- tor-relays - lists.torproject.org

Tor Exit & Law
by Sebastian Urbach 09 Mar '17

09 Mar '17

Hi, It is almost never a good idea to run an Exit@home: https://www.torproject.org/eff/tor-legal-faq.html.en -- Sincerely yours / M.f.G. / Sincères salutations Sebastian Urbach --------------------------------------------------------------------------- Those who surrender freedom for security will not have, nor do they deserve, either one. --------------------------------------------------------------------------- - Benjamin Franklin (1706-1790)

3 2

"wubthecaptain1" relay a year later, or why running a Tor exit at home is discouraged
by Juuso Lapinlampi 09 Mar '17

09 Mar '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 A year and a month later, I suppose it's a good time to share the experiences of running "wubthecaptain1" [1] exit relay from a residential IP-address. Or, the abuse reports and mail letters that came with it and why you shouldn't run a Tor exit at home. I started running this exit on 2016-02-02, [2] which has since been turned back to a middle relay in July 2016 due to abuse complaints. [3] At the time, I believe wubthecaptain1 was the second largest Tor exit in Finland, and if I recall correctly the only one not hosted at FlokiNET. In that time, I received an uncounted amount of abuse reports from my Internet service provider, tens or hundreds of malware infection incidents daily according to ISP's autoreporter logs, and one concern from NCSC-FI/CERT-FI (FICORA) regarding a suspicion of "botnet drone". I was also interrogated by Finnish police for alleged identity crimes, fraud and attempts of fraud (and needlessly had my personal rights violated, to my belief). [4] They have since frozen the investigation and don't suspect me to be responsible for the allegations. [5] I can't say for certain these investigations to have had anything to do with wubthecaptain1 exit specifically, but that's my best guess. Now, there's something new I'd like to share with this mailing list. Starting from December 2016, – long after the exit was turned into a middle relay – I've now been targeted by four different law firms representing copyright holders, demanding reimbursements for alleged copyright infringements from residential IP-addresses assigned to wubthecaptain1 Tor exit and threats to sue to market court. The parties involved and their reimbursement demands are: - Hedman Partners (on behalf of Crystalis Entertainment UG / Scanbox Entertainment A/S), Black Sails (S3E4) (150 EUR) / Taken 3 (900 EUR) - Tekijänoikeusturva TOT (on behalf of Interallip LLP), "Z-Nation" (900 EUR) - Adultia (on behalf of Copyright Management Services Ltd / Echo Alpha Inc), various adult pornography works (16600 EUR) - NJORD Law (on behalf of Nu Image, Inc), Survivor (550 EUR), Olympus Has Fallen (550 EUR), Automata (550 EUR) According to the letters, the aclaimed infringements have happened in early or mid-2016 while wubthecaptain1 was an exit. But they've only started sending these letters months after the aclaimed infringements and court decisions. One of the parties in particular was very well aware of me hosting a Tor exit on said IP-addresses, but still sent me demands – perhaps in hopes to "fraud" the recipient of money, given how this business of sending copyright letters works. They've since seemingly taken a word to aim their demands to the actual infringer instead of me as an Internet connection subscriber and former Tor exit operator. The other parties have been more ignorant and have continued delivering me letters titled "warning of suing to market court", despite efforts to educate about shared connection / Tor. The police in Finland is not interested in investigating these letters or their sending parties from what I've heard, claiming they are a "private dispute" between the parties out of legal scope. A journalist from national public-broadcasting company Yle has become interested in these copyright letters, and is expected to publish news about them sometime in this month at Yle MOT. (I've still yet to scan the latest two received letters to them.) Nonetheless I believe the law is on my side with non-liability, so I'm not concerned for my personal legal defence. If anyone is concerned, I've not agreed to any of the imbursements so far and I've not spent any money on a lawyer or legal advice. (Though, thanks to torservers.net for the offer earlier!) I've not counted how much bandwidth was actually served and contributed to the Tor network, but it was among lines of 90 Mbps for that time and that counts for a lot in months. Since turning it to a middle relay, the actual relayed bandwidth has dropped dramatically. We need more exit relays, especially in Finland too. Meanwhile, "partyvan1" [6] exit hosted at a datacenter (AS42708 Portlane AB) has received much less abuse reports (~10/year), though the bandwidth contributed is also smaller. Since it is registered in the RIPE database to Partyvan's contact addresses, I've not heard of one complaint from the ISP and it's been a smoother experience. [7] Hope this information was helpful to someone! If anything, this should discourage other operators from running a Tor exit from home. [1]: https://atlas.torproject.org/#details/337B7E307550F48DCDADA7481FA8436B2FCDA… [2]: https://lists.torproject.org/pipermail/tor-relays/2016-July/009684.html [3]: https://lists.torproject.org/pipermail/tor-relays/2016-July/009684.html [4]: https://lists.torproject.org/pipermail/tor-relays/2016-October/010842.html [5]: https://lists.torproject.org/pipermail/tor-relays/2016-November/010918.html [6]: https://atlas.torproject.org/#details/758C1D8401F31949EB1213E4A0D831BA835C9… [7]: https://partyvan.eu/transparency/emails/abuse/ -----BEGIN PGP SIGNATURE----- iQJEBAEBCgAuFiEE6WUHsIGJcKrZ7x3kmJlxsqa3r0sFAljBQ5MQHHd1YkBwYXJ0 eXZhbi5ldQAKCRCYmXGyprevSzcBD/9ylLQiY3C/iAZTWkjmODcBnPOc7NmpwLgM oayFFSUOumHYPi68h+o2Vj06nv/t/J3i7O1K1UJtnezqf/ZGuYHSlDS3vr6SFVqA TkwTYfBKHSZJgxd8WINknMUVmtPYdJpuXfKb7gdhDVpbW62RN8rXgZ6J8/Ah6LoK 1QrsU4PhrZX0ngqgo+zmyx+93K5n9ySoD1X7FWcE5qCavoApev5Xo7p+URO6HI/n LXGPSKP/7IM09k43E87vkJ7nG/ThN3k2pOAh/X3kRH6mSrl6i1z8ga4ywhDDrRtd AMk6upOS1ZNuedCFAKzYjLDLGEUU3g4pPhjKDwVQdTB3jdK+3fICGg6EaHj/tgQY TNFNeJ8LsVl+qBjA3o3IENM76NvG08IJWg8fho8OdfuewR2310GcwV70m5qOOzMu jgqm0f+D92YnHWsQ8U+ygpYkc+DsWqahW7Xt7QNDGj3Zr1Ry8hnKrXi3+fwVLadc OhbURXu4gpVFTk9ZzPPzBp4YCBnNPypP1UZlUbQgrEET84H37DwWA6rssSVcniCX 06SCC85JhXILIcmSzNrbiS94kJCABCvIZ8yLl+zdmWA2Oy/i+VneM5Qm2E1johii xOcVDMSiWIjNKS2aGaWn+3daw+RhmzT9QYzXZcjHkzdOisyh2EnqUILfJYN5ASUn lpdcoMDTFQ== =yr2I -----END PGP SIGNATURE-----

