Nodes are made up from a ‘Safe’ (previously called ‘Vault’) executable file and some spare space on disk of everyday computers. Nodes first go through a short PoW resource proof so the network knows the nodes capabilities and how to place them. Sybil attacks are prevented in many ways including random placement in sections and random relocation, and node ageing, which is a way of incremental responsibility when a node behaves all the way into the next relocation event and that is halved if misbehaving or offline. You would have to control a significant portion of the network to cause a problem and would be cost prohibitive in most cases. In a young network the highest risk comes from a ‘Google attack’ where they deliberately allocate their resources early on and either try to control the consensus or rug pull their resources which would cause massive data loss.
Safe Network also has Safe Network Token (SN) as an digital payment/incentive layer for providing or purchasing network resources (bandwidth/cpu/storage).
If you think CRDT’s or Asynchronous Trutworthy Transfers (AT2) are neat innovations you should definitely check it out as Maidsafe is really pushing the envelope there. safenetforum.org https://primer.safenetwork.org/
If you have a lot of sleeper nodes coordinate a google attack the network is unrecoverable though...
Amazon can monitor what runs on their servers.
It’s a server running on their hypervisor. Their hypervisor can see every single process.
Nobody but you knows that you're hosting hidden tor service. One need to perform a sophisticated attack to discover its location. You can buy VPS from Amazon and host your hidden tor service there and Amazon guys won't have a clue until NSA guys will come to them.