February 2022 - anti-censorship-team

Microsoft announces shutting down domain fronting attempts in Azure
by Cecylia Bocovich 18 Nov '24

18 Nov '24

It looks like Azure is going to shutdown domain fronting: https://www.microsoft.com/security/blog/2021/03/26/securing-our-approach-to… There isn't a time frame listed in the article, and I haven't gotten any notifications through my Azure account yet. Cecylia

7 9

Rust port of extor-static-cookie
by David Fifield 01 Mar '22

01 Mar '22

As an experiment to wring more performance from the snowflake bridge, I started a rough port of the extor-static-cookie shim to Rust. It's not in what I would call a production-ready state with regard to documentation and tests—I wanted to hack something together quickly in order to decide whether it's worth spending more time on. I am also pretty new to Rust async programming. As a side consideration, I wanted to get an idea of what a pluggable transports library for Rust might look like. https://gitlab.torproject.org/dcf/extor-static-cookie/-/tree/rust Currently commit 559fb5e292b45d82464bdaf978c6e1783c796e3d I have the Rust implementation running now (since 2022-02-27 03:00) under the flakey4 instance. The other three instances are running the Go implementation. It's too early to say whether it reduces CPU usage; an hour after being restarted, the flakey4 instance is still catching up to the traffic of the other instances. But it looks like it's stable and functional, at least.

2 2

bridgedb+rdsys test setup
by meskio 28 Feb '22

28 Feb '22

For the last few months I've being working on integrating rdsys with bridgedb, so bridges are managed by rdsys and bridgedb only does the distribution (https, moat and email)[0]. There will not be any visible changes, but all the insides are different. Thanks to the TPA work now we have a testing setup of the new setup to test it. If you want to test it I'll be happy to hear if you find any issues with it. As this is distributing real bridges only people with accounts in TPO LDAP has access to it. How to access the different distributors: * email. Just write an email to bridges-test(a)torproject.org from your @torproject.org email, and should get a reply with bridges. * https. The web interface is available at https://bridges-test.torproject.org, but only reachable from people.torproject.org. You can make a ssh proxy: $ ssh -D 9999 people.torproject.org and configure your browser to use a SOCKS proxy at localhost with port 9999. * moat. This is reachable the same way that https only from people.torproject.org. Is a bit more complicated to test, but I will stress test it myself :) I wrote I simple script to do the moat captcha request and solution: https://gitlab.torproject.org/-/snippets/127 It's run like: $ MOAT_URL="https://bridges-test.torproject.org/moat" CURL_OPTIONS="--socks5 localhost:9999" ./test-moat Thank you. [0] https://gitlab.torproject.org/tpo/anti-censorship/rdsys/-/issues/12 -- meskio | https://meskio.net/ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- My contact info: https://meskio.net/crypto.txt -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Nos vamos a Croatan.

2 5

Surge in Snowflake client polls
by Cecylia Bocovich 28 Feb '22

28 Feb '22

While looking at the snowflake broker metrics for clues about the sudden drops in known proxy NAT types[0], I noticed that the broker metrics show a very large spike in client polls over the last day. I've attached a few graphs that show this, which probably won't have showed up in tor relay metrics yet. One of the graphs is the usage of proxy capacity, which shows a rise in the number of client polls and a large drop in idle proxies. The other graph shows something similar, but for the pool of proxies available to clients with restrictive NATs. Here we see that the overwhelming majority of clients are being denied because all of the proxies are used. To some extent, we expect this and have seen it in the past, particularly for the pool of proxies for clients with restrictive NATs. The pattern follows a natural day-long period, and the number of denied clients never gets so high that a client won't get a proxy after 2-3 tries. However, these attached graphs go back 48 hours and show how much bigger the spike in clients is over the last day. At the peak of the spike, there were 5x as many clients requesting snowflake proxies from the restrictive pool as we had proxies to match. Perhaps this is a good time to push to get more proxies? It seems we could use proxies for both restrictive and unrestrictive NATs at this point. Cecylia [0] https://lists.torproject.org/pipermail/anti-censorship-alerts/2022-February…

1 1

Snowflake bridge outage, 2022-02-18
by David Fifield 24 Feb '22

24 Feb '22

On 2022-02-18 the Snowflake bridge was offline between about 14:02:05 and 15:26:38. I was alerted to the outage by Shelikhoo. The cause of the outage is unknown. There had been some kind of kernel crash (see first attached file for what was visible on the console), which required me to restart the VPS externally. After I restarted it, everything came back as normal. I asked Greenhost support if they knew of anything that might have happened in the data center to cause the problem, and they did not. I asked about using a management API to automatically restart the server if it happens again, but they did not have specific guidance on that. Resource graphs show that the CPU was still active during the outage, but the network usage was quiet.

1 0

Mac app / Safari extension for Snowflake
by David Fifield 22 Feb '22

22 Feb '22

Browsing through some search results, I found: https://apps.apple.com/us/app/torproject-snowflake/id1597501940 (https://web.archive.org/web/20220222083316/https://apps.apple.com/us/app/to…) https://github.com/jayluxferro/snowflake It looks like a repackaging of the Snowflake JavaScript proxy code for Mac and Safari environments. Maybe we could get in touch with the developer and find a way to adopt it into the main repository?

2 1

Snowflake bridge VPS cost estimates
by David Fifield 17 Feb '22

17 Feb '22

I haven't yet got a lead on finding a stronger server for the Snowflake bridge. I did some rough estimates: the cost of a VPS for what we need is about $250/month, and bandwidth will probably be about another $1000/month. The minimum hardware specs that would make moving the server worthwhile is 16 CPUs and 32 GB RAM. To get an idea of the range of pricing: * Linode 32 GB: $240/month https://www.linode.com/pricing/#compute-dedicated https://web.archive.org/web/20220207055603/https://www.linode.com/pricing/#… * Azure F16s v2: $292/month (1 year reserved) https://azure.microsoft.com/en-us/pricing/details/virtual-machines/linux/ https://web.archive.org/web/20220215193358/https://azure.microsoft.com/en-u… * Hetzner CCX42: €166/month = $189/month https://www.hetzner.com/cloud https://web.archive.org/web/20220214145505/https://www.hetzner.com/cloud The estimate of $1000/month for bandwidth comes from a typical cost of $0.01/GB = $10/TB, and the fact that during the 6 days the staging bridge was active, it averaged about 2.9 TB/day sent (and was rising). https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow…

2 2