Child porn distribution via mystnodes confirmed when b2p vpn is enabled

VPN
21

I agree this is a side effect I also experienced, but…couple things worth mentioning:

  • It scrambles your own traffic making your own traffic more private and being harder to link from your own traffic (better privacy).

  • In my case, my public IP rotates after 1 or 2 months…so no issue with being marked as a commercial VPN IP. Usually this is the case for everyone.

So in other words, aside from popping ads from Asia or other languages I don’t speak (due to my connections coming from there) I don’t see much downside.

22

Case is not closed yet. Each illegal post is leading to one NCMEC CyberTipline report where the exact timestamp of the post is logged. If they match those timestamps with the connection protocol from mystnode then we have the final confirmation.

I’m sure they will do that with multiple confiscated mystnodes from different node runners.

What I can say is that the dashboard at my.mystnodes.com displays 0 Myst Income for Public and VPN for the past months because those modes were disabled.

23

This is legit, atleast for public node runners

24

these are extremely serious allegations!

25

That means, my myst node is using my local DNS server for queries?

26

Yea u def don’t run that

27

I will be messaging you in 1 month on 2024-10-08 05:46:02 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

^(Parent commenter can ) ^(delete this message to hide from others.)

^(Info) ^(Custom) ^(Your Reminders) ^(Feedback)
28

Now what happens if the user is your node connects to TOR through your node. Tracking people on TOR is quite possible these days, especially because the CIA and NSA run so many of the nodes.

That all goes back to your IP. I didn’t think they could convict you but sure as hell seize your equipment for an indeterminate amount of time to forensically search them.

29

Uninstall it, don’t use it, don’t spread it.
I’ve received DMCA notice from my ISP somebody downloaded torrent on in, threatening to shut down my internet. Not worth it.

30

The police raiding your house is a potential downside.

31

Your nodes will use whatever your server is set to use, or if it’s running on your local system, it’ll use your local system’s default DNS. In almost all cases, this will be your router unless you have specifically changed it, and it will use whatever your ISP says to use. You would need to update your resolv.conf or your local NIC’s DNS server to manually enter the DNS server you’d like to use. Setting up pi-hole locally isn’t too hard, and there are plenty of managed lists on Github that you can subscribe to. There are also plenty of DNS service providers, free and paid, you could also use.

AdGuard has an extensive list with explanations of DNS servers that are public/free that you can use: https://adguard-dns.io/kb/general/dns-providers/

My current setup is to deploy all of my Myst nodes (100) via Docker containers. I run a custom setup.sh after each is launched, which fixes a few missing firewall commands, as well as adding some very basic torrent blocking for n00bs that don’t know how to encrypt their connections, and it updates the resolve.conf for each to use pi-hole. I also set the host to use the local pi-hole server to ensure no DNS leaks. Pi-hole is configured with around 14 block lists, which range from blocking torrent trackers, torrent listing/search sites, and anything deemed illegal, questionable, drug-related, hate-related, etc. You can go as far as blocking ads, porn, basically whatever you want. I could care less about anything other than what is illegal or leads to illegal activity. I use Quad9’s DNS-over-HTTPS servers for all of my DNS servers for my local home lab, ensuring that all of my DNS queries are encrypted. Yes, even for pi-hole.

Plus, at least for me, they have a faster response time than Google and Cloudflare.

A little proof:
I received my first payment from my first node in Nov 2021. In early 2022, I received two warnings from my ISP about illegal torrenting from a single node, which is when I implemented everything above. Since then, I have deployed a few more… and I haven’t had a single report sent to my ISP or law enforcement breaking down my door. That’s not to say it can’t happen; I’m just not concerned.

I use almost all of the blocklists from the blocklistproject, which I’m sure includes many of the domains for CSAM. The one from Gardenfence I found recently is not extensive, but it’s the only one I can find that includes explicitly CSAM blocking. Since most law enforcement won’t release those lists, for good reason, it’s hard to get access to a dedicated CSAM list.

Please let me know if anyone knows of any other RBLs I could add.

https://github.com/blocklistproject/Lists

I also include this one:

https://github.com/gardenfence/blocklist

I hope this is helpful; please don’t hesitate to let me know if you have any other questions.

EDIT:

I forgot to include this one.

https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/doh-vpn-proxy-bypass.txt

Important Note: Using Quad9’s DNS-over-HTTPS is not the only thing you should do. It helps, but the endpoint, a website where things might get posted, knows the IP that requested it, which in this case would be your node’s IP. So, while it will keep your ISP and any other provider from snooping, the endpoints still show the IPs being used. This is why you still want to add block lists, to keep bad actors from accessing websites where they could post or disseminate anything illegal. It’s also why you want to run your own dedicated DNS server just for this, so you can, as an endpoint, track IPs in case five-o ever comes knocking.

32

I will be messaging you in 1 month on 2024-11-08 08:36:31 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

^(Parent commenter can ) ^(delete this message to hide from others.)

^(Info) ^(Custom) ^(Your Reminders) ^(Feedback)
33

So I took my 3 myst nodes offline, 2 with home IP’s and 1 with mobile data. I hope the police will not show up here (Germany). Netflix seems to work again after removing my IP from spamhaus list.

34

Oh this is a good one. Yea I’m running pfblocker on my pfsense with an extensive list of block lists. This should already filter most of the bad stuff. I’m already using non logging DoT DNS servers which on the other side do not block any DNS entries. So blocklists are a must.

Did not take torrenting into account yet. So thanks for your write up, I will take a look into it and adapt it for my use case, especially torrents. Luckily I did not get any letter about torrenting (yet), so it’s not too late.

But… What if the clients from Myst use their own dns on their side?

35

No worries.

I’d recommend running a dedicated DNS server so you can monitor the blocks, the RBLs, etc… You are the end-point, so you can access the data in case anything happens.

Let me know if you have any other questions, happy to help.

36

I didn’t answer your last question.

The user’s DNS doesn’t matter here. When they connect to a Myst node, they are using that as their DNS. That means queries will use the Myst node over their local DNS defaults. Otherwise, that defeats the purpose of a VPN.