June 2016 - tor-project - lists.torproject.org

Ethics Guidelines; crawling .onion
by Virgil Griffith 28 Jul '16

28 Jul '16

Hello all. I am preparing a longer response to the issues Isis et al mentioned. Most are interrelated, but this one is not. And I wanted to get clarification on it. Isis expressed a concern about making a list of bitcoin addresses from .onion, citing, "Consent is not the absence of saying 'no' — it is explicitly saying 'yes'." For what it's worth, ahmia.fi actually supports regex searching right out of the box. In fact, a single line of JSON spits out all known bitcoin addresses ahmia knows about. For example, here's an anonymized list going .onion -> BTC which I mined from Ahmia, * http://virgil.gr/wp-content/uploads/2016/05/btc-on-dot-onion.html [6MB] And here's the same information going BTC -> .onion * http://virgil.gr/wp-content/uploads/2016/05/btc2domains.v2.txt [2mb] If you want to check the results you can ask Juha for the JSON query to do this. Lets go out on a limb and assume that regexs are okay. Is the issue then .onion search-engines? I understand Isis's preference for there to always be affirmative consent but does that mean that until such a standard exists all search engines from onion.link, ahmia.fi, MEMEX, NotEvil, and Grams are violating official Tor community policy? ---- Here's how I currently see this. I put on my amateur legal hat and say, "Well, the Internet/world-wide-web is considered a public space. Onion-sites are like the web, but with masked speakers." * https://www.hks.harvard.edu/m-rcbg/research/j.camp_acm.computer_internet.as… * http://aims.muohio.edu/2011/02/01/is-the-internet-a-public-space/ Ergo, I would argue that, by default, content on .onion is public the same way everything else on the web is. If you don't want to be "indexed", for physical spaces you go in-doors, or for the web you put up a login. As an aside, the web-standard is actually *kinder* than physical public spaces because on the web one can have an unobstrusive /robots.txt saying, "please don't index me". Which is a great thing. Whereas some would say Tor users are "anonymous", others would instead say any and everything Tor is "private". I believe this needs to be clarified. I once proposed to Roger that he delineate the sub-types of privacy in the same way Stallman delineated his "Four Freedoms". Roger replied that he preferred using the broad catch-all term "Privacy". These confusions may be a caveat of using a broad catch-all term. Interpreting broadly, Isis is correct. However, this conclusion has a lot of unpleasant ramifications. Comments appreciated, -V P.S. Mildly related, I saw this today involving DARPA, and Tor. http://thehackernews.com/2016/05/darpa-trace-hacker.html """ The aim of Enhanced Attribution program is to track personas continuously and create “algorithms for developing predictive behavioral profiles.” """ I hope you all are aware this flows directly from MEMEX. Right? This, and MEMEX, seems a much more appropriate target for outrage. A lot of this work that numerous community members have worked on gives even me pause.

5 22

meek-google suspension
by David Fifield 03 Jul '16

03 Jul '16

I managed to get some information on why meek-google got suspended on App Engine. There was a botnet that used Tor and the public meek instance for command communication. They shut it down for that reason. I still haven't gotten any kind of official communication from Google Cloud Platform. I wrote a guide on how people can set up their own personal instance. https://lists.torproject.org/pipermail/tor-talk/2016-June/041699.html I figure the botnet risk is far less this way, without a single central service to freeload off of. Though of course far fewer people will be able to follow these steps than were able to use a default configuration. Because I can't see just setting up a new account under the circumstances, I'm planning to ask the Tor Browser devs to remove the non-functional meek-google option.

4 3

Re: [tor-project] State of tshirts for volunteers running Tor relays
by Jon Selon 30 Jun '16

30 Jun '16

Hey all! Shari forwarded me the string of emails concerning the tor relay shirts. I would love to take this project on. We do have a small surplus of the relay shirts here at the Seattle office, so if someone could just point me in the right direction I will knock all this out. Where is this list of requests? Is this something I need to subscribe to? Let me know and I'll get this done. Any other information you could provide would also be greatly appreciated. Thanks, Jon

2 2

Monthly summary of various teams
by Nima Fatemi 30 Jun '16

30 Jun '16

With teams expanding in all different directions, it's getting harder and harder to catch up with what each team has been up to. Right now you'd have to sign up for all different mailing lists and show up for all different meetings to catch up with the work each team is doing... and then you wouldn't have any time to do any actual work. Would it make sense to have each team to send a summary of what they've been up to every month, to this list? or tor-reports? whichever that's more appropriate. Cheers, -- Nima 0X58C4B928A3E218F6 | @mrphs "I disapprove of what you say, but I will defend to the death your right to say it" --Evelyn Beatrice Hall

