February 2016 - tor-relays - lists.torproject.org

Please enable IPv6 on your relay!
by Moritz Bartl 28 Jan '17

28 Jan '17

Hi! We still have a depressingly low number of relays that support IPv6 (currently only ~120 of ~1900 relays). If your host supports IPv6, please enable it, especially if you run an exit! This has to be done explicitly. https://trac.torproject.org/projects/tor/wiki/doc/IPv6RelayHowto In short, you add: ORPort [IPv6::address]:port IPv6Exit 1 ExitPolicy reject6 *:* (or a more open exit policy respectively) Thanks! -- Moritz Bartl https://www.torservers.net/

30 42

Netflix overblocking non-exit Tor relays
by Gero Kuehn 16 Dec '16

16 Dec '16

tl;dr: Even paying customers sharing IPs with non-exit Tor relays are now blocked from accessing Netflix Hello everyone ! After two very fruitless attempts to get the issue silently resolved through proper Netflix support channels, the time has come to make this public. As some of you have probably already read in the news, Netflix recently announced a crackdown on what they call "VPN Pirates" and what I call "paying customers using the same benefits of globalization that global companies like Netflix (ab)use for their taxes". They have now obviously changed their strategy regarding the Tor network. I am operating (among others) a middle-relay on a German residential fixed-ip VDSL-50 line (dc6jgk1/486740353B905AA4731F82C0B4CC25821A62C6E3) behind a NAT. Until 2 days ago, none of the devices sharing the same external IP address had any problem connecting to Netflix and there never was a Tor exit relay on that IP as far as I can tell. It is also obviously not possible for users of the Tor network to connect to Netflix through middle relays. As a consequence they should not be classifying such IP addresses as VPNs/Proxies and they should not be blocking them. This has been escalated and explained twice to "technical supervisors" in their callcenters. They did however not leave the impression that they a) care or b) intend to fix this at some point by parsing the Tor network information properly instead of using whatever cheap&wrong hack they use now. The official response from Netflix is that you now need to make a choice between operating that Tor relay (of any type) and the ability to watch Netflix. They also strictly refuse to refund any remaining credit in the customer account. My personal choice with regards to that blackmailing is as clear my next steps (conditional cancellation, 14 day deadline for refund and a legal challenge of their German AGB with regards to this issue). I am allergic to being blackmailed like that and being called a pirate by a service I legitimately paid for. For those of you who just would like to contribute to the Tor network without having trouble like that, please do not let this nonsense stop you. A more diversified Tor network is a more healthy network and I would really like to see more normal users operating tor relays operating in as many different locations as possible - including DSL lines "that are there anyways". If you do not want to be put into a position where you have to choose between your contribution to the network and some legal and paid-for entertainment, you might want to operate only a bridge until the issue has been resolved. If you already have the same problem, make it as expensive for Netflix as possible and spread the word about why this block (and geoblocking in general) is wrong. Thanks ! Kind regards, Gero / dc6jgk

14 21

Opt-In Trial: Fallback Directory Mirrors
by Nick Mathewson 21 Jun '16

21 Jun '16

TL;DR: Stable non-exit relays can help tor clients use the Tor network. Please opt-in! We want to run a trial of fallback directory mirrors (fallbacks) in Tor. Tor clients contact fallbacks to download the consensus during initial bootstrap, before they contact the directory authorities. Fallbacks allow Tor to bootstrap in networks that block the Tor directory authorities. This allows people to use Tor without manually configuring bridges or pluggable transports. For more information about fallbacks, see: https://trac.torproject.org/projects/tor/wiki/doc/FallbackDirectoryMirrors For this trial, we want to find around 100 stable non-exit relays, as exits currently experience high load. We want relays that expect to be stable for the next 2 years, with: good uptime, the same IP address(es) and port, the same relay identity key, good bandwidth and network connectivity. In December 2015, we created a list of ~400 candidate fallbacks. https://trac.torproject.org/projects/tor/attachment/ticket/15775/fallback_d… If your relay is on this list, and you expect it to be on the same IP address(es) and port for at least 2 years, please consider opting-in for this trial. (Relays that aren't on the list are welcome to opt-in. They will be considered in future releases, or if the selection criteria change.) For the initial fallback release, we will only add your relay if you opt in. Please reply on the tor-relays mailing list, if you are able. (Opt-ins, opt-outs, and fallbacks chosen for inclusion in tor, will be managed using lists in the publicly available tor git repository.) all best wishes, & thanks for running Tor!

