- tor-relays - lists.torproject.org

Registration of a Tor node at the German Bundesnetzagentur
by tor-admin 11 Jan '13

11 Jan '13

Hi, this is a question more specific for the German jurisdiction. At the 29C3 in Hamburg I attended a interesting talk about open WIFI (http://is.gd/9G8AVA unfortunately in German) who was given by Reto Mantz (http://www.offenenetze.de/) He gave the advice to register open WIFIs which are operated by non-profits at the German Bundesnetzagentur, because this is required under German law for companies (http://is.gd/vcz2pZ) I am wondering if there are Tor nodes operated by Germans who have been registered at the Bundesnetzagentur. >From my layman’s understanding of the law this should at least be required for nodes operated by German non-profits like CCC and Torservers. I am specially interested in the case of a node which runs in a data center outside of Germany but is operated by a German non-profit. As I operate my nodes privately I am unsure if registration of my tor nodes is required. I will check with my lawyer if a registration should be done and could help to run the nodes more securely concerning law enforcement. Having information from others would help to clarify this. Thanks & regards, torland

5 12

Call for discussion: turning funding into more exit relays
by Roger Dingledine 09 Jan '13

09 Jan '13

For a few years now, funders have been asking if they can pay Tor to run more relays. I kept telling them their money was better spent on code and design improvements: https://blog.torproject.org/blog/why-tor-is-slow https://trac.torproject.org/projects/tor/wiki/org/roadmaps/Tor/Performance since a) network load would just grow to fill whatever new capacity we have, especially if we don't deal with the tiny fraction of users who do bulk downloads, and b) reducing diversity of relay operator control can harm anonymity. But lately the Tor network has become noticeably faster, and I think it has a lot to do with the growing amount of excess relay capacity relative to network load: https://metrics.torproject.org/network.html?graph=bandwidth&start=2010-06-0… At the same time, much of our performance improvement comes from better load balancing -- that is, concentrating traffic on the relays that can handle it better. The result though is a direct tradeoff with relay diversity: on today's network, clients choose one of the fastest 5 exit relays around 25-30% of the time, and 80% of their choices come from a pool of 40-50 relays. https://trac.torproject.org/projects/tor/ticket/6443 Since extra capacity is clearly good for performance, and since we're not doing particularly well at diversity with the current approach, we're going to try an experiment: we'll connect funding to exit relay operators so they can run bigger and/or better exit relays. If we do it right (make more faster exit relays that aren't the current biggest ones, so there are more to choose from), we will improve the network's diversity as well as being able to handle more users. We've lined up our first funder (BBG, aka http://www.voanews.com/) and they're excited to have us start as soon as we can. They want to sponsor 125+ fast exits. ---------------------------------------------------------------------- Open questions we need to decide about: 1) What exactly would we pay for? I think the right way to do it is to offer to reimburse bandwidth/hosting costs -- I don't want to get into the business of paying people to run relays, and I don't want people to be trying to figure out how to "profit". That leads to all sorts of horrible incentive structures. More broadly, we should keep in mind that the primary cost of running an exit relay is effort, not dollars: it takes dedication to find an ISP who will host it, and to hold that ISP's hand when an abuse complaint arrives. Or said another way, hosting costs are in many cases not the biggest barrier to running an exit relay. I think we should aim to constrain ourselves to talking about >=100mbit exits, assuming that turns out to give us enough choices. That said, we don't want to concentrate bandwidth too much in any given relay, so we should limit the amount we'll reimburse per relay. 2) Should we fund existing relays or new ones? The worst failure mode here would be that we screw up the current community of relay operators. That's why it's extra important to keep them involved at each step of this discussion. I think the right answer is probably a balance of reimbursing costs from current exits and encouraging new exits to appear. Before we can get more precise though, we need to get a handle on how many current fast exits there are, and what their constraints are (whether their hosting situation could give them more bandwidth, whether they're paying now or getting a deal through a friend/employer, etc). Even then, there are interesting further questions like: - Should we prefer big collectives like torservers, noisetor, CCC, dfri.se, and riseup (which can get great bulk rates on bandwidth and are big enough to have relationships with local lawyers and ISPs), or should we prefer individuals since they maximize our operator diversity? I think "explore both approaches" is a fine first plan. - For existing relays who pay for hosting, should we prefer that our money go to covering their existing costs (and then we encourage them to save their money for use, say, after this experiment finishes), or should we aim to add additional funding so the relay can use more bandwidth? I'd say it comes down to the preferences of the relay operator. That said, if we have plenty to choose from, we should pick the relays that will make the network grow -- but we should take extra care to avoid situations where operators in the first category say "well, fine" and shut down their relay. More generally, we need to consider sustainability. Our current exit relay funding is for a period of 12 months, and while there's reason to think we will find continued support, the Tor network must not end up addicted to external funding. So long as everybody is running an exit relay because they want to save the world, I think we should be fine. 4) What exactly do we mean by diversity? There's network diversity (AS / upstream network topology), organization and operator diversity, jurisdictional (country) diversity, funding diversity, data-center diversity, and more. We've started to answer some of these questions at https://trac.torproject.org/projects/tor/ticket/6232 https://blog.torproject.org/blog/research-problem-measuring-safety-tor-netw… but this research topic will need ongoing attention. I'd love to get to the point where our diversity metrics can recommend network locations that best improve the various diversity scores. 5) How much "should" an exit relay cost? Since we're aiming for diversity, we can't send all our volunteers to the same cut-rate German VPS provider. After all, much of the work in setting up an exit relay is finding a good provider that doesn't already host a bunch of Tor relays. But if we declare that we'll reimburse $50/month for 100mbit, we're going to attract a different set of volunteers -- and a different set of network locations -- than if we reimburse $100/month for 100mbit. We need to learn about current bandwidth pricing: I know there are 10 cheap hosting places that will tolerate exit relays, but are there 200? And do all of those 200 turn out to overlap diversity-wise? Initial guesses appreciated. I'm inclined toward the $100 number to give our volunteers more flexibility. If we want to reimburse on a monthly basis, how do we handle situations where the ISP wants a longer-term contract? I think the answer will come down to how many choices we have. 6) How exactly should we choose which exit relay operators to reimburse? It might be premature to speculate until we better understand what choices are available to us. But I think the answer must include doing it in a way that encourages continued growth of the relay operator _community_. People who are active in the Tor community, and well-known to many other people, should be part of the answer. At the same time, we should be willing to put some of the money into trying out new places and people, especially if they're in good locations diversity-wise. The broader answer is that we as a community need to figure out a good answer here. I definitely don't want it to be "Roger picks people in an opaque way". But I also don't want the answer to be "anybody on the Internet who offers to take our money". Maybe we should put together a consortium of current Tor activists who run fast exits? 7) How do we audit / track the sponsored relays? How should we check that your 100mbit relay is really working? What do we measure to confirm its capacity? To a first approximation I'm fine assuming that nobody is going to try to cheat (say, by colluding with an ISP to write legit-looking invoices but then just split the money). But as the plan scales, we need good ways to track statistics on how many relays are being sponsored and how much bandwidth they're providing (so funders can see how effective their money is), and what fraction of the overall network these sponsored relays are (to keep an eye on the diversity questions). 8) Legal questions? Tor exit relays raise plenty of legal questions already, especially when you consider jurisdiction variety. But reimbursing relays introduces even more excitement, such as: - Does such a relay operator end up in a different situation legally? - Does the overall Tor network change legal categories in some country, e.g. becoming a telecommunications service when it wasn't before? - Does The Tor Project Inc incur new liabilities for offering this money? Tor has a history of creating fascinating new challenges for legal scholars, and this exit relay funding experiment will be no exception. I believe if we position it correctly, we won't really change the legal context. But I encourage people to investigate these questions for their jurisdiction. ---------------------------------------------------------------------- Next steps: I'm going to do a short blog post pointing to this thread, since many interested parties aren't on tor-relays yet. Then I'll send individual emails to exit relay operators pointing them to it and asking for their feedback (on the list or private, whichever they prefer). I'll also try to get some sense of how much their hosting costs, whether they'd want to participate in our experiment, whether they're in a position to ramp up to a faster connection, etc. Once we have some concrete facts about how many current exit relays want to participate, how many new volunteers want to help, and how many ISPs could handle more exit relays and at what prices, we'll be in a better position to decide how to proceed. --Roger