3 2

Summary of meek's costs, May 2016
by David Fifield 30 Jun '16

30 Jun '16

Here's the summary of meek's CDN fees for May 2016. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 February 2016 $986.39 + $977.85 + $445.83 = $2410.07 March 2016 $1079.49 + $865.06 + $534.71 = $2479.26 April 2016 $1169.23 + $1074.25 + $508.93 = $2752.41 May 2016 $525.46 + $1097.46 + $513.56 = $2136.48 -- total by CDN $13138.96 + $14661.22 + $3625.02 = $31425.20 grand total https://metrics.torproject.org/userstats-bridge-transport.html?graph=userst… As you can see, the number of users took a hit around May 13, dropping from ≈10,000 to ≈6,000. This was caused by the suspension of meek-google. You can read more about that here: https://lists.torproject.org/pipermail/tor-talk/2016-June/041699.html Reminder that if you configure your own CDN or App Engine account and point it at https://meek.bamsoftware.com/, you will be using a completely unlimited bridge, which will go faster and help save money. == App Engine a.k.a. meek-google == 3068 GB $368.17 3146 instance hours $157.29 https://atlas.torproject.org/#details/88F745840F47CE0C6A4FE61D827950B06F9E4… == Amazon a.k.a. meek-amazon == Asia Pacific (Singapore) 215M requests $258.16 651 GB $90.42 Asia Pacific (Sydney) 7M requests $9.66 54 GB $7.46 Asia Pacific (Tokyo) 1M requests $2.05 17 GB $2.28 EU (Ireland) 249M requests $299.58 1617 GB $127.67 South America (Sao Paulo) 15M requests $34.23 174 GB $40.95 US East (Northern Virginia) 126M requests $126.43 1249 GB $98.10 -- total 616M requests $730.11 3765 GB $366.88 charge for alarms $0.48 https://atlas.torproject.org/#details/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 5262 GB $457.76 Zone 2 404 GB $ 55.80 -- total 5666 GB $513.56 https://atlas.torproject.org/#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

1 0

Unrecommended old 0.2.4.x and 0.2.5.x versions
by Roger Dingledine 30 Jun '16

30 Jun '16

Hi Peter, Sebastian, I just removed "0.2.4.23,0.2.4.24,0.2.4.25,0.2.5.8-rc,0.2.5.9-rc,0.2.5.10" from the set of Tor versions that moria1 recommends as acceptable. That's mainly because these are versions from before we added longclaw as a directory authority, so especially with dannenberg's rotated key (as of 0.2.8.1-alpha), those versions will have a tougher time believing today's consensus. According to https://packages.debian.org/search?keywords=tor there aren't any supported Debian packages that want to use those versions. I did not check Ubuntu or others. You should consider making this change too. :) Thanks, --Roger

2 1

Re: [tor-project] Globe is now retired (was: Plan to retire Globe)
by jah 30 Jun '16

30 Jun '16

Hi, Just a reminder that globe is listed as a currently available Onionoo client at https://onionoo.torproject.org/ . jah

2 1

Exit probability
by David Goulet 29 Jun '16

29 Jun '16

Hello everyone! A bit of context. Since November 2015, I've setup a Munin server that graphs some Tor network monitoring. You can have a look here: http://ygzf7uqcusp4ayjs.onion/tor-health/tor-health/index.html This email is about one of those graphs which is the Exit probability in the world. The graph has it per-continent. Here is a link to a graph with the full data since the start of my monitoring: http://ygzf7uqcusp4ayjs.onion/static/dynazoom.html?cgiurl_graph=/munin-cgi/… (Fun fact, the "Unknown" one is the IPpredator relay in "Liberia" ;) https://atlas.torproject.org/#details/BC630CBBB518BE7E9F4E09712AB0269E9DC7D… As you can see, Europe has been very dominant but lately it has grown from ~80% to 85% in the last month. While North America is going down from ~15% to 10%. I could do the exercise of graphing the top 10 countries in Europe that we exit but I _bet_ we'll end up with mostly 3 countries, Germany, France and Netherlands. (I might do this experiment actually.) To be honest, this is something that concerns me because this trend is going up for running Exits in Europe. Maybe it's because of attack on Exit relays in US? Maybe Snowden effect of USA == bad? Maybe hosting providers are too expensive in the North America? Maybe tor-servers/nos-oignons are too effective :)? I honestly don't know but that's not healthy in the long run. Of course having more in Africa and South America for starters would be amazing but that's another fight I feel like. Could we think of some outreach we could do maybe a blog post about the importance of location diversity in Exits? That running relays in the US is actually OK? or maybe just the fact that people have to stop using OVH (well OVH has a data center now in Montreal so NA!) or Hetzner or Linode? Or since Europe as a lot of countries thus multiple jurisdictions it's fine to have 85%? (is it really true with EU laws?) There. Thoughts? Cheers! David

