- tor-relays - lists.torproject.org

Aggressive abuse report
by Florentin Rochet 16 Mar '17

16 Mar '17

Hi list, I am running Kadoc[0] for a few weeks and got today a more aggressive complain from a System Administrator of my VPS provider. I seek for an appropriate response to not get banned. Does someone experienced a similar scenario and succeeded to educate the sys admins ? Here's the complain: /"It is running a Tor Exit, hence producing a false positive." is not a valid reason.// //You are the one responsible for the traffic generated on/trough your server, so you should make sure that no similar traffic will appear in future. Illegal actions are strictly prohibited in our network/servers.// //Please take immediate actions to stop this kind of activity./ I am almost sure that trying to argument that I am not responsible for the traffic generated through my Exit is not the right angle with such guy. Any ideas ? Best, Florentin Rochet [0] https://atlas.torproject.org/#details/171696AFDB589CA2C4978EED2C6A91153D2B9…

6 9

Changing exit to bridge
by Volker Mink 15 Mar '17

15 Mar '17

Hey Folks. I am going to change my Exit to a Bridge or whatever. When im browsing the Web i receive tons auf capchas and my KODI mediacenter is unable to update itself. I have my private IP fromm y Internet connection listet on some blacklists. Thats bad. What can i do to contribute and support the TOR-Network without being bugged and limited on my own private Internet Connection? Hope you can help me with some cool suggestions. Best, volker

6 9

[FYI] cymrubridge02 maintenance - quick reboot
by Sina Rabbani 14 Mar '17

14 Mar '17

Dear Team, cymrubridge02 (meek-azure) needs a reboot, it's going to be down for less than a min and will come right back up. > https://atlas.torproject.org/#details/8F4541EEE3F2306B7B9FEF1795EC302F6B84D… All the best, Sina -- Sina Rabbani | Systems Engineer | Team Cymru, Inc. srabbani(a)cymru.com | 0x53B422A8 | http://www.team-cymru.org/ "Do unto others as you would have them do unto you."

2 1

Public ntop service
by David Goulet 13 Mar '17

13 Mar '17

Hello Relay Ops! Few days ago, the bad relay team found some public ntop service running on these relays on port 3000 for which they have no or an invalid contact info. If you are one of the operator, please close or lock it down else as a safety measure we'll have to reject those relays from the network. https://atlas.torproject.org/#details/D9B536F18046990722D365BFECABBC638B41B… https://atlas.torproject.org/#details/25990FC54D7268C914170A118EE4EE7502545… https://atlas.torproject.org/#details/DB866328A5D55EBD34B5BC293FFFDD43AD81C… https://atlas.torproject.org/#details/8FD69D4C0E5CFDCD6831DD6E2141A182FC7DE… The two have contacted directly with the contact info: https://atlas.torproject.org/#details/64EB3CBCCEB760B9F647FA1B9A4053339830B… https://atlas.torproject.org/#details/BC497E213E43B51F7A893A563EEF17A99271A… And thank you for running a relay! David -- pTh3sRks6H+86/1amEcmv0zbvLoS0CTrRupKHYXthlQ=

1 0

0.2.9.10 dir port warning
by Logforme 13 Mar '17

13 Mar '17

Just upgraded my relay 855BC2DABE24C861CD887DB9B2E950424B49FC34 to 0.2.9.10 and now I get a new warning in the log file: Mar 13 12:02:22.000 [notice] Bootstrapped 100%: Done Mar 13 12:03:20.000 [warn] Cannot make an outgoing connection without a DirPort. Mar 13 12:03:21.000 [notice] Self-testing indicates your DirPort is reachable from the outside. Excellent. Publishing server descriptor. Everything is working fine, just curious about the warning. Is it an actual problem with my setup or a quirk of 0.2.9.10?

2 1

Tor and CIA leak
by Arisbe 11 Mar '17

11 Mar '17

Is there anything in the CIA documents that Wikileaks posted relating to hacking Tor? What about email providers like riseup.net?

6 7

Re: [tor-relays] [OrNetRadar] AS: "Choopa, LLC" - Linux (10)
by nusenu 11 Mar '17