25 59

Re: [tor-relays] [tor-talk] On the Theory of Remailers
by grarpamp 08 Jan '13

08 Jan '13

> It is an interesting questions, if with a modern user interface, can they > get to new life? I see no reason the state of the art from the legacy remailer types can't be combined and updated into a new service running on some of the same relay machines we have for Tor today. Even if only 10% ran them it would probably be more hosts than were ever behind the old remailer nets. And relay operators already have the abuse experience in place.

1 0

Re: [tor-relays] Disappointing AUP - (was Re: DDOS?)
by josh＠duskro.net 05 Jan '13

05 Jan '13

Are you only seeking providers outside of the U.S.? I've been using PhoenixNAP for the last two years and am very happy with their services. It's a dedicated server provider located in the United States, but they are still very affordable. I've contacted them in the past about running a TOR exit relay, and they said they had no problems with it. The only thing they warned me about is that if they received too many legal/DMCA complaints in a short time span, they may end up asking me to disable the service, but they wouldn't disable my service abruptly. The really great thing about PhoenixNAP is that their data rates are very affordable. I run a non-tor related website that processes up to 35TB of bandwidth a month. Minus the cost of the server itself, all that bandwidth only runs me $45 ($10 for a 1Gbps line plus $1/month per 1TB of bandwidth). Feel free to review their services and contact them directly with any questions you have. If you do decide to use them, I would greatly appreciate you using my affiliate link. It helps me keep the bills paid >_<. But if you feel that it's a false incentive, you in no way have to. http://www.securedservers.com/396.html Josh On 12/31/12 10:52, mick wrote: > On Mon, 31 Dec 2012 15:03:46 +0000 > Daniel Case <danielcase10(a)gmail.com> allegedly wrote: > >> This might be a bit of a shameless plug, but I used to use bitfolk ( >> bitfolk.com) - they have a generous allowance of bandwidth and allow >> tor as long as you set it up correctly. > Daniel > > I looked at bitfolk a while ago. They don't offer nearly enough > transfer for a tor node or for my tails mirror (I want at least 1TB per > month for each of them). > > For my own domestic usage (email/web server) I need a good solid stable > provider and have been with bytemark for several years (most latterly on > bigv.io). They are rock solid (and I have run a tor node with them in > the past) but they don't offer the bandwidth I need at the price I am > prepared to pay either. (Two reasonably high bandwidth VPS at bytemark > prices would come to around 100 UKP per month (say 160 USD per month). > > Call me cheap, but I do this for free. > > Mick > > --------------------------------------------------------------------- > > blog: baldric.net > gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 > > --------------------------------------------------------------------- > > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

