New Kazaa Lite Protects Identity

Denver_80203 writes "Found this story about the new Kazaa K++ 2.4.0 and it's new sister program which claim to protect your identity while sharing files. Any of you folk know how legit this could be? We all knew it wouldn't be long... is this the war or just another battle?"

Score one for us?

[Kai_MH]

Hurrah! It's about frickin' time that this came out... Now let's just pray the developers didn't make a deal with the RIAA and are sellign our identities to them with this new version. So, what's the verdict on it, fellow geeks?

Re:Score one for us?

[Quasar1999]

Let them sell our identities... I for one hope that we use P2P networks like Kazaa to only grab .torrent files...

Track my IP all you want, I was simply looking for a torrent file... I didn't download "The Matrix Reloaded.mpg", I downloaded "The Matrix Reloaded.torrent", not to mention the fact that by the time they could get your ass to court, the torrent would be dead, and they would have no evidence, (other than a torrent that has nowhere near enough data to reconstruct the video), and no leg to stand

Security Through Obscurity

[Deathlizard]

Pretty much works the same way as Security Through Obscurity if you ask me.

Although it blocks users from browsing your files and blocks queries from known malicious IP's It would not stop the RIAA from downloading from you from a not yet known malicious IP, Proxy, wierd "Save the Music Industry" Campaingn where they pay you to hunt down P2P Users, ETC.

Basicially if they do a search for "St. Anger" on Kazaa, Download it, and verify that it is "St. Anger" they have an IP going to somewhere. And that IP now has a big red Bullseye on it whether it's a proxy, a user or whatever else that could obscure your idenity.

The only way to truthfully be anonymous is to be encrypted, swarmed and stored all over the place by hundreds of users like Freenet does it, and even that gives them an IP to paint a target on with the excuse that even though you dont know what your PC is sending thats no excuse to infringe. Although the courts would have to decide that.

Re:Security Through Obscurity

[Anonymous Coward]

with the excuse that even though you dont know what your PC is sending thats no excuse to infringe. Although the courts would have to decide that.

Well, some courts have decided that: http://www.ca7.uscourts.gov/op3.fwx?submit1=showop &caseno=02-4125.PDF [uscourts.gov]

From the decision, in relevant part:

We also reject Aimster's argument that because the Court said in Sony that mere "constructive knowledge" of infringing uses is not enough for contributory infringement, 464 U.S. at 439, and the encryption feature of Aimster's service prevented Deep from knowing what songs were being copied by the users of his system, he lacked the knowledge of infringing uses that liability for contributory infringement requires. Willful blindness is knowledge, in copyright law (where indeed it may be enough that the defendant should have known of the direct infringement, Casella v. Morris, 820 F.2d 362, 365 (11th Cir. 1987); 2 Goldstein, supra, ? 6.1, p. 6:6), as it is in the law generally. See, e.g., Louis Vuitton S.A. v. Lee, 875 F.2d 584, 590 (7th Cir. 1989) (contributory trademark infringement). One who, knowing or strongly suspecting that he is involved in shady dealings, takes steps to make sure that he does not acquire full or exact knowledge of the nature and extent of those dealings is held to have a criminal intent, United States v. Giovannetti, 919 F.2d 1223, 1228 (7th Cir. 1990), because a deliberate effort to avoid guilty knowledge is all that the law requires to establish a guilty state of mind. United States v. Josefik, 753 F.2d 585, 589 (7th Cir. 1985); AMPAT/Midwest, Inc. v. Illinois Tool Works Inc., 896 F.2d 1035, 1042 (7th Cir. 1990) ("to know, and to want not to know because one suspects, may be, if not the same state of mind, the same degree of fault)." In United States v. Diaz, 864 F.2d 544, 550 (7th Cir. 1988), the defendant, a drug trafficker, sought "to insulate himself from the actual drug transaction so that he could deny knowledge of it," which he did sometimes by absenting himself from the scene of the actual delivery and sometimes by pretending to be fussing under the hood of his car. He did not escape liability by this maneuver; no more can Deep by using encryption software to prevent himself from learning what surely he strongly suspects to be the case: that the users of his service--maybe all the users of his service--are copyright infringers. This is not to say that the provider of an encrypted instant-messaging service or encryption software is ipso factor a contributory infringer should his buyers use the service to infringe copyright, merely because encryption, like secrecy generally, facilitates unlawful transactions. ("Encryption" comes from the Greek word for concealment.) Encryption fosters privacy, and privacy is a social benefit though also a source of social costs. "AOL has begun testing an encrypted version of AIM [AOL Instant Messaging]. Encryption is considered critical for widespread adoption of IM in some industries and federal agencies." Vise, supra.

Our point is only that a service provider that would otherwise be a contributory infringer does not obtain immunity by using encryption to shield itself from actual knowledge of the unlawful purposes for which the service is being used.

(emphasis added)

Small wonder this opinion is by Posner from the 7th Cir., known for being an industry goon. (He's from the Chicago school of 'screw the little guy' economists, as is Scalia, and many other jurists with sway.)

The point however is that merely encrypting files does not provide a defense. Likely, you'll still get sued, if you infringing use becomes large enough to attract one of the factory robot lawyers the RIAA is about to retain.

I would urge developers to read the 7th circuit opinion carefully. It lays out some tests for what a 'safe' p2p application can show to avoid liability. If others are interested, I'll follow up with a list of suggests for a bittorrent sister app I'm making that carefully follows the rules of the 7th circuit.

You don't have to give them an IP...

[wirelessbuzzers]

Actually, the folks at UDPP2P had an interesting idea in this regard. The client negotiates through the search network to find a server, but doesn't gets that server's IP. The server sends the data via forged UDP packets, encrypted, with some extra code to correct for out-of-order and dropped packets.

I think there was a paper on /. a while ago about a similar method of sending data; you take a big, not quite square matrix M and multiplied the data file by it, getting a bunch of rows; you send these rows along with row IDs; once the receiver has enough of these rows, he can construct (using the row IDs) the inverse of the submatrix of M that spawned them, and derive the original message, even if the rest were dropped or corrupted. VanderMonde matrices work for this, although I imagine there's a sparser solution.

Of course, your ISP/firewall wouldn't necessarily be happy about sending out all those fake UDPs, and many university networks throttle them. Also, the ..AA can still set up a fake server which logs you, since the server knows the client's IP, unless you proxy, which would cost in bandwidth. Or, you could send it to someone on the receiver's subnet and let them sniff, which wouldn't entirely give away their location.

Perhaps one should point out that this is practically a new internet protocol, requiring root access and stuff... it might be better for them just to use IPSec with address hiding.

