33
submitted 15 hours ago by xnx@slrpnk.net to c/piracy@lemmy.dbzer0.com

Found out v2 has been out for more than 4 years but I’ve never seen it used

you are viewing a single comment's thread
view the rest of the comments
[-] cecilkorik@lemmy.ca 14 points 13 hours ago

v2 doesn't realistically add anything important for functionality. sha256 is nice to have, but the chances of an actual attack on a sha1 chunk are still bafflingly remote. sha1 might be technically broken but in order to actually attack a sha1 torrent you need to generate a collision that is not only the same sha1 (which is still extremely rare and hard, only the fact that it's proven possible at all makes it "broken") but also within the same expected length of the torrent, otherwise any decent client should reject it for being too long, and they must reject it because otherwise they would be vulnerable to a denial-of-service attack from any bad actor who sends infinite length chunks and copyright trolls would be having a field day. I'm not a security expert but I write enough software to be fairly confident that I'm not wildly off base. In the event that somebody comes up with an actual realistic sha1 attack on bittorrent probably because of some weak/stupid client, and proves me wrong, attitudes might change quickly but I also suspect it will quickly be patched or vulnerable clients banned. If it's pretty widespread I'm sure it will light a fire to migrate to sha256 but the actual risk remains, as far as I can tell, infinitesimal.

Until then, the v2 protocol doesn't add anything except compatibility headaches for private trackers. I'm sure they'll get to it eventually, but there's no urgency and there's not going to be unless there's a viable attack to drive that urgency. Latest version for latest version's sake comes with its own set of risks.

[-] ReversalHatchery@beehaw.org 19 points 12 hours ago

that's not the only feature of v2. it also hels a lot with swarm merging (which with v1 only biglybt implemented), and it has updatable torrents. it also stores torrent information more efficiently and the incoming pidces can be verified immediately. afaik today torrent clients don't verify downloaded torrents by default. qbittorent has an option, default off, to verify after a torrent completed. this is slow because everything needs to be read again from disk. I'm not totally sure about this, but I think a malicious peer could be sending crafted pieces that contain something else and you wouldn't know it.

https://torrentfreak.com/libtorrent-adds-support-for-bittorrent-v2-a-potential-game-changer-200912/

[-] jbone@lemmy.dbzer0.com 1 points 3 hours ago

and it has updatable torrents

Did not know that. This would be a very a useful feature.

this post was submitted on 14 May 2025
33 points (97.1% liked)

Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ

61080 readers
670 users here now

⚓ Dedicated to the discussion of digital piracy, including ethical problems and legal advancements.

Rules • Full Version

1. Posts must be related to the discussion of digital piracy

2. Don't request invites, trade, sell, or self-promote

3. Don't request or link to specific pirated titles, including DMs

4. Don't submit low-quality posts, be entitled, or harass others



Loot, Pillage, & Plunder

📜 c/Piracy Wiki (Community Edition):

🏴‍☠️ Other communities

FUCK ADOBE!

Torrenting/P2P:

Gaming:


💰 Please help cover server costs.

Ko-Fi Liberapay
Ko-fi Liberapay

founded 2 years ago
MODERATORS