X0.at: upload files from cURL • Hacker News Board

Re: X0.at: upload files from cURL

#91

Post by mcculley » Tue, Mar 16, 2021, 6:53 PM UTC

dheera wrote: post #75

felipelemos wrote: post #73

Earlier quoted context omitted.

Why didn't you contact the police first?

Yeah honestly if I saw something like that I would have saved an offline copy on a USB stick and handed it to police for investigation. The problem that it even happens is much greater than the problem of online distribution, and deleting it and pretending it didn't happen isn't a satisfactory response.

Seriously, talk to your lawyer before doing any such thing.

I have done work for lawyers in exactly this scenario. Be very very careful.

You do not want to have to explain to explain the provenance of such a file without having someone to back you up.

Re: X0.at: upload files from cURL

#92

Post by mcculley » Tue, Mar 16, 2021, 6:55 PM UTC

MandieD wrote: post #89

PeterisP wrote: post #66

Earlier quoted context omitted.

Automation; the bare minimum would be to scan for known child sexual abuse material hashes - if you're not doing that, then opening up anonymous uploads is very risky, as for CSAM (unlike most other things) you may be personally liable even if it's distributed there without your knowledge. Cloudfare's CSAM scanning tool is one option that may help, there are other options. You can't rely on the good faith of users, i…

"You can't rely on the good faith of users; if your service is easily usable for crime, it will be used for it." - should be on every developer's login screen

And every developer needs to explain this to clients.

I had a client wanting to defer identity validation on a two-sided market system. I had to explain how it would be used for money laundering. It had never occurred to the client.

Re: X0.at: upload files from cURL

#93

Post by dheera » Tue, Mar 16, 2021, 8:29 PM UTC

reaperducer wrote: post #79

dheera wrote: post #75

Earlier quoted context omitted.

Yeah honestly if I saw something like that I would have saved an offline copy on a USB stick and handed it to police for investigation. The problem that it even happens is much greater than the problem of online distribution, and deleting it and pretending it didn't happen isn't a satisfactory response.

Yeah honestly if I saw something like that I would have saved an offline copy on a USB stick and handed it to police for investigation Maybe not a great idea. In some places, that puts you in possession, and is enough for prison time, regardless of your motives.

Wow that's a shitty legal system, okay ... I guess we the people have chosen to just let it happen and fear speaking up as witnesses.