11 Mar '17

Dear anonymous "Choopa 9001-9002" operator, care to set MyFamily? thanks! ornetradar(a)riseup.net: > 2017-03-10 > ----------------------------------------------------------------------------------------------------------------------- > Up|Ext|JoinTime| IP | CC | ORp | Dirp |Version | ContactInfo | Nickname | eFamlen > ----------------------------------------------------------------------------------------------------------------------- > 1 | 0 |00:22:18| 45.32.202.200 | us | 9001 | 9002 |0.2.9.10 | None | Unnamed | 1 > 1 | 0 |00:39:36| 45.32.199.231 | us | 9001 | 9002 |0.2.9.10 | None | Unnamed | 1 > 1 | 0 |00:40:12| 45.32.197.4 | us | 9001 | 9002 |0.2.9.10 | None | Unnamed | 1 > 1 | 0 |00:40:39| 45.32.194.162 | us | 9001 | 9002 |0.2.9.10 | None | Unnamed | 1 > 1 | 0 |00:41:02| 45.32.205.53 | us | 9001 | 9002 |0.2.9.10 | None | Unnamed | 1 > 1 | 0 |00:44:30| 107.191.55.26 | us | 9001 | 9002 |0.2.9.10 | None | Unnamed | 1 > 1 | 0 |00:44:59| 45.32.199.108 | us | 9001 | 9002 |0.2.9.10 | None | Unnamed | 1 > 1 | 0 |00:47:23| 45.32.207.152 | us | 9001 | 9002 |0.2.9.10 | None | Unnamed | 1 > 1 | 0 |00:47:58| 45.32.198.47 | us | 9001 | 9002 |0.2.9.10 | None | Unnamed | 1 > 1 | 0 |00:48:33| 45.32.198.25 | us | 9001 | 9002 |0.2.9.10 | None | Unnamed | 1 > Fingerprints: > C64B6833524B8351EEF8FDE4D9A2863CB51EEE8C,38A7F414C38582AFE89966D2C2F932EFA2C551A6,A865D74F4B1E33154A4C9F15DEAF4EF0EA899105,CAC71217E92A4FCE6DCB9CF66453678544558FF3,58AF0F8399DC2922F9D9E858AC50686926865A7C,F07B49E54AEEE343385798583CFE76E8E3F15AC4,8BD3BE8BF1AB050EFCF72B4709020805178488C5,4487A3F83CF83BA6D2CF05A25F18EDFAF20577CD,D7914FA39A0B00F38DD2DF574A75CDCDE1DC2C7C,284FFF4CC98E0F66F1881E4C28E9FEF0AE299492 >

1 0

Replacing secret key on exit
by Sec INT 11 Mar '17

11 Mar '17

Hi Ive been away and some of my exits dropped - I have bought a number of vps to restart my exits - is there a way that I can resurrect the previous exit that was running? I have saved the keys of the previous exit so do I just copy these over to the new exit to continue where I left off or is this not possible? Cheers Mark B Snaptor.co.uk (non commercial)

2 1

Tor Exit & Law
by Sebastian Urbach 09 Mar '17

09 Mar '17

Hi, It is almost never a good idea to run an Exit@home: https://www.torproject.org/eff/tor-legal-faq.html.en -- Sincerely yours / M.f.G. / Sincères salutations Sebastian Urbach --------------------------------------------------------------------------- Those who surrender freedom for security will not have, nor do they deserve, either one. --------------------------------------------------------------------------- - Benjamin Franklin (1706-1790)

3 2

"wubthecaptain1" relay a year later, or why running a Tor exit at home is discouraged
by Juuso Lapinlampi 09 Mar '17

