"I run a website where people can upload files."

This is an incredibly brave thing to do in 2026.

I didn't newly start this in 2026; I just haven't stopped the existing system :). Fifteen years ago there weren't all these issues though. Attempts at taking it down whenever anything bad was spotted started probably somewhere around 2019-2020, and user reports are picking up as well since about a year. People suddenly care a lot more that when they guessed a url and found malware (something no legitimate user would stumble upon), it gets removed promptly. So far the number of reports is very very manageable, but it's interesting to observe the collective consciousness change over time from "don't run executables that you don't know are safe" to "untrustworthy files shouldn't exist online in the first place"

The risk of pedophile images is way to high to let anyone upload files to your website. It's one thing probably even the evilest country would agree to jail you for, without investigation.

Sorry mate, the era of forums is over.

Maybe, let's see. So far I haven't gotten CSAM reports yet. Very little porn in general, maybe one video per year or so? In my particular case it's also not very useful because the uploads are all self-destructing. After a few hours you'd have to upload it again, but from a new IP address because I'd block any (C)SAM uploaders and report all evidence I have to police in the appropriate country. Seems like a silly way to burn through a set of working proxies if someone wanted to try to keep abuse material available on that site

Theres no way you can say having an internet presence is over for the little guy and yet at the same time imply its ok if you have enough money/power. I think at that stage it ceases to be useful and we need an internet 2.0. maybe something hobbyists can run over radio or something.

It exists, but very limited, lookup MeshCore and Meshtastic

This is why developing darknet and obfuscating P2P network tech that make it impossible to properly assign legal liability to a node is so important. States are by far the worst monsters humans have invented and they do the stupidest things imagineable.

A State might be composed of humans but it is a machine, a generally unthinking machine, which projects force on and breaks individuals.

[delayed]

You can easily swap government for big corporation in your sentence. So maybe the issue is something else?

[delayed]

/shrug - I have an end-to-end encrypted file delivery service. It's a dumb service. If the box go compromised, it doesn't even matter. The files can't be read or stolen because they would have to actually crack the algorithm... which if they did then it's just over, the internet is plaintext again if people are able to defeat what's been recommended as best practices for SSL/TLS these days.

That’s not the risk, the risk is you’re helping spread horrific things.

Just because a system is end-to-end encrypted doesn't mean the users are anonymous. If someone reported to me a download link with decryption key for my file service, I can probably find the IP address of the person that uploaded it. Then pass it off to whatever govt entity that deals with that.

I’m about to work on doing this. Quick-sharing media files for personal use between devices, friends, LLMs (like a shelf rather than a Dropbox), So an intermediate upload host is needed.

My biggest worry was preventing CPAM, and the possibly huge cost and emotional scarring thereof. What surface(s) are your primary concern? I don’t know what I don’t know. Thanks!

Unpopular opinion, but I think that any website owner accepting uploads from strangers should bear responsibility for those uploads. You cannot just say "not mine, I just distributed it".

I'd be fine if that were the law. What really frustrates me is the double standard where I can't host something that Microsoft or Wetransfer can without repercussions

When running an actually competent LLM is as cheap as a $10/mo cloud server (for the moderation), I'll actually agree with this sentiment. Probably wont be unpopular long beyond that point in time.

There's a middle ground for this though. Platforms like Youtube, Facebook, etc, have no excuse anymore. They can literally scan with these models they have available and handle it. So write the legislation based on their capacity so you don't screw the one dude just trying to support some indie game devs in a small community or something.

[delayed]

Usually the file is already gone by the time they finished reporting it, but otherwise delete and ban the uploader if it's a valid report. Criminals don't seem to use my site for malware spreading, though, because all uploads expire after a number of hours. Much better to put it somewhere that's stable until the victim clicks on it, like Google Drive or whatnot. You'd say Google is also responsible for infecting innocent victims right?