19 29

Re: [tor-relays] Opt-In Trial: Fallback Directory Mirrors
by hwertiout695＠Safe-mail.net 15 Apr '16

15 Apr '16

Hi. > TL;DR: Stable non-exit relays can help tor clients use the Tor > network. Please opt-in! My relay is on the list and I want to opt in! eriador 6DE61A6F72C1E5418A66BFED80DFB63E4C77668F

2 1

Northeastern University Relays
by nusenu 07 Mar '16

07 Mar '16

Thanks for adding relays! Maybe set a contactinfo? (Whenever a university adds an unusual amount of relays it reminds me of the CMU case though.) http://article.gmane.org/gmane.network.onion-routing.ornetradar/1030 (I'm not implying they are doing anything bad)

2 2

biggest guard operator apparently left the tor network
by nusenu 03 Mar '16

03 Mar '16

4 4

Network Bandwidth Fine Tuning
by stealth＠nym.mixmin.net 02 Mar '16

02 Mar '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I ran the speedtest on my VPS which gave the results below: root$ speedtest-cli Retrieving speedtest.net configuration... Retrieving speedtest.net server list... Testing from ProServe B.V. (81.4.111.251)... Selecting best server based on latency... Hosted by NFOrce Entertainment B.V. (Amsterdam) [0.00 km]: 4.817 ms Testing download speed........................................ Download: 711.10 Mbit/s Testing upload speed.................................................. Upload: 449.12 Mbit/s My Bandwidth results are averaging around 1.5mbs to 3.0mbs via the Tor Globe Stats page. Can someone tell me how to increase my network bandwidth based on what I am capable of uploading and downloading. I am allocated 2TB of bandwidth per month from my VPS Right now the Advertised Bandwidth is 1.7MB/s and when I scroll down further on the page in the Bandwidth section my "mean written bytes" are 226.15 kb/s and my "mean read bytes" are 227.1 kbs/s I see several sites averaging 50MB/s-60MB/s on the Top Ten Relays list -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (MingW32) iQIcBAEBAgAGBQJW0iFwAAoJEH1gNwhiMDZuT60P/jt6YmdvtjR48zhe/fQ2sx4z Uw76B+vjonWqKOaCqyJFBM/buFoXUixTJJ6ksj/KjiVVEdTU4/7WhbwwYTUWGYyc tYhB7nWCxdCNKPy4YMNUG3r+pIaMp1gF+k6wfnHHU+Pqq0H9tTMPNS0Ey44fM0bN BaX2NjuDYpOXDkmKO8xAzKv+KQr9a6pR/DBgC73LniqiZejV3iyMvof7/hypvltq h3QJoFZ8DYjCgk+W0qEWhjCky5RFze1f8ihFsVaM7U8WH6hGcULgXAYZl8Q/MAmN 4jlSogFDSh/e/+0DqVyrkgpyxIPZ43/4y2sn2WYfR8egeocVi6NO9VHtiiygUtcn jOAzaGROGtW6oXNQtGvfeJRwAEsoPmfHF09TJANRB++/KjjSm+cM/ALT1O4b3t5U ZMC5rkoJOUX2jyo3kZpBpobLOW012BnnbGyVV5KNM/BpVkM1sIxOnFhoSfYWij5c QziOvk5wtDXFta2ow12lgruW9wT2moier1WxAxib6u9V05jxckXrpmb3V9yvWBOz SzXh05lh7pEuAfPb2RQXKjGjmkqCweOI2cGhu4B3vDFNKRBhjdXYFZP7/aFe4DRh +J4su48cYVWcnav0c14/27oHxeoYUD8NQV2gBcs7/dCSa1iWHV+PORjBSe+l+IGG R2qL40EDeIgC9TVJqriD =c73J -----END PGP SIGNATURE-----

6 9

Stopping the censoring of tor users (via exit bridges / proxies / OpenVPNs)
by grarpamp 29 Feb '16

