Article:		It Doesn't Pay to be Popular
Subject:		Bittorrent guarantee identical to direct download
Date:		2003-05-30 22:58:36
From:		anonymous2
BitTorrent confirms that the resulting files match the description in the torrent file. If you distribute the torrent file from your site, then you have the same level of assurance about the resulting files as you do for a direct download from your site. BitTorrent would have been an excellent choice for you.

Showing messages 1 through 10 of 10.

• Bittorrent guarantee identical to direct download
  2003-05-31 09:04:16  eggboard [View]
  
  
  That's not exactly what I was writing about: if you distribute the file directly and have it distributed through the system, yes; but people downloading have no assurance that any file named X is the same file as X. You see what I mean? If you don't know the author, and there's no trust mechanism that currently allows you to "know" an author, then you don't know whether a file originated from the author who is distributing it or not.
  
  Someone could take our book PDF, add a virus, bundle it up, and name it "Real_World_Adobe_GoLive_6.pdf.exe".
  
  BitTorrent isn't an excellent choice at the moment for the reasons I cited: people can be fired, suspended, or expelled for using ANY P2P in many places, and our likely reader base wouldn't use a program like BitTorrent for reasons of obscurity (they're not in that community of people who know what P2P is) or job security.
• Bittorrent guarantee identical to direct download
  2003-08-13 06:11:34  anonymous2 [View]
  
  
  you need to just also include an MD5 file so people can check if their file is the real one. search for it on google not too sure whats the easiest way to do it but you see it all the time with big files like linux distros etc.
• Yes, but the problem is not specific to BitTorrent
  2003-05-31 15:27:47  anonymous2 [View]
  
  
  Let's review how BitTorrent works.
  
  1. You create .torrent file from original content. The .torrent file contains crypto strong hashes of the original content.
  2. You distribute .torrent file through website, mail or some other mechanism.
  3. User's download content as described by .torrent file.
  4. BitTorrent checks hashes in .torrent file.
  
  The weak link here is step #2. User's don't have a strong guarantee that the .torrent file is the one you generated.
  
  Note that this weakness is identical to direct download. Users do not have a strong guarantee that downloaded file named X is identical to the original file X.
  
  You can make a stronger guarantee in the direct download case by using https, but the same holds true for distributing the .torrent file.
  
  Just to be clear, you create the .torrent file containing the hashes and you distribute the .torrent file containing the hashes. The weak link is in the distribution and that weak link is identical to direct download.
  
  By singling out this issue with BitTorrent, you lead readers to believe that this is a weakness of BitTorrent compared to direct download. There's a lot of FUD about p2p. It's sad to see that you are adding to it.
  
• Yes, but the problem is not specific to BitTorrent
  2003-05-31 15:58:35  eggboard [View]
  
  
  You're reading the context wrong, and it is, in fact, different with direct download.
  
  In the article, I cite the general problem as: "In peer-to-peer systems, however, you can't necessarily be sure that a given file is the same an author meant to upload, that the file has been vetted for viruses, or that each version of the file throughout a network is the same as every other file." Then I mention BitTorrent's method of crypto as a specific example of trying to solve one part of the problem that doesn't actually verify or vet the file. So that's a general-to-specific example, not a condemnation of BitT above other P2P.
  
  Second, many sites do employ a variety of methods including MD5 and public key signing to ensure that a direct download is as promised. MD5, of course, only ensures that a file matches what's said on a Web site or in an email or newsgroup posting. If you use the methods recommended to obtain the verification of public keys used to sign downloads out of band (that is, not via a Web site or through email directly), then when you download a file, you can verify that the person or organization that you think created the file did, in fact, sign the file and it's been untampered with. (The cases in which this is a problem involve a lack of out-of-band confirmation of the public key, and so were more like just checksumming not ensuring integrity.)
  
