Orpheus News - Strange times
If you are on other sites like Orpheus, you will know that there have been problems elsewhere in the past month or more. Latest reports are of a brute force password guessing attack against Notwhat.
You should operate under the assumption that the same thing is occurring here.
I am following up with a member who noticed accounts appearing in their list of invitees that they did not invite. They think their password may have been guessed and someone else used it to create some accounts. (They have since changed their password). I urge everyone to check their invitee list to verify that no interlopers have crept in. If so, please contact me via PM.
And a reminder, once more, make sure your password is not used elsewhere, and sufficiently complex to avoid being brute forced. If you have trouble accessing your account at any time, join #disabled on irc.orpheus.network and wait for a moderator.
In closing, always remember that if someone is sufficiently motivated to force Orpheus offline for their own amusement, they will succeed. I hope that day never comes, but if it does we will do our best to defend what we have built here and will find a way to get the message out so that you know what is happening.
PS: it can't be all doom and gloom. To cheer you up, all enabled accounts have been credited with 1500 bonus points. Go and get some music and listen to it.
#privateTR
If you are on other sites like Orpheus, you will know that there have been problems elsewhere in the past month or more. Latest reports are of a brute force password guessing attack against Notwhat.
You should operate under the assumption that the same thing is occurring here.
I am following up with a member who noticed accounts appearing in their list of invitees that they did not invite. They think their password may have been guessed and someone else used it to create some accounts. (They have since changed their password). I urge everyone to check their invitee list to verify that no interlopers have crept in. If so, please contact me via PM.
And a reminder, once more, make sure your password is not used elsewhere, and sufficiently complex to avoid being brute forced. If you have trouble accessing your account at any time, join #disabled on irc.orpheus.network and wait for a moderator.
In closing, always remember that if someone is sufficiently motivated to force Orpheus offline for their own amusement, they will succeed. I hope that day never comes, but if it does we will do our best to defend what we have built here and will find a way to get the message out so that you know what is happening.
PS: it can't be all doom and gloom. To cheer you up, all enabled accounts have been credited with 1500 bonus points. Go and get some music and listen to it.
#privateTR
Orpheus.network News
The COVID-19 / Equinox Update
Recovery
When Orpheus launched, we had managed to secure an old backup from the previous site. This was used through a program called Recovery, to kickstart the member base and it allowed people to pick up some of the releases they had made previously.
Seventeen months later, it is time to bring the program to a close. People who were on the previous site should have heard about us by now. Therefore the decision has been taken to close the Recovery program at the end of the month (2020-03-31 23:59:59 UTC).
We will continue to help out the considerable amount of people who applied for recovery, but made a mistake in the process (for example, by not entering the same email as with their initial registration).
Gmail
Be aware that, if you invite someone, at this point in time Gmail is not delivering any emails from Orpheus. Please instruct your invitee to use a different provider such as Protonmail instead. If this does happen, they will have to join #disabled on IRC.
Security update
We have implemented a rate-limiting measure that will limit the amount of .torrent files you are able to download, should certain conditions be met. This should not affect legitimate users, but should limit the ability of a malicious actor grabbing everything.
Many people may be aware of a group named The-Eye, who are on a crusade to render private trackers irrelevant by lifting all the content through a technique called ‘Ghost leeching’ and making the data available on their own platform for a modest fee.
Their modus operandi consisted of iterating over all IDs and downloading the .torrent files. These would be loaded into their custom client which would connect to the swarm and leech the contents without reporting anything to the tracker.
Up until now, in Gazelle, this was possible because there is no built-in code to prevent this type of crawling. The code will be open-sourced, like everything else we have written and we hope that it will allow other Gazelle-based trackers to adopt the fix.
How does it work?
Gazelle makes a distinction between files that are downloaded and whether that file has been loaded into a client and snatched. We use this differentiation to determine a “Snatch Factor”.
An example: If you download many files but snatch very few, eventually the balance becomes very lopsided. For example, 60 files downloaded and only 5 of them snatched will result in a Snatch Factor of 12.
Every user class (User, Member, Power User, …) has an allowed class factor, which becomes more lenient as you level up. If your own Snatch Factor is higher than the class factor, you move into “Overshoot mode”.
In “Overshoot mode”, you can download a limited number of additional torrent files per 24 hour window. If you download more than this then you will begin to receive a “429 Too Many Requests” rejection. This means you will need to wait for a while or ensure that the torrent files you have already downloaded, have been snatched completely (100%, no partial leeches).
The allowed number in “Overshoot mode” increases as you move up user class levels.
TL;DR
The new rate-limiting measure should not affect legitimate users. Torrents uploaded yourself are not taken into account and may be downloaded as often as needed.
With ❤️ ,
Orpheus
#privateTR
The COVID-19 / Equinox Update
Recovery
When Orpheus launched, we had managed to secure an old backup from the previous site. This was used through a program called Recovery, to kickstart the member base and it allowed people to pick up some of the releases they had made previously.
Seventeen months later, it is time to bring the program to a close. People who were on the previous site should have heard about us by now. Therefore the decision has been taken to close the Recovery program at the end of the month (2020-03-31 23:59:59 UTC).
We will continue to help out the considerable amount of people who applied for recovery, but made a mistake in the process (for example, by not entering the same email as with their initial registration).
Gmail
Be aware that, if you invite someone, at this point in time Gmail is not delivering any emails from Orpheus. Please instruct your invitee to use a different provider such as Protonmail instead. If this does happen, they will have to join #disabled on IRC.
Security update
We have implemented a rate-limiting measure that will limit the amount of .torrent files you are able to download, should certain conditions be met. This should not affect legitimate users, but should limit the ability of a malicious actor grabbing everything.
Many people may be aware of a group named The-Eye, who are on a crusade to render private trackers irrelevant by lifting all the content through a technique called ‘Ghost leeching’ and making the data available on their own platform for a modest fee.
Their modus operandi consisted of iterating over all IDs and downloading the .torrent files. These would be loaded into their custom client which would connect to the swarm and leech the contents without reporting anything to the tracker.
Up until now, in Gazelle, this was possible because there is no built-in code to prevent this type of crawling. The code will be open-sourced, like everything else we have written and we hope that it will allow other Gazelle-based trackers to adopt the fix.
How does it work?
Gazelle makes a distinction between files that are downloaded and whether that file has been loaded into a client and snatched. We use this differentiation to determine a “Snatch Factor”.
An example: If you download many files but snatch very few, eventually the balance becomes very lopsided. For example, 60 files downloaded and only 5 of them snatched will result in a Snatch Factor of 12.
Every user class (User, Member, Power User, …) has an allowed class factor, which becomes more lenient as you level up. If your own Snatch Factor is higher than the class factor, you move into “Overshoot mode”.
In “Overshoot mode”, you can download a limited number of additional torrent files per 24 hour window. If you download more than this then you will begin to receive a “429 Too Many Requests” rejection. This means you will need to wait for a while or ensure that the torrent files you have already downloaded, have been snatched completely (100%, no partial leeches).
The allowed number in “Overshoot mode” increases as you move up user class levels.
TL;DR
The new rate-limiting measure should not affect legitimate users. Torrents uploaded yourself are not taken into account and may be downloaded as often as needed.
With ❤️ ,
Orpheus
#privateTR