- tor-relays - lists.torproject.org

seized relays reported for blacklisting?
by nusenu 20 May '17

20 May '17

Hi Nicolas, according to aeris (CC) one(?) [1] of your relays got seized/compromised [2]. Did you report it to tor directory authorities, so they can blacklist the relay? thanks, nusenu [1] InFlames - C46A33E7E56F4F3FF2D36308A37E3DA21CD100FB [2] https://twitter.com/aeris22/status/865317501525045248 -- https://mastodon.social/@nusenu https://twitter.com/nusenu_

3 4

Bridge not being used
by Joel Cretan 19 May '17

19 May '17

Hi relay operators, I've run a number of relays, so I'm familiar with how this usually works for non-bridges. I'm working on a project that might want to connect through a bridge, so I thought I'd fire one of those up to offset the demands I'd be placing on the network. I've been operating this bridge for about 30 days with RelayBandwidthRate set at 5000 KBytes, which I thought might be attractive to some clients, since most bridges are so small. But checking my logs for the last few days, I don't seem to have had any clients at all recently. Is this expected for a bridge, as clients don't rotate their bridge very often, or is something possibly wrong? As far as I can tell, everything is working OK, because I can connect through it with my own Tor client. The server descriptor is published. I'll avoid pasting the whole torrc since it's a bridge, but I can do that with some parts removed if that would help. Thanks! jc

2 2

Re: [tor-relays] seized relays reported for blacklisting?
by nusenu 19 May '17

19 May '17

Hi Nicolas, thanks for your fast response. Nicolas Simond: > I'll do but I don't know if this has been done since I haven't received > any response. Ok so you tried to contact them already? (what email / channel did you use?) > But all relay have disapeared from the atlas. Are you saying that more than one of your relays was seized? I found the following relays (down) with your contactinfo, did all 3 get seized? +----------+-----------------+---------------------+ | FP | nickname | last_seen | +----------+-----------------+---------------------+ | 96D67782 | darkstar | 2017-05-17 09:00:00 | | 6B356C10 | dustofnightmare | 2017-05-17 09:00:00 | | C46A33E7 | InFlames | 2017-05-13 16:00:00 | +----------+-----------------+---------------------+ Atlas is currently hardly working since its backend (onionoo.torproject.org apparently has some availability issues). Atlas also only shows relays that have been running at some point within the last 7 days (which should not be a problem in this case). -- https://mastodon.social/@nusenu https://twitter.com/nusenu_

1 0

DirCache 0
by Paul 19 May '17

19 May '17

Running a relay on small RAM I putted "DirCache 0" to save memory. As one can read here https://www.torproject.org/docs/tor-manual.html.en "Setting either DirPort or BridgeRelay and setting DirCache to 0 is not supported. (Default: 1) " I cant set a DirPort as well, which means I cant publish a DirPortFrontPage Exit-notice. Any idea how to circumvent this problem. Thanks Paul

2 1

Strange behaviour Tor 0.2.9.10 - off topic
by Felix 18 May '17

18 May '17

Hi everybody I walked through the March postings and found: > (Please don't put -- in your emails. Some people use broken > mail readers that hide everything below a -- .) Indeed it's not broken, it's *Usenet Signature Convention* https://tools.ietf.org/rfc/rfc3676.txt (chapter 4.3.) That's old school - how we saved bandwidth in ancient times :) -- Cheers, Felix

2 1

TROVE-2017-002: deb.torproject.org 0.3.0.x repos no longer updated? - help yourself
by Felix 18 May '17

18 May '17

Hi If you suffer from: (and https://www.freshports.org/security/tor/ is still on 3.0.6) > To help the 1.3% cw-fraction / 87 FreeBSD relays I filed > a ticket here: > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219364 and you are on FreeBSD source you upgrade to 3.0.6 and then put a small hack in place: Go to ports security/tor and edit the 3.0.6 distinfo to: SHA256 (tor-0.3.0.7.tar.gz) = 9640c4448ef3cad7237c68ed6984e705db8fb2b9d6bb74c8815d01bb06527d02 SIZE (tor-0.3.0.7.tar.gz) = 5779422 Change the 3.0.6 Makefile to: PORTVERSION= 0.3.0.7 Copy tor-0.3.0.7.tar.gz from https://dist.torproject.org/ to /var/ports/distfiles/ # cd /usr/ports/security/tor && make deinstall clean # cd /usr/ports/security/tor && make install And voila 3.0.7 shows up. Works as well for jails (/usr/jails/myjail/var/ports/distfiles/). If you come from some older versions please check ports/UPDATING, libevent is 2.1.8 now. -- Cheers, Felix

1 0

Re: [tor-relays] Strange behaviour Tor 0.2.9.10
by Geoff Down 18 May '17

18 May '17

Further information. Curl error Failed to receive SOCKS5 connect request ack. and from earlier, Tor log Mar 19 11:52:37.000 [notice] Tried for 32496 seconds to get a connection to [scrubbed]:80. Giving up. -- http://www.fastmail.com - A no graphics, no pop-ups email service

3 12

Bandwidth settings
by Torix 17 May '17

17 May '17

This is a newbie question, but I'm not sure where else to ask it. I had an older desktop box from a decade ago, so I put Debian tor on it as per the directions and set it up as a middle node (exit policy to reject *:*) at home. I added arm and vnstat to be able to look at it. I've never done anything with tor before, so I know nothing but what I've read in the past 2 weeks. My question is about bandwidth. I made a mistake at first with Kbytes and kbits, but currently have it set at 200KBytes steady, 300KBytes burst. This translates in the default arm display to 1.5Mb/s and 2.3Mb/s. I use Verizon Fios. When I did a speed test from Verizon, I got 60 Mbps up and 70 Mpbs down. I currently have not set any accounting max daily limit. It seems to me that I could add 10 times the bandwidth and still be at 15/23 Mbps out of 60-70 Mpbs, or only a quarter of my total bandwidth. Were I to do this, 1. would we notice at home, where we don't stream video; just run browsers and remote desktop about 8 miles away to work. 2. or would Verizon notice first the bandwidth or the amount of data going through our connection? Which would be the first limit? Bandwidth or data? In terms of data, I've already run 11.5 GB through tor yesterday, out of about a 17GB theoretical maximum at these bandwidth settings. Would 170GB/day be outrageous to Verizon if I cranked the bandwidth up? Would we notice it? Hoping someone might be able to add to my vast experience of 3 days up. Sent with [ProtonMail](https://protonmail.com) Secure Email.

