or the alternative is you find a dump and let ppl use that as an intermediary.

truth of the matter is i dont even run an ftp server. i usually up/down from ppls boxes and let them know on a regular basis if i have something that might interest them. Also it means i help them find stuff they are looking for.

use the network :) in many ways this is using tech in the familar way we shared music with friends in real life.

KaZaA disruption

[SecGreen]

I wonder how difficult it would be to create a pseudo-KaZaA client (since modifying the current one would be against the EULA) that would return erroneous results when the network tries to make your computer part of AltNet's "global computer resource-sharing program". If it was possible, what are the legal/moral ramifications of disrupting a for-profit P2P program in this manner?

Finding new styles

[global_diffusion]

Finally a little question for the P2P junks out there: many people claim they get to learn new kinds of music by P2P sharing. I won't say it isn't true, but how? You still need a handle to search new stuff? You just type in random keywords, or what? Just curious, because I'd like to broaden my musical horizonts a bit.

There are three things I do to find new music:

1) Type in random keywords. This may seem silly, but it can yield interesting results.

2) Search for a genre. You would be surprised at the amount of music that people catagorize/name by genre. Pick a genre that you don't know very well (IDM, dub, afrobeat) and search for it. You will get a seemingly random selection of music. Download these, listen to them and if you like them, search for the artist and/or stuff in the id3 tag. You will find more of their stuff, plus usually stuff they did with their friends.

3) Listen to KEXP. KEXP is possibly the best radio station in the world. They stream cd quality over the web. They are a public station (I'm a member) from Seattle. Check their time schedule (it's Pacific America time) and check out DJ Riz. This guy is the most inventive, relaxing, best DJ around.

Solution: Separate portions of the network

[phoenix123]

yep, thats it: separate the server from the client portion of the p2p-system.

first: a super-node like server, that collects all info from the content-servers and brokers the connection from the clients, processes search requests etc.
second: a content-server, the "criminal" part, where all the data is hosted. this server handles only OUTGOING connections, it always uses push-method to send the data.
third and last: the client, that open a listen port on the client machine. for downloads, it connects first to the brokers to search their database of content, and then signals download requests *to the brokers*, the brokers keep those requests in a "mailbox", that all servers check every x seconds. if a download request is found, the *server* starts sending the files to the client.
that way numerous issues are solved:
-the content-servers cannot be wild-card searched, no one can make greedy searches to know what content a particular user hosts. this ensures a certain amount of privacy for the content-sharing peers. if MPAA-paid detectives find that host at ip foo.bar hosts "metallica - enter xman.mp3", it is rather difficult to find how much more content that particular node is sharing.
-the clients put newly downloaded stuff directly in the shared folder as usual, but after many succesful downloads, no "evidence" is piled up on a part of the network that is viewable from outside. these clients have open sockets, so that the push-connections from the servers are coming through, but they are more like a sink-hole than anything else. cannot be queried.
- the brokers have another open port for the the servers and the clients, they aggregate supply and demand, but cannot be held liable for anything they do, since they do not host anything themselves.

those three parts of the "phoenix123 p2p network of the future(TM)" are either combined on one machine using different ports or distributed through the network like the system eDonkey2000 uses. maybe some kind of reward should be given for downloading clients, that have a broker and/or a content server running - slightly higher download priority maybe. (sure there will be hacks to spoof an open client etc, but nevermind - if the network load is low enough not many will care. people cannibalizing free-as-in-beer p2p-networks are just shabby)

this is just a small thought, maybe it's useful maybe it's not. problems with pple behind NAT-gateways are to mention... (maybe the brokers could detect such a situation and instruct the server to temporarily open ONE port just for ONE file for ONE client, so that the firewalled client can download its stuff) - oh and btw all the programming HAS to be done in java. performance issues aside, it is absolutely crucial that all platforms can run this, be it linux, win32 or mac or whatever AND java is mostly immune to buffer overflow issues unlike c++. critical points would be that the brokers do not know what its connected server have, all servers process their own search-requests and pass the results back to the brokers.
ideally, this would lead to massive content servers that are totally nebulous, you cannot prove they exist unless you download one file, you cannot prove they have anything more than that single file (so the pirated content value is too low for court appeal) unless you download more, but for that, you would have to make a VERY VERY lucky guess on the filename. critical is also the broker-architecture, that ensures, no one can flood the network with endless greedy searches. maybe the broker shut down connected nodes (clients or other brokers) that appear to flood them or are cancer nodes that behave wrong.
with the broker filtering and limiting the forwarding of search results and download requests, each broker has a limited scope on the network and unless a sufficient amount of nodes is compromised, nobody could map out anything. add a lousy 10bit encryption or a resolving "data-envelope" that only the intended recipient can open, and the necessary amount to track each individual exponentially diverts to positive infinity.

if it's bullshit, reply. if it's the coolest thing you ever thought of, reply, too! - java programmer willing to do such a thing with help of others... and YES!, it will run on linux. and on mac os X and if we code 1337 enough, maybe on MIDlet devices ;)

Cargo-cult science.

[Dispader]

If Interscope is trying to reduce file sharing, their approach may or may not work on its own merits. However, it disturbs me to see what is a pretty clear misapplication of a scientific theory.

Is it just me, or does applying an organic population model, correct or not, seem particularly inappropriate to solve the problem that the MPAA percieves itself to have?

An organic model presupposes an expansion model based on breeding. The population of users of P2P networks has an organic analog, but the client population connected to a network are not organic in nature at all: on the contrary, they can be produced and destroyed at will. If one were to shut down a "critical population" of the servers, one could induce another "critical population" of the servers overnight, whether through concerted effort or just blind fluctuation in interest.