Re:You don't have to give them an IP...

[tomtomtom]

This is a really good idea. You can extend it to make it even better though.

Part of the good thing about the erasure-correcting code approach is that if you use a big enough very low-rate code (although its quite tricky to do that with good CPU and memory efficiency) then you can have downloading from several servers concurrently without having to tell each server which parts of the files you want (just send random parts of the encoded data and theres a low chance of overlap from multiple servers).

Now, here's the clever part: you use IP Multicast with multiple sources spoofing the same sender address. This means that (a) you save quite a lot on bandwidth since many P2P clients will be downloading the same source file (this is important since a big reason many ISPs and Universities have banned P2P is the bandwidth); and (b) it is MUCH harder (not impossible, but hard enough if you are not an ISP or a router at the very end) to find out who either the source or the destination is.

I don't know if anyone has thought of this idea and tried to implement it. Someone should; maybe I'll give it a go when I have time.

PS. There is a sparser and more CPU-efficient solution than VanderMonde matrices, look for Low-Density Parity Check codes.

That's what I needed

[stud9920]

That's what I needed : something to hide my fake identity

Re:That's what I needed

[Tackhead]

> > hide my fake identity
> How can you fake your IP address?

"And honey, I faked every IP address!"
-- Anonymous Coward, as written on a note left on Hilary Rosen's bedstand.

Re:That's what I needed

[jtrascap]

Let's seperate the two - what you Kazaa is a seperate issue.

The whole idea of "stealing" a public hotspot is stupid - if it's public, then your access to it isn't stealing. If it's private, it's got 128-bit WEP encryption and is closed - right?

It's like leaving the water on in your house, watching it flow out onto the street and then crying foul when people line up with buckets...

Re:That's what I needed

[mrmag00]

No. This is the same thing as 'the locked door' analogy. If it is advertised as a public, free, hotspot- you can assume it is safe to use it. But otherwise it isn't.

If I lock my door on my house, you can still easily get in. That doesn't mean me not locking (or forgetting to lock) the door is inviting you to come in.

Re:That's what I needed

[drinkypoo]

If I lock my door on my house, you can still easily get in. That doesn't mean me not locking (or forgetting to lock) the door is inviting you to come in.

The law does see a difference between locked and unlocked doors. Entering an unlocked door without permission (or reasonable assumption thereof, such as a place of business' front door) is trespassing. Defeating a lock and entering is breaking and entering.

This isn't surprising. . .

[Salgak1]

. . .and neither will the response be a surprise: the RIAA et al using a different bunch of IPs, defeating this method. Give them a few weeks, enough to get some new lines provisioned, and they'll be back at their old tricks.

Just in time for the next move in this move-countermove chess game. . .

Re:This isn't surprising. . .

[Doctor7]

It doesn't use a fixed list of IPs, it links in to a user-created database, so that shouldn't be a problem. Some of the other upgrades sound a bit less convenient. One is the ability to block people from requesting 'show all files from this user' - great for people with a directory full of infringing material, not so great for someone like me who's sharing fan music videos and wants anyone who downloads one to be able to see what else I've got - so if this feature isn't optional, I won't be upgrading.

Re:This isn't surprising. . .

[Karamchand]

It is optional. You can find the option in Options => Kazaa K++ Options => K++ Options => User's [sic!] can't get a list of all your shared files checkbox.
HTH!

Re:This isn't surprising. . .

[nahdude812]

Or a day to install AOL software, Earthlink software, Juno software, and many other popular ISP packages, then dial up to various cities across the country, foot the long distance charge, and tack it to the next lawsuit filed against some teenager. If they can get subnets for these guys kicked off the network, then they win this battle, and use the networks' attempts to protect themselves as a weapon to cause the network to shut down huge portions of itself.

Re:This isn't surprising. . .

[Quixote]

Give them a few weeks ... to get some new lines provisioned,

Few weeks?? In today's economy, and with the RIAA's budget, I'd put the figure at a few hours!

Re:This isn't surprising. . .

[deman1985]

Next move I see is for a single source to be limited to providing 20 seconds of a particular music file so that we can take advantage of more fair use laws.

Really, I'm not sure why I haven't seen this used yet. Almost all the major sites out there that provide music content will let you play a 10 or 20 second sample of the music for free (and as far as I know, they don't have to license it), so why can't filesharing system users legally do the same?

It just so happens that each user has a different clip... and the software is intelligent enough to piece them back together into one music file instead of me having to do it by hand ;)

Re:This isn't surprising. . .

[Gaijin42]

Fair use applies to the user not the distributor. Therefore each person sending you the file is still in trouble, even though they only sent you a little bit. You the user are still in trouble, because you have the whole file, and therefore are exceeding fair use (probably.. fair use isn't really well defined)

Re:This isn't surprising. . .

[Croaker]

A) You can bet your bottom dollar that Amazon, CD Now, etc. al. have an agreement in place with RIAA (or the individual recording companies) that governs those clips on their site. Likely, there's a limit to the length, and there's a limit to what they can take from a song (i.e. first 20 seconds, etc.), and a limit on the sound quality (most places I've been too usually have low-quality clips, some even in mono). Many of the clips I hear also fade in and out, which would make them useless for "cobbling together" a full version of the music.

Actually, I would be surprised if Amazon and others do the sampling themselves. Most likely, they are supplied with the samples by the record companies themselves. Check out several web sites. Are the images, audio samples, and even copy about the albums any different from one site to another?

B) Intent also enters into sampleing under fair use. If I write a review of the new Harry Potter book that quotes from the scene when a certain character dies, and uses a quote to reveal the ending of a book, I could be sued if it seemed my intent was to get people not to buy the book. Extracting material from a work for the expressed purpose of damaging the commercial viability of the work is not allowed.

Now, do you want to face a judge and explain why you and your friends were hosting random 20 second perfect quality samples of music in light of the fact that a system exists that would recombine them into a perfect copy? What compelling 'fair use' intent could you claim? Throwing up your hands and saying "lordy! the law lets us use samples as fair use" isn't going to cut it.

Re:This isn't surprising. . .

[Stonehand]

Regarding prohibition, Amendment XVIII only prohibited manufacture, sale, transportation, importation and exportation. Technically, consumption was NOT illegal. Unless you can find a similar loophole in copyright law... it's going to be mostly an issue of pragmatism (scaring off the sharers is both easier and more efficient than scaring off the downloaders).

Re:Suppose one doesn't...

[Gaijin42]

The point is that you cant share ANY of the file under fair use. Its USING the file that is fair, not sharing it.

