Researchers Outline Targeted Content Poisoning For P2P Data

Diomidis Spinellis writes "Two USC researchers published a paper in the prestigious IEEE Transactions on Computers that describes a technique for p2p content poisoning targeted exclusively at detected copyright violators. Using identity-based signatures and time-stamped tokens they report a 99.9 percent prevention rate in Gnutella, KaZaA, and Freenet and a 85-98 percent prevention rate on eMule, eDonkey, and Morpheus. Poison-resilient networks based on the BitTorrent protocol are not affected. Also the system can't protect small files, like a single-song MP3. Although the authors don't say so explicitly, my understanding is that the scheme is only useful on commercial p2p distribution systems that adopt the proposed protocol."

Comments

This needs to be fought

[Anonymous Coward]

We need to fight against this kind of tyranny. Make sure to keep ourselves armed with the latest knowledge on how to defeat and subvert these 'poisons'. These corporate moneymongers are sad that they can only buy 3 boats this year instead of two, while we are stuck paying $25 for a CD. The system of money is an ancient and outdated system that needs replaced with a resource based economy anyway, and P2P is a good step in the right direction.

Re:This needs to be fought

[Anonymous Coward]

The issue is not 'information wants to be free' ... the issue is 'information is free, deal with it'... I agree with you. Money has been with us for far too long, it's time for a new way in which all that can be free, remains free. From each according to his ability, to each according to his need is the way of the future, and attempts to deny this simple mechanical law of nature will only result in even more suffering for us.

Re:This needs to be fought

[Freetardo Jones]

These corporate moneymongers are sad that they can only buy 3 boats this year instead of two

lolwut? Why would someone be sad that they could afford more boat than they originally expected?

Re:This needs to be fought

[ravenshrike]

'mechanical law of nature'

I don't think that phrase means what you think it means.

Re:This needs to be fought

[Achromatic1978]

Maybe if they'd promised their wife and two mistresses a boat each, and one for themselves, thus expecting four boats?

Re:This needs to be fought

[Anonymous Coward]

No one cares what you think.

Re:This needs to be fought

[ZeroExistenZ]

So what's wrong by buying a boat, forking out money enough to have people work months and feed their families?

I find this mentality a bit shortsighted: if I would have a pile of money in excess (yes, excess) and would "invest it" (say buy an appartmentblock, cash rent and take from people in that way for my "wellbeing") people don't say a thing.

But when someone aqcuires something, which creates work (luxury items need to be made, people make them, and they're expensive because they're not massproduced, right?) you stimulate an economy and economical activity (people can go to work, do something with their time and get paid) yet that is "wrong" because you can't take a boattrip?

As much I would enjoy excessive luxury as well, spending money stimulates an economy. If you have alot of money, the best thing to "make things happen", and give value is to spend it.

I'm working with banks and wealthmanagement software, I don't have such an abdunce of money as I see passing through our software, yet it creates cashflow and because of that cashflow +100 people here are able to work and drive nice company cars. They are happy. Clients are happy. And those who the people who are happy and comfortable (not excessively) pay to get value from are happy as they can make a business. (80% of the people here order their lunch in a small business who deliver to our office. This means they can bill each day for about 320 to run their business.)

While the economic attitude has proven flawed (growth instead of sustainability and stability). Our economy and wellbeing of those in and around it (you and I buddy) depends on the spending.

I do agree on the point the RIAA is a bunch of greedy bastards. And the value demanded for that music or whatever is not align with the perceived and experienced value delivered. But that is another issue.

Instead of looking down on someone with such a badass boat, ask him you can take a ride, chances are it's a very lonely person misguided trying to acquire wealth sacrificing alot you wouldn't sacrifice. Chances are you get your free ride. I've seen that alot.

Re:This needs to be fought

[ultranova]

The system of money is an ancient and outdated system that needs replaced with a resource based economy anyway, and P2P is a good step in the right direction.

The whole point of money is to assign a single number to measure the amount of available resources. It's a logistical aid.

Other than that, I'm with you, bro.

Re:This needs to be fought

[Lord Bitman]

Ask them. It's been well documented that all this complaining about P2P stuff started when executives were faced with the prospect of telling their shareholders that they failed to meet their projected profit increases. ie: For decades they'd been making more and more money every year, then suddenly when technology created hundreds of other ways to entertain people overnight, they didn't make as much more as they were expecting. (That is: they actually DID make more than the previous years. A lot more, by any sane standard, but not as much more as they had hoped).

They spun around, looking for someone to blame, and rather than noting inconvenient things like increased competition from other media or changes in the way people were spending their time, they heard about Napster, which allowed previous non-customers/non-consumers to jump out of their little section of the Venn-diagram and into the section "non-customer/consumer". They pounced, and pretty much ever since have still been trying to explain to their shareholders that only making four-billion more than last year instead of ten-billion more is because of evil 18th-century sea-fairing thieves.

Re:This needs to be fought

[Nathrael]

Gas prices.

Re:This needs to be fought

[shark72]

You make some good points, but I take issue with the very idea that the record industry is made of nothing but millionaires.

Sure, a small percentage of people in that industry -- whether they're artists or executives -- do very well, but that's the case with every industry. The IT and Internet industries have their own share, from hard-working executives to stock option millionaires who were at the right place at the right time. Of course, most people who work in IT aren't millionaires, but that's also the case for the record industry.

Many Slashdotters fly the jolly roger proudly, but we also claim not to like the Top 40 crap put out by the major labels -- so we're probably pirating mostly indie stuff. It's a safe bet that the indie labels have an even lower percentage of millionaires than the big labels. But if you choose to buy a track from a big label on iTunes, it's a bit like giving money to Google -- sure, a tiny portion of it goes to the guys on top, but most of it goes to the 99% of the rest of the people who are paid by the company.

"I do agree on the point the RIAA is a bunch of greedy bastards. And the value demanded for that music or whatever is not align with the perceived and experienced value delivered. But that is another issue."

Value isn't absolute. iTunes has sold billions of tracks. Their recent experiment of raising prices on in-demand tracks was a success -- they're making more money. Online music sellers have a very good understanding of the pricing that the market will bear. I've lost count of the times that a $0.99 track purchase or a $10 album purchase have given me hours and hours of enjoyment. Some folks will always choose to pirate, and many will use class warfare or the old "music is too expensive!" as their rationalization. But when Slashdotters claim that iTunes has it wrong, it's a bit like when Slashdotters claim that Microsoft should release Windows as OSS or that next year will *finally* be the year that Linux takes over the desktop. Microsoft won't, Linux won't, and although it's counterintuitive to many Slashdotters, Apple and the music industry as a whole are still making a metric buttload of money.

Re:This needs to be fought

[commodore64_love]

My annoyance is that "they" presume my downloading means they are losing money. I've been downloading a lot of recent movies lately, and no surprise, the movies are largely crap piled upon more crap (how they ever scored 7 or higher on imdb.com is a mystery to me). The RIAA/MPAA make the assumption that if I had not downloaded, I would have bought the DVD instead.

They presume wrong.

Out of some 20 movies downloaded there was precisely 1 that I will probably buy on DVD, and that's only because my niece wants to see Hannah Montana in 3D. Otherwise I don't waste my money on Hollyweird's shit unless it's exceptionally good. This past 2008-9 season almost nothing met that criteria. So for them to say, "We lost $400," is completely and totally inaccurate.

They are liars. They lost nothing because I'm not a spender. My money gets invested into the stockmarket, not shiny discs, which probably pisses them off.

Re:This needs to be fought

[Saxerman]

The luxury industry has been linked with reducing the size of the middle class, since it tends to greater a broader disparity between those providing goods and services and those consuming them. You are certainly correct, of course, that spending money will 'stimulate the economy' regardless if it comes from the rich or the poor. The question is the type of economy you want to stimulate. Luxury spending tends to stimulate the segment of industry that sees little return back at the lower end of the wage pools. They reap higher profits, and provide fewer goods and services, thus tending towards increasing the divide in wealth. Spending in the lower end 'consumer grade' market tends to stimulate an industry that will increase growth where more goods and services are produced.

Henry Ford famously paid his employees enough so they could buy the cars they were building. Imagine what might have happened to the auto industry if he had catered only to the rich? Compare also to Walmart, who also wants to pay their employees enough to buy their products.

Re:This needs to be fought

[Shakrai]

From each according to his ability, to each according to his need is the way of the future

Ok Comrade.

and attempts to deny this simple mechanical law of nature will only result in even more suffering for us.

Simple law of nature? What the heck are you smoking and why aren't you sharing it? The only law of nature is survival of the fittest. I don't think the gazelle being eaten by a lion volunteered to be eaten because the lion needed food.

Re:This needs to be fought

[mcgrew]

I see that they gave percentages for prevention rates, but not for false positives. As someone who uses P2P legitimately (Linux distros, movies like Star Wreck, SHN and FLAC files the musician wants shared, etc) this pisses me off no end.

A false positive here is simply vandalism. If these researchers release this thing to the public and there are any false positives at all, they deserve to be jailed.

Re:This needs to be fought

[jenn_13]

This is a serious question: If it's not worth wasting your money on to buy, then why on earth did you waste your time downloading and watching it? Either a product is worth the asking price or it's not. If it is worth it to you, buy it. If not, do without...

Re:This needs to be fought

[ZeroExistenZ]

Top 40 crap put out by the major labels -- so we're probably pirating mostly indie stuff. It's a safe bet that the indie labels have an even lower percentage of millionaires than the big labels. But if you choose to buy a track from a big label on iTunes, it's a bit like giving money to Google -- sure, a tiny portion of it goes to the guys on top, but most of it goes to the 99% of the rest of the people who are paid by the company.

I absolutely love this observation.

Your point is very valid, and the "greedy millionaires taking money from the poor consumer" is a flawed view.

After reading your post I thought over what the "RIAA" means, as a corporate entity to me and what I know about it, and it's shamefully little.

My own knowledge about the RIAA is limited to what I read on slashdot and on newssites, where it profiles itself as an agressive entity.

Which makes me think it's how the RIAA is out of tune with the needs of todays consumers, putting "measures into place", creating discomfort for users who otherwise would've been perfectly happy. Resulting in a greater need or desire for something more align with current media-consumption, which is direct, efficient, snack-sized. But on the other end, a coorporation with a businessmodel that doesn't apply anymore. Which comes back to the "relative perceived value"; if it's hasslefree, you'll pay more to not go through the hassle you experience otherwise.

Re:This needs to be fought

[jDeepbeep]

This is a serious question: If it's not worth wasting your money on to buy, then why on earth did you waste your time downloading and watching it? Either a product is worth the asking price or it's not. If it is worth it to you, buy it. If not, do without...

Until you watch it, how can you know if it was worth the asking price? (irregardless of how you obtained it)

Re:This needs to be fought

[PincushionMan]

Umm, maybe renting?

Re:This needs to be fought

[skeeto]

Don't worry about it much. Their paper is mostly bullshit, and they have no real mechanism for effectively poisoning the networks they claim they can attack. Either they don't know what they are talking about, or they intentionally wrote bullshit for some unknown end.

Re:This needs to be fought

[mea37]

I agree that the lack of false positive numbers is somewhere on the scale between fraud and criminal stupidity, as any number other than 0% makes the system effectively useless in a commercial sense.

However, as TFS points out, TFA appears to be aimed at designing new commercial P2P networks rather than modifying the usage of existing networks. If someone builds a network for commercial use and chooses to include this in the architecture of their network, then that isn't vandalism and nobody deserves to be jailed. It's bad business and the network owners deserve the customer relations nightmare they will bring upon themselves.

If it is even possible to use this on existing networks, and if anyone ever does, it is the person using it - not the researchers - who should then be liable for some sort of civil offense. Saying the researchers should be jailed in that case is just another instance - much like DMCA anti-circumvention - of saying that a technology, rather than an action, should be illegal.

Re:This needs to be fought

[michaelhood]

Yeah, why should people have a right to make a lot of money?? Especially when it infringes on your constitutional right to buy cheap music CDs!

Re:This needs to be fought

[michaelhood]

This is a serious question:

If it's not worth wasting your money on to buy, then why on earth did you waste your time downloading and watching it? Either a product is worth the asking price or it's not. If it is worth it to you, buy it. If not, do without...

Until you watch it, how can you know if it was worth the asking price? (irregardless of how you obtained it)

You have to price that risk in yourself. And "irregardless" isn't a word.

Re:This needs to be fought

[TheRaven64]

Because their projections indicated that they'd be able to buy four and the fact that they can't must be due to the evil pirates. Their income increased by less than they thought it would, so they clearly need more legislation to protect their business model.