3 2

Plan to retire Globe
by Karsten Loesing 29 Jun '16

29 Jun '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello everyone, as the subject says, I suggest that we retire Globe (currently available at https://globe.torproject.org/) The main reason is that Globe is serving a similar purpose as Atlas (available at https://atlas.torproject.org/) which it was forked from several years ago. Neither Atlas nor Globe are actively developed, they only receive critical bug fixes whenever necessary. And thanks, Philipp and Isis, for doing that! So, when deciding which of the two services we should keep, I looked at the number of daily requests to both services, which shows that Globe is used a lot less than Atlas: https://people.torproject.org/~karsten/volatile/atlas-globe-2016-04-01.png The hope is that retiring Globe could make it more likely that new developers start contributing to Atlas. It would also make it easier for us to add new feature to Atlas, because we wouldn't feel bad for not adding them to Globe, too. In any case, we're getting rid of yet one more thing. Here's a suggested timeline for retiring Globe: - By April 30, we create Trac tickets for all features we like in Globe and that are missing in Atlas. These tickets would go in component "Metrics/Atlas" in Trac. If you want to keep something in Atlas that you like in Globe, this is your chance to make that happen! - By May 15, we'll have reviewed those new tickets and decided which of them we should implement before shutting down Globe. We might send a call for help to tor-dev@ to write these patches. - By May 31 (hopefully), we'll have implemented, reviewed, merged, and deployed the missing features in Atlas, and we'll shut down Globe. We should probably add a static web page pointing to Atlas. If it takes longer than this, it takes longer, but let's use this date for now. Maybe nobody will be missing anything from Globe. We'll see. Suggestions welcome, not only if you strongly object! All the best, Karsten -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXG5afAAoJEC3ESO/4X7XBj/8H/25hssQXL5QuqVbzngTSJ8AF BchTx9l9lAclddyeaug74obAW01+ljO4PZhEZGr12FrTKtlot3PWlQTykkeqCuKh kbVDHgO4U90qSSsVX2aOB9UVlAfvNpk93c5RqdQVwa/1jx6MaMdUM3OFopm9m8ji ceJqizYBrKfL8sI4ksdz84f9u+fwClI2+2H1RMs5PhFG4gIZ/F/ZzVMbkh2ruITC gNl3tWwj46I1CicPQQfYEtaKsA2VckRNo+8N1pfpSKsHBAP6hdGbKQvTkTxRSsrO MFu+kMaF0wkaT58o2IF2FhrQdnq7rns/zAoG+L2ym+7qqEbuaqb/m3wq1jnNp1I= =NDEg -----END PGP SIGNATURE-----

8 17

List moderation or subscriber trimming on tor-talk@
by Griffin Boyce 27 Jun '16

27 Jun '16

tor-talk@ has always been fairly off-topic and subject to overflow from the cypherpunks list, but lately it seems like an endless barrage of filter-evading nonsense. I'm filtering my inbox, but it doesn't seem to help much. I filtered for subject & body content, then people omitted specific names. I filtered out specific senders, then people made new accounts. There seem to be less than ten people who never seem to be on-topic or moving any conversation forward. And indeed, many of these people are behaving the same way on other lists as well. Long-term, these people have been causing exponentially more distraction than any benefit their (rare) good points have made. While it's relatively easy for me to ignore, nearly 300 emails in two weeks would be hard to ignore for anyone who's just now subscribing to the list. And those 288 messages are filled to the brim with the most base tinfoil-hattery. So with all that said, I would like to broach the subject of moderating tor-talk, or perhaps removing those few subscribers who always seem to be off-topic. Understandably, this is a controversial topic, but I think it's critical to bring the list back to its normal functions. best, Griffin -- There are 10 kinds of people in the world: those who understand binary, those who don't, and people who didn't expect a base 3 joke.

6 23