And in the end, you have the whole file on your computer, which is clearly in violation.

This is a dead end. Fight the battle in trying to establish real fair use laws, not in trying to find wierd loopholes that will just be easily closed

Re:This isn't surprising. . .

[dmauer]

Really, I'm not sure why I haven't seen this used yet. Almost all the major sites out there that provide music content will let you play a 10 or 20 second sample of the music for free (and as far as I know, they don't have to license it), so why can't filesharing system users legally do the same? It just so happens that each user has a different clip... and the software is intelligent enough to piece them back together into one music file instead of me having to do it by hand ;)

Well, I have at least one idea: What you're describing is a technology whose sole purpose is to flout copyright laws. You may be right -- technically, using this method might be legal. However, it clearly goes against the point of copyright, and it's clearly just exploiting a loophole... which is something that really doesn't sit well with me, and certainly wouldn't sit well with the uber-rich lobbyists who got the DMCA signed in the first place. Don't think that widespread use of something like this wouldn't, in some way or another, result in more nasty restrictions on Fair Use -- I imagine it wouldn't be long before many of the online music retailers who offer short samples of songs would be forced to stop. The idea here is to get active, get the unfair laws changed, and get our fair use back. NOT to find tricky ways to break the law without really breaking the law. -d

Re:This isn't surprising. . .

[Anonymous Coward]

which is something that really doesn't sit well with me, and certainly wouldn't sit well with the uber-rich lobbyists who got the DMCA signed in the first place.

Ok, as soon as you figure out how to beat the uber-rich at the lobbying game, you let us know. Yeah yeah... go vote, I know. I already do that. The problem is that there are so damn many laws out there that nobody can understand it all or even form an opinion on most things anymore. Unless you're a lawyer, and even then you have to specialize

Re:This isn't surprising. . .

[gmcclel]

I think Kazaa needs to take another angle. Start asking doctors to prescribe music. Acquiring the music becomes a medical act. The new HIPAA regulations gives the user extraordinary rights to protect their privacy -- Kazaa and any other provider of medical services would be obligated by law to not turn over information about their users.

Afraid, are you?

[paranode]

Begun, this copyright war has.

Re:Afraid, are you?

[Eudial]

Begun, this copyright war has.

Dude, You seriously need to cut down on Star Wars.

(Star Wars, you seriously need to cut down on.)

Re:Afraid, are you?

[MORTAR_COMBAT!]

Cut down on Star Wars you must.

Re:Afraid, are you?

[AntiOrganic]

Matters not what this message says, be modded +5 funny it will.

Great!

[indros]

Who wants to bet that the news won't report that filesharing has jumped back up %15, and then some with the advent of this.

Re:Great!

[gl4ss]

It's down because college geeks are not at campuses for summer. Seriously, how can you make any figures on usage especially when users switch between networks and programs so much.

Kazaa K++ is an excellent program

[Ice_Balrog]

I don't know if Kazaa K++ can hide your identity, but what I do know is this: Kazaa K++ is an excellent program. It is so much better than vanilla Kazaa. No ads, spyware, many cool features make it a great program.

Re:Kazaa K++ is an excellent program

[aldousd666]

I was going to mod you down, but instead I'll be informative. Spyware can be detected by checking the network connections, and/or sniffing packets. I'm sure somewhere out there (people who work for kolla.de or lavasoft) people are already doing this. You can't hide spyware from a hacker. If you don't know anything about what I'm saying, try netstat -a at a command prompt (dos) you can see your incoming/outgoing connections. If you do it with Cydoor enabled kazaa, you'll notice some shifty odd IP addresses, which you can investigate further by jumping on a linux box and 'dig'-ing for the source, or nslookup them on you windows box (far less complete) to see who is connected to you. Some programs may hide spyware in the connection to their servers, which would be the way that it would have to in the new Kazaa in order to appear spyware free, but the guys with the packet sniffers would eventually dig this out as well. If they say it's spyware free, they'd better not be lying, becasue they will eventually be exposed.

Re:Kazaa K++ is an excellent program

[rosie_bhjp]

Then use spybot s&d [kolla.de]. I like it a bit better than AdAware and some spyware checks for and disables AdAware.

Re:Kazaa K++ is an excellent program

[glesga_kiss]

2 weeks later, it (same version, same install) found it again even though I had only been using Phoenix in the meantime.

Well, something on your system is clearly re-installing Gator without your permission. Most adware-funded packages crippled if you forcably remove the spyware components. They will attempt to repair themselves if this happens.

The fact is, AdAware found it and removed it. You check back a few weeks later and it was back. How is that AdAware's fault?

Re:Kazaa K++ is an excellent program

[Scutter]

it obviously only works on a punctual basis and not as a permanent protection.

FWIW, Ad-Aware isn't supposed to work that way. It's on-demand only. If you want the on-access scanner (Ad-Watch), you have to actually pay the $20 for Ad-Adware Pro (which I highly recommend, by the way, as it works *great*). Oh, and just like your favorite anti-virus, you have to keep the signatures up to date.

Just blocks IPs

[evilned]

From what I have seen, it just has a list of ips of law enforcement and record industry computers. Not a very fool proof method, but better than a tin foil hat.

Re:Just blocks IPs

[in7ane]

Don't trust the parent, it may be an attempt to persuade people to substitute a potentially insecure K++ for the proven security features of tin foil hats.

Either way, a tin foil hat is still a good security supplement even if this hype is true.

Re:Just blocks IPs

[Swamp]

From what I could gather from the article they were moving towards a system whereby suspicious IP addresses that perform wide scans are automatically recorded and perhaps added to a global 'block' list. A sort of reverse distibuted denial of service.

However I'm not sure how a client could tell whether one IP address was 'suspicious' or not, and I can't see it would be feasible to collect all IP addresses that connect to all clients to find those that couldn't possibly be legitimate Kazza clients.

Re:Just blocks IPs

[sharkey]

but better than a tin foil hat

What if I make a tin foil cover for my modem?

After My DMCA Letter Scare

[Soporific]

I stopped using Kazaa for a while, or only briefly. Now I can go back to being a file whore and stop using those unreliable BitTorrent sites.

~S

Re:Bittorent exlpained.....

[shibbydude]

Bittorrent trackers do fail quite often. I am sure you haven't used the program enough for that to happen yet. This is a problem especially for larger .torrents. Think of one 800Kb file being downloaded 10 million times, like when the Matrix reloaded was released. 800 x 10000000 = 8000000000 or 8 billion Kb or 8000 GB of bandwidth. Now, can your fileserver sustain 8000 GB of bandwidth in tracker files, not to mention the initial few seeds? We are talking serious server-rot.