4 4

Fallback Directory Update: May 2017
by teor 17 May '17

17 May '17

Dear Relay Operators, We have rebuilt the list of fallback directory mirrors in Tor[0] for the upcoming 0.3.1 release. The new list will also be backported to Tor 0.2.8 and later. If you're asking: Q: What's a fallback directory mirror? See [1]. Q: Is my relay on the list? Search [2] for your relay fingerprint or IP address and port. (I used to BCC this email to all operators on the list, but that's a lot of work!) Q: What do I need to do if my relay is on the list? Keep the same IP address, keys, and ports. Email me or this list if the relay's details change. Q: Can my relay be on the list next time? We need fast relays that will be on the same IP address and port for 2 years. Email me to get on the potential relay list[3], or to update the details of your relay. Every release or two we run a script to choose about 150-200 relays for the list. Q: Why didn't my relay get on the list this time? We check a relay's uptime, flags, and speed[4]. Sometimes, a relay might be down when we check. That's ok, we will check it again next time. It's good to have some new relays on the list every release. That helps tor clients, because blocking the whole list is harder. Tim [0]: https://gitweb.torproject.org/tor.git/commit/src/or/fallback_dirs.inc?id=5b… [1]: https://trac.torproject.org/projects/tor/wiki/doc/FallbackDirectoryMirrors [2]: https://gitweb.torproject.org/tor.git/tree/src/or/fallback_dirs.inc [3]: https://gitweb.torproject.org/tor.git/tree/scripts/maint/fallback.whitelist [4]: https://trac.torproject.org/projects/tor/attachment/ticket/21564/fallbacks_… T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org ------------------------------------------------------------------------

1 0

WannaCry fallout FYI
by Jon Gardner 16 May '17

16 May '17

From the SNORT folks... http://blog.talosintelligence.com/2017/05/wannacry.html?m=1 ".... Additionally, organizations should strongly consider blocking connections to TOR nodes and TOR traffic on network. Known TOR exit nodes are listed within the Security Intelligence feed of ASA Firepower devices. Enabling this to be blacklisted will prevent outbound communications to TOR networks." <>< Jon L. Gardner Mobile: +1 979-574-1189 Email/Skype/Jabber: jon(a)brazoslink.net AIM/iChat/MSN: jlg(a)mac.com

8 14

Tor and ufw
by je suis 15 May '17

15 May '17

Hello everyone One of my friends got a ransomware and, even if I am on Linux and I take care when browsing, with such a proof beside me I thought I'd secure myself a bit, so I got ufw. I am running a middle relay, and so far it went just fine with ~2.5MB bandwidth, even if only in the daytime, morning to evening (laptop...; I do plan in getting a RaspberyPi in the future). I followed this page for setting up ufw with tor: https://help.ubuntu.com/community/TorDedicatedUser , even if I have Archlinux. I didn't use all in there, only the part right below "Traffic redirection", with ufw in the command line. Now, if I see the relay with 25kB, it's a miracle. So, obviously, I did something wrong. Is there a page with proper explanations for dummies like me? If it helps, my net comes from a router that handles cable TV and phone, as well. Vlad

1 1

A Naïve Question About ARM
by Kenneth Freeman 13 May '17

13 May '17

This is possibly a naïve question, but I like to compile and run the alpha/unstable version of Tor, but for the life of me I can't figure out how to get ARM to run the latest version. I'm currently running Anosognosia (Fingerprint: 9536B457F01F40696B131A72BC102343759F46AA), but it's stuck in the unrecommended Tor 0.2.7.5 and I'd like it to run 0.3.0.5-rc. Please explain it to me like I'm eight. Thanks! P.S. I understand that ARM is crufty is shall be updated, and furthermore, I miss Vidalia.

2 2

niftybunny relays: MyFamily configuration needs an update
by nusenu 11 May '17

11 May '17

Hi Markus, thanks for running so many tor relays. One [1] of your relays recently got a new key (2017-04-27), please update your MyFamily setting accordingly to help protect tor clients from using your entry+exit at the same time. thanks, nusenu https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan… [1] https://atlas.torproject.org/#search/niftychinchilla -- https://mastodon.social/@nusenu https://twitter.com/nusenu_

1 1

schlarman.org relays: MyFamily configuration
by nusenu 09 May '17

09 May '17

Hi, thanks for running tor relays [1]. Please update your MyFamily [2] setting to help protect tor clients from using your entry+exit at the same time. thanks, nusenu [1] https://atlas.torproject.org/#search/contact:tor@schlarman.org [2] https://www.torproject.org/docs/tor-manual.html.en#MyFamily -- https://mastodon.social/@nusenu https://twitter.com/nusenu_

1 0

Relay has Low Consensus and No Exit Flag Following Upgrade
by Chris 07 May '17

07 May '17

Hello, I recently upgraded my tor exit relay's tor version to 0.2.8.12. The uptime is 51 days and it has valid, running and stable flags. However, it no longer has the exit node flag and the consensus is very low (20). It also is not listed as a directory. I suspect something else during the upgrade has broken it as I had some SELinux issues binding to the ports before - which I resolved. There are no errors in ARM although the log is non existent? - permissions error? The fingerprint is 575F2C60045805ABFDB2B7D7A78982F9571BC277 Where should I start to fix this? Best Wishes, Chris -- Protect your privacy: encrypt your communications GPG: CF7F98B2

5 5

Actual user demographics?
by Jivan Amara 03 May '17

03 May '17

The counter they made has a good point, that you really don't know who is using it; but to suggest that means it's entirely used by criminals is also ridiculous. What can be known is *how* TOR is being used by setting up studies at exits and seeing what kind of services people are connecting to. From that, some inference of *who* is using TOR is possible. Maybe it's the same guy buying cocaine from a black market seller that posts articles on a civil rights abuses site, but it would be silly to make that assumption. From the usage stats I've seen, the TOR website paints a prettier picture than the truth, but at the same time opponents paint a significantly darker one. On 05/03/2017 05:00 AM, tor-relays-request(a)lists.torproject.org wrote: > Good morning, > > I recently presented to a group of ten local police chiefs on the topic of Tor and its more common, though less publicized, civil usage, as opposed to the more publicized criminal usage. During my presentation I emphasized this fact, and they countered that because its usage is entirely anonymous, it is reasonable to assume that it could be used entirely by criminals and none of the oppressed as I had claimed. > > Which brings me to my question. Other than private individuals saying "Hey, I use Tor for X", how does the overall network know what the network is used for, even approximately? > > Make your day great, > Isaac Grover, Senior I.T. Consultant > Aileron I.T. - "Practical & Proactive I.T. Solutions" > > O: 715-377-0440, F:715-690-1029, W: www.aileronit.com -- Cheers, Jivan Amara --- Senior Full-Stack Developer Development(a)JivanAmara.net (619) 549-4497

