make no mistake: ipfs _by_itself_ is no more "anonymous" than torrenting or other types of file sharing ftp/sftp/ssh/http/whatever...

because they can always get your ip address.

You will need to use some other method if you want anonymity.

Sorry, the reference to Tor is misleading. I was not referring to anonymity but rather access to content from restricted areas like the Middle East or Asia.

In that sense, I would agree, ipfs can provide access to content that would otherwise be blocked.

Could ISPs throttle IPFS content the same way they did with torrents a while ago? (and probably will again once net neutrality falls).

Sure -- but libp2p's network transports underneath are pluggable. There's already Websockets (/ws, think domain fronting! [1]) and Tor (/onion) transports, so there's various options for evading censorship (I personally consider bandwidth throttling a form of censorship).

[1] Domain fronting lets you use a well-established web frontend for your web service. E.g. we could host /ws nodes in Google Cloud, and to the ISP the TLS handshake looks like it's for google.com, while inside the connection there's e.g. a `Host: libp2p.googlecloud.com` header. More info: https://www.bamsoftware.com/papers/fronting/

But then again, net neutrality is a political issue! You don't solve it for good with technology.

The real challenge to this is negotiating pinning without it being exploitable by third parties.

Is there where a third party node can spoof (or lie about) the content belonging to a pin to clients that ask it?

Since IPFS is based on content addressing, if a node tries to spoof a piece of content, any peers trying to fetch from the malicious node will immediately see that the content provided does not match the desired hash.

I'm not sure how peers handle that situation, I'd assume it'd be treated like wire corruption (retry) or give up and try to fetch from a different peer.

But that doesn't stop ddos attacks.

True, but a ddos also doesn't exactly mean the content is "exploitable".

I presume future clients would block nodes that share false content (if clients don't already).

Pins are something that's per-node, and whether a node has a specific piece of content pinned is not visible publicly (only that it's providing the content).

as far as I know www.shiftnrg.org is building something along those lines... decentralised hosting on IPFS + custom DNS...