K++?

[GnuVince]

Why not K++0x? ;)

What's needed..

[jkrise]

is protection from R*AA, not identity protection.

K++ edition

[Webtommy88]

Well K++ edition bascially contains a wrapper on the Kazaa application so that one can modify the memory accessed by Kazaa easily, and thus those who use K++ edition automatically has the K-Lite Master (1000) ranking on Kazaa. Its simply a matter of manipulating the values at the memory address.

I would think that extending on that principle, they could write protect or just dump gabarge into the memory space where idenities are stored.

Of course, I don't have the K++ source, so how would I know, it's just a theory.

Re:K++ edition

[Karamchand]

• This PL = 1000 thing is actually rather bad for the P2P network as a whole. If noone sees the need to share files fewer people will share files (specially in the light of recent RIAA threats)
• Actually your's is a rather bad theory. Because the identity is not your Kazaa nickname (which you can change anyway to anything you want) or anything like that - but it is your IP address. Without fundamental changes to the way FastTrack works (think rewrite in Freenet direction) it won't be possible to hide your identity.

Re:K++ edition

[Jucius Maximus]

"This PL = 1000 thing is actually rather bad for the P2P network as a whole. If noone sees the need to share files fewer people will share files (specially in the light of recent RIAA threats)"

I don't agree with this because even with kazaa lite, you are sharing by default. So everything you download is automatically shared unless you click that 'don't share' box or move it from your shared directory. And considering that most kazaa users are average folks, they won't bother to configure the application

Re:K++ edition

[toddestan]

Like most people, I have a fairly large download pipe (about 1mbps) while a tiny upload pipe (128kpbs). Thus, I have a rather large collection of files people want. Whenever I go onto P2P networks, my upload pipe is almost always maxed with lots of people qued up waiting to upload.

What this article says is not entirely true. While the leechers do not harm or take anything away from me, they do take bandwidth away from the people who are not leeching. And I do not have infinite bandwidth, because even if I left my computer on 24/7, more people will que up and try to upload than I ever could upload to.

Since I cannot upload to everybody, it is in my best interests to upload to the people who share. Because the people who share are the only one who will actually make the network grow. Also, when they share a file they uploaded from me, it also makes that file more available on the network and takes a little bit of the load off myself.

So there are practical reasons to kick freeloaders , besides just the moral ones. If I truly had infinite bandwidth (I interpet that as enough bandwidth to send my files to everyone who wants them, regardless of them sharing or not), then maybe I wouldn't care about freeloaders. But since I don't, I will continue to block leechers from uploading from me.

Re:K++ edition

[ncc74656]

The article said K++ and K-Lite are integrated with the PeerGuardian database. That's a list of IPs from which to refuse traffic. You can get the plaintext list here [simplyclick.org] and run it through a converter here [bluetack.co.uk] that converts the list into a script full of iptables commands to cut off the ??AA at your firewall, so they won't even get through to whatever filesharing software you're running.

RIAA Should be commended

[bugsmalli]

for pushing us to come up with ingenous ways to screw them. When the heck will they wake up and realize whatever they try they can't subdue filesharing. Why not just make it easier and rake in some money (read profit. anything more than 0 is...). sheesh. is the org run by a bunch of retards or what?

RIAA Should be commended

[ShineyNewSlashdotAcc]

It aint gonna work. The reason is simple : The rules have changed. Distribution of music is now much easier and cheaper than before and a large chunk of the old distribution network is *no longer necessary*. This is totally irrelavent as to weather or not this new distribution model is legal or not. It is happening. It probably cant be stopped(I mean the software industry tried and failed thru the 80s/early 90s)

So now the RIAA have several choice.

1. Try to roll back the technolgy that enables this new distribution channel. This is possible but not very likey.

2. Use more draconian law enforment techniques. Posibble but I mean whata ya gonna do... start sending colleage kids to prison ? For what stealing a Brittney track ? Is this what we want ?

3. Try to adapt to the new medium. Be creative and come up with new profit channels that take advantage of the medium.

Personally I dont think 3 is very likely either... I think RIAA is going to have to be dragged kicking and screaming into the 21st century.

Re:RIAA Should be commended

[PunchMonkey]

3. Pay (credit car, paypal, whatever)

... Credit Car??? What a fabulous idea!!! Embed your credit card on the tires of your car.

/me drives up to Window #1 at Wendy's.

Girl: That will be 28.10 please, how will you be paying?

Me: Credit Car

Girl: Please swipe your car through the reader

/me drives car back and forth through giant magstripe reader

umm

[ramzak2k]

Both Kazaa K++ and Kazaa Lite, two very similar modifications to the Kazaa file-sharing system by Sharman Networks, now contain hooks to the PeerGuardian database of IP addresses

Database of IP addresses is going to protect us ?
Cmon now. What prevents RIAA from using anonymous IP blocks that they can purchase legally for use?

Re:umm

[EinarH]

Cmon now. What prevents RIAA from using anonymous IP blocks that they can purchase legally for use?

Stupidity?

Re:umm

[poot_rootbeer]

Cmon now. What prevents RIAA from using anonymous IP blocks that they can purchase legally for use?

Stupidity?

Lack of operating funds? No, wait.

Re:umm

[theNote]

Entrapment?
How would using a different IP be in anyway entrapment?

The only way a case could be thrown out for entrapment is if the RIAA IM'd you and asked you to download a file, then turned around and sued you for copyright violation.

Re:umm

[Suidae]

You, sir or madam, are full of hooie.

Entrapment laws are very specific and have nothing to do with this.

The DMCA does not apply because they are the copyright holder and because they would not be circumventing any recognized encryption method (TCP is not an encryption method, regardless of how one tries to twist the definitions of the words).

This is probably quite legal, and IMO as an occasional trader of copyrighted files, fair play. Unfair play would be if they located my IP address, coerced my ISP into providing my physical address, and then came over for a visit.

Of course, all they would find is an 'accidentally' unsecured wireless access point connected to my cable modem and a tinfoil hat.

Re:umm

[j-turkey]

TCP is not an encryption method, regardless of how one tries to twist the definitions of the words

If ROT-13 is an encryption scheme under the DMCA (see Adobe Vs. Elcomsoft), it could be argued that TCP is an encryption scheme under the same rules.

Of course, all they would find is an 'accidentally' unsecured wireless access point connected to my cable modem and a tinfoil hat.