4 4

Actual user demographics?
by Isaac Grover, Aileron I.T. 02 May '17

02 May '17

Good morning, I recently presented to a group of ten local police chiefs on the topic of Tor and its more common, though less publicized, civil usage, as opposed to the more publicized criminal usage. During my presentation I emphasized this fact, and they countered that because its usage is entirely anonymous, it is reasonable to assume that it could be used entirely by criminals and none of the oppressed as I had claimed. Which brings me to my question. Other than private individuals saying "Hey, I use Tor for X", how does the overall network know what the network is used for, even approximately? Make your day great, Isaac Grover, Senior I.T. Consultant Aileron I.T. - "Practical & Proactive I.T. Solutions" O: 715-377-0440, F:715-690-1029, W: www.aileronit.com

3 2

tornull
by Dirk 01 May '17

01 May '17

Dear all, I was made aware of the Tor Null Advisory BL [1] which is also mentioned in trac here [2]. Block Botnets does not seem like a bad idea in principal. But the page has no listing of a responsible person neither any criteria listed which it chooses to identify "bad" IPs. Looking at some of the links I found 1 which had a date from 2011 [3]. As will I miss information an when and how often it is updated. Therefore it looks slightly suspicious to me. And it surely has an abuse potential. Does anyone have more information on the background or recommendations here ? best regards Dirk [1] https://tornull.org/ [2] https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy [3] https://www.spamhaus.org/sbl/query/SBL113323

4 4

Fast relay dropped from use by Tor
by Sec INT 01 May '17

01 May '17

Hi This relay processed 7TB in April for Tor and processed 12 gb yesterday but today is hardly processing any data at all? Its barely doing 1000 b/sec? Its flagged as'fast, guard' etc so why is it not being used? I also checked on Atlas and this relay is not even listed anymore? Finger: B39AD54B73A70DA68F6FC26CD0A874DE762B7825 Is this BW auth issue? Oh and I checked the available bandwidth its 100mb/s up and down Snap

2 1

Is there any problems for users of my exit node if I have DNS lookups go out on a different interface?
by Anders Andersson 01 May '17

01 May '17

I plan to set up a Tor exit node (again), and the server has two external interfaces each with a dedicated IP. I'm going to use one of these exclusively for Tor. I also run a validating Unbound on the same machine, and all DNS lookups that are not cached will go out on the *other* interface by default. internet <--> IP 1 <--> unbound internet <--> IP 2 <--> tor, talking locally to unbound IP 1 and 2 should have the same routing path otherwise, because it's on the same network. I can't imagine how this could be problematic, but there has been so much talk about DNS lookups over the years, so I thought I'd better check with people who know more about this.

2 1

(no subject)
by Alex 29 Apr '17

29 Apr '17

-- реклама ----------------------------------------------------------- http://FREEhost.UA - мы размещаем больше 100 тыс. сайтов! Качественный хостинг для новичков и профи - http://goo.gl/EcgF4I

1 0

Law Enforcement Request
by teor 28 Apr '17

28 Apr '17

Hi all, Last week, we were contacted by Australian law enforcement, on behalf of German law enforcement, about one of our relays. It appears that some law enforcement agency had performed a guard discovery attack on a hidden service. One of our relays was that hidden service's guard. They requested that we provide a detailed network capture of that guard's traffic. We refused. (We do not keep detailed logs.) We also shut down the guard. T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org ------------------------------------------------------------------------

3 3

bind DNS Crash on Exit
by teor 26 Apr '17

26 Apr '17

Hi all, Are you using bind as a local caching resolver on your exits? The DNS resolver on our exit crashed over the weekend due to this bug: https://kb.isc.org/article/AA-01466 It hasn't been patched yet in Debian: https://security-tracker.debian.org/tracker/CVE-2017-3137 So I have added a file: /etc/systemd/system/bind9.service.d/restart-on-abort.conf With the text: [Service] Restart=on-abort This should work for any systemd/bind9 Linux system. T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org ------------------------------------------------------------------------

2 1

Re: [tor-relays] [tor-talk] TOR problems - seriously PLEASE HELP ME!
by Jonathan Marquardt 26 Apr '17

26 Apr '17

On Mon, Apr 24, 2017 at 12:16:23PM +0200, unpublished wrote: > 1. Many web pages display information that I do not support "TOR > connections"? Not sure, what you mean here. Perhaps THEY don't support (i.e. block) connections from Tor users, because they are afraid of spam or other stupid reasons. Nothing you can really do here. Websites blocking Tor is a huge problem. > 2. How to increase (amazon) the number of relay nodes? Because standard > only two redirect point? There are always three nodes. The amazon node should be your guard relay (where you enter the Tor network). Then there are two relays after that. There isn't really any way to change that. Three hops should be sufficient for decent anonymity, no real need to worry here. > 3. How to change the end node of the country (eg country from which I am > POLAND)? Here's a simple guide on how to do that: http://www.wikihow.com/Set-a-Specific-Country-in-a-Tor-Browser -- 4096R/1224DBD299A4F5F3 47BC 7DE8 3D46 2E8B ED18 AA86 1224 DBD2 99A4 F5F3

2 1

Relay traffic went to ~zero
by Jan Jancar 21 Apr '17

21 Apr '17

Hi all, I have been running my relay for about a year now and about two weeks ago my relay traffic went close to zero [1]. Any ideas as to why? Is it my ISP silently throttling my ORport after founding out I run a relay? Is it some misconfiguration on my part? My consensus weight went down from ~400 to 10, over the last few days. [1]: http://imgur.com/YOMxU66 [2]: https://atlas.torproject.org/#details/1673C036756D2800D2BD0F7C20DEE3FB934F9… [3]: http://torstatus.blutmagie.de/router_detail.php?FP=1673c036756d2800d2bd0f7c… Cheers, -- Jan ______________________________________________________ /\ # PGP: 362056ADA8F2F4E421565EF87F4A448FE68F329D /__\ # https://neuromancer.sk /\ /\ # Eastern Seaboard Phishing Authority /__\/__\ #

5 7

maatuska's bwscanner down since 2017-04-14 -> significant drop in relay traffic
by relayoperator＠openmailboxbeta.com 20 Apr '17

20 Apr '17

Hi Tom! since maatuska's bwscanner is down [1] I see a significant drop of traffic on many of my relays, and I believe this is related. Do you have any update to [2] on when maatuska will report bwscan results again? thanks, a concerned relayoperator [1] https://lists.torproject.org/pipermail/tor-consensus-health/2017-April/0078… https://consensus-health.torproject.org/graphs.html#bwauthgraphs [2] https://lists.torproject.org/pipermail/tor-consensus-health/2017-April/0078…

1 0

Reducing Exit Node Connections
by Colin 18 Apr '17

18 Apr '17

Hello all, I'm having difficulties running exit nodes on VPS provided by Pulse Servers. Conntrack shows the number of connections climbing to 30,000 and this is untenable (at least for the cheap vps from this provider). I have tried MaxAdvertisedBandwidth at many settings with the same results, number of connections eventually climbs to around 30k. I'm interested in input regarding: * is it possible to reduce the number of connections, how does one achieve this? * given I have no other points of reference, is 30k connections on a typical low-cost VPS unreasonable? * anything else I should be considering? Thanks all. -- Colin

