Slashdot Mirror
Grad Student Project Uses Wikis To Stash Data, Miffs Admins
Anonymous writes "Two graduate students at the Ivy League's Brown University built a P2P system to use abandoned wiki sites to store data. The students were stealing bandwidth from open MediaWiki sites to send data between users as an alternative to BitTorrent. There was immediate backlash as site operators quickly complained to the University. The project appears to be shutdown, but many of the pages still remain on the web. The project homepage was also taken down and the students posted an apology this afternoon." The same submitter links to two different forum discussions on the project.
My response: cry me a river, and congrats to the grad students for their innovative work in the field of distributed communications.
I'd pause before calling this innovative. It doesn't really take much to encrypt data, chop it up and stash it on MediaWiki sites -- either in theory or in practice. If you want something "innovative" in the same vein, I'd vote for the guy who wrote the device driver that lets you use GMail as a drive (spawning many copies). Sure it isn't "distributed", but you could set up multiple GMail accounts to handle the contents of your drive. Clogging up other people's wikis is d**k at worst (and possibly a violation of the CFAA), and really not too much of a security threat at best ("oh? my disk is full? hmm...just dump this spammy user account, or restore the last backup, and password protect the whole business.").
What these grad students have done is demonstrate that open mediawiki setups can be spammed. Whee.
An old-timer with old-timey ideas.
I deal with this stuff all day long, predominantly from IP connections far outside U.S. jurisdiction. These students were, in my rather experienced and measured opinion, doing the community a favor by pointing out exactly how easy this sort of feat is to pull off.
Their note about using reCAPTCHA is sound advice. Admins who depend on TOS policies and their nation's legal framework to defend against networked threats are negligent in their duties. I don't waste my time worrying about chasing people around for violations of my sites' terms of service. Instead, I focus my efforts on deploying technical solutions that fix the issue.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
this is terrifyingly plausible
Media that can be recorded and distributed can be recorded and distributed.
-kfg
You're abusing TOR network, it was NOT meant to be used for high-bandwidth applications.
Please, stop doing it. Exit nodes do not have unlimited bandwidth.
Don't ask me how you're supposed to know this...
Common sense? Works for most of us ..
You couldn't be more wrong. When it comes to proof-of-concept research that illustrates a vulnerability, "If I didn't do it, somebody else would" is one of the noblest defenses known to man.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
What I find the most amazing about this thread, is that each participant seems to assume that one, but not both, of the following statements are true:
1) It is wrong to take what isn't yours even if it is easy (i.e. because nobody has put security mesaures in place that can stop you).
2) It is foolish not to have decent security measures in place.
Now, I agree that the use of the term "stealing" in TFS was a stretch; but that has everything to do with the fact that the offense was one completely different from theft and nothing to do with whether the sites' security was as it should be.
The thing is, what constitutes "decent security" depends on the society and the situation. There are many places in the world where even today it is considered normal not to lock the doors of your home. This does not magically mean those places don't have property rights.
When 3rd party harm is a concern (securing a gun, etc.), the standards are different -- but even then the guy who takes the unsecured gun and abuses it is not blameless even if the gun owner also isn't blameless. With the world of botnets, etc., networked computers belong in a category somewhere more sensitive than an electrical outlet on your porch but less sensitive than a gun.
"There's an old saying that your freedoms are only valid to the extent that you're able to defend them"
One of the principle means by which we defend our freedoms is by organizing into a society of laws.