A computer user can choose to run an application for P2P file sharing "at will." A computer user running a P2P node can suddenly be shut down or choose to stop. Consequently, a user not running a P2P client can choose to run one at any time, adding to the population.

Neither of the above cases is at all possible in an organic breeding system: deer do not simply disappear at will and re-appear. If we were to try to model population control models based on external whim, we'd fail quite miserably: but mis-applying a theory based on an organic breeding model is just as stupid.

If you're talking about the population of deer, it is important to note that monkeys can't jump from the trees and decide to be deer any time they so desire.

I'm afraid this is another example of what Feynman called "cargo cult science." The author clearly wants two things to be analagous, so he merely fiddles the variables of the model into his area of interest and creates science. If you want to model a peer-to-peer networking model, I beleive you would be better served by starting from first principles.

Re:Cargo-cult science.

[andrewchen]

(I am the author of the paper)

Firstly, you have to realize that I am simply proposing that a model used in ecology could be modified to describe P2P networks. Because the paper is fundamentally about an abstract mathematical model, any phenomenon that roughly resembles animal populations may be accurately described. Applying models from one area of study to another happens quite often - for example, I have been reading recently about how many models in quantitative finance come from physics and engineering.

However, some of your points are valid, and in fact, I try and touch on some of them on pages 17 and 18 of the paper. However, this model does account for some level of random perturbation (see the reference to the Tung paper), and as long as the perturbation is not too large, the system will still go the course described by the paper.

The main issue that comes up from what you've mentioned is that the population can grow or shrink almost arbitrarily, which I agree with. However, if you think about the way that people behave, what's important is that if file selection degrades, over time, people will stop using the network. You are examining the problem at very close detail, as opposed to the big picture process. If I were to add in some sort of stochastic process to this, I'm sure I'd get the same result.

Instead of criticizing this as "stupid" and "cargo cult science," maybe you can realize that it's just an attempt to reapply a theory from another area, which happens quite often and is completely valid.

Why not ban computers hosting fake songs?

[mattkinabrewmindspri]

Why not implement some sort of system where you can report a user who hosted more than one fake song? That way, if you downloaded a single fake song, you would be able to delete it, and you wouldn't be affected.

The users who are reported frequently by several users over a few days should be checked and then banned, with their IPs logged. If they are found to be populating the network with fake songs, ban their IPs. I would start by banning any IP addresses which are known to belong to the RIAA.

Reminds me of usenet...

[davburns]

When spam outnumbers real posts, most users stop reading (and posting).

I remember some groups decided to "move" somewhere else in the tree to try to avoid spam -- this worked for a while, but it really wansn't practical to move a community over and over. Simularly, many users cycle through email addresses when the old ones get on too many spam lists, but that means that friends can't keep up with them. (And really, email is the first and biggest p2p application.)

Using multiple p2p applications/transports/networks might make it harder to degrade the overall system, than using any one. A smart client might be able to automate that process.

Proposal 1 does not mean suing random people!!!

[andrewchen]

A few people here seem to think that it means that you'd want to just sue random people on the network. That's not true - the idea is that you'd watch what people were searching for, and sue people that were GUILTY of downloading copyrighted files.

Although this is a fairly aggressive analogy, what this is really proposing is similar to what happens with holding people hostage. Although it may be that a large group of people could overtake a gunman, the potential damage the gunman could do on one person keeps everyone in line. Same scenario here, except that it's with time-consuming/stress-inducing litigation.

Bees?

[Squeeze Truck]

Here's a wild-ass idea.

How do real life societies of humans and animals protect their communities from invasion?
I will assume that the number of "legitimate" users vastly outnumbers the invaders.

Could it be possible to mark or remember hosts who pass around bogus files, and then pass that information to other users on the network?

For example, I download a file from a user or group of users. When the download completes, I naturally check it. The P2P client then pops up a window asking me whether the file was valid or not. If not, I hit "no". This "no" could then be associated in some sort of metafile that inclues the IP address and other identifying information about the host, and this metafile can be shared with all other users on the network.
Like a virus, I could merge my metafile with the metafiles of other users on the system.
On subsequent searches, the client will check the host results list against my metafile and warn me who the probable invaders are. I could also set filters that automatically exclude hosts from uploading and downloading if they have more than say, 5, black marks against them, effectively blackballing them from the network.

I realise that the invaders could easily change their IP address, but after passing 5 bad files they'd be off the network again.

Re:Bees?

[karlm]

Then they just distribute bad metafiles that claim thousands of users are spreading bad files. I like the "web of trust" idea, where I keep a budy list, and my search results are ranked by the number of degrees of seperation via buddy lists.

One among millions?

[r_barchetta]

Yeah. You're making a difference. Does not change that the majority of people trading files are doing so for one reason: they want musicians (or other creative people) to do the work and they want to give nothing back.

For every single example of someone, like yourself, who does give back, how many do not? And, if it weren't for the tax, would you voluntarily contribute money to the artists?

Now, if this home recording tax were international, then we'd have something. And for the record I would support that idea. I'm sure countless people here would oppose it as being "unfair."

-r

Right idea, wrong reason.

[Anonymous Coward]

They could be stopped by the legal system if it weren't for the fact that they have an immensely powerful lobby. The courts will rule in favor of the corps to avoid reprisals in increases of record prices, etc. They can't be hit by antitrust because so many of them are based offshore, and the supreme court is afraid to touch them.