  So you're definitely RIGHT in that the problems are P2P based, but they're exacerbated by a distributed mechanism in that the "author" doesn't define where the downloaded file is authoritative from.
  
  Obviously, a way to make this work better would be to tie in Web sites or subsites on a Web site that managed the crypto: signed files, etc., and have a streamlined method of obtaining keys or keys signed by other keys, so that any file in BitTorrent had to have some identity confirmed at the end of a chain, not just crypto hashing confirmation of the individual file.
  
  It's definitely a global problem, but it's "solved" in the sense that sites like apache.org or sendmail.org use mechanisms that allow verification. If those files are then distributed through BitTorrent those same methods of verification work.
• Yes, but the problem is not specific to BitTorrent
  2003-06-02 14:34:31  anonymous2 [View]
  
  
  I think you're missing something. BitTorrent implements the solution you describe.
  
  You as the author create the (small) .torrent file with the checksums in it. You host this on your webserver and link to it. The first step of a BitTorrent session is for the user to download these checksums directly from you.
  
  Then BitTorrent does its peer to peer magic and retrieves the actual file (your pdf). The client checks the pdf against the .torrent file to ensure that what the user gets is exactly what you created.
  
  If you still disagree, please read about the BitTorrent protocol. It's a very different beast than the Kazaas and Gnutellas of this world. For example.. there is no search engine built in. A user doesn't search inside BitTorrent for your book to obtain it. She goes directly to your website and clicks the BitTorrent link that you have set up. Thus her client can guarentee that she gets exactly what you want to give her.
  
  Of course, as you mention, there is still a stigma against peer-to-peer programs in general. This is probably because most of these programs are really designed to make it easy to illegally share copywrited work.
  
  BitTorrent is different. It's designed from the ground up to solve the very problem that you are having. As people get more comfortable using it, I think the stigma will begin to fade.
  
• Yes, but the problem is not specific to BitTorrent
  2003-06-02 14:34:09  anonymous2 [View]
  
  
  I think you're missing something. BitTorrent implements the solution you describe.
  
  You as the author create the (small) .torrent file with the checksums in it. You host this on your webserver and link to it. The first step of a BitTorrent session is for the user to download these checksums directly from you.
  
  Then BitTorrent does its peer to peer magic and retrieves the actual file (your pdf). The client checks the pdf against the .torrent file to ensure that what the user gets is exactly what you created.
  
  If you still disagree, please read about the BitTorrent protocol. It's a very different beast than the Kazaas and Gnutellas of this world. For example.. there is no search engine built in. A user doesn't search inside BitTorrent for your book to obtain it. She goes directly to your website and clicks the BitTorrent link that you have set up. Thus her client can guarentee that she gets exactly what you want to give her.
  
  Of course, as you mention, there is still a stigma against peer-to-peer programs in general. This is probably because most of these programs are really designed to make it easy to illegally share copywrited work.
  
  BitTorrent is different. It's designed from the ground up to solve the very problem that you are having. As people get more comfortable using it, I think the stigma will begin to fade.
  
• Yes, but the problem is not specific to BitTorrent
  2004-02-01 02:41:56  susy_miller [View]
  
  
  Acctually, nothing is missed. It works, look closelly. If you find out the best documentation ever written in the matter, you might conclude that everything works fine.
  
  
  
  
  __________________________________________________
  Translated by Mail-Translator
  
• Yes, but the problem is not specific to BitTorrent
  2004-02-01 02:38:39  susy_miller [View]
  
  
  Accctually, nothing is missed. It works, look closelly.
  
  
  
  ----------------------
  Translated by Mail-Translator
  
• Yes, but the problem is not specific to BitTorrent
  2003-06-13 05:58:22  anonymous2 [View]
  
  
  Late to the party, but just wanted to chime in that as a content author I consider BitTorrent a perfect distribution channel - specifically because it counters the issues you raised.
  