5 6

Are you looking for node diversity?
by grarpamp 05 Jan '13

05 Jan '13

> I'd prefer to stay away from the US. > (That said, the 1st and 2nd place remain the same in this case.) > Exit probability is interesting: 43% chance of exiting from a US-based node. > Also, I feel for that poor guy in Chile. Try posting up on some of the lists/forums... isp-planet, datacenter, nanog, etc for service in South America, Africa, India, Mid-East, Hong Kong, Korea... wherever needed. For better prices, consider mentioning the capitol and/or cable landing cities by name. For legal separation, say that you're looking for a locally (in-country) owned/operated company, as opposed to some global biz. Subject: '<typeOFservice> providers in <place>?' Also google: site:<cc> vps/dedicated/whatever hosting

1 1

MaxAdvertisedBandwidth advice please
by mick 04 Jan '13

04 Jan '13

Hi all Following a couple of my earlier messages to the list (about alleged DDOS on my node) I started up a new relay only node with digitalocean (thanks to Roman Mamedov for the pointer). In order to test their service I signed up for the minimal sized "droplet" (VPS) - 256Mb RAM, 1 core, 20Gb disk. Very quickly the VPS ramped up to over 1000 tor connections and a throughput of 25Mbit/s with a daily total traffic of 230 GiB. Absolutely astonishing when compared to the appalling service I was getting from my node at thrustvps. (After my complaints I was told "This is standard procedure for our clients, all nodes are on a 100mBits network, the node you are currently on shares that connection with 59 other virtual servers".) So no wonder the service was crap. But this morning I noticed that the new server had stopped and tor says in it's log "Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a m ore restricted exit policy." I've never had the luxury of encountering this problem before, But clearly the network connectivity at digitalocean is not a limiting factor, and the resource of the VPS is. I monitored usage for the first day or so and top never showed any CPU bottleneck of high load averages, but memory was almost maxed out. The manual entry for "MaxAdvertisedBandwidth" is not particularly clear because it does not specify whether the bytes|KB|MB|GB is per second or a maximum for some other period. And I do not have the experience to know what rate would best be set on a node with limited memory (though I will buy larger nodes iof this test works out over a longer period) but apparently unlimited network capacity. So my question is, what can colleages recommend as a suitable maximum rate which will allow my node to provide maximum utility to the tor network without falling over? Many thanks in advance. Mick --------------------------------------------------------------------- blog: baldric.net gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 ---------------------------------------------------------------------

2 1

DDOS?
by mick 31 Dec '12

31 Dec '12

Hi guys The provider for one of my VPSs, running my tor node tor.baldric.net has shut it down (unilaterally and without telling me) a couple of times this month, most recently today. Their response to my query as to why is that they say they are seeing a large DDOS attack on the VPS server hosting my node, apparently aimed at my address. I shut tor down while I investigated and when running nethogs I noticed a shed load of attempted connections to my tor port (443) from non-tor addresses. A snapshot is at http://rlogin.net/tor/incoming.png Anyone else seeing anything similar? I can't believe I'm the only node being poked. Cheers Mick --------------------------------------------------------------------- blog: baldric.net gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 ---------------------------------------------------------------------