...they may be able to confiscate your access point, along with your computer, and any other associated material to examin

Re:umm

[Suidae]

It wouldn't matter if you included encryption. The point of p2p networks is to give files to people you do not know and (therefore) do not trust. Just as the RIAA cannot provide DRM music in such a way as to prevent copying, you cannot provide encrypted files without providing a way to decrypt the files.

Even if you did, the RIAA could 'decrypt' (ROT13, whatever) the file and if it isn't theirs, delete it. If it is theirs, they have broken no law, even if they choose to share it on the network. Its thei

Re:umm

[DoorFrame]

Only law enforcement agencies can be accused of entrapment. There's no such thing for a non police corporation. They can entrap all they want. Remember, you're going to be going to civil, not criminal court.

Still isn't available for Linux though...

[TrollBridge]

I've been gradually putting together a good functional Linux setup on my laptop, and was surprised to learn that there wasn't a Linux version of Kazaa or Kazaa Lite out there.

Is there an alternative I am unaware of?

Re:Still isn't available for Linux though...

[SugoiMonkey]

mldonkey is pretty good and has Fast Track (meaning Kazaa) support.

Re:Still isn't available for Linux though...

[drgroove]

Limewire [limewire.com]

Runs on anything, has a decent following, so there's a good chance the song/file/app you're looking for is available.

Re:Still isn't available for Linux though...

[Zocalo]

I don't know about and native Linux Kazaa client clones, but Kazaa runs just fine if you run it on Linux via the WINE emulation layer. Couple that with the Linux version of BitTorrent and a copy of WASTE and you have all your P2P client needs met.

Re:Still isn't available for Linux though...

[Rysc]

Kazaa used to distribute kza, a linux curses app which was very basic but worked fairly well. Then they changed some stuff about the protocol, kza broke, and they've never released an updated version. At this point you're basically stuck with Wine, and last I knew installing Kazaa under Wine failed (you have to install under windows, and then run under wine).

For a while there was giFT, an attempt at implimenting an open Fast Track client. But due to some of the same changes that broke kza, which were an at

Re:Still isn't available for Linux though...

[Dave2 Wickham]

May I point you to giFT-FastTrack [berlios.de]?

mlDonkey is better anyhow

[evilad]

My favorite is mldonkey [mldonkey.org], which hits a whole bunch of different networks, including FastTrack (which Kazaa uses). The gui is separate from the p2p application, so you can turn off your workstation but leave your downloads running on your server in the basement.

I'm utterly impressed with it. Very easy to use, and I really like being able to hit all the differnt networks at once. It's also pretty cool having native guis available for linux AND windows.

Seems pretty weak to me

[anon*127.0.0.1]

Blocking the IP address or range of addresses that they suspect the RIAA is using. Yeah, that'll stop them. No way they'll be able to scan from a different IP. I feel safer already.

Not letting people see what other files a user has might be a bit more useful, but I don't think either of these measures is going to do much to stop the RIAA from prosecuting people.

Privacy and Filesharing

[anonicon]

Interesting. Since I know 0 about PeerGuardian, I suppose this may be effective (or not). Does anyone have a documented analysis of how this works instead of some vague news report?

Also, I don't mind sharing the music on my hard drive (it's all indie and OK'd to be there), but that said, do firewalls protect your IP identity or are they useless for that? Unclear about what tools may be used in conjunction with p2p to cover your identity.

Peace.

All this seems to do...

[Stinky Glen20]

From the article, all this seems to do is some basic housekeeping to ensure that your search history is not stored, and interact with a database of IP addresses known to be used by the RIAA

This doesn't seem to be anything revolutionary, or, interesting.

If the services went through some kind of anonymizer, that would be cuter. Of course, the bandwidth demands would be huge.

What may be an alternative is to produce a collaborative download system. I request a download, which is proxied by another random user (provided I return the favor). Even if you had RIAA sniffers, all that could be proven is that MY IP address downloaded something, but not the ultimate destination of the data.

Of course, if I have illegal music on my PC, then I am still screwed. But I leave solving that problem to the reader :)

How legit?

[AllUsernamesAreGone]

"know how legit this could be?"

As legit as sharing copyrighted files? ;) IANAL, but I doubt that the Recording Industry Ass. of America can use existing laws to prevent this being done (although I doubt that'll stop them trying).

If the Kazaa guys have done it right they may even be able to wave the good old DMCA under the Recording Industry Ass. of America's nose if they try to crack the system as well (oh the irony!)

But this is just the latest volley in what is going to be a very drawn-out and bloody Information Cold War.

I'm Safe

[dlosey]

I already protected my identity. I am John Doe at 123 Abc St. My email is [e-mail]. How could they possibly find me?

*knock* *knock*

Umm.. yeah.. I'll finish this post la.. *ouch* Not so tight with the handcuffs.

Not true.

[Eric_Cartman_South_P]

Well, it IS true in the fact that it blocks a known range of RIAA and other "bad" IP's. However, do you really think they wouldn't use random, seperate IP's to do their dirty work? I don't think the "music-searchin-lawsuit-makin" box is sitting next to their Exchange Server. They do have the cash to get some techies who know how to read ZeroPaid and Slashdot and I'm sure the "music-searchin-lawsuit-makin" box is on a completely different class C ip, or even random cable/dsl modems accross the country. Why not? THat's what I would do (uhg, feels dirty to even think like them for a second). That said, the new Kazaalite features are an ok, simple start to something good I guess.

The new feature that blocks users from seeing ALL files, however, is VERY smart. All 50 million users (pulled that number out of thin air, should be close) now appear to be sharing only the ONE file you searched for. Makes hiding in the sea of users fruitful.*

* Disclaimer: Don't steal music. :)

How?

[bazik]

How can you hide your identify on a Peer2Peer system where other users get your IP when they connect to your machine to download stuff (for backup reason of course)?

I doubt there is a way... netstat kills your privacy :P

Re:How?

[Zocalo]

The object, for those in a dubious copyright position, would primarily be to hide the identity of the uploader sharing the files, not the downloader retrieving them - that's just a bonus. Most P2P networks use some kind of hub system to collate requests and assign them to servers, at least initially. So, at a very basic level:

1. Client contacts hub and requests a file
2. Hub contacts available servers with details
3. Server(s) sends data blocks to client
4. Client receives data blocks and ticks off the file bitmap, making additional requests of the hub until all sections are retrieved.

Therefore, if the servers fake their originating IPs and all data verification is done by the client only the hub needs to know the IPs of the servers. Apparently there is already a UDP based P2P client in development that does something like this - it's mentioned in this very thread in fact.