2 1

[warn] circuit_mark_for_close under (Linux 4.4.0-21-generic) Tor 0.2.9.10
by Paul 18 Apr '17

18 Apr '17

[warn] circuit_mark_for_close_(): Bug: Duplicate call to circuit_mark_for_close at ../src/or/onion.c:238 (first at ../src/or/command.c:579) (on Tor 0.2.9.10 ) Can this warning be neglected - I thought it is a BSD and not a Linux issue? Got nearly a hundred of them today - all with the same time stamp. Thanks - Paul

1 0

Some n00b questions about exits
by Mirimir 14 Apr '17

14 Apr '17

I'm thinking about running an IPv6 exit. I've found a Tor-friendly VPS provider, but they have metered bandwidth. And 500GB per month is about my limit. So I could have a 40Mbps/80Mbps exit that was up for maybe a week per month, or a much slower persistently stable exit. For exits, speed is better than persistence, right? Also, I can choose VPS in UK vs DE vs US. Which is needed most? And am I right that a DE exit will generate the least hassle? Thanks.

2 1

snaptor relays: MyFamily update required
by nusenu 08 Apr '17

08 Apr '17

Hi snaptorg, thanks for adding new relays, please do not forget to update your MyFamily. +---------------------+-----------------+---------------+------+ | first_seen | IP | MyFamilyCount | exit | +---------------------+-----------------+---------------+------+ | 2016-11-12 00:00:00 | 213.32.66.192 | 9.0000 | 0 | | 2016-11-26 23:00:00 | 193.70.90.199 | 9.0000 | 0 | | 2016-11-26 23:00:00 | 128.199.108.14 | 9.0000 | 0 | | 2016-11-27 00:00:00 | 139.59.46.211 | 9.0000 | 0 | | 2016-11-28 11:00:00 | 94.156.77.41 | 8.0000 | 1 | | 2016-11-28 14:00:00 | 142.4.206.241 | 9.0000 | 1 | | 2016-11-29 00:00:00 | 185.103.110.210 | 9.0000 | 1 | | 2016-12-03 23:00:00 | 144.217.90.138 | 9.0000 | 0 | | 2016-12-16 15:00:00 | 176.123.26.27 | 8.0000 | 1 | | 2016-12-16 23:00:00 | 193.70.22.86 | NULL | 0 | +---------------------+-----------------+---------------+------+ https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan… regards, nusenu -- https://github.com/nusenu/ansible-relayor

3 9

tor-fw-helper
by Alexander Færøy 07 Apr '17

07 Apr '17

Hello. I'm interested in hearing if anybody on this list is currently using the tor-fw-helper[0] tool in their relay setup? We are currently fixing some issues in Tor's way of doing I/O between subprocesses, but before spending too much time on this task it would be useful to know if this tool is used at all. Cheers, Alex. [0]: https://gitweb.torproject.org/tor-fw-helper.git -- Alexander Færøy

2 1

rise in bridges starting with ~2017-03-28
by nusenu 06 Apr '17

06 Apr '17

Hi, I don't know if the discussion of the thread "22% of bridges run by a single entity?" [1] sparked this, but someone was very busy adding lots of obfs4 bridges. Normally you would see <50 new bridges per day, in the last few days we saw >120 new bridges per day. They all run tor 0.2.9.10, support the obfs4 transport and have a nickname that looks like it is generated from a dictionary. https://github.com/nusenu/tor-network-observations/blob/master/2017-03-29_m… You can even see it on metrics: https://metrics.torproject.org/networksize.html [1] https://lists.torproject.org/pipermail/tor-relays/2017-March/012156.html -- https://mastodon.social/@nusenu https://twitter.com/nusenu_

1 0

why my exit is not being used?
by gustavo panizzo (gfa) 06 Apr '17

06 Apr '17

Hello I ran sorrentini [1] as a relay for a month or two and everything was fine. then 2-3 weeks ago i decided to allow exit, the traffic went down significantly, is that expected? it has recovered a bit but i feel the node is underutilized, is it stational? I've attached node's munin graphs [1] https://atlas.torproject.org/#details/5E762A58B1F7FF92E791A1EA4F18695CAC667… here is my torrc # general Nickname sorrentini Log notice syslog ControlPort 9051 HashedControlPassword XXXXXXXXX AccountingStart month 01 00:00 AccountingRule sum AccountingMax 1024GB ContactInfo 0x44BB1BA79F6C6333 <tor-admin AT zumbi dot com dot ar> MyFamily 82C92FBAF2196EC346670D12BB9650FE9FF55741,EFD2EEB91E5C5D8CB999B1EC68D89E51F8776AC7 SocksPort 0 SocksPolicy reject * ## IPv4 ORPort 128.199.76.145:443 DirPort 128.199.76.145:80 Address 128.199.76.145 OutboundBindAddress 128.199.76.145 ##IPv6 IPv6Exit 1 ORPort [2400:6180:0:d0::18a7:d001]:443 OutboundBindAddress [2400:6180:0:d0::18a7:d001] # Exit DirPortFrontPage /etc/tor/tor-exit-notice.html CellStatistics 1 DirReqStatistics 1 EntryStatistics 1 ExitPortStatistics 1 ExtraInfoStatistics 1 HiddenServiceStatistics 1 ExitRelay 1 ExitPolicy accept *:53 # DNS ExitPolicy accept *:80 # HTTP ExitPolicy accept *:110 # POP3 ExitPolicy accept *:143 # IMAP ExitPolicy accept *:220 # IMAP3 ExitPolicy accept *:443 # HTTPS ExitPolicy accept *:873 # rsync ExitPolicy accept *:989-990 # FTPS ExitPolicy accept *:991 # NAS Usenet ExitPolicy accept *:992 # TELNETS ExitPolicy accept *:993 # IMAPS ExitPolicy accept *:995 # POP3S ExitPolicy accept *:1194 # OpenVPN ExitPolicy accept *:1293 # IPSec ExitPolicy accept *:3690 # SVN Subversion ExitPolicy accept *:4321 # RWHOIS ExitPolicy accept *:5222-5223 # XMPP, XMPP SSL ExitPolicy accept *:5228 # Android Market ExitPolicy accept *:9418 # git ExitPolicy accept *:11371 # OpenPGP hkp ExitPolicy accept *:64738 # Mumble ExitPolicy reject *:* # nothing else is allowed -- 1AE0 322E B8F7 4717 BDEA BF1D 44BB 1BA7 9F6C 6333 keybase: https://keybase.io/gfa

7 22

visualbasic033 relays: please update 'MyFamily' in your torrc
by nusenu 05 Apr '17