6 10

Complaint about spam originating from my server
by Brock Tice 14 Dec '12

14 Dec '12

Hello all, I follow the guide for avoiding abuse notices, and generally I only get 1/year of the DMCA variety. However, I recently received this complaint, which appears to show spam originating from my Tor server (209.188.113.101 / tor-proxy.anfani.com) As far as I know, port 25 is blocked on my exit policy. Port 587 is allowed. I do have a mail server running on this machine, but it does not accept outside connections. Is there something I am missing? Is there anything else I should do to prevent this in the future? Could there be some way that a Tor user could locally send mail using my server? Thanks, --Brock -------- Original Message -------- Subject: RES: Fwd: Olá Date: Thu, 13 Dec 2012 14:41:22 +0000 (UTC) From: abuse(a)terra.com.br To: Luis Barzon <barzon(a)terra.com.br> CC: network-abuse(a)cc.yahoo-inc.com, brock(a)anfani.com Prezado Usuário, O Departamento de Abuse do Terra trabalha seriamente para proteger seus assinantes contra abusos cometidos por terceiros. Nosso objetivo é proporcionar segurança aos nossos Clientes, evitando e impedindo o mau uso da Internet, através dos servidores Terra. Em relação a sua reclamação, informamos que após análise, identificamos que o responsável não pertence ao Terra.Nesses casos identificamos o administrador e encaminhamos a incidência para a devida tratativa. Salientamos que as devidas ações corretivas passam a ser de responsabilidade do administrador da rede identificada. Para o seu conhecimento, o endereço de contato que encaminhamos a incidência é: network-abuse(a)cc.yahoo-inc.com <mailto:network-abuse@cc.yahoo-inc.com>, brock(a)anfani.com <mailto:brock@anfani.com> Atenciosamente, Rafael Doyle Equipe de Segurança Terra - Depto. de Abuse abuse(a)terra.com.br <mailto:abuse@terra.com.br> SAN - Servico de Atendimento Nacional Fax: (51) 3287-9087 ------------ Mensagem Original ------------ *De:* Luis Barzon [barzon@terra.com.br];abuse@terra.com.br *Enviada em:* 11/12/2012 15:15:49 *Para:* abuse(a)terra.com.br *Assunto:* Fwd: Olá =?iso-8859-1?Q? Return-Path:_<web02689(a)att.net> received:_from_[10.235.200.103]_by_preston.tpn.terra.com_(LMTP);_Tue,_11_Dec_2012_12:26:19_+0000_(UTC) received:_from_if00-mail-sr03-mia.mta.terra.com_(if00-mail-sr03-mia.mta.terra.com_[208.84.243.10])_by_1n7.tpn.terra.com_(Postfix)_with_ESMTP_id_C790122CC_for_<barzon(a)terra.com.br>;_Tue,_11_Dec_2012_12:26:18_+0000_(UTC) received:_from_ochaua.tpn.terra.com_(unknown_[10.235.200.126])_by_mail-sr03-mia.tpn.terra.com_(Postfix)_with_ESMTP_id_190696002271_for_<barzon(a)terra.com.br>;_Tue,_11_Dec_2012_12:26:16_+0000_(UTC) received:_by_ochaua.tpn.terra.com_(Postfix,_from_userid_520)_id_17A1D229EFAAC;_Tue,_11_Dec_2012_12:26:16_+0000_(UTC) received:_from_[10.235.200.97]_by_ochaua.tpn.terra.com_(LMTP);_Tue,_11_Dec_2012_12:26:15_+0000_(UTC) received:_from_nm17-vm0.bullet.mail.gq1.yahoo.com_(nm17-vm0.bullet.mail.gq1.yahoo.com_[98.137.177.224])_by_1j4.tpn.terra.com_(Postfix)_with_ESMTP_id_5A96DC0000DFA_for_<waleria.luis(a)itelefonica.com.br>;_Tue,_11_Dec_2012_12:25:02_+0000_(UTC) received:_from_[98.137.12.55]_by_nm17.bullet.mail.gq1.yahoo.com_with_NNFMP;_11_Dec_2012_11:54:56_-0000 received:_from_[98.139.44.79]_by_tm15.bullet.mail.gq1.yahoo.com_with_NNFMP;_11_Dec_2012_11:54:56_-0000 received:_from_[127.0.0.1]_by_omp1016.access.mail.sp2.yahoo.com_with_NNFMP;_11_Dec_2012_11:54:56_-0000 received:_(qmail_60874_invoked_by_uid_60001);_11_Dec_2012_11:54:56_-0000 received:_from_[209.188.113.101]_by_web184904.mail.gq1.yahoo.com_via_HTTP;_Tue,_11_Dec_2012_03:54:56_PST X-Terra-Karma:_0% X-Terra-Hash:_5d0acc65d08e1a21e9e416133fc07644 X-Terra-Delivered-To:_6972688#perm!vivodiscbrlm