Can you elaborate on what big potatoes you're seeing? Genuinely asking. The Android app, for example, writes everything to the app's storage, and runs only when your phone is plugged-in and is connected to wifi. To me that generally means "when I'm sleeping". What's the big potato in this scenario?

▲

sp332 29 minutes ago | parent | next [-]

Not only downloading, but also uploading. Your ISP (in America) has a policy about how many DMCA strikes you get before they disable your internet permanently.

▲

u8080 5 hours ago | parent | prev | next [-]

They hated him because he told the truth moment.

Any iOS or Android app could in fact, download arbitrary content without you noticing, but corporations conditioned people to only raise alarms on torrents and other community efforts.

	▲	yoavm 4 hours ago \| parent [-]
		Yes. As far as I know, with WebRTC I can make your device share certain files with peers simply by you visiting my website.

▲

nerdjon 6 hours ago | parent | prev | next [-]

That is a hell of a lot of trust that people are putting in to download and upload unknown files.

The risks that you download and start spreading malware or worse CSAM. You really don’t want that sitting on your disk.

Admittedly the risks is lower if the list is coming from Annas Archive, but this is still putting a lot of trust in an external list.

Much better off doing this manually, finding the list of what you want to seed and vetting that list yourself.

▲

yoavm 6 hours ago | parent [-]

The torrents are coming directly from Anna's Archive torrents list generator, which suggests their torrents based on how rare their content is. There's currently 177TB of data that is only seeded by 4 computers around the world, which I personally find worrisome.

People seem to be very concerned, but putting aside the legal risks (which I accept - don't use this if you're in one of the ~10 countries it could get you in troubles for), I don't really get it. The idea is to support Anna's Archive. If you do not trust the project, why support it? Levin is meant for people that want to support Anna's Archive, and my assumption was that this implies some kind of trust in their torrents.

Edit: just adding that "finding the list of what you want to seed and vetting that list yourself" is extremely not practical and not won't really help anyone. Torrents work because we're all seeding the same torrents. If I'd seed a torrent of my 5 favorite books and you seed a torrent of your 5 books, our torrents will forever have 1 seeder each. And good luck manually vetting all the files in one AA torrent. I am planning to let people manually add/remove torrents from Levin, but I highly suspect it will be used by very, very few.

▲

nerdjon 5 hours ago | parent [-]

You are making a wild jump here, you can trust without blindly trusting. How dismissive you are being in multiple comments about people having legitimate security concerns is extremely concerning.

This is such a fundamental security concept that we even have a commonly used phrase “trust but verify”.

You don’t have to just go based on your favorite books, but instead yourself find the list of torrents that need extra seeders and commit to those. Do a sanity check of the torrent and move on.

The risks of this blind trust is just way too high.

▲

yoavm 4 hours ago | parent [-]

Please, go to https://annas-archive.li/torrents and check their torrent list generator. It will recommend you torrent files that need help seeding. Pick one, and see for yourself that it's practically impossible to audit its content. I just checked and the average torrent size is around 125GB. With a typical file in it being around 0.5mb, you're looking at auditing 250,000 files. And the filenames are all hashes.

I would honestly love to know what you see as an alternative to trust here; an alternative that can still be helpful.

▲

nerdjon 4 hours ago | parent [-]

Again nowhere am I saying an alternative to trust, I can trust AA without blindingly trusting. Human error and malicious actors don’t immediately remove trust in a larger group, but it is also up to you to take some responsibility to protect yourself.

Even the simple act of manually choosing the torrent you are going to seed is already more of a sanity check than what your tool is doing. You could decide that your personal safety guidelines are that you will seed older torrents but not new ones just to make sure that some time passes and nothing was snuck in.

Is that perfect, no. But you know a lot more about what is happening on your device than a piece of software that just chooses what it is going to download and seed automatically. And you know before anything happens, not after.

Personally my biggest problem there is not choosing to use a tool like this or even how you wrote it. My problem is that you don’t make any mention of this on GitHub and that you’re incredibly dismissive of any concerns about running this way. If this is how you want it to work fine, but simply acknowledge that there are risks involved that go beyond just simply trusting AA and you are asking for blind trust.

	▲	yoavm 3 hours ago \| parent \| next [-]
		I'm sorry if it sounded like I was being dismissive. FWIW, people suggested that I'll add some information to the README and even implement some kind of a "country-check" to warn the user, and I think these are all great ideas. I still don't think that auditing AA torrent files make much sense however. As my first comment mentioned, the project is WIP. I posted it here because it seemed relevant, but if you're looking for bugs, I'm sure you'll find them both in the code and in the README. I assumed that people realise that a combination of torrenting + AA requires some precautions, but if your point is that I can make it clearer - I don't disagree.
	▲	s3p an hour ago \| parent \| prev [-]
		If you are seriously this upset about such a tool, why don't you just avoid using it? Instead of commending the author for their work you're trying to tear them down and prove them wrong in every reply. Why not just move on with your day and avoid using it?