Re:This needs to be fought

[Actually, I do RTFA]

These corporate moneymongers are sad that they can only buy 3 boats this year instead of two

lolwut? Why would someone be sad that they could afford more boat than they originally expected?

Because if they only have two, then they can clearly have "his and hers" boats. Now that there are three, they have to compromise on the name and usage of the third. Plus, have you seen how hard it is to split a boat in the case of a divorce?

Re:This needs to be fought

[Freetardo Jones]

Did you even read the part that I quoted from the GGP? He was saying that they were complaining that they got 3 boats INSTEAD OF 2 boats.

Re:This needs to be fought

[Capt.DrumkenBum]

"have you seen how hard it is to split a boat in the case of a divorce?"
It is pretty easy if you have a chainsaw and a plasma cutter.
Go ahead, ask me how I know. :)

Re:This needs to be fought

[socz]

I have a deal for you my friend! A mere $1,000,000.00 USD for a 500ml bottle of water! Sure, you might find it for less elsewhere, but when you're traveling through the Mojave desert and your car breaks down, i'll be there waiting for you!

Re:This needs to be fought

[couchslug]

"These corporate moneymongers are sad that they can only buy 3 boats this year instead of two, while we are stuck paying $25 for a CD."

I'm not stuck paying anything for a CD. STOP WANTING them, now, if you are serious.

The problem is not how to obtain mass-market shit culture, but wanting it in the first place!

Re:This needs to be fought

[Anonymous Coward]

You only buy movies that you've already seen?

Re:This needs to be fought

[Anonymous Coward]

Either a product is worth the asking price or it's not. If it is worth it to you, buy it. If not, do without...

So you're saying that if a product isn't worth $15 to someone, then it's also not worth $0 (cost of download) to that same person? That makes no sense.

Here's a car example, because everyone likes those.

A Honda costs $20k. But I, as a consumer, only think it will give me $15k of benefit. So I wont buy it. The next day, someone else is selling it for $15k. I'll buy it.

A movie isn't worth $15 to this guy. He wont buy it. But today, someone is offering it at the low low price of zero. He'll buy it. Why "do without" when you can "do with" at a cost that is less than or equal to the value you expect to get out of it?

Re:This needs to be fought

[Anonymous Coward]

They lost nothing because I'm not a spender.

They got no money from you, but you got "entertainment" from them (whether or not you liked the movie is quite immaterial). You benefited from their effort and expenditure without recompense to them, when such was explicitly requested.

Is that illegal? Debatable. Is it immoral? Pretty much.

Pay to play. This is not a hard concept.

Re:This needs to be fought

[Deliveranc3]

"As much I would enjoy excessive luxury as well, spending money stimulates an economy. If you have alot of money, the best thing to 'make things happen', and give value is to spend it."

Dear sir, if you look at current inflation and cost of living statistics you would be seriously scared about every purchase you have made... no joke.

Money is labour, you can pay people money to do just about anything.

Being rich means building a dam in the flow of money around an economy, usually between the profits of your company and your employees. It used to be about supporting your decendents for GENERATIONS (think monarchs and Paris Hilton) off the wealth generated from your wealth (consider the taxes on inheretence, and the implications of removing those taxes).

My point is that wealth easily generates more wealth... not exactly a novel thought. But consider that certain things (Usury, credit cards (19+% MY GOD!), and removing liquidity in the market seem to produce excessive wealth from past labour.

Middle class means being able to hire a few people to help you accomplish tasks, upper class basically means you can pay people to THINK for you.

So yea, spend if you want the world to function. Save if you want to get rich or build something, and while the big boys pretend that they're the gatekeepers of every avenue to profit (and certainly they do hold a lot of keys) occasionally little guys sneak through. If you save by finding those little guys who are making holes you'll be allright, local computer stores, etc. We're told 9/10 of them fail, probably half of those because they don't have enough capital and half because people dream of hearing "my goodness that's a great idea!" and believe it when they shouldn't.

If you're middle class you can MAKE a small company, try getting some people together and helping to build one even if that's simply by keeping them from excessive interest payments!

Adopting the proposed protocol?

[Anonymous Coward]

Yeah good luck with that.

Re:Adopting the proposed protocol?

[Joce640k]

They already tried this about five years ago with poisoned servers. What happened? The Kad search mechanism was adopted and the servers were useless.

The same thing will happen here, the protocol will change, the poisoners will have wasted a lot of money and achieved nothing.
 

Re:Adopting the proposed protocol?

[Alsee]

There is no need for existing protocols to change. This paper cannot be used to attack them. This paper proposes a new paid-P2P network, one deliberately designed to give a central authority (the RIAA) the power to poison the system.

-

Re:Adopting the proposed protocol?

[Inda]

That's the empression I got too but that still creates a massive "WHY?" in my head.

Why the need for a 'private' P2P network that's not really private at all? If 'pirates' can get into your network, the problem isn't solved by poisoning.

Even if the content providers used a public network, there must be a better way, such as encryption and key exchanges.

And... And this is the killer: it only takes one person to move content from a 'private' network to a public network and they're fucked.

Re:Adopting the proposed protocol?

[Cyrgo]

Insightful comment, but maybe by first installing a 'private' (or 'commercial') P2P network these conglomerates feel entitled to push for stronger restrictions on public P2P networks since there should be no need anymore for them (since all legal free download will still be available, but controlled).

Their logic may go like this
1) getting scr**ed by public P2P
2) establish several private P2P
3) go to congress with argument that there is no more need for public P2P
4) public (uncontrolled) P2P becomes illegal
5) profit !!!

There is no need for the ????

Re:Adopting the proposed protocol?

[Alsee]

That's the empression I got too but that still creates a massive "WHY?" in my head.

I think there's two different ways to answer that. First 'll give their rationalization for it, the reason they think they are working on it, second I'll give what I think is the real reason.

The rationalization is that P2P reduces distribution costs. They hear how the technology is revolutionizing content delivery with zero cost publication, and how they are supposed to embrace the new technology and how it's supposed to save the them money because they don't have to pay for bandwidth and servers to deliver the downloads, blah blah blah.

The economics of that rationalization don't really fly. The bandwidth costs and server costs to directly deliver downloads are already a negligible fraction of a cent for non-P2P. The servers and bandwidth they'd need to play "gatekeeper" managing their new P2P network would cost a fair percentage of what they'd have to spend just to send the download themselves. But the big killer is that they'd need to keep their old direct-download system anyway for people who cannot or won't-want-to run P2P to buy stuff. They'll need to run a P2P pay system side by side with direct download pay system, and run duplicate payment systems and duplicate marketing and duplicate management and duplicating other overhead costs. The "publishing revolution" of P2P is that it's supposed to completely eliminate those things, not cause them to duplicate. The magic of P2P is that there is no gatekeeper, that you can step into any random home and borrow a computer to host a file on P2P for a half hour, then you can just turn the computer off and go home, literally zero cost and zero effort once the file gets copied onto the P2P.

I think the real reason is that the content industries are beginning to recognize that their efforts to kill P2P are never going to succeed, they are recognizing that P2P is extremely popular with their target customer base and they are envious of that popularity, and message "they need to embrace new technology and update their business models" is seeping into their brains by sheer endless repetition, so they are desperately grabbing at any snake oil hope of taming the monster. The fantasy is that if they release their own "legal" version of P2P then maybe people who like using P2P will switch over to their network and maybe the "bad P2P" monster will shrink or maybe even die away.

They still don't understand P2P and the rest of this interwebby stuff(*), but I dunno, I guess maybe it's progress. Some dim touch of reality has reached their brains and they are at least making some confused attempt to deal with it. It's a step up from their living in complete denial and having nothing more than a "Hulk Smash!" reflex.

(*) I'm sure most executives have enough IQ points to reach a basic grasp of P2P and of the internet, but unfortunately people tend to be quite skilled in failing to understand things they don't want to understand. That goes double when people have a financial stake in not-understanding something.

-

Re:Adopting the proposed protocol?

[Alsee]

I'm replying a second time because I just thought of a funny alternate explanation for "why".

We still need creators, but the need for a mass publication industry is largely obsolete. Who needs publishers when the public is eager preform that job for free? Internet technology, and particularly P2P, is essentially a terminal illness for the publishing industry.

The five stages of greif:
1. Denial
2. Anger
3. Bargaining
4. Depression
5. Acceptance

They spend several years in Denial, ignoring all the technology and ignoring the internet and refusing to permit music to be sold online or on computers at all. Then they entered the Anger stage with the Hulk-Smash-Everything routine. And now they seem to have entered Stage Three, the Bargaining phase, with "Will you come back and pay us if we promise to play nice and we do your P2P thing with you?" Chuckle. I guess in a couple more years they'll hit Depression.

-

Researcher is the wrong word.

[Darkness404]

I'm not exactly sure "researcher" is the right word here. From the paper

Abstract: Today's peer-to-peer (P2P) networks are grossly abused by Illegal distributions of music, games, video streams, and popular software. These abuses have resulted in heavy financial loss in media and content industry. Collusive piracy is the main source of intellectual property violations within the boundary of P2P networks. This problem is resulted from paid clients (colluders) illegally sharing copyrighted content files with unpaid clients (pirates). Such an on-line piracy has hindered the use of open P2P networks for commercial content delivery. We propose a proactive poisoning scheme to stop colluders and pirates from working together in alleged copyright infringements in P2P file sharing. The basic idea is to detect pirates with identity- based signatures and time-stamped tokens. Then we stop collusive piracy without hurting legitimate P2P clients. We developed a new peer authorization protocol (PAP) to distinguish pirates from legitimate clients. Detected pirates will receive poisoned chunks in repeated attempts. A reputation-based mechanism is developed to detect colluders. The system does not slow down legal download from paid clients. The pirates are severely penalized with no chance to download successfully in finite time. Based on simulation results, we find 99.9% success rate in preventing piracy on file-level hashing networks like Gnutella, KaZaA,Area, LimeWire, etc. Our protection scheme achieved 85-98% prevention rate on part-level hashing networks like eMuel, Shareaz, eDonkey, Morpheus, etc. Our new scheme enables P2P technology for building a new generation of content delivery networks (CDNs). These P2P-based CDNs provide faster delivery speed, higher content availability, and cost-effectiveness than using conventional CDNs built with huge network of surrogate servers.

This isn't unbiased in the least. Sure, arguably it is "research" but calling them researchers from an university makes them seem neutral at best.

Re:Researcher is the wrong word.

[s-whs]

] Researcher is the wrong word.

I was thinking the same thing. But not necessarily based on them being biased, but for this: Why would anyone want to 'research' this? I can understand making a protocol resilient to poisoning (same as making a computer resilient to virus attacks, there will always be a-holes trying to mess things up wether legal or illegal), or making it faster, adding some nifty features perhaps. But poisoning to prevent illegal sharing with the pathetic argument that this hinders commercial distribution? What kind of a researcher is that? A RIAA paid one I'd guess. Possibly as valuable as those 'researchers' for tobacco companies who said there was no health problem with smoking.

Re:Researcher is the wrong word.

[Darkness404]

Exactly, I was reading into the article thinking it would be presented as a vulnerability or proof of concept that could be exploited by the RIAA, not that the entire thing seemed to be written especially for the RIAA.

Re:Researcher is the wrong word.

[Kuroji]

Well, here's the thing: by having this information out in the open, people can look at how it's done and look at the protocols they use, and find out whether such vulnerabilities could exist. Sure, it might not help anyone right now if they're vulnerable, but it does mean that the protocols that people use in the future are a lot less likely to have such weaknesses that allow for data corruption.

Copyright or not, when you have the ability to corrupt data on a whim, the network is quickly rendered useless.

Re:Researcher is the wrong word.

[Anonymous Coward]

moreover, they are from USC, not UCLA.

Re:Researcher is the wrong word.

[Darkness404]

But it wasn't presented like that though. It would be one thing if it was "Hey, your network can be exploited if you do this, this and this" but instead its "Your network can be exploited by this, this and this, because of this you can do -insert illegal stuff- to get revenge on those evil filesharers". I mean, seriously the stuff you read in 2600 about exploiting things to make a profit seem to have less bias than this. At least a bunch of those articles say "please only use this for information".

Re:Researcher is the wrong word.

[Darkness404]

Ok, even though this is terribly off topic I feel I have to say this, who the crap plays Runescape anyways? I mean, if your on /. try to at least sell us WoW gold or something, or some MMO people above age 8 actually play.... At least post AC whenever you spam totally irrelevant stuff. I mean it could be argued that the 3nl@rg3 y0ur p3n1s spam you get in your e-mail are more relevant because at least most /.ers actually have one of those....

Re:Researcher is the wrong word.

