On Thu, Jan 15, 2015 at 04:25:10PM +0100, Philipp Winter wrote:
2014-01-30: A clearly related group of relays comes online, presumably the one from the pulled Blackhat talk. (A) 2014-11-17: Several probably related relays in the Google cloud get online. (B) 2014-12-26: Many relays named LizardNSA and FuslVZTOR come online. (C) 2014-12-30: Many relays named anonpoke come online. (D)
The visualizer program only works on archived microdescriptors, which only go back through 2014. But I ran it on all of 2014 and you can see the four incidents above.
The stripes in the background are months.
https://people.torproject.org/~dcf/graphs/microdescs/microdescs-2014.png (8760×62986 pixels) https://people.torproject.org/~dcf/graphs/microdescs/microdescs-2014-short.p... (8760×2048 pixels)
(Wow, who knew there were over 60000 distinct descriptors in 2014?)
Maybe the checker should also check for when a lot of relays go away at once. It looks that happened in mid-April, where relays that had been started at different times in the beginning of the year all stopped at once.
(Oh, on further reflection, that must have been Heartbleed!)
David Fifield