X-Yahoo-Newman-Property:_ymail-3 X-Yahoo-Newman-Id:_716919.82230.bm@omp1016.access.mail.sp2.yahoo.com Dkim-Signature:_v=1;_a=rsa-sha256;_c=relaxed/relaxed;_d=att.net;_s=s1024;_t=1355226896;_bh=7Ocy5nwKIISVUmGV43vB0i1iNVN39I1mHkdz3VPVAFE=;_h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;_b=0eDgFzVzb+Is8oPpjwC7X7ykXEwP1vqK/KsMDuq6G031UGtMUoUEWjrbWvkP/tKStZS97RKSOYJIE1qQgMEGI20mvh9kdbTAlmoPjGwqaBIEYLmL9f7/Q1XCDiJm5cfPhFd/h5gn0ZUnCySIrkWtz2lBu8MGN1PMKASROPpG+40= Domainkey-Signature:_a=rsa-sha1;_q=dns;_c=nofws;__s=s1024;_d=att.net;__h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;__b=k3zX4zTRmj4a+jDcq+hmrP16lkRdtgX/yE2X3sueOVGLvbhnzLcVv/BL36y5nKhGPVCRhAqLpgCTJcxtYlcPXwqGSioqqso+tTm2D3Erses151z2aE3O0Zh6h9rVPUC4dqpOa5hObz9Xk8JqvvhsL6iUEQ845+OhFclyx3dSvSE=; X-Ymail-Osg:_bt8QfNYVM1k4GHRsx7y5pfUGNSY6POK5unpLV_C31c4vkp__wiUd09OX7vaDxaaiyySoyCgUEVGfXdTTl80vwJw6IPtOfHpuS0EG_l86Hxyx_vym.CY7gciAimFEEoWBpvWo7QWAwqsVQPv7soRtipZBxkFXCCX2PtUGsQrkI_XAOwfJggidaSr3gtWqG3UTWBq2ncBnZOKX2UrowDDWI_fxuExXmq34owVBCQ_iAnR3RdyhAULqzrDic5WJdJtZFxmDUM9x957AYKvCX7XZZU99Zo5w0w.QdCL_H.XFp1W_mqhW07Y_zSDOZovHJZoWZliXJFc3LZPbeRWhRjCPlm3UrJYKyY3m_s0LvztqJP_kN.xenaemuhGfD0tZLKwGJXKRWDTc7CkJ6MOscOeS.ByYdUxJG_LI4aoTrmi2UJfQ.bcOzn7eU5h3bzIx9qUJ5adHil_8M3SI5wE8LpDdkSZPJQ_7z7D_yRyQap1qel8fK_4sKScaeTDKEsSH31ZEBWQYwcmzZMvMOvxVETA.2RX_5fbK8QLeCADZ5cLQxBHhObi1.IYT0FMM37nUNfrZg1V2Tt0lWUn3kh8pP7jh_QCmg1y7vH0WwDGdDeKWhI07pf8z8e1NlEJ9Z1jTnISKVuHodZa5cpGOPssPG_7QePJvqaBTDLrc3uewNOvnj_e53jnQPEKCexdGBa5K.hMwmCJ79Otno5GXtp_Faro- X-Rocket-Mimeinfo:_001.001,DQoNCk9sw6ENCgpCb20gdGUgY29uaGVjZXIsIEV1IHNvdSBNaXNzIEZsb3VyZW5jZSwgZXUgZ29zdGFyaWEgZGUgdMOqLWxvIGNvbW8gbWV1IGFtaWdvLCBwb3IgZmF2b3IsIHZvY8OqIHBvZGVyaWEgdm9sdGFyIHBhcmEgbWltIHBhcmEgbWFpcyBkZXRhbGhlcyBkbyBtZXUgZXUsIGUgdG9kb3MgdGFsdmV6IG5lY2Vzc8OhcmlvIGVtIHJlbGHDp8OjbyBpbmNsdXNpdmUgYSBtaW5oYSBpbWFnZW0sIHNlIGVzdGUgaW50ZXJlc3NlIHF1ZSB2b2PDqiB2b2x0YXIgcGFyYSBtaW0gLiBzZXUgRmxvdXJlbmNlLg0KCi4BMAEBAQE- X-Mailer:_YahooMailClassic/15.1.1_YahooMailWebService/0.8.128.478 Message-Id:_<1355226896.58713.YahooMailClassic(a)web184904.mail.gq1.yahoo.com> Date:_Tue,_11_Dec_2012_03:54:56_-0800_(PST) From:_Fl_Dosi_<web02689(a)att.net> Reply-To:_flourencedosi@yahoo.co.uk Subject:_?= Olá To:_undisclosed_recipients:_; X-Clx-Rate-Response:_fh=1j4;_fi=10.235.200.250:2001;_rg=B;_GT=-934589197;_fs=45;_ns=164;_id=BFBwyXX6-BB122532k;_rv=7182/208.84.242.250:14051;_ts=H/Mq6;_gv=-25;_fp=IC46g;_gd=1;_fl=IAA;_ip=98.137.177.224;_he=NiDDbon0Jbq;_ht=1;_nt=0;_ho=Drk85SdDLJY;_hd=EmCVu0/pq3k;_hf=KuHCD1QD89G;_hF=EeGv2Nz5zhR;_hj=GOnAt8y/c4h;_hr=EiVSUfo4L9J;_ZM=KIpT9Tbxt6G;_ZB=GSe9x8zMeYG;_ZB=IKbBeAtS5zj;_ZB=Ei/hJgabWx3;_ZB=GJeEnTMQT26;_ZB=Mru7Qx7UNOT;_ZF=C5pWnNZauWE;_Zi=GVxvNHWVzGA; X-Clx-Id:_a113GLF9X16I0VH-BB122538 X-Abaca-Is-Spam:_false X-Abaca-Spam:_45 X-Terra-Client-Ip:_98.137.177.224 X-Milter-Version:_master.39-g1fd3ecd+ Content-Type:_multipart/alternative;_boundary="514226816-1910405447-1355226896=:58713" X-Terra-Spam:_No X-Terra-Rec-Key:_YmFyem9uQHRlcnJhLmNvbS5icg== Mime-Version:_1.0 * -----_Original_Message_----- From:_Fl_Dosi_web02689@att.net To:_undisclosed_recipients:_; Cc:_ Sent:_Ter_11/12/12_08:54 Subject:_Fwd:_Olá * Olá Bom_te_conhecer,_Eu_sou_Miss_Flourence,_eu_gostaria_de_tê-lo_como_meu_amigo,_por_favor,_você_poderia_voltar_para_mim_para_mais_detalhes_do_meu_eu,_e_todos_talvez_necessário_em_relação_inclusive_a_minha_imagem,_se_este_interesse_que_você_voltar_para_mim_._seu_Flourence. .................................................................................. Hello Nice_Meeting_You,_i_am_miss_Flourence,_i_wish_to_have_you_as_my_friend,_please_could_you_get_back_to_me_for_more_detail_of_my_self,_and_all_maybe_necessary_in_relationship_including_my_picture,_if_this_interest_you_get_back_to_me.yours_Flourence.