[Anonymous Coward]

You might do better here peddling WoW gold......

Re:Researcher is the wrong word.

[ZosX]

Aren't there laws against DOS attacks? If you jammed the RIAA's network you would surely go to jail if caught. They should leave the law enforcement to the police. Its too bad nobody can seem to get them on racketeering. They extort millions (heh, literally apparently) from the american public and at the same time have not paid millions of dollars owed to the artists that they supposedly represent.

Re:Researcher is the wrong word.

[Darkness404]

Yes, and the RIAA doesn't seem to care. Just look at how they used MediaDefender ( http://en.wikipedia.org/wiki/MediaDefender ).

Re:Researcher is the wrong word.

[cortesoft]

of COURSE they aren't real researchers. The summary writer mistakenly thought the study authors were from UCLA, which would mean they would have been some of the smartest, unbiased, amazing people in the world. However, they were actually from USC, meaning they were spoiled, unprofessional, RIAA lapdogs who also smell.

And yes I happened to go to UCLA, but that is besides the point.

Re:Researcher is the wrong word.

[Anonymous Coward]

How much are they charging for the research details? Is the RIAA willing to buy out this information? If its from a university then someone is looking for grant money.

Re:Researcher is the wrong word.

[Anonymous Coward]

I've gotten dragged back into Runescape in the past month, though still as free-to-play. They've actually improved the free-to-play content quite a bit recently. Among the things they've done is limit the amount you can send or recieve in trades of unbalanced value, which hits gold sellers hard, without being a massive hindrance to the legit players.

Re:Researcher is the wrong word.

[Anonymous Coward]

My best guess is that they did this "research" a while ago.. As most of the networks they clam they can attract are long dead. Limewire, emule are still around but both have extra anti-attract features added to them. Most people like my self run ip blocking software so any block of Ip's found to be actively attracting a network would be added to the block lists. I'll have to take the time to read there paper in detail as clients like emule, if they receive bad blocks from a client that client is automatically denied further pretisapation in the network.

Re:Researcher is the wrong word.

[siloko]

Researchers find a topic that interests them and follow through on some hunch. When they have found out something potentially publishable (the meat and potatoes of a researchers career) they big it up. This abstract reads exactly like that - "we did some work and this is why it's the most important work in the world" - the fact that the spiel coincides with the RIAA party line is probably coincidence.

Re:Researcher is the wrong word.

[Jurily]

We developed a new peer authorization protocol (PAP) to distinguish pirates from legitimate clients. Detected pirates will receive poisoned chunks in repeated attempts. A reputation-based mechanism is developed to detect colluders. The system does not slow down legal download from paid clients. The pirates are severely penalized with no chance to download successfully in finite time.

Oh, this cracks me up. Did anyone notice notice how this doesn't mention bittorrent, which AFAIK makes up 90% of the possibly infringing content? Of course, anyone who's seen a torrent client in action knows that clients sending bad data are banned fast.

Now that I think about it, this "researcher" should rank high on the "Best ways to make money and improve your karma" list. He's obviously a better way to drain RIAA money than lawsuits :)

Re:Researcher is the wrong word.

[Jurily]

How much are they charging for the research details? Is the RIAA willing to buy out this information? If its from a university then someone is looking for grant money.

I, for one, welcome our new RIAA-cheating overlords.

Re:Researcher is the wrong word.

[Anonymous Coward]

Fuck the world, you're wrong, they're wrong, we're all wrong. Let's go get some ice cream! Steal from each other! Sure they over-charge, screw the artists over, and rip-off everyone in between, but what would Bono do?

Re:Researcher is the wrong word.

[Odinlake]

... with no chance to download successfully in finite time.

That is mathematically speaking a pretty silly statement (as there obviously is some non-zero chance of obtaining each piece), moreover so considering the next sentence which says they had a 0.1% failure rate.

Re:Researcher is the wrong word.

[hairyfeet]

So in other words they just want to steal the P2P networks from those that actually built up the things and turn it into an iTunes store, only one where the cheap bastards won't even have to pay for bandwidth. Nice. Just when I thought they couldn't be even more piggish than they already are. It just goes to prove that just when you think they've scrapped the bottom of the barrel and can't actually go any lower, if you lift up the bottom of the barrel and continue digging, you can get even lower. Nice.

Meanwhile they rob from us and our kids by eliminating the public domain thanks to eternal copyrights, and screw you out of first sale with crap like DMCA and DRM, which they pay to have rammed up our butts with treasonous bribes. Very nice. These bunches are the only ones that can make CEOs at tobacco companies and South American drug lords not seem so scummy.

And for all the countries getting USA eternal copyrights forced down their throats? I'd like to say as an American I'm sorry, we didn't actually want that crap either, but we only have a two party system and both sides have sold out because all our politicians are whores to big business. Maybe you'll have better luck dealing with the multinational cartels than we did.

Re:Researcher is the wrong word.

[Eris13]

Reads more as a marketing pitch for an IT startup than a research article abstract.

Unless the world got really fscked up since I was last at uni.

Re:Researcher is the wrong word.

[paganizer]

I see one good thing about this; they positively could not have poisoned Freenet, (unless they are talking Freenet 0.7, maybe) but every additional Freenet 0.5 user makes the network faster and more anonymous; by trying to screw with it, they made it a little better.

plug: gotthefire.net

Re:Researcher is the wrong word.

[MrMr]

I'm surprised there wasn't a big disclaimer at the bottom of the paper about RIAA funding; like the ones you see nowadays on many medical studies...
Could they be sneakier than big pharma?
(Btw. I only read the last page of the FA, honestly)

Re:Researcher is the wrong word.

[Anonymous Coward]

the fact that the spiel coincides with the RIAA party line is probably coincidence.

I beg to differ. After reading it, my impression is that it is most likely not a coincidence.

Re:Researcher is the wrong word.

[sukotto]

People who develop new weapons are researchers. I don't have a problem with calling them researchers.

Re:Researcher is the wrong word.

[mcgrew]

These abuses have resulted in heavy financial loss in media and content industry.

Bullshit. It's been shown that music pirates spend more money on music than non-pirates, and the same is probably true of movie pirates and software pirates, too. They've declared war on their best customers.

Re:Researcher is the wrong word.

[Anonymous Coward]

This is at the same level of problem solving as, for example, spreading plague in Afghanistan in order to prevent shoe-bombers.

Re:Researcher is the wrong word.

[Deliveranc3]

Offtopic but... This is the product of recession. People get so desperate for work that they don't care about ethics, so desperate to keep their job they don't ask questions. We're going to be seeing this type of research appearing for the next 5-6 months, stuff that has absolutely no value and is simply a small expenditure by big companies looking to hurt their competition and slow progress.

Re:Researcher is the wrong word.

[Casai]

Of COURSE they're from USC. Who would come up with an attack based on hiding stuff you don't want inside stuff you want? Yup...the Trojans.

3 is less than 2

[Anonymous Coward]

ur funny

Actually

[Renraku]

Actually, poisoning P2P networks as a commercial venture could be prosecuted as theft-by-deception.

Stealing bandwidth is a crime. Downloading songs isn't, if you aren't profiting form it.

Re:Actually

[Darkness404]

And so is DDoS attacks, but that sure didn't stop the RIAA from using MediaDefender ( http://en.wikipedia.org/wiki/MediaDefender )

Re:Actually

[Anonymous Coward]

If stealing bandwidth is a crime then most P2P users are liable because they're downloading/uploading horribly tagged tracks at only 128kbps. How exactly are you going to take a commercial entity to court over poisoning a P2P network? "Your honor, this company kept me from carrying out copyright infringement!"

Fucking entitlement generation.

Re:Actually

[Anonymous Coward]

Yeah, because any court of law is really going to seriously listen to a cause from a copyright infringer whining about having his pirated downloads from a P2P network poisoned.

Downloading songs isn't, if you aren't profiting form it.

First of all there is no requirement that you be profiting from copyright infringement for you to have broken the law. And secondly, how exactly would one make a profit from downloading a song?

Re:Actually

[bertoelcon]

And secondly, how exactly would one make a profit from downloading a song?

Resale of something you got free, ie. radio-copied mixtapes, bootleg cd/dvds, hosting files on a private pay access ftp, etc.

Re:Actually

[timmarhy]

so those big warnings on every dvd i've ever rented that state copying this dvd is a federal office are lieing? fyi, i know slashdotters never RTFA but you take the cake for not even reading the summary - this doesn't work on small files like songs..

Re:Actually

[Anonymous Coward]

Resale of something you got free, ie. radio-copied mixtapes, bootleg cd/dvds, hosting files on a private pay access ftp, etc.

But that would be making money from reselling it or streaming it not from the act of downloading the song itself.

Re:Actually

[nhytefall]

Fucking entitlement generation.

Amen.

Re:Actually

[cboslin]

Stealing bandwidth is a crime.

Tell my Cable ISP please. They advertise up to 6Mbps and throttle me back to as low as 4 Kbps. I do see 20 - 30 Kbps regularly, but never more than 100Kbps downstream consistently, yes downstream, except in bursts of 1 sec. I do see bursts of 1 sec up to 1 Mbps, occasionally 1.5Mbps and rarely up to 3 Mbps, but NEVER above 3.5 Mbps, and always for only a second or less at a time, per my DD-WRT logs and bandwidth monitoring.

If its a crime, why are we Americans not bringing a class action lawsuit, as even the FCC states a 768Kbps definition of Hispeed Internet, though they still list 200Kbps - 6 Mbps as the definition in other places.

And Japan has had 100Mbps/100Mbps for $55 per month since 2000, and since 2006 are getting 1Gbps / 1Gbps for Tell my Cable ISP please.

Re:Actually

[1u3hr]

And secondly, how exactly would one make a profit from downloading a song?
Resale of something you got free, ie. radio-copied mixtapes, bootleg cd/dvds, hosting files on a private pay access ftp, etc.

Yeah, there are HUGE profits from selling radio copied mix tapes. (Especially if you use the new 8-track format.)

Really, these are things you literally couldn't give away. Anyone who wants these and isn't fussed about copyright has no problem downloading it himself, or swapping with a friend.

Re:Actually

[houstonbofh]

First of all there is no requirement that you be profiting from copyright infringement for you to have broken the law. And secondly, how exactly would one make a profit from downloading a song?

This may surprise you, but the law is not the same in every country. In spite of industry attempts...

Re:Actually

[TheLink]

That's no longer downloading though.

That's distribution.

Re:Actually

[xouumalperxe]

If you download something and then sell it, I'd call that prima facie evidence that the downloading itself was done for commercial purposes.

Re:Actually

[VShael]

"Downloading songs isn't, if you aren't profiting form it."

Depends on your locale, doesn't it? Not all laws are the same in every location.

Re:Actually

[jenn_13]

Actually, you'd be surprised. I used to ride public transportation to work every day, and people frequently tried to sell bootleg DVDs to me. Amazingly, several people actually bought from them...

Re:Actually

[jDeepbeep]

And Japan has had 100Mbps/100Mbps for $55 per month since 2000

Here in Wilson, North Carolina, we get municipally provided 100 symmetric / FTTP

Needless to say, the telecoms are viciously pissed and are doing everything they can to stop it.

Re:Actually

[cboslin]

Let's hope the elected officials in Wilson honestly have their neighbor's best interest at heart. If they do, the Cable companies and telcos can get pissed all they want and it will simply NOT matter.

Based on their lack of action over the last 30 years to put fiber to our homes, something some of them, if not all, have been promising since the 1990s; they do NOT have a leg to stand on.

Economics are not working due the Oligopoly / Monopoly nature of Cable Companies and Telcos, ONLY de-regulation will WORK with this economic model.

Govt deregulation of NTT worked in Japan back in 2000, since 2006 those customers are now getting 1 Gbps / 1 Gbps for less than $52 per month, a cost savings to the customer thanks to technological innovation. A huge success for all, even NTT whose dominance in Fiber is paying off very well.

Here in the US, the Telcos, Cable Companies, ISPs could have innovated us out of their outdated tiered pricing model, but they chose NOT to. They made their choice for all Americans to see. They made their choice when they watered down the Telecommunications act of 1996. They make their choice each and every week today, when they spend $1.5 million or more on lobbying elected officials to prevent fiber getting to our homes. What if they spent that $1.5 million per week and the estimated $300 billion they have received since 1990, some of in tax revenue from Americans, and actually laid fiber to our homes. How many more jobs would Americans have today thanks to the higher bandwidth available to us.

American Telcos and Cable companies continuously choose to hurt Americans with their Actions. Their words fall on deaf ears.