Quite how you get around the issue of the RIAA et al operating a hub and looking at the traffic though is another matter. Ultimately, something *must* bring the source and destination IPs together to initiate the transfer, and that's the point that the copyright police are going to be working at. I think it's a problem with a solution though - the similar issue of public key exchange had people stumped for an age before it was first solved by James Ellis' team at GCHQ.

In fact, that's another way of looking at the problem - who cares if Eve can see an ISOs worth of data transferred between Alice and Bob if they can't tell whether its the latest distro or the latest Hollywood movie DivX? They can't pursue every P2P downloader on the off chance it's a copyright violation, can they? And encryption is and essential feature of communications software to gain mainstream business acceptance in this paranoia ridden world, right?

A Most Important New Feature

[Entropy248]

The new versions contain several features designed to foil scanning attempts. PeerGuardian attempts to catalog a range of IP addresses used by or suspected to be used by labels, the Motion Picture Association of America, the Recording Industry Association of America, and other agencies. The database is built by contributions of individual users, although the methodology used to determine and verify the IP addresses is unclear.

Stop trying to flood my P2P network...
Now we have blacklisting and whitelisting (through Sig2DAT). Though both of these methods together would seem to defeat P2P "spammers", the easiest way for them to get around this might be to spam the whitelist. The next move in the P2P wars remains uncertain.

And the arms race begins... err .. continues

[WPIDalamar]

First there was napster, which was shut down through the courts, so people made kazaa (ok, I'm skipping a few steps) which is harder to shut down through the court system, so The Man decided to go after individual users... so kazaa made it harder for them to do that...

It's just going to go on and on and on.

To bad kazaaa can't patent the communication protocol, and not license it to RIAA... <SARCASM>Maybe we should enact a law to explicitly enforce these patents</SARCASM>

Is it a good thing to not share?

[Sky-217]

"Users of the latest versions of Kazaa Lite and Kazaa++ also have the option of disabling a function that allows remote users to see what other files the user has. "

If everyone did this, wouldn't that kill P2P file sharing? Isn't that what the RIAA wants to happen anyway?

Re:Is it a good thing to not share?

[Paddyish]

No. Results would still be returned from a general search. All this would do is disable the 'see more from same user' option which allows you to browse a single user's shared file collection.

Hate to Burst your Bubble

[OS24Ever]

...but the RIAA can easily get around this block of 'known' IP addresses.

To borrow from the other scourge of the internet, They'll just pay people to work from home for $1000s a week!

All they'll do is pay some one who wants money to run their program using their home DSL, Dial up or Cable Modem. Then the blocking of RIAA's 'known' addresses would become as big as every high speed residential network on the planet.

Quote from article

[Zog The Undeniable]

At post time, the RIAA.org site was not responding

Is this a new euphemism for "ownz0r3d and h4X0red out of existence, again"?

Re:Quote from article

[youBastrd]

Let me get this straight: the author of the article says he installed software that blocks communication with RIAA servers, then claims that the site couldn't be reached.

Umm...

doesn't fix the problems, it's a band-aid

[firewort]

This doesn't really fix the problems here, it's a band-aid on a gaping wound.

This is a nice idea, and one way to approach things. I'm just not positive that it's effective.

The RIAA won against Verizon in court, and can now request IP addys, logs, and user contact info. So, this doesn't really slow them in that sense.

Additionally, what's to stop the RIAA from getting a bunch of DHCP home accounts under a subsidiary's name instead of their own? The possibilities for playing catch up here to add more IP ranges are endless.

This is a neat little effort, but doesn't fix the greater problem of balance in copyright law/infringement/fair-use.

It's the proverbial finger in the hole in the dam.

Lulu.com- publish your stuff! Creative commons compliant. [lulu.com]

anonymity is available

[stinky wizzleteats]

In other P2P networks. Freenet [sourceforge.net] and GNUnet [ovmj.org] both offer crypto and anonymity. Freenet isn't a P2P app in the pure sense. It's more of an underground www. GNUnet has better anonymity (theoretically - due to it's ability to resist traffic analysis attacks), but it is a younger project.

When it's time to retreat from gnutella, these represent the next stage in the information war.

Fanning the flames

[Mikey-San]

Here's a question that popped into my head while reading this story:

Is this legal? If so, should we really advocate it?

If people are stealing music, and a company attempts to block the people from whom the music is being stolen, with the intent of protecting the identity of the pirates, isn't there some line that's being crossed somewhere?

And even if it /is/ in that legal grey area and isn't clearly illegal, isn't it a really stupid move regardless? It seems like by hiding the people pirating the distribution-prohibited music, it helps give the RIAA /more/ reason to jack up CD prices and impose arm-bending DRM practices.

No, I don't think music piracy is the big reason why CD sales are falling. It's a larger issue than just p2p apps, but it gives the RIAA /cause/ that they can wave around like a flag in the newspapers and on TV news programs that don't do the proper amount of research into the issue.

I digress.

This is really stupid of KaZaA to do, bottom line, I'd say. :-/

So Why Is Everyone Negative Toward Peer Guardian?

[The Spie]

I run PeerGuardian's list on my system (either with its standalone program or through using its list with Sygate Personal Firewall). I've contributed IP blocks to it as well. So, unlike the sanctimonious among /., I know what I'm talking about here.

What I can't understand is why so many people here seem to be down on it. Here is a project that's free as in beer, free as in speech, receiving a great number of contributions from a tech-savvy community, helping to maintain privacy rights, and is making a solid attempt to send a message to the **AAs. This sounds like something the Open Source community would jump on as an example of community action to solve a problem. The fact that K++ is offering it will increase participation among users.

(By the way, the list is not only being constantly updated, a number of times a day, but it's being continually scrutinized for bad or inappropriate ranges. Congrats to eremini, dingdongding, and c00kies2000 for some great work on getting rid of inappropriates and dupes.)

It's not perfect, but it's a good stopgap until a better solution can be found.

The Spie

The RIAA's Not-So-Secret Agenda

[plasticmillion]

Actually the RIAA has been quite upfront regarding their plans to sue the pants off offenders. They have stated repeatedly that they plan to go after users who are sharing tons of files, not the zillions of normal users, which makes sense since supposedly a small minority of big sharers supplies the vast majority of files on the networks.

From this perspective something like a proxy for file transfers is not so important (not to mention fairly impractical). If other users can't see your full library and can't see your IP address in their search results (the latter might enable smart bots to "guess" what your library contains), the only way they can determine that you are sharing massively is to download tons of files and see which IP addresses crop up. This is because they will only see your IP when they actually start downloading.

All this to say that with the latest changes in K++ and Kazaa Lite, even big time file sharers can probably rest easy.