2 1

Running Tor relay inside Qubes
by William Denton 09 Mar '17

09 Mar '17

Has anyone tried running a Tor relay inside Qubes [1]? Would it work? Does it make sense? I run relays as myself, in a shell in tmux [2], compiled from the latest stable release. I'm wondering if using Qubes to isolate it on its own, away from anything else on the machine, could add a useful layer of security. Bill [1] https://www.qubes-os.org/ [2] https://tmux.github.io/ -- William Denton :: Toronto, Canada :: https://www.miskatonic.org/ Caveat lector.

2 1

Logfile: Tor overloaded or attacked
by Petrarca 09 Mar '17

09 Mar '17

Hello all, I just got the following in my tor logfile: [warn] Your Guard GrmmlLitavis ($8C00FA7369A7A308F6A137600F0FA07990D9D451) is failing a very large amount of circuits. Most likely this means the Tor network is overloaded, but it could also mean an attack against you or potentially the guard itself. Success counts are 105/214. Use counts are 71/74. 194 circuits completed, 9 were unusable, 80 collapsed, and 9 timed out. For reference, your timeout cutoff is 60 seconds. Any idea what it really means - is Tor really overloaded or anyone aware of attacks; anything special I could or should do?

3 2

(no subject)
by Даниил Орлов 07 Mar '17

07 Mar '17

1 0

(no subject)
by Raymond Bordt 07 Mar '17

07 Mar '17

1 0

new Atlas feature: Not Recommended Tor Version
by nusenu 07 Mar '17

07 Mar '17

I'd like to highlight a new Atlas feature [1]: Atlas now displays a red "!" if the relay runs a tor version that is not recommended by the tor directory authorities. Examples https://atlas.torproject.org/#/top10 Thanks to RaBe and irl for adding this. [1] https://trac.torproject.org/projects/tor/ticket/21367

5 5

torpids family seems outdated
by Felix 05 Mar '17

05 Mar '17

Hi torpids AT yahoo dot com Thank you very much for so many relays labeled torpids*. Are there contradictions in the announcement of the family ? Torstatus [1] returns 32 family members and fingerprints. Altas [2] shows as biggest family section a number of 8 relays. The manual compare of the fingerprints shows to me: * 8 relay fingerprints match and are within the pronounced family * the other 24 relays are out of the pronounced family Is the observation correct ? [1] http:// jlve2y45zacpbz6s.onion/router_detail.php?FP=0cf8f3e6590f45d50b70f2f7da6605eca6cd408f [2] https:// atlas.torproject.org/#details/6B7191639E179965FD694612C9B2C8FB4267B27D -- Best regards, Felix

1 0

www.artikel5ev.de relays: please update 'MyFamily' in your torrc
by nusenu 05 Mar '17