05 Apr '17

Hi visualbasic033, thanks for running relays. Please do not forget to set/update the MyFamily parameter in your torrc configuration to tell clients your relays belong to a single operator, otherwise they might use your relays in multiple positions within a circuit, which is rather bad for their anonymity. If you need help with the MyFamily option let us know. thanks, nusenu -- https://mastodon.social/@nusenu https://twitter.com/nusenu_ https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan… https://github.com/nusenu/ansible-relayor The counter in the last column should match the number of rows: +------------+------+-----------------+-----------+---------------+ | first_seen | exit | IP | nickname | FamilyMembers | +------------+------+-----------------+-----------+---------------+ | 2015-12-04 | 0 | 141.255.166.150 | doutreval | 1 | | 2016-03-07 | 1 | 162.220.246.230 | dlavolos | 1 | | 2016-08-08 | 1 | 91.223.82.156 | sowinetz | 1 | +------------+------+-----------------+-----------+---------------+

1 0

42bpm relays: please update 'MyFamily' in your torrc
by nusenu 05 Apr '17

05 Apr '17

Hi contact42bpm, thanks for adding a new relay. Please do not forget to set/update the MyFamily parameter in your torrc configuration to tell clients your relays belong to a single operator, otherwise they might use your relays in multiple positions within a circuit, which is rather bad for their anonymity. If you need help with the MyFamily option let us know. thanks, nusenu -- https://mastodon.social/@nusenu https://twitter.com/nusenu_ https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan… The counter in the last column should match the number of rows: +------------+------+-----------------+-------------+---------------+ | first_seen | exit | IP | nickname | FamilyMembers | +------------+------+-----------------+-------------+---------------+ | 2016-09-18 | 0 | 92.169.22.209 | RedOctober | 4 | | 2016-12-07 | 0 | 163.172.223.165 | May68 | 4 | | 2017-02-02 | 0 | 62.210.84.34 | 9OfDecember | 4 | | 2017-02-03 | 1 | 94.23.173.249 | 14OfJuly | 4 | | 2017-04-04 | 0 | 62.210.247.178 | 5OfNovember | 1 | +------------+------+-----------------+-------------+---------------+

1 0

Bandwidth Accounting troubles
by Tyler Johnson 02 Apr '17

02 Apr '17

Hello! I've enabled bandwidth accounting on my tor relay, but encountering issues when the relay attempts to wake from hibernation.... Mar 20 23:47:25 tcj Tor[74346]: Bandwidth soft limit reached; commencing hibernation. No new connections will be accepted Mar 20 23:52:30 tcj Tor[74346]: Heartbeat: Tor's uptime is 10 days 12:00 hours, with 150 circuits open. I've sent 90.20 GB and received 90.30 GB. We are currently hibernating. Mar 20 23:52:30 tcj Tor[74346]: Circuit handshake stats since last time: 2745/2745 TAP, 15557/15557 NTor. Mar 20 23:52:30 tcj Tor[74346]: Since startup, we have initiated 0 v1 connections, 0 v2 connections, 0 v3 connections, and 113565 v4 connections; and received 1100 v1 connections,130 v2 connections, 41 v3 connections, and 249967 v4 connections. Mar 21 00:00:00 tcj Tor[74346]: Configured hibernation. This interval began at 2017-03-21 00:00:00; the scheduled wake-up time was 2017-03-21 00:00:00; we expect to exhaust our quota for this interval around 2017-03-22 00:00:00; the next interval begins at 2017-03-22 00:00:00 (all times local) Mar 21 00:00:00 tcj Tor[74346]: Hibernation period ended. Resuming normal activity. Mar 21 00:00:00 tcj Tor[74346]: Opening OR listener on 185.92.223.3:8080 Mar 21 00:00:00 tcj Tor[74346]: Could not bind to 185.92.223.3:8080: Address already in use. Is Tor already running? Mar 21 00:01:00 tcj Tor[74346]: Opening OR listener on 185.92.223.3:8080 Mar 21 00:01:00 tcj Tor[74346]: Could not bind to 185.92.223.3:8080: Address already in use. Is Tor already running? Mar 21 00:02:01 tcj Tor[74346]: Opening OR listener on 185.92.223.3:8080 Mar 21 00:02:01 tcj Tor[74346]: Could not bind to 185.92.223.3:8080: Address already in use. Is Tor already running? It will continue in this manner until I manually intervene and restart the relay instance. snippet from torrc: ## Set a maximum of 30 gigabytes each way per period. AccountingMax 30 GBytes ## Each period starts daily at midnight (AccountingMax is per day) AccountingStart day 00:00 ## Required: what port to advertise for incoming Tor connections. ORPort 185.92.223.3:8080 ## The IP address or full DNS name for incoming connections to your ## relay. Leave commented out and Tor will guess. Address 185.92.223.3 ## If you have multiple network interfaces, you can specify one for ## outgoing traffic to use. OutboundBindAddress 185.92.223.3 Tor version and OS: $ tor --version Tor version 0.2.9.10 (git-1f6c8eda0073f464). $ uname -a OpenBSD tcj.me 6.1 GENERIC#224 amd64 Has anyone else experienced this issue? I have only one outbound interface, so is setting the OutboundBindAddress unnecessary and possibly causing the problem? I do apologize if this has been discussed already. Please point me to the relevant post if so! Thanks in advance, Tyler

2 4

22% of bridges run by a single entity?
by nusenu 30 Mar '17

30 Mar '17

Hi, is it known that (likely) a single entity is running ~22% of all bridges? (not the 'ki' bridges [1]) I'm not necessarily saying that this is bad, just curious and wondering if this is somehow known. Since contactinfo is removed from bridge descriptors before publication I can not tell whether this is i.e. torservers, Frenn vun der Enn, AccessNow, ... Added on [2] 2016-01-17 2016-01-18 2016-01-24 [1] https://lists.torproject.org/pipermail/tor-project/2016-December/000851.html [2] https://github.com/nusenu/tor-network-observations/blob/master/bridges_adde…

5 6

Re: [tor-relays] Hackers
by John Ricketts 29 Mar '17

29 Mar '17

Great. On Mar 29, 2017, at 01:03, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Sure do . From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 11:02 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Sir, I do not know why you contacted me. You did not tell me what was attacked, when it was attacked, or how it was attacked. Now you're threatening to attack me. Clearly, you are not a reasonable person. Do what you must. My information is public, you know where I live and you have my telephone number. :-) John On Mar 29, 2017, at 00:57, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Look pal, CC me again to your dark webbers and I will go after you. I clearly contacted you about a complaint for hackers coming from YOUR servers. I copied and pasted it right to you. Don't play games, "doc". Complaints: 1) Hackers are coming from your servers. 2) You're sharing my information with a large email list without my permission about hackers coming from your servers, for contacting you about these very same hackers. Don't play stupid. You know exactly why I contacted you.