  1. File Integrity - As long as I host the .torrent file (which as mentioned is a small file containing tracker information and checksums) my audience knows they are getting *exactly* the file I created and intended to download. I suppose someone could create a similarly named file, create a torrent for it, and post it somewhere else - but my audience knows as long as they download the .torrent from my site it is as secure as a direct download.
  
  2. Using "peer to peer" at work. Because bittorrent works off standard web links, there is less concern to employers that it's being misused. It's not like there is a client sitting in the background that may be downloading mp3's on the sly - standard web logging shows exactly what files were downloaded. Essentially BT creates a unique P2P network for a single file that distributes ONLY that information - there's no temptation to "go browsing" or stray into non work-related issues as there is no other content on that particular network.
  
  2.5 Legitimacy. As a distributor of legitimate content, I don't want my users to feel they're involved in any kind of shady "warez/mp3/filering" nonsense. There's no exposure to other BT users (or whatever content they may choose to distribute using BT.
  
  3. Dramatically faster D/L times. Instead of having to serve 100's of large video files concurrently (and in a short period of time) my audience base can actually experience *faster* connection times with the more people who download.
  
  4. Ease of use. I don't service a particularly technically knowledigible clientelle, I doubt they would adopt new clients or media viewers. With BT all they need to do is download and run the installer. After that they can just ignore it and continue downloading from the web just like they always have.
  
  5. Reduced Bandwidth Cost - The "file swarm" concept works very well for product, like mine, that has an anticipated "release date". After the first few downloads the downloading community services their own replication and distribution, and I just have to serve the small .torrent content.
  
  I have to agree with some of the other responders that it's tough to see that an innovative system that is hugely benificial to both users (increased d/l speeds and availability) and providers (lowered bandwith, faster delivery) the (admittedly deserved) stigma of "THE DREADED P2P" can hinder it.
  
  - Brad
• Yes, but the problem is not specific to BitTorrent
  2003-06-13 05:55:53  anonymous2 [View]
  
  
  Late to the party, but just wanted to chime in that as a content author I consider BitTorrent a perfect distribution channel - specifically because it counters the issues you raised.
  
  1. File Integrity - As long as I host the .torrent file (which as mentioned is a small file containing tracker information and checksums) my audience knows they are getting *exactly* the file I created and intended to download. I suppose someone could create a similarly named file, create a torrent for it, and post it somewhere else - but my audience knows as long as they download the .torrent from my site it is as secure as a direct download.
  
  2. Using "peer to peer" at work. Because bittorrent works off standard web links, there is less concern to employers that it's being misused. It's not like there is a client sitting in the background that may be downloading mp3's on the sly - standard web logging shows exactly what files were downloaded. Essentially BT creates a unique P2P network for a single file that distributes ONLY that information - there's no temptation to "go browsing" or stray into non work-related issues as there is no other content on that particular network.
  
  2.5 Legitimacy. As a distributor of legitimate content, I don't want my users to feel they're involved in any kind of shady "warez/mp3/filering" nonsense. There's no exposure to other BT users (or whatever content they may choose to distribute using BT.
  
  3. Dramatically faster D/L times. Instead of having to serve 100's of large video files concurrently (and in a short period of time) my audience base can actually experience *faster* connection times with the more people who download.
  
  4. Ease of use. I don't service a particularly technically knowledigible clientelle, I doubt they would adopt new clients or media viewers. With BT all they need to do is download and run the installer. After that they can just ignore it and continue downloading from the web just like they always have.
  
  5. Reduced Bandwidth Cost - The "file swarm" concept works very well for product, like mine, that has an anticipated "release date". After the first few downloads the downloading community services their own replication and distribution, and I just have to serve the small .torrent content.
  
  I have to agree with some of the other responders that it's tough to see that an innovative system that is hugely benificial to both users (increased d/l speeds and availability) and providers (lowered bandwith, faster delivery) the (admittedly deserved) stigma of "THE DREADED P2P" can hinder it.
  
  - Brad