▲

6 hours ago | parent | prev | next [-]

[deleted]

▲

pavel_lishin 6 hours ago | parent | prev [-]

Would you be willing to let me mail a package to your house, to hold for me? It would be placed in your house at night, while you're sleeping.

▲

yoavm 6 hours ago | parent | next [-]

These are beautiful analogies, but I'd appreciate an answer my original question. Your package can explode, these torrents cannot (as far as I am aware). If you want to send me a CD to store at my house, feel free to email me.

▲

filoleg an hour ago | parent | next [-]

> Your package can explode, these torrents cannot (as far as I am aware).

Sure, but what if the scenario was slightly modified, with explicit 100% guarantees regarding rhe package you would receive in the maile:

1. It could only contain either an SSD/hard drive or a usb drive. The storage device has not been tampered with. It was only ever used as a regular storage device out of the box.

2. There is no malware or any malicious executables on the storage device. The only types of data that it could contain would be text/html, structured data/document files (json, csv, office suite files, pdf, etc.), and media files (audio, video, images, etc.). None of those files will exploit any vulnerabilities in the software that opens them (neither through the parser nor anything else)

This makes it nearly a perfect 1:1 analogy to the torrenting scenario, both involving the exact same set of imo the most important dangers.

Which, for me personally, is the fear of ending up with illegal content (CSAM, stolen credit card dumps, etc.) on a storage device in my possession through no fault of my own.

Even if it could be a winnable battle in the end, it would be pretty much over reputationally way before it gets to the legal resolution. Just being accused of having any illegal content of that nature is not something I would want to ever deal with at all.

You gotta realize how it would sound and how you would appear to most uninvolved average people in real life, when your legal defense isn’t even something like statement #1 below, and is way closer to the statement #2:

> “I am not guilty, the accusarions are false, those files were never present on any of my storage devices.”

> “I am not guilty, despite those files being actually present on a storage device in my possession. That’s all due to how torrents inherently work, so, let’s start from the basics…” [and now we gotta explain simplified basics of torrent technology and how it works to the DA, the judge, as well as anyone else observing the trial, and pray they will try to actually understand]

▲

SecretDreams 6 hours ago | parent | prev [-]

If you end up torrenting very illegal or malicious content, who is responsible? Will it be you, the app creator?

▲

yoavm 5 hours ago | parent | next [-]

Assuming you are referring to non-books kind of content: I assume that if this happens to anyone, we'd learn about it and all stop seeding AA's content until they explain what happened and how they're making sure it doesn't happen again. The poor person this happened to will have to explain that this wasn't at all what they thought the software was doing.

As I said in other comments - yes, this requires some kind of trust in the AA project. Personally, I tend to have more trust in this kind of projects than in big corporations, of which people are happily running their binaries without blinking. However, I'm not trying to convince people to trust AA - this project is simply meant for those who want support them.

▲

SecretDreams 5 hours ago | parent [-]

AA has plenty of illegal and gray content. It's not something laypeople should help to seed. You need to go in eyes wide open and protect yourself if you're participating, which I do not feel you are sufficiently emphasizing in this pitch.

▲

margalabargala 4 hours ago | parent | next [-]

Yeah it has a lot of content that violates copyright! That's illegal!

▲

acessoproibido 4 hours ago | parent | prev [-]

What is an example of illegal content that is distributed by AA?

	▲	throwaway2037 29 minutes ago \| parent \| next [-]
		To clarify your question, are you asking if "AA actually distributes stolen content" (one could argue no, since it is only available by Torrent) or "the stolen contents of AA" (essentially every published book in existance)? Honestly, in these HN discussions, I am disappointed that people seem very casual about mass piracy of copyrighted works.
	▲	an hour ago \| parent \| prev [-]
		[deleted]

▲

rolymath 5 hours ago | parent | prev [-]

Why do none of you understand that this is for Anna's archives official torrents only?

▲

throwaway150 an hour ago | parent | next [-]

> Why do none of you understand that this is for Anna's archives official torrents only?

Because you are on the site where people who have no understanding of the domain or the problem still feel it necessary to share their opinion on things they don't understand.

▲

ozim 4 hours ago | parent | prev [-]

It is first time I see name of that project. I don't know anyone who is involved in that project. On Wikipedia I see it "shadow library launched by pseudonymous Anna".

"Anna's archives official torrents only" - doesn't put me at ease and it is far far from SETI@Home that was ran by highly regarded university and it wasn't storing any torrents on people hard drive.

Random people should not "just try it out because it is as easy as SETI@Home" - it should be, people who already know the project and would like to contribute but it was a hassle for them to set it up.

	▲	acessoproibido 4 hours ago \| parent [-]
		Only people who already know and trust AA are going to use it - that is the point of this project

▲

satvikpendem 5 hours ago | parent | prev | next [-]

By that logic no app should allow you to store any data whatsoever on their servers. Because your data might explode.

▲

vachina an hour ago | parent | prev [-]

Yes, if I know who you are and you have a list of what you might send. Anna’s Archive’s (who) content is well defined (what).