09 Mar '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 A year and a month later, I suppose it's a good time to share the experiences of running "wubthecaptain1" [1] exit relay from a residential IP-address. Or, the abuse reports and mail letters that came with it and why you shouldn't run a Tor exit at home. I started running this exit on 2016-02-02, [2] which has since been turned back to a middle relay in July 2016 due to abuse complaints. [3] At the time, I believe wubthecaptain1 was the second largest Tor exit in Finland, and if I recall correctly the only one not hosted at FlokiNET. In that time, I received an uncounted amount of abuse reports from my Internet service provider, tens or hundreds of malware infection incidents daily according to ISP's autoreporter logs, and one concern from NCSC-FI/CERT-FI (FICORA) regarding a suspicion of "botnet drone". I was also interrogated by Finnish police for alleged identity crimes, fraud and attempts of fraud (and needlessly had my personal rights violated, to my belief). [4] They have since frozen the investigation and don't suspect me to be responsible for the allegations. [5] I can't say for certain these investigations to have had anything to do with wubthecaptain1 exit specifically, but that's my best guess. Now, there's something new I'd like to share with this mailing list. Starting from December 2016, – long after the exit was turned into a middle relay – I've now been targeted by four different law firms representing copyright holders, demanding reimbursements for alleged copyright infringements from residential IP-addresses assigned to wubthecaptain1 Tor exit and threats to sue to market court. The parties involved and their reimbursement demands are: - Hedman Partners (on behalf of Crystalis Entertainment UG / Scanbox Entertainment A/S), Black Sails (S3E4) (150 EUR) / Taken 3 (900 EUR) - Tekijänoikeusturva TOT (on behalf of Interallip LLP), "Z-Nation" (900 EUR) - Adultia (on behalf of Copyright Management Services Ltd / Echo Alpha Inc), various adult pornography works (16600 EUR) - NJORD Law (on behalf of Nu Image, Inc), Survivor (550 EUR), Olympus Has Fallen (550 EUR), Automata (550 EUR) According to the letters, the aclaimed infringements have happened in early or mid-2016 while wubthecaptain1 was an exit. But they've only started sending these letters months after the aclaimed infringements and court decisions. One of the parties in particular was very well aware of me hosting a Tor exit on said IP-addresses, but still sent me demands – perhaps in hopes to "fraud" the recipient of money, given how this business of sending copyright letters works. They've since seemingly taken a word to aim their demands to the actual infringer instead of me as an Internet connection subscriber and former Tor exit operator. The other parties have been more ignorant and have continued delivering me letters titled "warning of suing to market court", despite efforts to educate about shared connection / Tor. The police in Finland is not interested in investigating these letters or their sending parties from what I've heard, claiming they are a "private dispute" between the parties out of legal scope. A journalist from national public-broadcasting company Yle has become interested in these copyright letters, and is expected to publish news about them sometime in this month at Yle MOT. (I've still yet to scan the latest two received letters to them.) Nonetheless I believe the law is on my side with non-liability, so I'm not concerned for my personal legal defence. If anyone is concerned, I've not agreed to any of the imbursements so far and I've not spent any money on a lawyer or legal advice. (Though, thanks to torservers.net for the offer earlier!) I've not counted how much bandwidth was actually served and contributed to the Tor network, but it was among lines of 90 Mbps for that time and that counts for a lot in months. Since turning it to a middle relay, the actual relayed bandwidth has dropped dramatically. We need more exit relays, especially in Finland too. Meanwhile, "partyvan1" [6] exit hosted at a datacenter (AS42708 Portlane AB) has received much less abuse reports (~10/year), though the bandwidth contributed is also smaller. Since it is registered in the RIPE database to Partyvan's contact addresses, I've not heard of one complaint from the ISP and it's been a smoother experience. [7] Hope this information was helpful to someone! If anything, this should discourage other operators from running a Tor exit from home. [1]: https://atlas.torproject.org/#details/337B7E307550F48DCDADA7481FA8436B2FCDA… [2]: https://lists.torproject.org/pipermail/tor-relays/2016-July/009684.html [3]: https://lists.torproject.org/pipermail/tor-relays/2016-July/009684.html [4]: https://lists.torproject.org/pipermail/tor-relays/2016-October/010842.html [5]: https://lists.torproject.org/pipermail/tor-relays/2016-November/010918.html [6]: https://atlas.torproject.org/#details/758C1D8401F31949EB1213E4A0D831BA835C9… [7]: https://partyvan.eu/transparency/emails/abuse/ -----BEGIN PGP SIGNATURE----- iQJEBAEBCgAuFiEE6WUHsIGJcKrZ7x3kmJlxsqa3r0sFAljBQ5MQHHd1YkBwYXJ0 eXZhbi5ldQAKCRCYmXGyprevSzcBD/9ylLQiY3C/iAZTWkjmODcBnPOc7NmpwLgM oayFFSUOumHYPi68h+o2Vj06nv/t/J3i7O1K1UJtnezqf/ZGuYHSlDS3vr6SFVqA TkwTYfBKHSZJgxd8WINknMUVmtPYdJpuXfKb7gdhDVpbW62RN8rXgZ6J8/Ah6LoK 1QrsU4PhrZX0ngqgo+zmyx+93K5n9ySoD1X7FWcE5qCavoApev5Xo7p+URO6HI/n LXGPSKP/7IM09k43E87vkJ7nG/ThN3k2pOAh/X3kRH6mSrl6i1z8ga4ywhDDrRtd AMk6upOS1ZNuedCFAKzYjLDLGEUU3g4pPhjKDwVQdTB3jdK+3fICGg6EaHj/tgQY TNFNeJ8LsVl+qBjA3o3IENM76NvG08IJWg8fho8OdfuewR2310GcwV70m5qOOzMu jgqm0f+D92YnHWsQ8U+ygpYkc+DsWqahW7Xt7QNDGj3Zr1Ry8hnKrXi3+fwVLadc OhbURXu4gpVFTk9ZzPPzBp4YCBnNPypP1UZlUbQgrEET84H37DwWA6rssSVcniCX 06SCC85JhXILIcmSzNrbiS94kJCABCvIZ8yLl+zdmWA2Oy/i+VneM5Qm2E1johii xOcVDMSiWIjNKS2aGaWn+3daw+RhmzT9QYzXZcjHkzdOisyh2EnqUILfJYN5ASUn lpdcoMDTFQ== =yr2I -----END PGP SIGNATURE-----

2 1