this post was submitted on 28 Aug 2023
730 points (98.7% liked)

Selfhosted

40183 readers
1089 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
HybridSarcasm@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
730
I just developed and published a script to clear your pict-rs object storage from potential CSAM. (github.com)
submitted 1 year ago* (last edited 1 year ago) by db0@lemmy.dbzer0.com to c/selfhosted@lemmy.world
104 comments fedilink hide all child comments
 

I noticed a bit of panic around here lately and as I have had to continuously fight against pedos for the past year, I have developed tools to help me detect and prevent this content.

As luck would have it, we recently published one of our anti-csam checker tool as a python library that anyone can use. So I thought I could use this to help lemmy admins feel a bit more safe.

The tool can either go through all your images via your object storage and delete all CSAM, or it canrun continuously and scan and delete all new images as well. Suggested option is to run it using --all once, and then run it as a daemon and leave it running.

Better options would be to be able to retrieve exact images uploaded via lemmy/pict-rs api but we're not there quite yet.

Let me know if you have any issue or improvements.

EDIT: Just to clarify, you should run this on your desktop PC with a GPU, not on your lemmy server!

you are viewing a single comment's thread
view the rest of the comments
[–] snowe@programming.dev 95 points 1 year ago (25 children)

Hey @db0@lemmy.dbzer0.com, just so you know, this tool is most likely very illegal to use in the USA. Something that your users should be aware of. I don't really have the energy to go into it now, but I'll post what I told my users in the programming.dev discord:

that is almost definitely against the law in the USA. From what I've read, you have to follow very specific procedures to report CSAM as well as retain the evidence (yes, you actually have to keep the pictures), until the NCMEC tells you you should destroy the data. I've begun the process to sign up programming.dev (yes you actually have to register with the government as an ICS/ESP) and receive a login for reports.

If you operate a website, and knowingly destroy the evidence without reporting it, you can be jailed. It's quite strange, and it's quite a burden on websites. Funnily enough, if you completely ignore your website, so much so that you don't know that you're hosting CSAM then you are completely protected and have no obligation to report (in the USA at least)

Also, that script is likely to get you even more into trouble because you are knowingly transmitting CSAM to 'other systems', like dbzer0's aihorde cluster. that's pretty dang bad...

here are some sources:

[–] db0@lemmy.dbzer0.com 52 points 1 year ago* (last edited 1 year ago) (19 children)

Note that the script I posted is not transmitting the images to the AI Horde.

Also keep in mind this tool is fully automated and catches a lot of false positives (due to the nature of the scan, it couldn't be otherwise). So one could argue it's a generic filtering operation, not an explicit knowledge of CSAM hosting. But IANAL of course.

This is unlike cloudflare or other services which compare with known CSAM.

EDIT: That is to mean, if you use this tool to forward these images to the govt, they are going to come after you for spamming them with garbage

[–] snowe@programming.dev 27 points 1 year ago* (last edited 1 year ago) (18 children)

Cloudflare still has false positives, the NCMEC does not care if they get false positives. If you read some of those links I provided it wouldn't be considered a generic filtering operation, from how I'm reading it at least. I wouldn't take the chance, especially not with running the software on your own hardware in your own house, split from the server.

I think you're not in the US? So it's probably different for your jurisdiction. Just want to make it clear that in the US, from what i've read up on, this would be considered against the law. You are running software to filter for CSAM, so you are obligated to report it. Up to 1 year jail time for not doing so.

[–] csolisr@communities.azkware.net 17 points 1 year ago

Nothing that can't be fixed by adding a quarantine option instead of deleting the offending picture. Hopefully someone can upload a patch for that?

load more comments (17 replies)
load more comments (17 replies)
load more comments (22 replies)