5 4

Hack attempts made to appear as exit node?
by Steve Snyder 06 Dec '12

06 Dec '12

I recent days I have gotten 3 complaints from people who report hack attempts from my exit node, at 82.221.99.229. One problem: this IP address is not in use by me and never has been. The RDNS for this address is "tor-exit.burratino.net" and there is the standard Tor explanatory page on http://82.221.99.229/. The "email the maintainer" is a mailto link to my e-mail address, thus the contacts from people reporting hack attempts. I guess that the page on port 80 was ripped from my actual exit although it is slightly different in that my page has my IP address on it, and http://82.221.99.229/ doesn't reference any particular IP address. Further, I can find no evidence ( https://metrics.torproject.org/exonerator.html ) that this IP address has ever actually run a Tor node. Am I crazy or is someone doing port-scanning and making it appear to be from a Tor exit node?

1 0

Traffic pattern on Tor relay
by tor-admin 05 Dec '12

05 Dec '12

Hi, I am monitoring the network interface of my tor server with nload. From time to time nload shows strange traffic patterns: http://i.imgur.com/0Wr9h.png The graph is updated every second so one hash mark corresponds to one second. The most recent traffic value is on the right side. The graph shows that the traffic oscillates with a period of about 14 seconds and the traffic doubles in the peaks. Does anyone has an explanation of this pattern? Regards, Torland

2 1

Prepared for [Raided for running a Tor exit node]?
by grarpamp 01 Dec '12

01 Dec '12

> Only regarding home Wireless access in the US > I was involved in a case with just this situation. > > According to my lawyer there is no consensus on who is responsible for wifi. > Every State has different laws each one is just a vague. > In NY, if your wireless is secured (pw protected) you are ok. > In NH, you are responsible for all data that passes your wifi point secured > or not. > In MA(my state) there is no specific law Putting links to such laws on the Tor wiki would be useful for operators and users to know. It would seem hard to believe that there are 'must secure' laws [1] in the US or elsewhere. Even harder that anyone would be sentenced... regardless of whether their AP is open, 12345, or dR;$8w@G... merely for traffic traversing their AP/node that was not theirs, or that cannot be proven was theirs. Not that you wouldn't be questioned, charged or held before the case was dropped. [1] There are 'must secure' civil ISP contracts. They are only meant to 'secure' more revenue (no account/line sharing) for the ISP and save revenue from dealing with whatever headaches your open AP/node creates. And criminal 'theft of service' laws for the same reasons. > you just need a good lawyer :) This (and links to the actual laws) are much easier to believe. Because if someone here took the NY example above literally and did illegal deeds via their secured wifi thinking that example was the law (and thus their immunity), they be jailed pretty quickly. And what does being forced to secure or responsible mean? If you hit a bug, exploit, or get cracked, and can show it, you're jailed? What if there is no proof either way but the existence of traffic, is the user then jailed by default? What if no evidence but crypted disk, or questions as to character/belief? In those crazy places even 100% lily white users would seem better off running an open AP/node and risking that lone lesser charge [2] than attempting to be rather secure, risking a crack, and being held responsible for some major crime. [2] If the major wasn't dropped, at least they'd be jailed with evidence the access was open, which looks a lot better than if it wasn't. The crazy is why you're supposed to visit, write, call and email your lawmakers, educate your executive, and hang your jury.

2 2

Suggestions for Tor Relay Operators after a Police interaction
by Andrew Lewman 30 Nov '12

30 Nov '12

# Suggestions for Tor Relay Operators after a Police interaction Disclaimer: We are not lawyers, and this is not legal advice. This is friendly advice from those of us at Tor who work with relay operators after a police visit or raid. This is a collection of suggestions of what we've gathered from five years of helping people like you. Exit relay operator visits are exceedingly rare. You are in the 1% of operators ever visited or even raided by a police force. If you're reading this message, then you probably have a poor photocopy of the warrant the police served to you. The warrant may mention Tor and some suspected criminal activity (such as terrorism, money laundering, child abuse materials, or copyright violations). 1. Read the EFF legal FAQ for relay operators, https://www.torproject.org/eff/tor-legal-faq.html.en. 2. Find legal representation. A list of possible legal advisers can be found here, https://blog.torproject.org/blog/start-tor-legal-support-directory. If none of these people are in your country, or close to you, ask either the EFF or Tor Project. We can likely help you find someone in your jurisdiction. 3. Get a copy of the full warrant. There is a generally a process to get a full copy of the warrant. It will have details you'll need to know to defend yourself. At a minimum, it's likely to have a timestamp and IP address of your exit relay. 4. Make sure the IP address in question is your exit relay and was a valid relay at the time in question. We make available the exonerator tool to look through the entire history of the Tor Network to find your relay, https://metrics.torproject.org/exonerator.html. 5. Get in touch with The Tor Project, preferably by email, see https://www.torproject.org/about/contact for finding ways to reach us. If you need someone official to explain Tor to either a bondsman, judge, or the police, generally phone works best, https://www.torproject.org/about/contact#phone. When you contact Tor, we need the following details in order to help you maintain your innocence: - The IP address of each relay. - The timestamp (date and time of day) for each IP address in the warrant. - How to reach you or your legal adviser. 6. Likely, your legal adviser is going to want a signed, notarized, official letter from the Tor Project stating the IP address was or was not an exit relay at the date and time in question. They are going to want this mailed via trackable method (FedEx, UPS, DHL, registered mail, etc). We need to know if you want one letter per IP/timestamp combination, or if we can put everything into one letter. Best of luck going forward. The police generally only receive an IP address and a street address. They do not know it is a tor exit relay. Some national police forces in Europe and North America are sophisticated enough to determine "tor or not" before they execute a warrant. Generally, but not always, these national police forces send detectives to interview you (known as a "knock and talk"), rather than send in a SWAT team (known as a raid). The press repeats the SWAT team stories because it generates page views for their organization. It's not the norm. Tor is available for further help, whether it be as an expert witness, further explanations of how Tor works, etc. Just ask for help, we're happy to do so. By sharing your experience with us, you also help us to help law enforcement understand Tor better in the future. Thanks for sharing and thanks for running a relay. -- Andrew http://tpo.is/contact pgp 0x6B4D6475

