thenose
If you're serious about protecting yourself, Whonix is a requirement.
Day to day browsing is a pain. I use a VNC client to remote into our server, which is running a desktop environment with a regular browser. That way you can use apps (gmail, discord, etc) from outside the Tor network. But since you're tunneling through Tor, this is painfully slow. You'll likely want to type out long messages in Whonix, then copy-paste into your remote session. Each keystroke can sometimes take a full second to appear when animations are heavy.
Transferring large amounts of data is also painful. If you try to start Litecoin Core on Whonix, you'll need to sync more than 30 GB, which can take a very long time.
Patience is your weapon. You have all the time in the world not to make a mistake, and moments to make a fatal one. Think carefully about everything you do.
Stylometry scares me. AI can help here: run an assistant locally, and ask it to reword everything you write. You won't be able to use ChatGPT for this, obviously because OpenAI retains a history of everything you submit, but also because they require a real phone number to sign up. And you can't get a real number through any means I've found so far.
Payment is also a pain. I'm hoping to ask the community to donate Vanilla gift cards so that I can sign up for Tarsnap or spin up a droplet.
By applying the discipline normally found in aeronautics, I think it's possible to do this safely. But you'll still be risking jail time, and the intersection of people who want to do something for altruistic reasons and willing to risk prison is pretty small. I'll be documenting everything I do so that you can learn from my example, or perhaps from my mistakes.
I wrote up our security procedures here: https://news.ycombinator.com/item?id=37346620
The reason Tails isn't an option is because, as others have mentioned, there have been Tor browser exploits which reveal the IP address of the Tails user. While this is unlikely for our case, it's important to approach security from first principles with threat modeling. An attack from the FBI may seem unlikely today, but both Silk Road and one of its successors were taken down by mistakes they made when setting up their site. Learning from history, if you're not careful early, you're in for a surprise later.
Case in point: When I started Whonix Workstation to post this comment, the Whonix Gateway VM failed to boot. So when I tried to start Tor Browser and go to https://news.ycombinator.com, all I saw was a connection error. This kind of layered defense is essential if you're serious about staying out of jail.
Realistically, you'll likely dox yourself through some other means: sending Bitcoin to your pseudonym from your real identity, admitting to someone you know that you control your pseudonym (this work gets lonely, so this is a real temptation), or even accidentally signing off an email with "Thanks, [your real name]". And once you make a single mistake, you can never recover.
(We noticed The Pile was recently taken offline, so we hosted it: https://thenose.cc. Apparently Books3 was also a part of The Pile, so feel free to download.)
Notice the links now 404. We tried to make a drop-in replacement for those links. All they have to do is change the-eye.eu to thenose.cc in the urls.
Unfortunately there's not a lot of ways to get their attention to let them know this exists now. I'll try emailing the contact address but I imagine they receive lots of spam, so I was hoping to try to get noticed by people like yourself first. Maybe a direct email is still the best way, but there's no guarantee they'll even be willing to change the urls due to legal risks. For all they know I could be logging the IP address of everyone who downloads it and forwarding it to authorities. But I'm not, and it's a frustrating problem to try to solve. I just want to help AI flourish.
This also serves as a template for someone else to do the same thing, so at least there can be multiple mirrors.
Thank you again. The fact that you even took the time to look it over meant a lot. If you have any other ideas, I'd be interested to hear.
Recently The Pile was taken offline from The Eye by DMCA. One solution is to host it offshore, which we're calling The Nose: https://thenose.cc
The technical security measures may be of interest to the audience here, so I'll be as detailed as possible. The following formula should be safe if you follow it to the letter.
The basic setup is to install Whonix on a VeraCrypt drive, acquire Monero through any method, use a non-KYC exchange to convert it to Bitcoin on a wallet stored only on the Whonix installation, sign up for a ProtonMail account (when they ask for email verification, use a no signup inbox service like yopmail), rent a dedicated server at Shinjiru using bitcoin, and register the domain at the same place. They're both a registrar and a server host, which simplifies matters. Use N/A for all contact info. Use Cloudflare to manage your site's DNS records.
Wallet security: do not ever move Bitcoin to any wallet linked with your personal identity. This is easier said than done. First there is the question of how to store passwords. These are the keys to the kingdom, and are the most sensitive aspect by far, because they're intimately linked with you. Additionally, if hardware failure occurs, you'll lose everything if you store them on the Whonix drive. My setup is to use KeePass to store the passwords on a laptop I use to VNC into the computer with the Whonix drive, and then save the database to a folder that gets synced to the cloud. The only flaw in this model is that if your laptop is compromised while your KeePass is open, you're done. But (as Ulbricht discovered) this is always true. The threat model assumes lawyers coming after you with DMCA with additional safeguards against the FBI narrowing down who you are in real life. If your physical location is compromised through any method, you're done.
All it takes is one mistake to end you. SSH into your box from your real computer? Done. Sign up using your real name with Mailgun? Done. Accidentally say "Thanks, <your real name>" to the support staff at Shinjiru in an email? Done. Abandon ship and close everything down.
The security of this technique comes down to simplicity. There are very few moving parts. I opted for nginx + mediawiki with Discourse forums at https://forums.thenose.cc (though I don't know if anyone will care enough to join). Logging is turned off to protect users downloading the data, though you only have my word on this. But reputation is the only thing a hacker has ever truly had anyway.
If you're serious about following the above recipe, I urge you to read through the Whonix docs on online anonymity: https://www.whonix.org/wiki/Documentation Remember, threat model is your saving grace. You probably aren't starting a darknet, so you can relax your threat model in terms of physical safety. But you won't get away with any mistakes made in cyberspace.
As for the site itself, I've avoided asking for donations for now (hosting is $130/mo though, which will get expensive) or describing anything beyond this HN comment. I'll say it's for simplicity, but in fact I only started it a few days ago and haven't had time to provide anything but the essence of our service: hosting AI datasets in stable, copyright-resistant ways.
If additional datasets beyond The Pile need protection or distribution, you can contact me at [email protected] or at https://forums.thenose.cc. I have a 4TB drive, of which 800gb is being used by The Pile so far.
My question was, how did you envision BitTorrent working?
It's also the trick to being liked in general. Not everyone cares about that, but I've found it more of an asset than a distraction.
Thankfully this seems rarer than the one you're mentioning, where everyone is happy to build a nice company they want to work for. It's an odd situation, where the natural incentives align to reward the opposite. Is there a way to guard against those?
And of course; good faith is all that we have here.
Text is timeless, and it's worth keeping an open mind that it can work. Maybe specific niche interests are the key; crypto is a big topic now, but back then only a few enthusiasts cared.