29 Feb '16

On 2/25/16, blacklight . <pandakaasftw(a)gmail.com> wrote: > hello there! i don't know if this mailing list works but i thought of > giving it a try. > > i was lately reading an article ( > http://www.pcworld.com/article/3037180/security/tor-users-increasingly-trea… > ) > and it was about tor users getting blocked from accessing alot of website. > but after giving this some thought i think i came up with a possible > solution to the problem :there is a thing called bridges, they are used to > access the tor network without your isp knowing that you use tor, but if > you can use those proxies to enter the network, it might also be possible > to exit the network with them. But then we face a second challenge, the > exit nodes have to be configured in such a way that it will relay traffic > to such a bridge, so the exit node owners also need to know the ip of the > bridge. While this doesn't seem difficult to do, it can become difficult. > You see if the bridges are published on a public list(like normal bridges > are) then the blocking sites in question will be able to block those > address too. While this also posses a problem, a possible solution could be > found in something called flashproxies, flashproxies are bridges with a > really short life span, they are created and destroyed fairly swiftly, when > this is done in a rapid pace, they become really hard to block because the > ip changes all the time. So if the exit nodes can be configured to make use > of such flash proxies, then the problem could be solved. I Must admit that > not an expert on this or anything, and it needs alot of more thought, but > it could work. so i was wondering if there are any experts who could help > me with thinking out this subject and maybe confirm if this idea could > work. Skipping that whoever wants to enumerate, test, block, and share lists of the IP of your final hop will find a way to do so... "flashproxies" - are essentially illegal to use as the operator got stupid, and didn't gave permission. - are unstable as were never intentionally provisioned, and the operators get smart when abuse reports and shut them off. - proxy lists are going to be a pain for you to scrape and maintain Options - run your own volunteer network of last hop "proxies" / bridges - buy them from AWS or wherever "meek" style - partner with or plug into already existing networks of those - get tor relays or bridges to do this I previously wrote in archives that exit relays could bind OpenVPN to extra IP's they configure on their exit relay boxes. Tor daemon has nothing to do with those IP so they never appear in tor's easily blacklistable consensus. Users then OpenVPN over tor to those via use of the relay fingerprint to reach vpn terminator IP over relay localhost to save bandwidth, and on out to clearnet. You can OpenVPN to some list of onions if you don't feel like listing the relay fingerprints / extra input IP's on wikis. But it's not going to stop dedicated blacklisters, and onion doubles bandwidth use. However it could also be used by non-exits that for whatever reason didn't want to be a tor-exit but did want to offer exit via some remote third party vpn service. And strictly social sharing on forums etc could happen for distribution. There are already some exits that for various reasons, intentional or other, do not exit from their OR IP. That is a feature that some tor users do now find and use. And relays don't offer OpenVPN yet which would also give users more than just IPv4-TCP exit scheme. Though it is integrated somewhat, I2P has this manual sort of exit offering model with false.i2p and a few other nodes. [Doesn't seem to require daemon dev work, updated subject, continuing thread reply to relays and talk.]

1 0

What do the huge providers have to do within tor circuits?
by torserver＠datakanja.de 29 Feb '16

29 Feb '16

Hello, slowly getting acquainted with running a Tor relay, i am wondering: >From my gathering, tor is - at times - connecting to many instances of akamai CDN services, amazonaws, and other similar services simultaneously. When i say many instances, i mean: a saw a peak exposure of 30 outgoing ports from my server all going to the above 2 alone (as gathered by iftop. I didn't set up snort just yet). This is seen on a NON-Exit-relay and is troubling me: I am aware of Akamai being the premier CDN provider, serving around 30% of internet traffic alone. Their server power, manpower and know-how is huge. And their ability to draw information from any sort of internet traffic is unparalleled. >From my outsider's perspective, they are in the process of building the tools to effectively dismantle the means and purpose of the Tor network at large. That is what is giving me chills, when i watch them acting from inside the circuits. Clearly, they would be able to hide their identity while doing so. And since they aren't, i may be getting something wrong. So that is why i am asking you: Does anyone KNOW, what is going on? NewTorKidOnTheBlock

2 1

default exit notice
by Markus Koch 29 Feb '16

29 Feb '16

Does anyone have the exit notice in japanese? markus

1 0