I want to live in a city like Wilson, North Carolina; where they are putting their neighbors first, as it should be. If all politicians did this, treated their office like a public service ~ which it is, and returned to their real work after serving for a few years, lobbyists would not be able to get their way and hurt the average American.

Hey politicians, watch the movie Dave or Mr Smith Goes to Washington and do the right thing! If you can not do the right thing, remove yourself from office with honor and let someone else in that will do the right thing. Or do you really want to continue to mess up your neighbors, hurt Americans and destroy your own family. Do you really hate those you serve that much?

Elected leaders in Wilson, North Carolina, stick to your guns, serve your neighbors who you promised to protect and serve and all will benefit, even you when you leave office. More importantly your kids and their kids will benefit by what you are doing.

What other communities are going to take it upon themselves to put the fiber in the ground, ignore the Cable Companies and Telcos and do the right thing for your citizens? Heads up all Internet corporations, Wilson, North Carolina looks like a good place to relocate your jobs for their citizens and the benefit of your company!

Here I thought it would take a company with no ties, no peering agreements to any other American telco to pull this off. And was secretly hoping such a company would rear its head, I would want to work with them for their success in the US, or at least a company like Google, that is laying undersea cables would be able to offer bandwidth to communities being chocked dry by the current American Telcos and Cable Companies.

Can you please find out who they are buying their Internet access through, as I want to support that company over all the others in America? I will encourage all my friends to do likewise, the day that Wilson North Carolina gets fiber to 10% or more of its homes.

Re:Actually

[cboslin]

Here is the .pdf letter in full: Check out the names at the end, if these elected leaders represent you, let them know that you want a company like Greenlight for you and your neighbors also. Tell them to vote NO on HB1252

May 4, 2009
The Honorable Joe Hackney
Speaker
North Carolina House of Representatives
2207 State Legislative Building
Raleigh, NC 27601-1096

Dear Speaker Hackney:

We, the undersigned private-sector companies and trade associations urge you to oppose HB1252, the so-called "Level Playing Field Act." HB1252 is "level" only in the sense that it will harm both the public and private sectors. It will thwart public broadband initiatives, stifle economic growth, prevent the creation or retention of thousands of jobs, and diminish quality of life in North Carolina. In particular, it will hurt the private sector by undermining public-private partnerships, hamstringing our ability to sell our goods and services, interfering with workforce development, and stifling creativity and innovation.

The United States is currently suffering through one of the most serious economic crises in decades. We also continue to lag behind the leading nations in per capita broadband adoption, access to high-capacity networks, cost per unit of bandwidth, and growth of new broadband users. To address these concerns, Congress and the Obama Administration have made more than $7 billion available to catalyze public and private efforts to accelerate deployment of broadband infrastructure and services. States can ill afford to enact measures like HB1252, which impair use of these broadband funds and the ability of the public and private sectors to work hand-in-hand to reverse these trends.

We support strong, fair and open competition to ensure users can enjoy the widest range of choice and opportunities to access content online, which is the heart of economic development in an information-based global market. HB1252 is a step in the wrong direction. North Carolina should be lowering barriers to public broadband initiatives rather than establishing new ones, so that we and other high technology companies can spread and prosper across this beautiful state. Please oppose HB1252.

Sincerely,

Alcatel-Lucent
American Public Power Association
Atlantic Engineering Group, Inc.
EDUCAUSE
Fiber to the Home Council
Google, Inc.
Intel Corporation
Utilities Telecom Council
Telecommunications Industry Association

cc: Governor Bev Perdue (by fax)
Secretary of Commerce J. Keith Crisco (by fax)
Rep. Hugh Holliman (by email)
Rep. William Wainwright (by email)
Rep. Paul Stam (by email)
Senator Marc Basnight (by email)
Senator Tony Rand (by email)
Senator Katie Dorsett (by email)
Senator Phil Berger (by email)
Senator R.C. Soles (by email)
Rep. Ty Harrell (by email)
Senator David Hoyle (by email)
House Public Utilities Committee members (by email)

Copyright violators

[wigaloo]

Two UCLA researchers published a paper in the prestigious IEEE Transactions on Computers that describes a technique for p2p content poisoning targeted exclusively at detected copyright violators.

What's to prevent poisoning legal p2p? There are plenty of examples of copyrights being inappropriately asserted. The technology itself doesn't discriminate.

Re:Copyright violators

[Darkness404]

Exactly, just go to YouTube and you will see the DMCA abused left and right. (Well, and if you read the comments page you will find the rules of spelling, rules of actually saying something along with the rules of grammar and common sense to be abused too....)

Re:Copyright violators

[TechForensics]

What's to prevent poisoning legal p2p? There are plenty of examples of copyrights being inappropriately asserted. The technology itself doesn't discriminate.

The article says the method works only on P2P networks that have adopted the authors' proprietary PAP protocol. That's not likely to be many of them.

Re:Copyright violators

[Anonymous Coward]

From what I've read this has been going on for years. Albums are being posted to NNTP and P2P which are bogus. For example, the track length is right. All the ID3 tags are there, but the file ends up either being emtpy noise/video or a the first 8 seconds repeated over and over.

There are legitimate uses for P2P downloads. I can get an ISO of SUSE much quicker through P2P, verify the MD5, and go. There are non commercial files in P2P such as images of poodles. Every once in a while I'll download something non commercial, not copyright, which has been poisoned. One day a few years back "rock climbing" became a keyword for some nasty files.

Isn't everyone simply doing rapid share, moviefap, and the like now, anyway?

The dawn of a new age

[mewsenews]

Humans had discovered methods to speedily and automatically transmit mountainous volumes of data. It was a new frontier, a utopia where information was shared peacefully between the people who wanted to see it. And what was its downfall? Not the anarchists, or the communists, or the Islamic fundamentalists, but the so called leaders of the free world.

"We had to do it," they said, "there is such a thing as too much freedom."

Re:The dawn of a new age

[basementman]

Get over yourself, the method doesn't do shit to bittorrent, the most popular p2p format so it's basically useless. If anything this will just get idiots off limewire into onto a decent network.

Re:The dawn of a new age

[jnnnnn]

That was a very moving post.

Re:The dawn of a new age

[Vectronic]

Although I agree (about LimeWire, KaZaA, etc)... the only reason this isn't happening to BitTorrent, is because they haven't figured out how yet, not because they think it's some infallible, untouchable, system nor that they think everyone should be using it instead of the others.

Re:The dawn of a new age

[Yogiz]

One problem with bittorrent is that it has a centralized tracker. You see what is happening to The Pirate Bay. If legal issues are of concern, I'd say that it's the bittorrent guys that should start moving onto a more decent network. And if that is to happen, we need to eliminate problems like content poisoning.

Re:The dawn of a new age

[xouumalperxe]

Semi-centralized, really. There is no clean way for me to connect to a "different Kazaa network", yet mostly anybody can host .torrent files and a tracker.

Re:The dawn of a new age

[DrDribble]

Well, TPB tracker is still online, but torrents are already re-fit with several other open trackers. The massively troublesome central point of failure is fixed even before failing!

Re:The dawn of a new age

[n30na]

Eh, you'd just have to have clients smart enough autoban peers with hashfails over a significant threshold, and I wouldn't be surprised if that already do something like that. I'm pretty sure the poisoning relies on the distributed nature of the network, so having a .torrent file with all the hashes kind of makes it moot.

Re:The dawn of a new age

[Hillgiant]

The tighter you close your fist, the more systems just slip through your fingers.

So everyone should just use BitTorrent.

[Anonymous Coward]

If all of the other p2p applications and protocols are vulnerable, as described by this research paper, then to me that gives direction to all pirates about what software they should use.

The other outcome likely is that the other applications/protocols will be improved to prevent such attacks.

This is a very nice and free security vulnerability analysis!

Re:So everyone should just use BitTorrent.

[Aklyon]

This is a very nice and free security vulnerability analysis!

how nice of them!

Re:So everyone should just use BitTorrent.

[v1]

Poison-resilient networks based on the BitTorrent protocol are not affected.

So, the most effective method of P2P is the one that's immune. Really, Edonkey? who uses that? Find yourself a good private BT tracker and be done with it. There are many to choose from. Not only are they immune to content filtering, but due to ratio requirements and the possibility of getting banned if you misidentify content you upload, they're immune to content poisoning as well as data poisoning and have pretty much guaranteed high speed across the board.

Wow

[taucross]

Poisoning the well. What an insightful revelation. Surely it's never been done before, maybe they should throw a patent on it.

Re:Wow

[Hurricane78]

Well. maybe we should throw something poisonous in their well.

Oh, wait. We're already doing it, and it works great. :D

Nothing to do with piracy

[Anonymous Coward]

What does this even have to do with piracy? The "researchers" have found a way for a third party to break p2p software when used for its intended purpose. Whatever your motivation is for that, it's a bug in the software, not a feature.

UCLA?! It's USC!

[eudean]

The bios at the end of the paper clearly state that both the Ph.D. student and the professor are from USC, not UCLA.

Two "researchers"?

[macraig]

They sound more like wannabe whores to me. How is this blatant soul-selling behavior legal and prostitution is not?

Re:Two "researchers"?

[Anonymous Coward]

And seriously, may I be the first to say:
*COUGH*PROXY*COUGH*

Re:Two "researchers"?

[macraig]

No, you may not! Didn't your momma ever teach you not to proxy^H^H^H^H^Hcough in public?

Freenet is gnutella?

[Anonymous Coward]

I was curious as to how they were poisoning Freenet, which should be robust against this with its Forward Error Correcting.

According to the paper, Freenet falls under the category of the "Gnutella family" (p.2). The Freenet Project that I know is in no way related to Gnutella.

Are they referring to a different file sharing program by the name of Freenet, or is this statement of theirs just plain inaccurate?

Re:Freenet is gnutella?

[Hurricane78]

Looking at their level of competence, I'd say: Both.

And neither. :P

Re:Freenet is gnutella?

[skeeto]

Yeah, I'm pretty sure their paper is bullshit. Aside from the whole anti-academic feel of the paper, I use Freenet myself and the little know enough about its architecture is enough to see through this paper. To poke at the other Freenet parts,

The popular BitTorrent and Freenet networks are still facing many lawsuits against their content distribution operations

I'm not aware of any Freenet lawsuits at any time, let alone "many". The way Freenet is built, it would be very difficult to find who to sue. For BitTorrent, the relatively small number of trackers have been under attack rather than the clients.

Applying our protection scheme, the Gnutella family, including Gnutella, Ares, KaZaA, LimeWire, Freenet, BareShare, etc., demonstrates the highest penalty on pirates because poison detection is only possible at the file level. Even a few chunks poisoned, the entire file must be discarded and downloaded repeatedly.

At the fundamental level, files injected into Freenet are split into 32kB (or less) chunks, which are inserted individually. That list of chunks that makes up a file is put into another chunk as a manifest, which becomes the address of the file. Freenet itself is not aware of files, just these small chunks. There is no "file level". It's the applications that run on top of Freenet that work with files.

It's content-addressable storage, so the hash of the chunk is its address. This makes it trivial to see if a chunk is good or bad. If a chunk is poisoned, the first clean node along the route will recognize this immediately and toss it out, which is a mere 32kB, not the whole file. Then search will continue elsewhere for the same chunk, as there is redundancy in the system specifically to thwart this attack (and deal with node downtime).

All in all, I'd rather the media cartels fall for fabricated papers like this than actually make effective attacks on p2p networks. So this paper is probably a good thing.

Freenet

[evanbd]

The paper won't download here, so I'm asking without RTFA, but how can this work against Freenet? Do they discuss Freenet in the paper at all? Freenet does chunk-level hashing, and the network enforces that the data matches the hash at all steps. Nodes returning invalid data will rapidly get dropped by their peers. Attacks like this are something that Freenet is explicitly designed to prevent. Also, the anonymity guarantees that Freenet makes would make it hard (potentially very hard) for them to identify a single user, let alone "collusion".

I'm forced to wonder whether the researchers mention Freenet at all, or if the poster is simply lumping Freenet in with other p2p apps that it has very little in common with. (Bittorrent and Freenet should be similar in some ways to their resistance against this attack, but Freenet's strong anonymity guarantees should make it more resistant. The fact that a node engaged in widespread poisoning will have trouble even staying connected makes Freenet even more resistant.)

Re:Freenet

[Anonymous Coward]

They lump Freenet into the category of "Gnutella-like networks", and say that their attack against gnutella should also work against Freenet since it is Gnutella-like (p.2 and p.12).

In other words, it is as you said, they are lumping it together with other networks.

It makes me question the quality of their research if they think that Freenet is so similar to Gnutella that the same class of attacks would work against both.