2 1

Prepared for [Raided for running a Tor exit node]?
by grarpamp 30 Nov '12

30 Nov '12

>> Running an exit node from home DSL or Cable is bad idea. One must look >> for a Tor friendly ISP and have balls made of steel! ... ISP[/hoster] and[/or] have ... > However, I do not believe it is that way in > the United States What 'way'? Running an exit node at home, or elsewhere, would seem to come down to... a) Are you physically ready for a query / subpoena / search warrant / exigent raid? Are things segregated by room? Are your doors and machines labeled with the same sort of exit node notice you'd put on the TCP port and in DNS? Have you inventoried, photographed and documented your setup and property? Do you have offsite backups? Are private things encrypted? Are any co-habitants aware and similarly prepared? b) Are you mentally ready? Is your life and butt otherwise clean, legal, and organized? If you were to appear in court, how would you act and be perceived? How do you feel about being in the news and in public docs? Have you networked with other operators and entities? c) Are you legally, financially, and timewise ready? Have you consulted with and preselected a couple attorneys? Have you made arrangements for making bail? How will you make court required appearances? All these sorts of meta things, and surely more, come into play whether or not you're ever raided. I'd suggest making a wiki article for them.

1 0

How to get client locale statistics without arm?
by tor-admin 30 Nov '12

30 Nov '12

Hi, I would like to know from which countries my nodes are mostly used. I tried to use arm for this but on high capacity relays arm eats the same cpu resources as the tor process it monitors, if the connection panel is activated. Switching to the connection panel lets arm often freeze. Is there another way to get country statistics from a node? Maybe something build in Tor? Thanks, Torland

2 3

Bandwidth and server leads [was: Tor raid]
by grarpamp 29 Nov '12

29 Nov '12

> From: elijah wright <elw(a)stderr.org> > Date: Thu, 29 Nov 2012 13:38:51 -0600 > Cc: nanog(a)nanog.org > Subject: Re: William was raided for running a Tor exit node. > We had a guy (aka potential customer) inquire the other day about hosting a > Tor exit on our infrastructure the other day; he disappeared fairly > quickly when he figured out that we weren't just going to give him an > endless supply of unmetered 10G bandwidth. I was looking forward to > billing him. :-) Contemporary mailing list lols aside, I believe you'll find that most operators in this space are quite serious and professional. If you're a potential friend of Tor, anonymity networks and the general thought space around it... and your price [or that of someone you know, nanog or otherwise, who might be such a friend] was highly competitive, or even special... I'd be fairly confident that consultation with those on this list would lead to a sale of said (or related) billable services. Feel free to forward and/or put any interested parties in touch with this list or torproject.org.

1 0

Deploy relays using hidden exit IP's?
by grarpamp 29 Nov '12

29 Nov '12

Shouldn't some exit relays (funded or not) be deployed to use an exit IP that is different from it's advertised exit IP in order to prevent a simplistic form of blocking based on scraping the descriptor set? I think this can happen if the default route is out another interface or secondary address. Something of that nature.

10 14

setting up a Tor exit node
by esolve esolve 29 Nov '12

29 Nov '12

I want to use Tor browser bundle to set up a Tor exit node in vidalia, I click "set up relay" -> sharing then there are some options, I checked "Relay traffic for the Tor network(exit relay)" and then click "ok" however, it doesn't work, and the exit relay option is automatically unchecked, while the option "relay traffic inside the tor network (non-exit relay)" is checked how can I set up a Tor exit node? thanks!

5 13

TOR relay and their flags
by androny 29 Nov '12

29 Nov '12

Hello all! My torrc main config: SocksPort 0 RunAsDaemon 1 DataDirectory /tmp/.tor ControlPort 9051 CookieAuthentication 1 ORPort 4999 AvoidDiskWrites 1 BridgeRelay 1 ExitPolicy reject *:* so, its pure relay. Run arm and got: "flags: none" Well, read flags definitions at https://gitweb.torproject.org/torspec.git?a=blob_plain;hb=HEAD;f=dir-spec.t… and still don't understand it :-) My tor has almost 4 days uptime, and at logs have: ----- Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor ----- Performing bandwidth self-test...done. ----- Tor has successfully opened a circuit. Looks like client functionality is working ----- Connections (1 inbound, 6 circuit, 1 control) ----- It means, it works well - so, why my tor relay server doesn't have an "Running" flag, "Valid" flag or "Stable"? Regards And-ron

