At 22:57 10/11/2015 +1100, Tim Wilson-Brown - teor wrote:
Such "non declared" exit IP addresses (OR IP != exit IP) are found by exiting through every single exit relay to detect its exit IP.
Since exits can change their exit IP address at any time the exit list can never be 100% accurate by design.
https://collector.torproject.org/formats.html#exit-listshttps://collector.torproject.org/formats.html#exit-lists
Isn't this a bug in TorCheck? It assumes that every relay has its ORPort IP as its Exit IP (OutboundBindAddress), and most likely also assumes that each exit only has one IP.
I opened one a few days ago:
#17297: TorCheck fails on new exit egress IP not in exit DB, confusing to user https://trac.torproject.org/projects/tor/ticket/17297
#17297: TorCheck fails on new exit egress IP not in exit DB, confusing to user https://trac.torproject.org/projects/tor/ticket/17297
As said three days ago before OP...
No, I'd consider it a technique to avoid having your exit put on braindead tor-hating consensus scraping blacklists... a feature not a bug... with the great side effect that such exits are usable to circumvent similar braindead / hating censorship directed at tor users. (Thus exit operators my explicitly want to set this up and could care less what check.tpo and whatever else say, or don't say, about their IP.)
Exonerator is for operators, that's their choice there.
I'd rather add a blurb on check.tpo to hit newnym and check again if user has reason to believe they're using tor than start booting relays because of this. (Or "fixing" exit DB / check.tpo by scanning).
Also, it's routing / tunnelling / bind addressing and has nothing to do with exit policy.
If "glaring unhappy RED spits" scare people just tell them to hit "new identity", restart TBB, etc until some threshold of "bah, it's not going away" happens.
On 12 Oct 2015, at 04:12, grarpamp grarpamp@gmail.com wrote:
#17297: TorCheck fails on new exit egress IP not in exit DB, confusing to user https://trac.torproject.org/projects/tor/ticket/17297
As said three days ago before OP...
No, I'd consider it a technique to avoid having your exit put on braindead tor-hating consensus scraping blacklists... a feature not a bug... with the great side effect that such exits are usable to circumvent similar braindead / hating censorship directed at tor users. (Thus exit operators my explicitly want to set this up and could care less what check.tpo and whatever else say, or don't say, about their IP.)
Exonerator is for operators, that's their choice there.
And law enforcement use Exonerator too. So multihomed exit operators may have to explain/prove that their extra IP is a Tor exit (if given a chance), rather than having the authorities discover this while pulling the machine apart.
I'd rather add a blurb on check.tpo to hit newnym and check again if user has reason to believe they're using tor than start booting relays because of this. (Or "fixing" exit DB / check.tpo by scanning).
Also, it's routing / tunnelling / bind addressing and has nothing to do with exit policy.
As long as the operator secures the services on their machine that assume that connections from localhost are trusted, which is why exit policies have been adjusted for multihomed exits by default.
…
Tim
Tim Wilson-Brown (teor)
teor2345 at gmail dot com PGP 968F094B
teor at blah dot im OTR CAD08081 9755866D 89E2A06F E3558B7F B5A9D14F
tor-relays@lists.torproject.org
-
grarpamp -
starlight.2015q3＠binnacle.cx -
Tim Wilson-Brown - teor