So far as I can tell, the malware uploaded to my site is when people use it as a virtual usb stick; transferring files to a lab system or something else they already have access to. A multiplayer remote desktop site was popular for a while, loads of links to shared virtual machines and sometimes people would upload screen recordings of something that happened (usually social things like someone saying something edgy in a chat that runs alongside). Since it's a lab environment, the users enjoy letting loose all sorts of malware and they'd use my site to get it there, but they always already had access or you can't type in the URL and execute the file

There was one instance where someone did make a self-spreading piece of malware, custom for my site. It would try to occupy a lot of short links, so pretty much no matter what you guessed, you'd end up finding that Windows executable and, if you ran it, it would upload itself to create yet more valid download links. Didn't do anything malicious to infected machines, just a nuisance to the site until I banned IP addresses that continued to spam the site

Of course, that's just focusing on the malware. The vast majority of uploads are screenshots, legit software (matching sha2sum with a known good source), long links or commands someone would otherwise have to type over, stuff like that. On occasion there's waves where some community will decide to use it for something, like rich Koreans sharing chatroom links for about a year comes to mind. A few teachers use it for temporarily having a very short link that they can put on the chalkboard/whiteboard for students to download coursework from

> A multiplayer remote desktop site was popular for a while

Are you talking about CollabVM? :)

https://computernewb.com/collab-vm/

Yeah, that's the one! I recognise the name, thanks :)

> People don't treat big tech this way; you don't think "oh, there's malware on Github, let me just report github.com as a suspicious website that nobody should be able to visit anymore"

> The correct answer is probably the abuse contact shown in the WHOIS data. That's programmatically accessible and thus scales

... They don't treat Github that way either. You mean to report the domain as abusive to the registrar?

Let me offer the wisdom of the BBS Era, which had the same problem of people uploading bad files to small, oftentimes non-commercial, nodes: Scan files on upload.

Running anti-virus scanners immediately on uploaded files was a widespread practice in the BBS Era, adopted in response to the same kind of abuse. FTP sites did it, too. There was usually a delay for (run on a schedule) virus scanning between uploading to one of the shareware FTP sites and the file getting out of the upload directory and into the download areas.

The headlined article isn't really about hosting user-uploaded files, though. In no sensible system do user-uploaded files go straight into the site's own published JavaScript. The headlined situation is not analogous either to you or to BBSes, involving script hyperlinks to defunct third parties in one form of the problem, so what to do when it comes bad uploads from users is really going off on a tangent from Scott Helme's actual question.

I think this has become much more expensive these days. We do it, at a significant computational cost. Not with a small hobbyist machine, but a beefy hobbyist machine. Sometimes making the hubby a bit less worthy...

> Sometimes making the hubby a bit less worthy...

You may want to meet with a marriage counselor.

Thanks. I've considered scanning but besides that it gives a false sense of security (it's trivial to make something for which there's not already known signatures), github and other file hosting sites don't do this either. Some do, I think Google Drive does it after the fact, but it doesn't seem to be the deciding factor in whether vigilantes try to take your site down or instead report malicious content

Maybe scan every time it is accessed as well? So if and when a malicious file hits the lists maybe your antivirus can flag it? This is an amateur question for the discussion not advice.

They at least use different domains for user-uploaded data. e.g. googleusercontent.com and you could go even further by giving each user their own subdomain. That at least gives block lists the possibility of blocking a single user at a time.

I have zero practical experience with contacting abuse contacts. But my expectations would be very very low. For the hyperscalers you will get autmated responses and no way to make your point heard. For small ones there will typically be silence.

Can anybody tell me it's not that bad?

I've tried contacting various domains via their abuse and technical contact WHOIS info over the the years. Mostly small-to-midsize domains, including colleges. I've never gotten a reply, and I don't know if the emails ever went to a real person. Occasionally the issue I was reporting got fixed, but I have no idea if my email had anything to do with anything.

IIRC you give each user a subdomain and put the parent domain in the public suffix list.

That's actually an interesting idea! I remember looking at that list and I don't qualify but I also currently don't have subdomains, maybe it would work then. Not sure if the issue was needing a certain size, like 100k users or whatever (which you'll never reach if half the people can't use your site. I should look into this again with the subdomains option in mind