How confident can I be that the Feds wont pay me a visit at 4am?
edit: The information on how it's secured for packeteers seems a bit limited. (how do you prevent people spraying 192.168.1.1 into all endpoints?).
But it's interesting enough to hit up in a seperate docker network. I'm looking forward to seeing if it'll actually use GBs.
1. Check your ISP contract. If it is a residential connection, it probably says you are not allowed to share your connection with people outside your home (and it could be argued that you are doing so by running this).
2. Check your laws. In Spain, if your connection is used to conduct illegal activities and you willingly gave access to the attackers (which is what you are doing here) then you are a "necessary collaborator" and would be found guilty of these crimes.
In other countries, “not technically illegal” may apply. In Spain, it does not.
Or to give another analogy, it’s not technically illegal to sit in a car. It’s a different matter if you’re sitting in the car as a lookout while a crime is occurring. While there’s “intent” that matters in that particular example, when it comes to internet crime in Spain, intent doesn’t matter, facilitation is all that does.
Firstly, you really want to engineer your systems as much as possible so that you can't look at any PII -- and that includes things like usernames that aren't displayed to the public, and maybe even ones that are! -- as an administrator of your system, without going through some sort of "break glass in case of emergency" process that leaves an audit trail with a clear policy of when it is acceptable.
Second, even if you have access for job-related tasks, you shouldn't spontaneously try to tie user accounts to outside identities; that should be like line 4 or 5 in your data access policy. The right way to do the above would be something like saying "Thanks for vouching for us! If you message me your username @XYZ, I'll add some extra bandwidth credits to your account. :)"; that turns the interaction/demasking into something voluntary on the user's behalf, rather than you creepily stalking them through your user DB.
Agreed it's a little scummy to not factor your operating expenses into the price of the product, especially if that's not blatantly obvious from the outset.
My second thought was hoping traffic actually does get proxied through your network, and isn’t pure P2P, to provide anonymity between users.
My third thought was that I should sign up regardless, as this could be useful!
One nitpick: I'm seeing occasional timeouts (probably because the residential endpoint went down recently). Do you have a best practice on how to work around that?
Is being a packeter safer than running a tor exit node? I'd worry that the people willing to run this risk for a small income couldn't afford adequate legal defense if necessary.