4 3

DFRI is running two sponsored exits
by Linus Nordberg 26 Nov '12

26 Nov '12

Hi Moritz, DFRI [1] is running two relays, DFRI0 and DFRI3, which should qualify as fast relays as defined by sponsor j. (They were just recently bumped From 10 MB to 12.5 MB. They both have an exit policy allowing the ports explicitly required on https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorJ.) We'd love to be able to get some funds for this which would make it possible for us to run more exit traffic. We only have one /24 network to run exit traffic from atm though so this is all we can do for now without breaking the stated diversity rules. (Anybody sitting on an IPv4 /24 PI that we can borrow for a year or so? We'd handle it with care!) We could technically run bridges too but we would have to discuss this internally some more first. Do we really want to take money for running entry _and_ exit relays? Isn't that exactly how you'd attack Tor users if you had the power, by controlling entry and exit? If we've missed some public discussion on this topic, please point us at it. [1] https://dfri.se/index.en/ Thanks, Linus, DFRI

4 4

Setting up new Tor relay
by Lance Hathaway 25 Nov '12

25 Nov '12

Hi all, I'm trying to set up a Tor bridge relay as an NT service under Windows 2003 x64. It runs, but only when I -don't- pass it a torrc file. Specifically, I've tried the following: 1. Installed service using "tor --service install". This installed the Tor service, with files located in "C:\Documents and Settings\LocalService\tor". I copied a torrc file into this directory and edited it to correctly set the ports and other options to be a bridge relay. After placing this file into the directory, attempting to start the service results in error 1064: an exception occurred in the service when handling the control request. Renaming or removing the torrc file allows the service to start. 2. After reading some old posts to tor-talk and tor-relays, I ensured that the directory has full permissions assigned to SERVICE and LOCAL SERVICE accounts. No change. 3. I removed the service and created a new directory for the configuration and log files, located at "C:\torsvc". I installed the service again with "tor --service install -option -f "C:\torsvc\torrc". I also ensured the new directory had all permissions set correctly. The service installed as "tor -net-service" without any options and executed successfully. I stopped the service and fixed the path in the registry to include "-f "C:\torsvc\torrc"", but then the service wouldn't start any more. 4. I verified the permissions on the torsvc directory. After removing the -f option from the service, the service starts successfully again, albeit without my configs (including log locations which would tell me what was going wrong). Sorry to be a bother, but could anybody offer me some enlightenment on what I'm missing??? -Lance

2 3

(no subject)
by Znerol2 25 Nov '12

25 Nov '12

Sent from Samsung Mobile

1 0

Akamai running Tor exit relays
by tagnaq 24 Nov '12

24 Nov '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, I found out about it via Moritz's twitter feed [1] and I think it is great. Am quite curious about it. Does anyone have some insights on why Akamai decided to start 10 fast exit relays? (CC'ing the relays contact address here) Some compass stats [2]: bandwith: 2.75% of the Tor network exit probability: 6.97% [1] https://twitter.com/torservers/status/266669861139255296 [2] https://compass.torproject.org/?family=C3D1F08204E2BF81C6A426F312AE3A2212C7… -----BEGIN PGP SIGNATURE----- iF4EAREKAAYFAlCws7EACgkQyM26BSNOM7YTnQD+L6D2fH6T5QmR0MUh4wJAnan2 Aag6ImaavJeFZS+jihwA/2roYnLDlocvfgoHe4cDk7vJvGctTGgylLi/FdH2tf9r =zf1i -----END PGP SIGNATURE-----

1 0

traffic pattern indicates MITM?
by ea 19 Nov '12

19 Nov '12

For four days the BW graph and usage table of my bridge indicated noticeable traffic and then the graph dropped precipitously to near zero & the table shows no recent usage. Vidalia/tor are working fine. I did try rebooting my router-modem gateway last night, but as far as I could monitor it, the traffic has still been near zero (maybe a few KB every hour or so). If I'm reading it correctly, onionoo is showing that the bridge is still published. I'm not complaining about this pattern, but wondering if the abrupt drop-off in traffic for a still-published bridge is diagnostic of MITM activity. Maybe there's a way to further monitor my bridge from within the network? If MITM is suspected, should I shut down the bridge for a day or so?

2 1

Tor marked as "enforced" process in Apparmor, but also "unconfined"
by Christian 14 Nov '12

14 Nov '12

Dear fellows, I use Ubuntu Precise 12.04 and as I run a Bridge, I find the idea of confining Tor with an Apparmor profile charming. When upgrading Ubuntu and Tor, the Apparmor stuff seemed to be automatically worked out, so I deleted my old handmade usr.sbin.tor profile as I found the new system_tor profile. Wenn I type "sudo aa-status", I get system_tor as "enforced process" with its correct process id and there's no process "unconfined, but with a profile defined". But when I type "sudo aa-unconfined", /usr/sbin/tor ist marked as "not confined". So, what about that being charming? Is everything bad? Or good, and it's just I'm an idiot? I tried to rename the system_tor profile to usr.sbin.tor and adjusted its name in the profile itself, but this only results in Tor being listed under "unconfined processes that have a profile defined" when typing "sudo aa-status". Anybody who can see clear in this issue? Any help is appreciated and thanks in advance. christian P.S.: I really did a "sudo service apparmor reload" ;-)

1 0

Tracking fast Tor exits
by Moritz Bartl 07 Nov '12

07 Nov '12

Hi, I wrote a small script today that keeps track of all "fast exits" as defined in https://trac.torproject.org/projects/tor/ticket/6498 . https://github.com/moba/tor-fast-exits-tracker Hourly updated output: https://www.torservers.net/tor-fast-exits.html Move mouse over dots to see the timestamp. -- Moritz Bartl https://www.torservers.net/

1 0