Re:Freenet

[calmofthestorm]

This is utterly absurd. The verification on freenet is based on asymmetric crypto. If they haven't broken that, the most they can do is flood the network with corrupt chunks, in which case the software will just start dropping peers who send too many corrupt packets at too high a rate. Translation: you need # of bad guys >> # of good guys to have much of an impact on network quality. And of course it's complete trash against a darknet, but I doubt these guys know what that is.

Given the subject matter, weasel words, and shoddy methodology, I'm about as worried about this as I am about the zombie communist terrorist invasion predicted for 2012.

Re:Freenet

[evanbd]

Most of the data verification on Freenet is based on SHA256. There is a well supported mechanism for signed keys (SSKs), but those are almost always used to simply redirect to the hash-based keys that use SHA256. Signatures in Freenet are based on DSA (slightly different lengths than the standard specifies, but the math is identical).

Re:Freenet

[MikShapi]

Freenet is a hard target. Arguably, the hardest of them all today. It's also the least popular.

The studios are playing a money game. Bang for buck. They want maximal deterrence for minimal spend.

Much like virus-writers aim viruses at the highest targets on the "adoption-by-the-masses"/"soft-bellyness" index, RIAA go-getem's do the same thing.

FastTrack - high adoption, soft belly.
Torrent - high adoption, not-so-soft... and segregated into lots of independent share-specific networks.
Freenet - low adoption, practically impossible to break.

It's a no-brainer. They've got no reason to go for the last. They may be greedy scum, but they're not that stupid with their money. Freenet would need to be adopted by the masses and get a ridiculous amount of media exposure to even pop up on their radar. Their goal is not to technically "stop filesharing" altogether, they realize that's a waste of money and effort. Their goal is to mitigate it by taking pot-shots at just the targets that are easy to break, and leave the harder ones alone (for now).

Being an informed geek, that actually makes me really happy. In a nutshell, It means we won.

Re:Freenet

[evanbd]

Yep. Freenet and TOR are both quite good at what they do (though they solve very different problems). Unfortunately, Freenet has a small userbase (current estimates ~ 10k). I think it needs more applications that work on top of Freenet before it will see more than very slow growth. It would be very interesting to see enough Freenet adoption that people took notice. There's plenty of reason to think it's reasonably secure, but you just don't know until someone actually tries to attack it.

Re:Freenet

[Anonymous Coward]

I have read the article (about an hour ago, I don't have it in front of me as I write).

As far as I can remember there was no mention of freenet at all, however the article does cover the effectiveness of the method against different P2P technologies in terms of the chunk verification features of the different P2P technologies, which may be relevant to how this would apply.

First point to note is that the article covers eMule, eDonkey, BitTorrent, Shareaza, Limewire, Azureus and some others calling them all 'networks'. I'm not sure this is appropriate, some of the names signify protocols to me, others signify client programs, and others possibly cover protocols which are only implemented in a single (presumably closed source proprietary) client. Designating a network with the name of a protocol which enables you to join it may be OK, I am not sure the same applies for clients (some of which may be multi-protocol).

Second point is that their approach is to propose extensions to existing protocols which add a permission-to join-and-share feature. They've grafted an extension of this kind onto one of each kind of the base protocols covered, and modelled how well the extension helped them to permit sanctioned sharing but prevent unsanctioned sharing. The applicability of the work appears to be to content delivery networks which attempt to reduce the cost of distribution of paid content by using peer-to-peer software running on customer CPUs to fulfil delivery of content. The applicablilty of their technology appears to require that all peers are running a client supporting their extension, so this is not relevant to poisoning of a community using an open protocol where multiple clients exist and are not all under proprietary control.

Their result appears to show that their poisoning technique works very well against P2P technologies which have to download a whole file before hash verification, fairly well against technolgoies which do hash verifiaction on large chunks, and not well at all against technologies (like BitTorrent) where hash verification is used for every downloaded chunk. On this basis the parent's description of freenet puts it in the class of protocols which would not be a good match for a proprietary CDN vendor would bring ito such a solution.

Re:Freenet

[Anonymous Coward]

If I remember corretly, Shareaza does gnutella with chunk level hashes using TigerTree hashes. If a client starts sending corrupted data the client just bans it.

Re:Freenet

[Kjella]

They lump Freenet into the category of "Gnutella-like networks", and say that their attack against gnutella should also work against Freenet since it is Gnutella-like (p.2 and p.12).

Except it won't because freenet isn't p2p it's p2swarm.... a client can request data with the right "magic code" but all the nodes inbetween would cache it and all the pirates get it from one of the non-authenticating nodes. Note that this is really all a stupid authentication system, the sending peer could simply ask the master server "is this an authenticated client too?" and send poison data if not. This is basicly already done and better with private torrents - with the rights flags set the tracker will only allow authenticated peers and peers won't let you connect even if you know about them through DHT etc.

Re:Freenet

[n30na]

Given the subject matter, weasel words, and shoddy methodology, I'm about as worried about this as I am about the zombie communist terrorist invasion predicted for 2012.

I believe you mean zombie communist alien vampire terrorist invasion

Re:Freenet

[Deliveranc3]

Freenet is a hard target. Arguably, the hardest of them all today. It's also the least popular. High overhead will do that to you, ISPs make the overhead look bigger by shunting encrypted data into low speed transmission. Ugly ugly stuff, arguably illegal and the government is too scared to step in. The studios are playing a money game. Bang for buck. They want maximal deterrence for minimal spend. I'm concerned that's the happy fun version, really they're looking to transfer us all over onto their p2p network, consider if they released all their movies and music (perfectly cataloged) for a year over a single protocol, what % of file sharers would move to it? What if they started paying Linux distros to use it? Or other content distribution systems? They want to control the network, or at least the vast majority of users like they did in the 90s, making obvious their attacks hasn't worked. Now they will be surreptitious, releasing subtly degraded works and shunting the piracy crowd somewhere out of the way for execution.

They won't give up, they are America's propaganda and they have the full backing that entails.

These "researchers" obviously arent Entourage fans

[Cur8or]

If they where, they would not be engaging in such pointless research. A little more Turtle and a little less Ari.

Who cares?

[Stickerboy]

First, the *IAA went after the file-sharing services. "Oh no!" The geeks cried. "File-sharing services have their 2-5% legal uses, too. Why can't they go after the illegal usage?"

Next, the *IAA went after the individual copyright violators. "Oh no!" The geeks cried. "You're being mean! And sometimes the computer owner isn't the actual violator."

And now it seems the *IAA wants to increase the noise-to-signal ratio on P2P to raise the difficulty of illegally downloading copyrighted content. "Oh no!" now the geeks are crying (from the comments prior to mine). "It's harder to get my free shit." (literally)

Seriously, out of the three options presented, I would pick #3 any day of the week... I have no need of the latest trash from the next star of American Drooling Idiot, and it's the least punitive measure they've explored.

If you guys really cared about putting the *IAA out of business, you would stop buying AND downloading their products and encourage others to do the same. Their entire business cycle depends on hype and publicity, it doesn't matter HOW they get it.

"But... but... what about [insert favorite author/performer/director here]? I love their stuff!"

Fuck it. Get some priority, and figure out what's more important to you - your self-gratification or putting them out of business. Unfortunately, everyone, including the *IAA, already knows what the large majority of sheeple will pick.

Re:Who cares?

[guruevi]

Plenty of people already do it - heck even the musicians are starting to turn away from RIAA-backing labels. The RIAA however has found another way to keep their businesses alive: government bailouts. Just like GM, Ford, Chrysler and a host of other companies that couldn't cut it in the new world, they are now being funded by the government which just creates a law about who should pay for these old businesses. Who's paying for it now: the radio stations. The government has decided that the radio stations should pay the RIAA for songs they play. Over the years, the labels have paid DJ's to promote their music (payola), gotten free airtime etc. etc. and now they expect the radio stations to pay it all back. They already pushed the internet radio stations to pay more for the right to play any song, now they are pushing the am/fm radio stations to pay for the rights to play any song.

The RIAA has effectively become through lobbying a government agency. They are being allowed to tax anybody who plays or makes public any type of music in any type of way even if the musician or label is not signed with them.

Re:Who cares?

[timmarhy]

dude you reek of yourself.

Re:Who cares?

[Anonymous Coward]

First, note that I do not pirate anything.
Your argument is stupid. I also see people using it against people who don't like the iPhone store limits.
I will explain why:
1) File sharing services have many uses legally, your 2-5% is just bullshit that you made up to prove your point. I have played many legal freeware games that were only mirrored as torrents as the developers didn't want to/couldn't pay for hosting, torrents were a great solution for them. There are many other uses, definitely more than 2-5%, but no, I won't make up numbers.
2) There's nothing wrong with going after the owner of the computer, but you have to prove that they actually did it. I'm fine with people being punished for stealing songs, but $20 per song when you don't have proof that they actually did it (besides it being their computer) is stupid. Sure, a lot of them did it, and they should be punished. Get some evidence and a fair sentence.
3) Pick number 3? No. First off, they are proposing that they detect piracy automatically. I hope that anyone on slashdot would understand that this is not possible. Second, they want DRM things they don't even own. If they want to make their own service and DRM, fuck it, I won't use their service, but if they are trying to get DRM on other peoples crap, I have a problem.
4) You assume we buy/download stuff from the RIAA. I don't know why you assume this, I am aloud to complain that they are trying to fuck up my filesharing wether or not I own their stuff. Then you recommend that we boycott their stuff--then you explain that it won't work. So why recommend it? You just took your own point and nullified it.

In the end, your argument sounds smart and (usually) gets a good rating wherever it is applied, but it really doesn't make sense. All is not binary, you can like music enough to buy it and still have the right to complain that the RIAA is full of shit.

Re:Who cares?

[Stickerboy]

>dude you reek of yourself.

I'm sorry, did I touch a nerve? Or are you one of those who rail against the *IAAs while rushing like a good little sheep to consume their products?*

*buying OR downloading

Ratios for overseeded torrents?

[tepples]

Not only are [private BitTorrent trackers] immune to content filtering, but due to ratio requirements and the possibility of getting banned if you misidentify content you upload, they're immune to content poisoning as well as data poisoning and have pretty much guaranteed high speed across the board.

But the sum of share ratios can never exceed 100%. Say I download a file and then leave my client seeding for a week, but almost nobody downloads the file from me because the torrent has a total of three downloaders getting pieces from about 100 other seeds. How do I get to even 90%? Or how strictly does a typical private tracker enforce ratios for older, overseeded torrents?

Re:Ratios for overseeded torrents?

[Bigjeff5]

Have you ever actually used a bittorent client before?

There is no such thing as an overseeded torrent. There are underseeded torrents, and those are frustrating, but there is no such thing as an overseeded torrent. The general idea with upload ratio requirements is that it encourages you to never stop seeding a torrent. If 100 people are seeding and only 3 are downloading, those three get the file extremely fast, and your bandwidth isn't taxed. If you download enough content that you are on a private tracker, then you should have a number of torrents to share. If you aren't downloading all that much, then it will be easy to keep a 100%+ share ratio. If you ARE downloading a lot, you should still be in the 50% range, and eventually you will hit critical mass and the ammount you download won't be able to keep up with the amount you upload.

It's good for everybody. Plus, if a private tracker has a very high seed rate, chances are the required share ratio will be lowered. It creates a win-win situation.

Remember, no such thing as an overseeded torrent. If you download a lot, you WILL share a lot. If you keep sharing after you download, you will soon be sharing more than you download. People move on, quit sharing, lose their computers, etc.

Your share ratio math ignores a lot of things that reduce the amount of data on the network which occur all the time. It's actually pretty easy to exceed 100% share ratios for everybody on the network. If you can't see how it's because you've locked yourself in a tiny box and completely ignored outside factors which remove data and introduce data without affecting increasing the amount of data a person can download. Whenever someone adds a new download to the tracker, the potential share ratio for everyone in the network increases. Whenever a new member joins, the potential share ratio for everyone on the network increases. Eventually it balances out to 100%, but the network is ever changing so it never actually gets there.

Re:Ratios for overseeded torrents?

[Freetardo Jones]

Or how strictly does a typical private tracker enforce ratios for older, overseeded torrents?

Private trackers enforce a ratio for your cumulative downloads and uploads not on a individual torrent basis.

Re:Ratios for overseeded torrents?

[Alsee]

I think he has used torrent before. His complaint about "overseeded" torrents was that *you* get squeezed out from offering any upload on a torrent that has a large ratio of seeders-to-downloaders. If you download some old massively-seeded-and-few-downloaders file, it becomes almost impossible to meet private tracker upload ratios. You could seed for a month and end up with a 0.1 upload ratio.

-

Re:Ratios for overseeded torrents?

