I never heard a real technical reason to avoid high concentration of Tor exit capacity.

Let me give you a few examples why a distributed network is in some ways more resilient to attacks and harder to observe than a centralized.

Observability

If all traffic leaves the tor network at a single or very few places, surveillance becomes a lot easier and cheaper when compared to a network that is distributed and has many exit locations.

Resiliency against outages

If all capacity is concentrated around just a few locations, local issues/outages have a bigger impact on the overall availability and capacity of the network.

Resiliency against software vulnerabilities

A single operator tends to setup their systems in a relatively similar manner. Most of its relays will use the same OS, OS version, SSL library, tor version, hardware architecture and have a similar good or bad patch level. In such an environment it is more likely that a single vulnerability affects large portions when compared to a diverse ecosystem. A homogeneous ecosystem also reduces the cost for exploit development.

Resiliency against security breaches

If an hypothetical operator controlling 1/2 of the network gets compromised the impact is a lot bigger than if they were to run 1%. The incentive for an attacker to compromise an operator running 50% of the network is also a lot higher than attacking an operator of 1%.

Risk of detection The risk of detection is likely higher for an attacker that compromises multiple organizations compared to a single victim.

Cost of attacks Compromising all relays operated by a single entity is likely cheaper than compromising all relays run by multiple independent organizations.

Performing a hijacking attack against a single prefix is probably easier than successfully hijacking multiple independent prefixes with different upstream providers concurrently and harder to remain undetected.

A DDoS attack against a single AS is likely cheaper than against many targets at the same time.

There are also non-technical (organizational and legal) reasons why having a distributed network capacity is beneficial to the tor network.

Legally attacking many organizations is more expensive than a single one. If a single operator no longer has the financial capacity or motivation the removal of their relays should not have a existential impact on the network. If the policy of a hoster changes from 'tor relays allowed' to 'tor relays forbidden' than we better not run all our capacity at a single hoster.

In short, you don't want to make the tor network depend on 1-2 or 10 but many. So if a few operators disappear the network remains functional and available and is generally harder to attack.

kind regards, nusenu

Thanks for your explanation. You are right in all points. But they are a bit of theoretical, because we don't have big choice here. Further I don't think a big exit is the opposite of our goals, it's just the beginning.

I believe they are less theoretical than one might think.

One practical example that comes to mind is when the Tor network was affected by the Debian openssl bug in 2014 or the removal of outdated relays in October 2019.

Shouldn't the tor software handle the diversity?

Yes I believe it should, but I'm not sure about the exact definition of 'handle'.

My understanding is that you are looking for an authoritative answer to the question:

What is the acceptable upper limit of a relay operator in terms of fraction of the Tor network capacity (cw fraction) or an authoritative answer that there is no such limit.

Actually I was always looking forward to see someone test this practically by adding capacity (in a transparent and responsible way) since I doubt there will be a public authoritative answer that is more specific than what we have already on the record and that gets actually enforced.

On a side note: Should anyone be worried about big publicly declared operators than I would recommend to turn your eye towards less publicly declared Tor capacity that might be run with less noble intentions.

Having big fractions of the Tor network that is actually attributable to some extend will actually be beneficial to another side project I'm interested in to reduce the risk of the increasing fraction of malicious or at least rather dodgy relay capacity.

So what can we do to achieve the ideal distributed network? Throttle all (nodes) to the slowest... to get the best diversity? We need all (nodes), whether high or small capacity. Don't we?

Tor is a form of gravity well. If the cloud is not saturated, adding more nodes increases odds of traffic analysis. Among other things, tor's utilization falloff curve should probably not give many users and use cases much comfy feels. Tor's design doesn't provide a way to distributively utilize excess nodes safely, it cannot, so it tries to game and manage that as best it can. Such global throttle could help, but access to throughput will disappear, and it's still subject to same class of analysis. Tor's design can't really do much here while still being called tor. Look elsewhere for other designs.