05 Mar '17

Hi artikel5ev, thanks for running tor relays. Please do not forget to set/update the MyFamily parameter in your torrc configuration to tell clients your relays belong to a single operator, otherwise they might use your relays in multiple positions within a circuit, which is rather bad for their anonymity. If you need help with the MyFamily option let us know. thanks, nusenu https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan… https://github.com/nusenu/ansible-relayor The counter in the last column should match the number of rows: +---------------------+--------------+---------------+ | first_seen | nickname | FamilyMembers | +---------------------+--------------+---------------+ | 2014-04-11 23:00:00 | dc6jgk2 | 20 | | 2014-05-17 21:00:00 | dc6jgk3 | 20 | | 2014-06-09 18:00:00 | dc6jgk1 | 20 | | 2014-08-04 19:00:00 | dc6jgk4 | 20 | | 2016-07-22 22:00:00 | h3rmi | 19 | | 2016-09-05 17:00:00 | dc6jgk5 | 20 | | 2016-10-06 23:00:00 | dc6jgk6 | 20 | | 2016-10-19 19:00:00 | artikel5ev1 | 20 | | 2016-10-29 00:00:00 | artikel5ev2 | 20 | | 2016-11-04 03:00:00 | dc6jgk7 | 20 | | 2016-11-06 23:00:00 | dc6jgk8 | 20 | | 2016-11-07 19:00:00 | artikel5ev3 | 20 | | 2016-11-11 02:00:00 | dc6jgk9 | 20 | | 2016-11-11 02:00:00 | dc6jgk11 | 20 | | 2016-11-11 02:00:00 | dc6jgk10 | 20 | | 2016-11-13 04:00:00 | dc6jgk12 | 20 | | 2017-02-05 20:00:00 | tweinbrenner | 19 | | 2017-03-01 22:00:00 | utzer1 | 19 | | 2017-03-01 23:00:00 | utzer1 | NULL | | 2017-03-02 01:00:00 | utzer2 | 19 | | 2017-03-03 15:00:00 | tweinbrenner | NULL | | 2017-03-05 01:00:00 | Artikel5ev6 | 16 | +---------------------+--------------+---------------+ 22 rows

1 0

dipulse.it relays: please specify 'MyFamily' in your torrc
by nusenu 05 Mar '17

05 Mar '17

Hi, thanks for adding more tor relays. Please do not forget to set the MyFamily parameter in your torrc configuration to tell clients your relays belong to a single operator, otherwise they might use your relays in multiple positions within a circuit, which is rather bad for their anonymity. If you need help with the MyFamily option let us know. thanks, nusenu https://github.com/nusenu/ansible-relayor https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan… ornetradar(a)riseup.net: > 2017-02-19 > ----------------------------------------------------------------------------------------------------------------------- > Up|Ext|JoinTime| IP | AS | CC | ORp | Dirp | OS | Version | Nickname | eFamlen > ----------------------------------------------------------------------------------------------------------------------- > 1 | 0 | 12:53:10 | 163.172.189.100 | Online S.a.s. | fr | 8443 | 8080 | Linux | 0.3.1.0-alpha-dev | DipulseFR15 | 1 > 1 | 0 | 12:49:39 | 163.172.181.240 | Online S.a.s. | fr | 8443 | 8080 | Linux | 0.3.1.0-alpha-dev | DipulseFR16 | 1 > 1 | 0 | 12:45:42 | 163.172.187.152 | Online S.a.s. | fr | 8443 | 8080 | Linux | 0.3.1.0-alpha-dev | DipulseFR14 | 1 > 1 | 0 | 12:51:17 | 163.172.183.161 | Online S.a.s. | fr | 8443 | 8080 | Linux | 0.3.1.0-alpha-dev | DipulseFR18 | 1 > 1 | 0 | 12:42:14 | 163.172.160.239 | Online S.a.s. | fr | 8443 | 8080 | Linux | 0.3.1.0-alpha-dev | DipulseFR13 | 1 > 1 | 0 | 12:52:08 | 163.172.183.220 | Online S.a.s. | fr | 8443 | 8080 | Linux | 0.2.8.12 | DipulseFR19 | 1 > 1 | 0 | 12:46:43 | 212.47.245.227 | Online S.a.s. | fr | 8443 | 8080 | Linux | 0.3.1.0-alpha-dev | DipulseFR12 | 1 > 1 | 0 | 12:55:27 | 212.47.236.157 | Online S.a.s. | fr | 8443 | 8080 | Linux | 0.3.1.0-alpha-dev | DipulseFR17 | 1 > 1 | 0 | 14:29:40 | 163.172.166.1 | Online S.a.s. | fr | 8443 | 8080 | Linux | 0.3.1.0-alpha-dev | DipulseFR11 | 1 > Fingerprints: > 5928164F3759E3710393E7DC1ED69FACB669BE82,0211F6543B8EB8BE2AAD17ABD05635BD135FFCF7,D3FA077CE59A2D13B6E6B8C62B04A2C03BAC784F,8D60E9C8DB03BE39159B8824680ACCBD642ACF62,AF59C8E3CBB0B2C34D2BDCBA55CD7282BAA22B22,B66760160753DD26A6FD1B4B87F9CB3D0EEACC2D,619B69FD8F3A4642E2E8E40B5E97D2875496C829,B5CFDBA1E8DAFE061C5D259BBC44BF994ACB8C26,EFDCB52BD37CDDEFDD38DEF3F6C7A60DCCF099EE >

1 2