[Kjella]

If you can't see how it's because you've locked yourself in a tiny box and completely ignored outside factors which remove data and introduce data without affecting increasing the amount of data a person can download. Whenever someone adds a new download to the tracker, the potential share ratio for everyone in the network increases. Whenever a new member joins, the potential share ratio for everyone on the network increases. Eventually it balances out to 100%, but the network is ever changing so it never actually gets there.

No. Your ratio can only become better by making the newcomer's ratio worse, so they have to limit their downloads and try to get upload of their own. More files being added is an opprtunity to seed but it's no good if it's rushed by everyone else that needs to improve their ratio as well. If I'm just a few hours late on a release it'll have 100 seeds and never seed back 100% because even if some are late to the party the 100Mbit symmetric people will seed them in minutes.

I am member of a nice private tracker, 0.45 minimum + bonus points + free leech files + free leech weekends + 1/2 off some classes and before on a slower line I was struggling to make it and it's not because I'm being tight fisted, it's because it's impossible to seed more. I had to snipe fresh releases and download free leech files that I then get credited upload for just to avoid being banned. The upside is that every file maxed my download every time, never any waiting for what I wanted. A fair trade, I think.

Re:Ratios for overseeded torrents?

[v1]

But the sum of share ratios can never exceed 100%

I tried to have that discussion with several people in the past and was unsuccessful at penetrating their skulls with the concept.

For any one user that has a ratio of 2.0, there must be two users with a ratio of 0.5, etc. (in other words, the sum average ratio must be exactly 1.000) But there are other factors at work. deadbeats with low ratios (0.1) get banned. FreeLeech events. Both of these raise the average ratio above 1.0 . I think keeping the average ratio above 1.0 is the main reason we see freeleech events on all private trackers. Other private trackers make similar events such as "2-for-1 upload week", "freeleech torrents" or something like that.

But I'm one of those that skews the curves. I have a seedbox and generally don't stop a torrent until the tracker removes it. I see people stop in and snatch something I'm the only one seeding a month after everyone else has left the swarm. That keeps my ratio well-fed and allows me to hop in and grab a gig or three when I want to without having to worry about my ratio. It also keeps content availability/selection high, it's nice to go to a tracker and immediately find what you're looking for even if it's not all that popular or common. People like me are what make that happen.

Unfortunately there are enough people doing this that it puts a lot of announce load on the trackers. I've seen private trackers actually request that users don't seed beyond a certain time past the "no leeches" point, or to cap the total number of torrents they are seeding. Most trackers just run scripts that automatically delete torrents after they have gone a certain time without any leeches. I suspect a few of them dynamically adjust the prune point based on the number of announces their tracker is receiving, to keep traffic at a level their tracker can manage.

Re:Ratios for overseeded torrents?

[tepples]

I've seen private trackers actually request that users don't seed beyond a certain time past the "no leeches" point, or to cap the total number of torrents they are seeding.

So what should I do when my torrents are being pruned but are still at 0.2 or something?

Re:Ratios for overseeded torrents?

[Anonymous Coward]

This is amusingly enough pure bullshit.

It takes time, but it is not as hard as you'd think.

I have an account on a private tracker where it is quite hard to keep a high ratio. Still, I've managed to reach a ratio of over 4.xx. Leaving the torrent seeding almost guarantees that you'll push some bytes over time. If the data is sitting on your drive anyway there is really no downside to having it set to seed.

Re:Ratios for overseeded torrents?

[Anonymous Coward]

I'll leave the name of the tracker I use out for obvious reasons but consider this:

Ratio rewards for doing work for the tracker. Like winning forum competitions :D
"Free Leech" packs where only your upstream transfer is counted.
Time-based ratio rewards. (Some trackers reward you some bytes per hour of just having the torrent seeded regardless of any actual data transferred).

Just a few ways of which the trackers are not a zero-sum sphere ;)

I dont know any tracker that enforces ratio on a "per torrent" basis. All I've ever seen enforce a global user ratio. Most are quite lax even..

Re:Ratios for overseeded torrents?

[n30na]

I think he might have been suggesting that you upload your own torrents.

Re:Ratios for overseeded torrents?

[Repossessed]

Whenever someone adds a new download to the tracker, the potential share ratio for everyone in the network increases.

Only for the person who added the download. Anybody else needs to download it before they can start sharing, making it zero sum for them.

Whenever a new member joins, the potential share ratio for everyone on the network increases.

Except for the new guy, whose share ratio will be lower because he has to download something before he can upload it.

The average share ratio for a given download will *always* equal n/(n+1) where n is the number of downloaders. It will never quite reach 100%, its certainley impossible for everyone to have 100%, since there are selfish people like me with high seed ratios.

You also have to factor in that the tracking is extremely flawed. I have a total upload on demonoid of 144.61 GB, but *just* the uploads of one seed total 166, so the tracker isn't terribly accurate.

Finally, if everyone seeds everything they download like you describe that will actually jam up the network, since you'll have 100s of seeds on a download that your client will waste time trying to make contact with because the seed's network is congested with all the things its uploading.

Re:Ratios for overseeded torrents?

[tepples]

It takes time

Months? Years?

If the data is sitting on your drive anyway there is really no downside to having it set to seed.

Other than the computer being powered off or disconnected from the Internet. Not everybody owns a dedicated server for seeding that is left on all night.

Re:Ratios for overseeded torrents?

[v1]

So what should I do when my torrents are being pruned but are still at 0.2 or something?

That can happen if you happen to join a swarm that's near the end of its life. If it's been going for 4 months and has already been snatched 500 times, and there's currently five seeds and no leeches, it's a prime candidate for pruning.

There are lots of things you can do to help your ratio. Most good sites have a lounge area with pages with specific suggestions for how to do this given their site's rules and SOP. If not:

1) run a seed box. Use another computer to do your torrenting, and when something finishes, let it ride until it gets deleted. Set the computer to auto start after power fail etc.

2) don't cap your upstream. or if you need to, be sure to uncap it when you don't need it anymore.

3) upload your own torrents. 100% of your traffic on an upload is upload ratio. Just be sure you mind the site's rules. Read them, create the torrent, and before you upload it, read them again and make sure you are following the rules.

4) get on torrents early. Keep an eye on the front page, and download things you want the day they are uploaded. Your seeding will go much better in the first two weeks of the torrent than if you join a swarm that's two months old. Avoid trawling old torrents for something you want or might want. Have some patience and see if someone else will upload a newer/better version that you can hop right on while it's new instead.

5) advanced technique for power-ratio'ing: if you spot something just uploaded that you know is going to be popular, and you have a good upstream, download it. I don't care if you don't want it, download it anyway. Put your seed box to work. That 500mb ISO you download can quickly turn into 5-10gb of upload over the next two weeks. The faster you can get it downloaded, the faster you can seed it, so don't use your downstream for other things while downloading it, so you get it seeding as quickly as possible.

6) all the usual BT stuff... make sure your ports are mapped, connectable, clever, whatever you want to call it. Make sure your port isn't being throttled by your ISP. Try different BT clients that may perform better. Check those advanced options. Check your seed box every few days in case it needs your attention.

7) another advanced power-ratio'ing technique: if you spot a swarm that's still in midlife (or better, new!) and you already have that, download the torrent. Start it and stop it immediately. Drag in a copy of it from your files. Tell your client to recheck it. It should recheck at near 100%. You'll be seeding it within minutes. It's as good as an upload.

Re:Ratios for overseeded torrents?

[v1]

If you download some old massively-seeded-and-few-downloaders file, it becomes almost impossible to meet private tracker upload ratios. You could seed for a month and end up with a 0.1 upload ratio.

I've been there. My first experience with BT was someone invited me to a private tracker to get something that was not exactly breaking news. 600mb later and I went into seeding and was horrified to see my fat upload pipe barely cracking 2k/sec. I left it seed, a week later I get a ratio warning. A week after that I get my login banned. I could still continue to seed though so I prayed it would eventually crawl above acceptable.

And then we had a blackout that beat my UPS. game over man game over.

Re:Ratios for overseeded torrents?

[tepples]

That can happen if you happen to join a swarm that's near the end of its life.

That's the situation I envisioned.

1) run a seed box. Use another computer to do your torrenting, and when something finishes, let it ride until it gets deleted. Set the computer to auto start after power fail etc.

How would one justify the electric bill for that?

3) upload your own torrents. 100% of your traffic on an upload is upload ratio. Just be sure you mind the site's rules.

I already dealt with that in this comment. Even if private trackers didn't have a policy of scene releases only, how would I create works that other tracker users want to download?

Avoid trawling old torrents for something you want or might want. Have some patience and see if someone else will upload a newer/better version that you can hop right on while it's new instead.

So once the torrent for a DVD nears its end of life, would you recommend that I wait years for the Blu-ray release?

6) all the usual BT stuff... make sure your ports are mapped

A mapped port isn't worth much if no downloaders want to connect to it.

Make sure your port isn't being throttled by your ISP.

What can I do if both the local cable company and the local phone company throttle BitTorrent traffic even on a nonstandard (but constant) port? Is it common among users of private trackers to move their families to a town that has an ISP that doesn't throttle BitTorrent traffic?

Try different BT clients that may perform better.

Which private trackers tend to ban. It's either recent Azureus or recent uTorrent or nothing.

Re:Ratios for overseeded torrents?

[v1]

1) run a seed box. Use another computer to do your torrenting, and when something finishes, let it ride until it gets deleted. Set the computer to auto start after power fail etc.

How would one justify the electric bill for that?

If your seed box is making a noticeable impact on your electric bill, either move to a civilized country or get a better machine. A seed box shouldn't add more than a buck a month to your electric bill.

3) upload your own torrents. 100% of your traffic on an upload is upload ratio. Just be sure you mind the site's rules.

I already dealt with that in this comment [slashdot.org]. Even if private trackers didn't have a policy of scene releases only, how would I create works that other tracker users want to download?

Sorry I can't help you with your creativity. Consider finding public works and making collections. Some sites allow this and users like someone saving them them time. You'd be amazed how popular picture collections of hot celebs are.

Avoid trawling old torrents for something you want or might want. Have some patience and see if someone else will upload a newer/better version that you can hop right on while it's new instead.

So once the torrent for a DVD nears its end of life, would you recommend that I wait years for the Blu-ray release?

Maybe someone will upload the director's cut, or a version with multiple audio tracks, additional content, higher bitrate encode (or perhaps raw, or vice-versa, not everyone wants to download 7gb of VOBs) There are many possibilities even for your specific example. If you downloaded VOBs because that's all that was available, then encode them down to MP4 and watch people with metered bandwidth flock to your swarm.

6) all the usual BT stuff... make sure your ports are mapped

A mapped port isn't worth much if no downloaders want to connect to it.

Actually, if you DON'T have a mapped port, and a leech that wants your seed isn't or can't map his port, that will prevent them from connecting from you. That's the point of "being clever". Seeders that aren't clever should expect a lot less traffic.

Make sure your port isn't being throttled by your ISP.

What can I do if both the local cable company and the local phone company throttle BitTorrent traffic even on a nonstandard (but constant) port? Is it common among users of private trackers to move their families to a town that has an ISP that doesn't throttle BitTorrent traffic?

You may have to go with a different provider, possibly a lower quality one, or you may just be SOL. Not every problem is fixable.

Try different BT clients that may perform better.

Which private trackers tend to ban. It's either recent Azureus or recent uTorrent or nothing.

Just pay attention to the rules. Very often they have an entire thread or faq devoted to this issue, and will get very specific about which versions of which clients they do and do not accept. It's common to see a whole string of posts on a given client, as new versions are either being banned or accepted as new versions are released and bugs crop up or get fixed.

You appear to be content to chew on sour grapes rather than try to fix your problem.

Cuckoo eggs

[tepples]

the network enforces that the data matches the hash at all steps.

But what enforces that the hash matches the title, as opposed to a cuckoo egg?

Re:Cuckoo eggs

[Anonymous Coward]

Most file sharing on Freenet is done through Frost or FMS, both of which are message board software.

It would be pretty easy to detect the fake files, as the users would call it out. On FMS, you can even mark users who supply fakes as untrusted. By rating other people's trust lists, and publishing your own, you form a "web of trust". This was intended to be used against spammers, but would also work well against "Cuckoo eggs".

Re:Cuckoo eggs

[evanbd]

Nothing -- that's a key distribution problem. There are various people working on the general spam problem for Freenet through web of trust type solutions. Those would extend to cuckoo egg type spam as easily as any other spam. Get your keys and your torrents from someone trustworthy. Right now, that's done by message board apps, and people could easily post complaints about or verification of a specific file.