Submitted for your approval:

[DuckDuckBOOM!]

In a future release of [your favorite P2P app], an option which presents to peers requesting downloads or file lists one of those pseudo-word-containing images you see on eBay and Ticketmaster to block bots. The requestor has to type in the character string he/she/whatever sees to get the file or list. This wouldn't stop RIAA scans, but would sure as hell slow them to a crawl by de-automating the scan process, without substantially impacting a normal user. The only serious downside I see is that this method probably busts a patent somewhere. Is there a way to avoid that?

Sanity check, anyone?

Re:Submitted for your approval:

[vegetablespork]

Damn, that's the best idea I've read yet! Somehow, though, it would have to be enforced for searches across all the users (e.g. searching for Red Hat ISOs). For that, I'd envision a protocol that negotiated some kind of image whose pseudo-word would be good for that one search.

Of course, eliminating the ability of the *AA to trawl the networks with bots would yield an escalation, two of which I'll guess:

• *AA outsources trawling to China or India, where it can be done by prisoner or cheap hired labor respect

Blacklisting RIAA's (and friends) networks

[Aceticon]

Actually the thought just came to me that an interesting way to fight back would be having filesharing software somehow totally blacklist access to suspicious networks at the PC level (meaning not only filesharing - everything).

The blacklisting should be done at a higher level than machines only - the whole network of the ISP providing RIAA with access should be blacklisted if one or more machines in the network are being used by RIAA (or related entities) to scan for filesharing.

Also, the user of the filesharing program should be given a choice - "Do you want to block access to and from networks where RIAA is scanning filesharers (Yes/No)?"

My basic idea goes down to a bit of social engineering - please follow me on this one:
- RIAA contracts with an ISP to provide it with network connectivity to the Internet.
- RIAA then uses machine(s) over that network connection to scan filesharing networks.
- Said activity is detected (exactly how i don't know)
- The whole network for that ISP (or at least a significant portion of it) is blacklisted in millions of machines (all those running the filesharing app). This can be scalled up to bigger sub-networks (the ISP of the ISP) if needed.
- Other entities hosted on the same ISP are also in practice cut-off from some of their (potential) customers. Mostly their websites are ineccessible from millions of machines. This is especially bad for online shops and ASPs.
- They complain to the ISP.
- The ISP, faced with the choice between keeping RIAA as a customer and loosing several other customers or simply dumping RIAA will find that the choice that makes more business sense is dumping RIAA.
- Eventually, RIAA and it's associates will become persona non grata to most ISPs (as in, they choose to not take RIAA's business).

The nice thing about it is that it's all absolutelly legit:
- Each individual user chooses to accept an autometed cut of contact with those networks that provide access to filesharing scanning. Everyone is in their right to do so.
- ISPs choose to not sell their services to RIAA. It is their right to do so.

Now, this whole theory has some holes in it, and a couple of weak points (not to mention no solutions for the technical problem) - still, a distributed, voluntary system that makes it bad business for ISPs to provide access for companies that do filesharing scanning would leverage the power of those "hundreds of millions of users" of the filesharing apps.

Comments please ...

A Plan for RIAA

[Pac]

(With many apologies to Paul Graham [paulgraham.com])

What Kazaa Lite has now is equivalent to blacklists of spammers and spammers domains. We have already determined this strategy alone won't solve the problem.

The next logical step is to combine the lists with a distributed statistical filter capable of identifying RIAA hosts by search pattern and IP pattern. Since it is happening in a connected network, each peer filter can then broadcast its guesses and receive other peers guesses. Locally you can build a trust list based upon the likehood of search comming from a RIAA host.

Obviously this have problems.

One problem is the lack of significant search samples to make decisions. We would have to see an implementation to discover if it is mathematically feasible.

RIAA can also start trying to close down sharers by broadcasting their IP as "riaa-like" from a great number of peers. The way to avoid this is having all peers checking "the evidence". If the sharing IP and its searches do not match RIAA pattern, the call is probably bogus and those IPs broadcasting it are probably RIAA's. Backfire on them...

Another danger is RIAA using a range of IPs large enough to endanger the network connectivity. This is probably too expensive, but RIAA is probably too rich too.

Anyway, my point is that since the data is there (RIAA is searching the networks for the sharers), one can always analyse this data and try to extract as much information as possible from it.

If only...

[revmoo]

The thing is, the RIAA has subsisted all along on being the middleman. They don't really DO anything. Sure they promote new albums.......oh wait, no they don't, they have ad agencies and their ilk to do it. I know, they press cds......oh wait, no they don't, they outsource it to record pressing companies.

The RIAA(meaning the record companies) only exists because the artists and the consumers haven't really questioned their existence. Artists stand to make a lot of money without the RIAA in place. Why not make all music free? If you want to brave the p2p networks for different quality mp3s and such help yourself. OR, you can pay $5 directly to the artist to download the cd from their website.

Artists can make MORE than enough money from licensing their music(think movie scores, and commercial soundtracks), and live performances. Without having to pay large portions of their income to the record companies, artists stand to make a LOT more money, once the RIAA is gone.

The artists you see fighting p2p etc, are the ones that NEED the RIAA to survive. I'm talking about the sell-out corporately manufactured groups that wouldn't last if the RIAA wasn't there to spam their name all over the radio and mtv every 10 minutes. Those are the only artists that NEED the RIAA, and if we lose them, frankly, here is one slashdot poster that could care less.

It's not that I mind paying for music, but isn't it about time for a paradigm shift? Natural selection has provided an easier and better way to get new music and the record companies are a dying breed.

I have a couple thousand mp3's on my hard drive that I didn't pay for, but I also have heard a lot of new artists that I will jump at the chance to see live, or buy merchandise from.

I'm a bit of an aspiring dj, and I buy records from artists that I've heard and liked through p2p. If it wasn't for p2p those artists wouldn't have had my purchase.

The problem doesn't lie with the consumer.

spare us the theoretics and justifications

[*weasel]

the RIAA exists because traditionally it has been very expensive to break into the music business.
now that the wall is being torn down, the RIAA is going out of its way to try to ensure its relevancy. (payola, tighter distribution contracts with artists, destroying the credibility of digital distribution, etc) it sucks - but it's all legal.

all that aside this is about theft. downloading mp3s for material you haven't paid for -is- theft. whether it -should-be- or not is debatable. but under the law, it is. bummer.

so this little arms race may be between the good intentioned hackers vs the big bad corporation - but legally it's just pirates against copyright holders.

the fault -doesnt- lie with the consumer, it lies with the pirate. if you've noticed, not even the RIAA is saying 'p2p is bad' anymore. the specific practice of illegal distribution of music is what they're fighting now.

they logistically can't (and don't even try to) sue -you- for downloading. it's not obvious from the information available within a p2p app whether or not you are downloading a song you have fair use rights to (if i own nevermind, i can legally download the mp3s for that album) - and it would be financially prohibitive to even try to figure that out.