3 3

(no subject)
by Nicholas K S Cullen 29 Mar '17

29 Mar '17

Please.unsubscribe me

2 2

(no subject)
by Nicholas K S Cullen 29 Mar '17

29 Mar '17

Please unsubscribe me

1 0

Recent events in Tor-Relay.
by John Ricketts 29 Mar '17

29 Mar '17

All, Any suggestions short of a restraining order? That was one of the most bizarre interactions I have ever had with anyone on the internet. Thanks for your input, John

2 2

Re: [tor-relays] Hackers
by John Ricketts 29 Mar '17

29 Mar '17

Sir, I do not know why you contacted me. You did not tell me what was attacked, when it was attacked, or how it was attacked. Now you're threatening to attack me. Clearly, you are not a reasonable person. Do what you must. My information is public, you know where I live and you have my telephone number. :-) John On Mar 29, 2017, at 00:57, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Look pal, CC me again to your dark webbers and I will go after you. I clearly contacted you about a complaint for hackers coming from YOUR servers. I copied and pasted it right to you. Don't play games, "doc". Complaints: 1) Hackers are coming from your servers. 2) You're sharing my information with a large email list without my permission about hackers coming from your servers, for contacting you about these very same hackers. Don't play stupid. You know exactly why I contacted you.

1 0

Re: [tor-relays] Hackers
by John Ricketts 29 Mar '17

29 Mar '17

Hello, I am sorry you feel attacked. Feel free to take whatever action your require. Let's start with the actual issue, you did not outline any actual abuse complaint. Please detail your issues, and I will explain to you how to block Tor traffic and specifically my IP addresses since you feel the source is Quintex. Until you send me a valid abuse complaint with actionable information, there is nothing further I can do to assist you. John On Mar 29, 2017, at 00:47, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Now the abuse is sharing my info was a bunch of dark web hackers for contacting an ISP about abuse. That’s sick. Now I do have cause. From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 10:46 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Hello, I am sharing this discussion with everyone as I have nothing to hide and I feel this is of the public interest. I am very familiar with Tor's origins, original intent and what it is used for today and where it's future hopefully will go. Thank you taking the time to email me with your abuse complaint. If you have any further issues, please feel to email me. In the future please please include more technical details such as IP addresses, the specific attack and times and dates. Sincerely, John L. Ricketts, PhD Quintex Alliance Consulting On Mar 29, 2017, at 00:41, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: I know quite a lot about Tor and how it was developed by the Navy and is used by agents for covert work. Maybe you should study more about Tor. You’re not as discrete as you think. Why are you CCing me to the entire Tor email list? Was I talking to them, or you? From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 10:38 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Hello, Please read https://torproject.org and perhaps you'll change your mind. Bad people will do bad things no matter what. If a bank robber uses a public street or highway during a crime does that mean we should destroy the highway? No. I wish you the best. John On Mar 29, 2017, at 00:28, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Thanks for the info. You’re still an IP providing frauds, pedophiles, and intelligence agencies access to do illegal attacks and activities. Bunch of cowards to hide behind Tor… From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 9:28 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Hello, It's because i'm running Tor Exit servers. I am an ISP. I will not turn off any of the Tor exit servers because I am not doing anything illegal. If you feel you must file legal action, please do so. If you're not concerned about blocking Tor, why don't you block all of the exit nodes instead? Bloxking just my exit will not help a lot. Feel free to block 199.249.223.0/24 and 199.249.224.0/24 and you won't have any traffic from Quintex servers. John On Mar 28, 2017, at 22:54, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: John, why am I getting Tor related hackers from your servers? Hmmm… Please turn it off or I’ll be filing legal against your company. You've chosen to block the network that 199.249.224.41 is part of. We've marked the networks we found that this IP address belongs to in red below. Make sure you read all the WHOIS information so that you see all networks this IP belongs to. We recommend blocking the network with the lowest number of addresses. You may find this is listed at the end as part of the 'rWHOIS' query which contacts the local WHOIS server that is run by the network administrator. # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # If you see inaccuracies in the results, please report at # https://www.arin.net/public/whoisinaccuracy/index.xhtml # # # The following results may also be obtained via: # https://whois.arin.net/rest/nets;q=199.249.224.41?showDetails=true&showARIN… # NetRange: 199.249.224.0 - 199.249.224.255 [256 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> CIDR: 199.249.224.0-199.249.225.255 [511 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> NetName: QUINTEX224 NetHandle: NET-199-249-224-0-1 Parent: NET199 (NET-199-0-0-0-0) NetType: Direct Assignment OriginAS: AS7018, AS6939, AS13693, AS3549, AS62744 Organization: Quintex Alliance Consulting (QAC-4) RegDate: 1994-06-02 Updated: 2017-03-13 Ref: https://whois.arin.net/rest/net/NET-199-249-224-0-1 OrgName: Quintex Alliance Consulting OrgId: QAC-4 Address: 308 Bluegrass Drive City: San Angelo StateProv: TX PostalCode: 76903 Country: US RegDate: 1994-06-03 Updated: 2016-08-22 Ref: https://whois.arin.net/rest/org/QAC-4 OrgAbuseHandle: JR125-ARIN OrgAbuseName: Ricketts, John L OrgAbusePhone: +1-325-653-1444 OrgAbuseEmail: john(a)quintex.com<mailto:john@quintex.com> OrgAbuseRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgNOCHandle: JR125-ARIN OrgNOCName: Ricketts, John L OrgNOCPhone: +1-325-653-1444 OrgNOCEmail: john(a)quintex.com<mailto:john@quintex.com> OrgNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgTechHandle: JR125-ARIN OrgTechName: Ricketts, John L OrgTechPhone: +1-325-653-1444 OrgTechEmail: john(a)quintex.com<mailto:john@quintex.com> OrgTechRef: https://whois.arin.net/rest/poc/JR125-ARIN RNOCHandle: JR125-ARIN RNOCName: Ricketts, John L RNOCPhone: +1-325-653-1444 RNOCEmail: john(a)quintex.com<mailto:john@quintex.com> RNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN

1 0

Re: [tor-relays] Hackers
by John Ricketts 29 Mar '17

29 Mar '17

Hello, I am sharing this discussion with everyone as I have nothing to hide and I feel this is of the public interest. I am very familiar with Tor's origins, original intent and what it is used for today and where it's future hopefully will go. Thank you taking the time to email me with your abuse complaint. If you have any further issues, please feel to email me. In the future please please include more technical details such as IP addresses, the specific attack and times and dates. Sincerely, John L. Ricketts, PhD Quintex Alliance Consulting On Mar 29, 2017, at 00:41, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: I know quite a lot about Tor and how it was developed by the Navy and is used by agents for covert work. Maybe you should study more about Tor. You’re not as discrete as you think. Why are you CCing me to the entire Tor email list? Was I talking to them, or you? From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 10:38 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Hello, Please read https://torproject.org and perhaps you'll change your mind. Bad people will do bad things no matter what. If a bank robber uses a public street or highway during a crime does that mean we should destroy the highway? No. I wish you the best. John On Mar 29, 2017, at 00:28, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Thanks for the info. You’re still an IP providing frauds, pedophiles, and intelligence agencies access to do illegal attacks and activities. Bunch of cowards to hide behind Tor… From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 9:28 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Hello, It's because i'm running Tor Exit servers. I am an ISP. I will not turn off any of the Tor exit servers because I am not doing anything illegal. If you feel you must file legal action, please do so. If you're not concerned about blocking Tor, why don't you block all of the exit nodes instead? Bloxking just my exit will not help a lot. Feel free to block 199.249.223.0/24 and 199.249.224.0/24 and you won't have any traffic from Quintex servers. John On Mar 28, 2017, at 22:54, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: John, why am I getting Tor related hackers from your servers? Hmmm… Please turn it off or I’ll be filing legal against your company. You've chosen to block the network that 199.249.224.41 is part of. We've marked the networks we found that this IP address belongs to in red below. Make sure you read all the WHOIS information so that you see all networks this IP belongs to. We recommend blocking the network with the lowest number of addresses. You may find this is listed at the end as part of the 'rWHOIS' query which contacts the local WHOIS server that is run by the network administrator. # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # If you see inaccuracies in the results, please report at # https://www.arin.net/public/whoisinaccuracy/index.xhtml # # # The following results may also be obtained via: # https://whois.arin.net/rest/nets;q=199.249.224.41?showDetails=true&showARIN… # NetRange: 199.249.224.0 - 199.249.224.255 [256 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> CIDR: 199.249.224.0-199.249.225.255 [511 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> NetName: QUINTEX224 NetHandle: NET-199-249-224-0-1 Parent: NET199 (NET-199-0-0-0-0) NetType: Direct Assignment OriginAS: AS7018, AS6939, AS13693, AS3549, AS62744 Organization: Quintex Alliance Consulting (QAC-4) RegDate: 1994-06-02 Updated: 2017-03-13 Ref: https://whois.arin.net/rest/net/NET-199-249-224-0-1 OrgName: Quintex Alliance Consulting OrgId: QAC-4 Address: 308 Bluegrass Drive City: San Angelo StateProv: TX PostalCode: 76903 Country: US RegDate: 1994-06-03 Updated: 2016-08-22 Ref: https://whois.arin.net/rest/org/QAC-4 OrgAbuseHandle: JR125-ARIN OrgAbuseName: Ricketts, John L OrgAbusePhone: +1-325-653-1444 OrgAbuseEmail: john(a)quintex.com<mailto:john@quintex.com> OrgAbuseRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgNOCHandle: JR125-ARIN OrgNOCName: Ricketts, John L OrgNOCPhone: +1-325-653-1444 OrgNOCEmail: john(a)quintex.com<mailto:john@quintex.com> OrgNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgTechHandle: JR125-ARIN OrgTechName: Ricketts, John L OrgTechPhone: +1-325-653-1444 OrgTechEmail: john(a)quintex.com<mailto:john@quintex.com> OrgTechRef: https://whois.arin.net/rest/poc/JR125-ARIN RNOCHandle: JR125-ARIN RNOCName: Ricketts, John L RNOCPhone: +1-325-653-1444 RNOCEmail: john(a)quintex.com<mailto:john@quintex.com> RNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN

1 0

Re: [tor-relays] Hackers
by John Ricketts 29 Mar '17

29 Mar '17

Hello, Please read https://torproject.org and perhaps you'll change your mind. Bad people will do bad things no matter what. If a bank robber uses a public street or highway during a crime does that mean we should destroy the highway? No. I wish you the best. John On Mar 29, 2017, at 00:28, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Thanks for the info. You're still an IP providing frauds, pedophiles, and intelligence agencies access to do illegal attacks and activities. Bunch of cowards to hide behind Tor... From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 9:28 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Hello, It's because i'm running Tor Exit servers. I am an ISP. I will not turn off any of the Tor exit servers because I am not doing anything illegal. If you feel you must file legal action, please do so. If you're not concerned about blocking Tor, why don't you block all of the exit nodes instead? Bloxking just my exit will not help a lot. Feel free to block 199.249.223.0/24 and 199.249.224.0/24 and you won't have any traffic from Quintex servers. John On Mar 28, 2017, at 22:54, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: John, why am I getting Tor related hackers from your servers? Hmmm... Please turn it off or I'll be filing legal against your company. You've chosen to block the network that 199.249.224.41 is part of. We've marked the networks we found that this IP address belongs to in red below. Make sure you read all the WHOIS information so that you see all networks this IP belongs to. We recommend blocking the network with the lowest number of addresses. You may find this is listed at the end as part of the 'rWHOIS' query which contacts the local WHOIS server that is run by the network administrator. # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # If you see inaccuracies in the results, please report at # https://www.arin.net/public/whoisinaccuracy/index.xhtml # # # The following results may also be obtained via: # https://whois.arin.net/rest/nets;q=199.249.224.41?showDetails=true&showARIN… # NetRange: 199.249.224.0 - 199.249.224.255 [256 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> CIDR: 199.249.224.0-199.249.225.255 [511 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> NetName: QUINTEX224 NetHandle: NET-199-249-224-0-1 Parent: NET199 (NET-199-0-0-0-0) NetType: Direct Assignment OriginAS: AS7018, AS6939, AS13693, AS3549, AS62744 Organization: Quintex Alliance Consulting (QAC-4) RegDate: 1994-06-02 Updated: 2017-03-13 Ref: https://whois.arin.net/rest/net/NET-199-249-224-0-1 OrgName: Quintex Alliance Consulting OrgId: QAC-4 Address: 308 Bluegrass Drive City: San Angelo StateProv: TX PostalCode: 76903 Country: US RegDate: 1994-06-03 Updated: 2016-08-22 Ref: https://whois.arin.net/rest/org/QAC-4 OrgAbuseHandle: JR125-ARIN OrgAbuseName: Ricketts, John L OrgAbusePhone: +1-325-653-1444 OrgAbuseEmail: john(a)quintex.com<mailto:john@quintex.com> OrgAbuseRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgNOCHandle: JR125-ARIN OrgNOCName: Ricketts, John L OrgNOCPhone: +1-325-653-1444 OrgNOCEmail: john(a)quintex.com<mailto:john@quintex.com> OrgNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgTechHandle: JR125-ARIN OrgTechName: Ricketts, John L OrgTechPhone: +1-325-653-1444 OrgTechEmail: john(a)quintex.com<mailto:john@quintex.com> OrgTechRef: https://whois.arin.net/rest/poc/JR125-ARIN RNOCHandle: JR125-ARIN RNOCName: Ricketts, John L RNOCPhone: +1-325-653-1444 RNOCEmail: john(a)quintex.com<mailto:john@quintex.com> RNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN

1 0

Re: [tor-relays] Hackers
by John Ricketts 29 Mar '17

29 Mar '17

Hello, It's because i'm running Tor Exit servers. I am an ISP. I will not turn off any of the Tor exit servers because I am not doing anything illegal. If you feel you must file legal action, please do so. If you're not concerned about blocking Tor, why don't you block all of the exit nodes instead? Bloxking just my exit will not help a lot. Feel free to block 199.249.223.0/24 and 199.249.224.0/24 and you won't have any traffic from Quintex servers. John On Mar 28, 2017, at 22:54, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: John, why am I getting Tor related hackers from your servers? Hmmm... Please turn it off or I'll be filing legal against your company. You've chosen to block the network that 199.249.224.41 is part of. We've marked the networks we found that this IP address belongs to in red below. Make sure you read all the WHOIS information so that you see all networks this IP belongs to. We recommend blocking the network with the lowest number of addresses. You may find this is listed at the end as part of the 'rWHOIS' query which contacts the local WHOIS server that is run by the network administrator. # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # If you see inaccuracies in the results, please report at # https://www.arin.net/public/whoisinaccuracy/index.xhtml # # # The following results may also be obtained via: # https://whois.arin.net/rest/nets;q=199.249.224.41?showDetails=true&showARIN… # NetRange: 199.249.224.0 - 199.249.224.255 [256 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> CIDR: 199.249.224.0-199.249.225.255 [511 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> NetName: QUINTEX224 NetHandle: NET-199-249-224-0-1 Parent: NET199 (NET-199-0-0-0-0) NetType: Direct Assignment OriginAS: AS7018, AS6939, AS13693, AS3549, AS62744 Organization: Quintex Alliance Consulting (QAC-4) RegDate: 1994-06-02 Updated: 2017-03-13 Ref: https://whois.arin.net/rest/net/NET-199-249-224-0-1 OrgName: Quintex Alliance Consulting OrgId: QAC-4 Address: 308 Bluegrass Drive City: San Angelo StateProv: TX PostalCode: 76903 Country: US RegDate: 1994-06-03 Updated: 2016-08-22 Ref: https://whois.arin.net/rest/org/QAC-4 OrgAbuseHandle: JR125-ARIN OrgAbuseName: Ricketts, John L OrgAbusePhone: +1-325-653-1444 OrgAbuseEmail: john(a)quintex.com<mailto:john@quintex.com> OrgAbuseRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgNOCHandle: JR125-ARIN OrgNOCName: Ricketts, John L OrgNOCPhone: +1-325-653-1444 OrgNOCEmail: john(a)quintex.com<mailto:john@quintex.com> OrgNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgTechHandle: JR125-ARIN OrgTechName: Ricketts, John L OrgTechPhone: +1-325-653-1444 OrgTechEmail: john(a)quintex.com<mailto:john@quintex.com> OrgTechRef: https://whois.arin.net/rest/poc/JR125-ARIN RNOCHandle: JR125-ARIN RNOCName: Ricketts, John L RNOCPhone: +1-325-653-1444 RNOCEmail: john(a)quintex.com<mailto:john@quintex.com> RNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN

1 0

Tor Relay On Pfsense 2.3.3-RELEASE-p1 (amd64)
by Edwin Garzón 29 Mar '17

29 Mar '17

Hi all. Need you help, I have pfsense *2.3.3-RELEASE-p1* (amd64) and > pkg install tor: pkg: No packages available to install matching 'tor' have been found in the repositories I want to install a Tor relay Thank

4 3

What kind of hardware do I need for my relay
by Farid Joubbi 28 Mar '17

28 Mar '17

Hello, I have been running low powered middle relays for a few years. Now I think it's time for a small upgrade. I haven't looked at computer hardware for a long time. What is the cheapest and most power efficient CPU/motherboard that can saturate 100 Mbit/s as a Tor relay? Thanks.

9 15

aTorRelay@gmail.com relays: please update 'MyFamily' in your torrc
by nusenu 27 Mar '17

27 Mar '17

Hi thanks for adding 3 more relays. You are currently the biggest known operator with end-to-end correlation capabilities [1] Please do not forget to set/update the MyFamily parameter in your torrc configuration to tell clients your relays belong to a single operator, otherwise they might use your relays in multiple positions within a circuit, which is rather bad for their anonymity. If you need help with the MyFamily option let us know. thanks, nusenu [1] https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan… https://github.com/nusenu/ansible-relayor The counter in the last column should match the number of rows: +------------+------+-----------------+------------+---------------+ | first_seen | exit | IP | nickname | FamilyMembers | +------------+------+-----------------+------------+---------------+ | 2015-11-15 | 0 | 82.220.89.53 | inky | 8 | | 2016-05-23 | 0 | 212.47.244.38 | Chimborazo | 8 | | 2016-05-24 | 0 | 163.172.157.213 | Cotopaxi | 8 | | 2016-05-24 | 0 | 163.172.139.104 | Pichincha | 8 | | 2016-10-02 | 0 | 212.47.240.189 | Tungurahua | 8 | | 2016-10-02 | 0 | 163.172.133.54 | Cayambe | 8 | | 2016-11-16 | 1 | 92.222.103.232 | Sangay | 8 | | 2016-11-19 | 1 | 185.100.87.186 | Antisana | 8 | | 2017-03-21 | 1 | 91.134.232.58 | Illiniza | NULL | | 2017-03-21 | 1 | 178.32.53.53 | Cuicocha | NULL | | 2017-03-21 | 1 | 92.222.134.129 | Atacazo | NULL | +------------+------+-----------------+------------+---------------+ 11 rows

1 0

Problem with arm
by Javier Benito Santoni 21 Mar '17

21 Mar '17

Hello, im having a problem with arm. Everytime i open it it apears this: [ARM_WARN] The torrc differs from what tor's using. You can issue a x sighup to reload the torrc values by pressing x. qj - torrc values differ on lines: 2, 3 Even by restarting tor service it shows the same error again and again Could it be a problem with my config? BandwidthBurst 8MBytes BandwidthRate 7MBytes ORPort 9001 DirPort 9030 ExitPolicy reject *:* ContactInfo administrator(a)anonmail.me Nickname AnonMailMe DisableDebuggerAttachment 0 A week has passed since i started my relay and i cant see it on tor globe yet: F40FEF3A1326EFC5D73E4FE6DB6EB0791E4082A1 -- My PGP Public Key: https://box.anonmail.me/javikey.txt

4 6