Translation:

[Snacktard]

Today UCLA researchers enrolled in the RIAA's Junior Achievers program proved that p2p networks Gnutella, KaZaA, Freenet, eMule, eDonkey, and Morpheus are, in fact, still in use. Researchers proceeded to take great joy and pride in kicking a dead horse. Unfortunately they were unable to have any effect on modern incarnations of artificial scarcity reduction technology.

Re:Translation:

[calmofthestorm]

And the rivers flowed green with grant money.

Can't download it?

[Anonymous Coward]

http://thepiratebay.org/torrent/5019955

Re:Can't download it?

[evanbd]

Alternately, someone in the Freenet IRC channel was able to download it and insert it for me:

CHK@XJ75hZcrMrQyfhFQrwwWflZkatrK-ZDBzvmkoHdon2U,2UW5ISsU0Qafd3gCOvsB7lstjGrx5RGqPEU1vQm4Dfg,AAIC--8/IEEE-TC2007-09-0492R2-finalized-April8-2008.pdf

Toy Story quote

[bertoelcon]

Somebody's poisoned the water hole!

where's michael jackson's grave?

[Anonymous Coward]

i'm wanna take a big shit on it.

Time the *$&*()^ out

[cortesoft]

These guys are from USC, not UCLA. As a UCLA graduate, I am extremely upset that anyone would make this mistake. USC students and professors are smelly, unclean, spoiled children who work for the RIAA. UCLA students and professors are the opposite.

Never, EVER, confuse us again.

Re:Time the *$&*()^ out

[w0mprat]

Hey I resemble that remark!

Re:Time the *$&*()^ out

[Hurricane78]

Which USC do you mean? http://en.wikipedia.org/wiki/USC

Yowzer

[sonicmerlin]

Even researchers should have basic ethics. Research like this can only harm society in the long run.

Poisoning is redundant, the content is poison

[syousef]

...given the absolute rot most people are downloading on the networks. I mean honestly. What could be more poisonous than a Britney Spears song? I'd say let the downloaders have the content. Can't think of anything more poisonous.

Re:Poisoning is redundant, the content is poison

[gigabites2]

You're right. Britney Spears' songs are definitely toxic.

Re:Poisoning is redundant, the content is poison

[syousef]

You're right. Britney Spears' songs are definitely toxic.

My mistake. Alice Cooper was "Poison" ;-)

Re:Poisoning is redundant, the content is poison

[mcgrew]

What could be more poisonous than a Britney Spears song?

Rap?

Re:Poisoning is redundant, the content is poison

[Anonymous Coward]

i used to say this but I have realized that not all rap is bad rap

wrong end of the stick...

[bukuman]

I read the summary as them finding a way to create a p2p network of 'customers' (clients who pay to be in your p2p network where you deliver paid content) and protecting yourself from the 'customers' who 'collude' (e.g. hacked client s/w?) with non paying client s/w to allow non paying customers to get the content. I don't think it's about subverting an existing network, it's about protecting a network from subversion. If so then the techniques could presumably be used for other purposes, poisoning surveillance perhaps.

Re:wrong end of the stick...

[pearl298]

Problem is that this has already been tried for several years and no one has managed to make it work! Emule right now returns 4 bogus "search results" for any global search (not a KAD search!) for example.

How often do you think someone will be fooled by that or any reasonablee derivative.

kazaa=small BT=large

[fluffernutter]

People use Kazaa for large files? I thought Kazaa was for small files and bittorrent was for large ones. Now I'm confused.

Never confuse ignorance with determination

[msimm]

It's entirely possible that the authors do fundamentally believe in the rights of the copyright industry, but that doesn't mean they might not be frightfully ignorant of any number of closely related technologies.

In fact my experience has shown me that fundamentalists tend to be the most narrowly focused people I meet (whatever their beliefs).

Anonymous Coward

[Anonymous Coward]

anyone who still uses Gnutella, KaZaA, Area, LimeWire, eMuel, Shareaz, eDonkey, or Morpheus deserves this. anyone who researches said p2p apps should have their computer taken away, for they shall never understand the internets.

Paper summary

[creidieki]

As a comp sci grad student, here's what I got from a quick reading of this paper:

Imagine that you're a content provider, with paying users. You've decided to distribute content to your users by running a Gnutella-style network. How do we make sure that only paying users can get our content? After all, it's an open network.

We start by sending some sort of magic timestamp-thing to all of the paying users. I didn't read this part in much detail. Anyway, the paying users can all identify each other somehow. They mention that it maintains privacy.

Some of your paying users (the "Clients") are good, virtuous folk, and they're running the Happy Authorized Gnutella software you gave them. Others (the "Colluders") are running Evil Hacked software. No matter what you do, the Colluders are going to send chunks of your precious data to the "Pirates" (anyone who hasn't paid you).

Normally, we'd expect our Clients to ignore requests from our Pirates. This paper instead suggests: let's obligate the Clients to send poison data to the Pirates! The Pirates won't know which chunks are bad; they'll only find out that the file is corrupt once it's finished downloading. The Pirates won't be able to get a good copy, and they'll give up and go away.

And there's one other great thing: we can set up *fake* Pirates, and check which users aren't giving out the poison they're supposed to! So we've served data to all of the Clients; we've identified all of the Colluders; and we've defeated all of the Pirates.

(Bittorrent has data integrity checks for every chunk, instead of every file; that's why it's not vulnerable to this attack...I mean business model).

In summary: This paper describes a way that a company can charge for distributing their own content on a peer-to-peer network. It only works if they control a centralized "transaction server" thThat's why no one has ever at organizes the entire network, and if they control the software of all the "honest" people. They can't destroy our existing networks with it, and it doesn't prevent anyone from turning around and posting the file to BitTorrent once it's downloaded.

The tone of the paper is definitely not as neutral as I feel it should be. What they're trying to say is "there's no obvious way to charge people for running a Gnutella server, because pirates will eat your lunch. But we think we have a way." But it definitely feels like they're putting moral force behind what's really a network algorithms result.

Re:Paper summary

[Anubis IV]

As a note though, from a fellow CompSci grad student (though I didn't bother reading the paper), it IS possible to "poison" BitTorrent. I've read a handful of papers on the subject in the past year or two, but most of them focus on things like DHT entry poisoning or other similar techniques, and not on compromising the data itself.

Re:Paper summary

[Diomidis Spinellis]

Very well put. I didn't have space to explain this in the submission's summary, but this is the gist of the paper.

Re:Paper summary

[Anonymous Coward]

Which is the stupidest idea I've ever heard. Any enterprise could create a private Bittorrent tracker, with any authentication mechanism, to achieve the same goal. But they prefer to waste client's bandwidth sending junk to pirates.

Re:Paper summary

[ymgve]

Bittorrent has data integrity checks for every chunk

So does edonkey. These people have no clue what they're talking about.

How is this different?

[pearl298]

Lets me see if we substitute "not approved by the fearless leader" for "unlawful copyright violator" how does that change the what they are doing?

IMHO this is yet another attempt at FUDD to scare off people who would spread ideas that those in power do not like.

The enormous success of these approaches can easily be seen by a quick check of Emule/Bittorent which shows over 6 million users right now.

My bad.

[Kaenneth]

I once accidently did a minor DoS attack, when I was starting to write my own P2P client for the Kad network used by eMule, etc. it kept returning the same IP in response to every directory lookup.

Sorry to whoever had 127.0.0.1 back then, if your connection went down it was my fault.

(I don't remember the actual IP)

Fundamentally Flawed.

[Anonymous Coward]

Note: This attack does not work on open networks as described. The abstract is in error.

They're actually describing the design of a large number of authorised, trusted (paid?) clients, and collusive content providers, indexed for some reason in an open network, but trying to poisoning that open network if it asks for the same.

Riddle me this - why the fuck would such a model not just form a closed network and "solve" the problem that way? (Of course, true Judas nodes are undetectable, leaking a highly-colluded file or master file immediately afterwards, rather than concurrently.)

GossipTrust has various flaws I'm not going to talk about here; let us simply say, gossip is unreliable, and susceptible to as many attacks as it is in real life. :)

Further, it's possible for the rest of the network to collude in the exact same way to detect the fake nodes and drop them off the face of the network, using the same thing. Which they do, because a few nodes tried this attack about five years ago. So, the colluders will be partitioned out into a separate network anyway.

Receive a single poisoned chunk, which is in fact detectable with a single TTH leaf (they have completely forgotten that Gnutella as it was originally defined no longer operates, and in fact TTH is widely pervasive and, due to the smaller block size, many times quicker at spotting corrupted chunks than torrent's often 512KB/1MB SHA-1 list is, although torrent also has a TTH extension now), and all modern P2P network designs will "shitlist" you, which will spread as fast as your chunks do.

How'd this piece of shit research ever get published in the IEEE journal? It's worthless, its conclusions are questionable, you'd be laughed off the stage talking about this at any security conference. Turn it around and talk about detection, but don't pretend this is practical at all.

Re:Fundamentally Flawed.

[Anonymous Coward]

As I suspected, you can pretty much tear this apart with a Sybil attack using just two IP address/port pairs in hidden collusion, one of which is authorised and one of which isn't.

By "vulnerable", I mean a complete DoS attack - the reputation system can be used to lock every authorised client out of the "clean" chunks (essentially by reporting them as suspected colluders), as well as harvesting all the IP addresses of the poisoners using the same authorisation system as they use. Which can then be shitlisted.

This attack would take one person about 15 minutes, making this far more fragile than the networks it's based upon.

If you have authorised content to distribute over P2P, don't be a fuckwit - use torrent, and an https: private tracker. Job done. That will be far more effective, and far less crashable, than this.

SLASHDOT SUMMARY IS WRONG

[Alsee]

I'm part way through the research paper, the article summary is just plain wrong.

There is no vulnerability here. They CANNOT poison Gnutella, KaZaA, and Freenet, eMule, eDonkey, Morpheus, or any other existing network with this technique. To quote the paper: Presently none of these P2P networks has built with satisfactory support for copyright protection.

The "problem" they want to "solve" is that existing networks to not possess adequate support for poisoning attacks. This paper proposes creating a NEW additional P2P network. They propose deliberately building in special support to ENABLE poisoning attacks.

While I'm sure the RIAA will eagerly read it over while dreaming of world conquest by releasing their own deliberately crippled "legal P2P network" where they get paid for each authorized client-to-client transfer. As far as most readers here are concerned, this is a completely non-newsworthy story, the contents of this paper are completely irrelevant and harmless. There is absolutely nothing new or surprising about the fact that you can deliberately make your software insecure and you can deliberately leave it vulnerable to poisoning. Yes, a P2P new network could be built Defective By Design.

-

Re:SLASHDOT SUMMARY IS WRONG

[Alsee]

I'm not sure if I missed the last line of the summary in my haste to read to the PDF file, or if the summary was updated, but the last line of the summary is correct and it pretty well refutes the rest of the summary-as-written. The earlier statements in the summary about success rates in blocking particular existing networks are wrong. Those blocking percentages are modeled results *if* those sorts of networks were to become paid access networks implemented this deliberate poisoning capability into their design.

-

Gnutella, KaZaA, Morpheus?!?!

[Anonymous Coward]

Did I just step back in time?! Hello? 2001 called and wants it's technologies back.....

Actually-consequence? What consequence?

[Anonymous Coward]

"Actually, poisoning P2P networks as a commercial venture could be prosecuted as theft-by-deception."

And engaging in illegal copyright infringement could be prosecuted as? Are you sure you've thought this whole thing through?

"Stealing bandwidth is a crime."

You might want to be careful with that argument. Carried to it's conclusion people who abuse their ISPs connection could be fined and do jail time.

"Downloading songs isn't, if you aren't profiting form it"

Uploading is, poisoning them takes care of the downloading part.

Re:kazaa=small BT=large

[justinlee37]

People use bittorrent for small files all of the time.

I can see it from here

[Drakkenmensch]

*knock on Pirate Bay's office door*

"What the hell is that?"

*Hannigan the traveling salesman enters*

"Good evening, little girl, is your mommy home?"

"Dude, this is the pirate bay office."

"No worries precious, I'm sure your birthday party can wait a few moments longer until the dreadful pointlessness of existance crushes your youthful hopes and dreams like mine have been two decades ago, leaving me a hollow broken shell of a man seeking solace in cheap whores and nickel whiskey shots on hungarian hobos."

"Who the hell are you?"

"Hannigan's the name, and I'm here to offer you a great product - it's Peer to Peer Protocol Poison, or 'Pee Pee Pee Pee', from Doc Poison's computer destroyers. When there's traffic that needs destroying, it's Doc Poison or arson!"