-however-, sharing the files is absolutely illegal. the RIAA -owns- the distribution rights for signed artists, and you are infringing on their copyrights by pirating that right.

sure, maybe some day the artists will wise up - but until then, you -are- breaking the law. get used to it, get an ipod, or uninstall kazaa. check your justifications at the door.

and whether or not p2p affects CD sales is irrelevant. discussing that is like trying to justify theft from a profitable business because they're still profitable despite the theft. sure - it's a neat little communistic self-delusion - but it's still theft under our laws.

Cutting off your nose...

[nick_davison]

Recently, the file trading networks have been having some limited success by using the argument: "If there are significant other legitimate uses, a technology cannot be shut down because of its possible uses for piracy."

K++ is touting as a major feature being able to block law enforcement's (you think the RIAA won't play it as their lawyers attempting to do the work of the police?) attempts to crack down on its illegitimate (yes, yes, I know everyone thinks it's legitimate but the law doesn't) uses.

Surely they've just handed the RIAA a victory? They've said, "We've been sneaking in by claiming we have legitimate uses, trading all types of file - and now we've proved that our real purpose was piracy all along."

Yay. In one step, you've got 15% of users back for the couple of months before the policy offers the RIAA all the justification they need to shut you down entirely.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:!!!WARNING!!! New Kazaa-Lite turns file sharing

[Pvt_Waldo]

How touching. Someone is concerned about Kaza-lite "put[ting] the user in violation of the policy at their ISP" and "[...]in violation of federal, state, and local laws." I'm so glad someone's concerned about trying to obey the laws and legally binding contracts!

I'm sure you're just using it to put up scans of your art work you've put in the public domain, get the latest linux, and share open source PHP scripts.

Right?

You're not trading music, warez, and other stuff you don't have legal rights to.

Right?

Wait just a darned minute...

[MachineShedFred]

So you installed a P2P file sharing app, and it turned ON file sharing?!

Those BASTARDS! This is a conspiracy of machiavellian proportions!

Judge Posner's Aimster Analysis Isn't Helpful

[werdna]

Judge Richard Posner, a highly regarded Seventh Circuit Judge recently wrote an opinion upholding the Aimster injunction [uscourts.gov] that tends to suggest that identity protection for file sharing is more likely to support a claim for contributory infringement of the vendor than not. The opinion, while troublesome in many respects, is probably the most intelligently written articulation of the 9th Circuit Napster reasoning we are likely to see, and will likely be deemed a persuasive authority by most District Court Judges. That is, until and unless the Supreme Court speaks clearly on whether they meant what they said when they wrote in the Sony Betamax case, that regardless of evidence of wrongdoing there can be no contributory liability for distribution of technology that is capable of a substantial noninfringing use.

My problem with the Napster, and now Aimster, opinions is simply this: the 9th Circuit adopted a broader view of the liability of a technology manufacturer in the Sony Betamax case, essentially a "substantial infringing uses occur means infringement by vendor" test, which was discredited and reversed in Sony, which adopted the "substantial noninfringing use possible means no infringement by vendor," almost the very opposite result. It is hard for me to understand why, when the 9th Circuit essentially brought back the same analysis in its Napster opinion that got "sent home" in Sony, that Judge Posner would so freely adopt it here. To be fair, he explains his reasoning very, very well -- I just don't find it persuasive in view of the law and its underlying policies -- contribution isn't about expanding copyright to permit technology regulation.

To me, the question isn't whether the technology is being used poorly -- even by most users -- if it is capable of a substantial noninfringing use -- in which case there should be NO liability for contribution. (To get a sense how far the Supreme Court went, there was survey evidence before the District Court showing that 50% of the Betamax users were doing some infringement.) The question should be whether the technology vendor was affirmatively and actively inducing others to engage in infringement, as was the case in Napster and, arguably, Aimster.

Time will tell. But until the Supreme Court gets to this, it looks like the Posner account of Napster will be the final word on this question of law. Note, however, that his remarks on identity protection as indicia of wrongdoing are very troubling -- one of these days, perhaps in a few more years, perhaps, if we don't have any more tall buildings hit by planes, we really need to affirmatively try to get the courts and the Congress focused on privacy again.

Do the EULA

[Zangief]

Why don't we put a EULA in the new Kazaa programs, which say something like this:

I don't belong to any organization related to RIAA.... I won't use any information obtained from the use of this program, or the study of the way this programs works, to sue others users of this or related program... I don't suck

And then require, from some point in the near future, that everyuser of kazaa has accepted this EULA

IANAL, and I don't know how an EULA like this would stand in a court, but should work for a time at least.

In the worst case, if the EULA doesn't stand in a court, it would provide a good case against crazy EULA's

It's a win-win!!

trust and reputation management

[mr_burns]

I believe the next major advance in P2P technology will be the inclusion of reputation management / trust relationship technologies.

How do you know which IP's to blacklist? How do you know that the file you're downloading isn't a trojan?

I don't think the answer is in a centralized database of 'evil-doers'. That's an arms race that can eventually get everybody censored. Especially with dynamic IPs.

What needs to happen is you have to earn a reputation before you end up in those search results. You do this by people vouching for the quality of your files and not being a mole. Trust is gained by WHO vouches for that person and their metric of trustworthyness.

There should also be an option to restrict access to a given file to those within your web of trust so when the death squads in your country are looking to kill people serving up books about democracy, they can't just do a search real quick.

After we achieve a trust framework. I believe the next step will be dealing with traffic analysis. However, I'll rant about that when the time comes.

Re:Check out UDPP2P

[stikves]

Please forgive me if I'm wrong, but UDPP2P does not seem to be "promising".

I've checked the web site. It basically says "we broadcast all the queries and if someone has the file we meet each other by using secret codes hidden in those queries".

A peer-to-peer network that does queries in terms of network-wide broadcast is always doomed to fail. Gnutalla failed (and was redesigned) the same way. Even Novell NetWare was unable to scale because of SAP (service advertising protocol).

Nevertheless, the web site says "peers will somehow know each other". This is also a big problem in P2P networks. -- No design only big words.

Anyways, if I were you, I'd use freenet [freenetproject.org]. It's anonymous, and it works much better than the scheme explained on the web site.