<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD><META http-equiv=Content-Type content="text/html; charset=utf-8"><META content="INBOX.COM" name=GENERATOR></HEAD>
<BODY>
Such a clear explanation would be good to see on torproject.org.<br><div> </div><br><br><blockquote style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px"><div class="msgHeaders">-----Original Message-----<br><b>From:</b> nusenu-lists@riseup.net<br><b>Sent:</b> Sat, 04 Jan 2020 11:44:00 +0000<br><b>To:</b> tor-relays@lists.torproject.org<br><b>Subject:</b> Re: [tor-relays] Exit Concentration vs Bulk filters?<br><br></div><div class="oldBody">> I never heard a real technical reason to avoid<br>> high concentration of Tor exit capacity. <br><br>Let me give you a few examples why a distributed network is in some ways<br>more resilient to attacks and harder to observe than a centralized.<br><br>Observability<br><br>If all traffic leaves the tor network at a single or very few places, surveillance becomes a lot easier and cheaper<br>when compared to a network that is distributed and has many exit locations.<br><br>Resiliency against outages<br><br>If all capacity is concentrated around just a few locations, local issues/outages have a bigger impact<br>on the overall availability and capacity of the network.<br><br>Resiliency against software vulnerabilities<br><br>A single operator tends to setup their systems in a relatively similar manner.<br>Most of its relays will use the same OS, OS version, SSL library, tor version, hardware architecture<br>and have a similar good or bad patch level.<br>In such an environment it is more likely that a single vulnerability affects large portions when compared<br>to a diverse ecosystem. A homogeneous ecosystem also reduces the cost for exploit development.<br><br>Resiliency against security breaches<br><br>If an hypothetical operator controlling 1/2 of the network gets compromised the impact is a lot bigger than<br>if they were to run 1%. The incentive for an attacker to compromise an operator running 50%<br>of the network is also a lot higher than attacking an operator of 1%.<br><br>Risk of detection<br>The risk of detection is likely higher for an attacker that compromises multiple organizations compared to a single<br>victim.<br><br>Cost of attacks<br>Compromising all relays operated by a single entity is likely cheaper than compromising all relays<br>run by multiple independent organizations.<br><br>Performing a hijacking attack against a single prefix is probably easier than successfully hijacking multiple independent<br>prefixes with different upstream providers concurrently and harder to remain undetected.<br><br>A DDoS attack against a single AS is likely cheaper than against many targets at the same time.<br><br><br>There are also non-technical (organizational and legal) reasons why having a distributed <br>network capacity is beneficial to the tor network.<br><br>Legally attacking many organizations is more expensive than a single one.<br>If a single operator no longer has the financial capacity or motivation the removal of their relays should not<br>have a existential impact on the network.<br>If the policy of a hoster changes from 'tor relays allowed' to 'tor relays forbidden'<br>than we better not run all our capacity at a single hoster.<br><br><br>In short, you don't want to make the tor network depend on 1-2 or 10 but many.<br>So if a few operators disappear the network remains functional and available<br>and is generally harder to attack.<br><br>kind regards,<br>nusenu<br><br>-- <br><a href="https://mastodon.social/@nusenu">https://mastodon.social/@nusenu</a><br><a href="https://twitter.com/nusenu">https://twitter.com/nusenu</a><br><br><br><br><br><br><br></div></blockquote>
</BODY>
</HTML>