This poisoning scheme wouldn't work

[Anonymous Coward]

Gnutella, eDonkey and Ares clients simply check the chunks and discard them if they're bad. If a client repeatedly feeds bad chunks, the client receiving data from it will simply ban it and get its chunks from other people. In order to slow down P2P networks poisoners only a little bit poisoners would need thousands of peers, which simply doesn't work (just ask the lamers at MediaDefender). OverPeer had managed to poison Kazaa because of the weakness of Kazaa's hashing system: it considered only the beginning of each file instead of the entire file, but modern P2P clients are immune to this (which explains why OverPeer went bankrupt).

To put it simply, this "research" looks like BS to me. Besides, the paper was published in April 2008. If their stuff had a chance to work, I guess the mafiaa would have been already using it by now.

Great...

[Hurricane78]

I only use the eDonkey network for small files (music, images, books), and BitTorrent for the big ones, so that thing won't even affect that.

The only bad thing is, that now rare bigger files (like lossless music, very specific software, etc) will be hard to get.

But I really do wonder. Because as far as I know, no network out there works without checksums. So poisoning will be detected, and then circumvented (e.g, manually).

Re:kazaa=small BT=large

[mcgrew]

You're not confused, the "researchers" are.

snuggl

[jDeepbeep]

One problem with bittorrent is that it has a centralized tracker. You see what is happening to The Pirate Bay.

This may be of interest.

For those who can't be arsed to follow the link:

TPB has been owned by a company for the last years since the raid so nothing there will really change except the names of the owners. The talk about TPB are going to be a pay site is wrong, the CEO that said that does not know what he is talking about. Now, the BIG change is that the tracker is going to be outsourced to a new formed company that wont know what they track, just that they connect peers, and the torrent listings will be handed by an other new company that will have torrents but they will not know either content or who is using the torrents. This setup will be practically impossible to take down or find anyone liable to sue. The 3d party company services will have APIs, so you can on your blog or whatever have your own small torrent listings just as you now pull in twitter feeds. remember how the twitter design totally havoced the iranian attempts to block it as ppl just used another side that pulled in the feeds and read it there instead? well that goes for torrents and TPB to. All in all, this is not the end of the world as some are seeing it but a rather interesting technical improvement. And dont worry, not a dime will go to the media industries spectrial prize money what i know of but a really nice fund for doing cool stuff. /krs - co.founder of TPB and PB, not involved in TPB anymore and have no stake in any cash.

IEEE?

[theultramage]

The paper has tons of English grammar mistakes and typos. I also noticed several semantic mistakes, like calling p2p clients "networks", and using the word "swamp" when they obviously meant "swarm". They also repeated the "this won't work against FTP/email/DVD-in-mail" paragraph at least 3 times in the first two pages.

Doesn't IEEE have some quality standard for their publications?

Anyways, I got bored of reading this thing after the first few pages (maybe that was their intent?). In short, they propose a custom p2p content distribution system, or augmentation of existing p2p software. The main servers would do the management, and users would do the decentralized distribution part.

Their system adds some sort of authorization mechanism: after purchasing something you get a receipt, and you use that to connect to the network via a (company-controlled) bootstrap node. You have to continuously refresh your auth token against this node. And somehow this token lets anyone recognize a legal/illegal download request. And the poisoning part is there to stop clients that skip the authentication process (both producers and consumers). Does anyone feel like examining their method in detail?

The problem with anonymous peer to peer

[Cajun Hell]

is that you don't know who your peers are. They might not even be "peers" in the everyday commonly-understood sense.

Solution: remove anonymity, or at least replace it with pseudo-anonymity. I don't know who the guy that signs his chunks with keyid 0xDEADBEEF is, but I know he's never sent me garbage in the past. The owner of keyid 0xF00C1000 sends me chunks that don't match up with the rest of the content. My computer has a hard disk. It can remember things like this.

Gnutella blacklists mediasentry IPs. IPs are ephemeral. What they ought to do is use a signed protocol, and blacklist bad signing keys. Or better yet, greylist everyone by default and whitelist the ones who show a history of integrity. No wait, program the client to do all that, and don't distribute any lists at all.

This paper is completely off-base with Gnutella

[br00tus]

The paper says "hash distribution - Bittorrent, SHA hashing at piece (256 KB) level; Gnutella, SHA hashing applied to entire file". Actually, you can tell how little they dealt with Gnutella since they call Bearshare "Bareshare" repeatedly.

The Gnutella community began discussing the use of Tiger Tree Hashes over eight years ago, and I can't think of a major Gnutella "servant" that does not have tiger tree hashing - Limewire has it, Bearshare has it, Shareaza has it, Gnucleus has it, and GTK-Gnutella has some support for it.

While this paper says it was revised in April 2008, it seems to have been completed in September 2007. In their references, only one paper referenced is from 2007, while they have several references to papers, articles and events in 2006. Thus, it is likely a lot of this work was done in 2006 or before (three years ago), with a little brushing up before it was submitted, accepted and published in a journal.

I am not much interested in the legal aspects of someone sharing a Jonas Brothers or Britney Spears mp3, although of course I think it is absurd that p2p developers are being sued by the RIAA/MPAA mafiaa, because among other things, if they're law-breakers, then people who develop ftp servers, or web servers or IRC clients with DCC file sending could be charged as criminals as well. I have spent a lot of time looking at RIAA/MPAA organizations, and am fully convinced they are not after just pirates, but anyone that threatens their profits, including independent labels and artists who might circumvent their monopoly on the commissar-like monopoly of the marketplace of ideas and art. The excellent documentary "This Film is Not Yet Rated" shows how the MPAA not only imposes de facto censorship, but how it uses its power to shut out players outside of the major studios. We don't even know what a network of free citizens using peer to peer to share files, videos, music, web pages and the like would be like, since developers are all legally threatened and stopped before the technology can even get off the ground.

Putting that aside, I do not think these poisoning attempts are all bad because they allow for a more robust p2p (and Gnutella) protocol. People are poisoning file chunks? Gnutella puts in full file SHA hashing, and later partial chunk tiger tree hashing. People are using misleading file names so that people will download junk instead of what they want? Gnutella servants implement file ratings, allow junk files and junk serving hosts to be marked as sources of junk and so forth. Everything the p2p well poisoners have come up with has resulted in a counter-foil which strengthens Gnutella and p2p. The structure is already in these programs to foil all of this, if it is not up to the 99% or so level its just because the poisoning has not been at a level to up it to that much robustness, the structure and classes are already there in the programs, and the methodology is already within the protocol, so if the mafiaa goes all out on this path, it can be countered. But of course, it is necessary to the RIAA/MPAA mafiaa on the legal/political front as well, that they can go after p2p developers is ridiculous - if we're liable, who is next? It's one step from legal mandates for DRM in all devices so some corporation is the one who controls your machine, not you, and all of that garbage.

Re:This paper is completely off-base with Gnutella

[ArneBab]

Good to see a clear technical answer - that's also what I thought:

They can only poison Gnutella 0.4 and early versions of 0.6 - that's a very low percentage of todays popular clients. In effect that means, they can't poison real life Gnutella clients.

Since Freenet is not based on Gnutella-0.4, they can't pollute it, either.

They then state that they can't poison BitTorrent (page 11, bottom left).

They say they can poison eMule on the sub-part level.

So to me this looks like a failed attempt to develop a way to bootstrap commercial leech networks on existing p2p networks without exposing the files those networks share internally.

Interesting would be to see what happens when the first people copy that code to their client, but turn it around to poison the files of paying customers. It would just require switching one bool: "Is paying customer" -> "is pirate", and they will suffer from their choice of a poisonable network.

But considering the claims against LimeWire I read last week "you should change the Gnutella network, so it can't be used for piracy anymore" this paper looks like a part of a chessgame:

Step 1: Claim that Gnutella can be changed to no longer allow piracy.
Step 2: Make Gnutella developers say, that this isn't viable.
Step 3: Make researchers with pseudo-reputation state that it is possible to have something to show the politicians: "it's easy and it works".
Step 4: Tell teh politicians to force the Gnutella developers to deploy the (nonworking) scheme in new versions of their software.
Step 5: Force the devs to remove the parts which foil the scheme but also are the safety against compromised files.
Step 6: Wait till the network goes down.
Step 7: Leech from the next network.

Basic BitTorrent isn't interesting to them, because they can easily control one BitTorrent server to allow only their own modified clients (as long as these don't support the DHT, but they can just strip that out).

Only 7 years too late

[Anonymous Coward]

Companies like Overpeer developed effective P2P poisoning over 7 years ago. Which means they didn't do much research for section 2.2.

(note: I'm posting this as A/C because I not only worked for Overpeer, I actually designed and developed the system used for P2P poisoning which is unpopular on Slashdot. Though people are often under the misconception that we would protect anything and everything, as opposed to just protecting copyrighted material we were paid to protect).

Overpeer's software was VERY effective, and supported many different protocols. While they are correct with some basic points (eg. the hashing and chunking of various networks), their approach could never be financially viable or sustainable.

First, they disregard the fact that making it harder to FIND a pirate file is much more economical than poisoning the ones that are out there. If there are 1000 results out there, and you can manage to be 985 of them, each with a high number of 'sharers', then you never need to send a single byte of the file, just have all your clients be 'busy' and put the client on queue. Most people will think they'll get the download soon enough, and eventually will give up and possibly search again, with the same chances of finding our systems again. note: for some P2P schemes, like BitTorrent, where the search is not part of the network infrastructure, poisoning is the only thing possible.

Second, Poisoning pirate files, as they state, is possible. But it is usually used as something of last resort, or something you want to have happen as little as possible. That is because it is very bandwidth intensive. The biggest cost at Overpeer was bandwidth, and although we implemented file transfer throttling and system-level throttling in our custom software, once you get into this game, especially with things like swarming downloads, you're in for a LOT of file transfers, whether you like it or not.

Third, the second biggest challenge at Overpeer was IP blocklists. IP addresses used for P2P blocking of this type have a limited shelf life, and although usually only the more savvy P2P users will implement blocklists, and they're usually not who you're trying to protect against, once your IP addresses start showing up on blocklists, you usually have to request a new block of IP's from your service provider and return the ones you have, and reassign those IP addresses to the various machines (or routers if using NAT like they do). Which means you had better have programmed for it.

Fourth, they really don't touch on some of the network self protection measures aside from the hashing and chunk hashes involved. It's all well and good to say 'we can protect anything you want on these networks', but at some point you really need to have distributed computing and emulate multiple clients from a single host. Why? Because certain networks implement certain restrictions on purpose to stop people sharing millions of files on a single client connection. For example, most eDonkey servers will limit the number of files you can share with a soft limit (anything above this is not indexed) and a hard limit (trying to share more than this will get you disconnected). So scalability becomes an issue unless you design your software to split your content into 'bite sized chunks' so to speak. Not to mention that on things like eDonkey, you get a lower priority (and often no connction) if you are NAT'd, so their methodology of using NAT without some kind of specialized software also makes no sense.

Fifth, their approach talks about modifying file indexes to have a certain signature. Doing this makes you easily detectable. And they seem to think people on P2P networks aren't good enough to figure this out. They are. You want to look as much like a regular 'pirate' as you can in this game. Any small thing, like a detectable signature will get client writers, blacklist writers and even in some cases network writers writing code that detects your signature and automatically blocks your IP from the

One problem: If it's not on NFOrce then forget it!

[tepples]

I think he might have been suggesting that you upload your own torrents.

I don't see how I could create a work and upload it to these trackers in order to gain credits. The first time I looked into the private tracker scene, I found some boilerplate language across a bunch of trackers running ByteMonsoon software: "If it's not on NFOrce then forget it!" or "If it's not on NFOrce or grokMusiQ then forget it!" In fact, there are still a bunch of sites using this exact notice. And as I understand it, NFOrce and their ilk track only illicit releases of major-label works from recognized release groups in the warez scene.

Re:One problem: If it's not on NFOrce then forget

[n30na]

Ah. Well i'm not big on the private tracker scene, but at least *some* aren't so picky. Some certainly are, but that's the same for all kinds of communities i think.

The average of a set of size 1 is its only member

[tepples]

I dont know any tracker that enforces ratio on a "per torrent" basis. All I've ever seen enforce a global user ratio.

If you are still seeding your first torrent, then your global user ratio must necessarily equal the ratio on the only torrent you've downloaded.

Mark Montgomery boboberg@nyc.rr.com

[Mark Montgomery]

This protocol will never even put a dent in illegal filesharing. When are folks gonna wake up: music and films have been free for the past 10 years and we don't ever get any closer to figuring out how to stop folks from sharing files. We win!!! Die RIAA and the motion picture industry!!