DigitalOcean starting Exit node crackdown
Hello friends, As I recall, there are several exits running on DigitalOcean's infrastructure. This is presented FYI: Background: I've run an exit on DigitalOcean for about a year without issues (lost track of uptime duing heartbleed key regen). It wasn't hidden (the droplet name was 'tor-exit') and it had valid reverse DNS and the standard informational page was hosted there. At the time of droplet creation, tor exits were not prohibited by their ToS. I've mentioned to DigitalOcean staff during support tickets that it was a Tor exit. Today the exit was shutdown, the message received was this:
Hello
We do see that you are running an exit node for the TOR network.
Unfortunately we are unable to resume services to this droplet and ask you that you please not run any other TOR exit nodes.
Please get back to us as soon as possible so we can resolve this.
Thanks Support
I sent the following response:
Hello,
My droplet has been running for months (perhaps a year) with no significant incidents. It is well managed, allows only a strict subset of traffic to exit and the very few complaints that have been lodged have been dealt with quickly and professionally (as said by your support team). The droplet has been configured to limit the rate of traffic below the droplet's monthly network transfer quota.
It's well established that under US law ISPs are excluded from liability under the safe-harbour provisions of the DCMA for any copyright infringing traffic. More generally, the probability under US law that an ISP would be held liable carrying user-generated traffic is extremely low. Tor exits have been operated by Universities, Churches, and corporations (large and small) for slightly more that 10 years. During this time not a single criminal or civil complaint has been brought against an operator's ISP (to my knowledge).
While it is surely your right to operate your business in the manner of your choosing; I politely request an explanation for your apparent policy against Tor exit nodes. If there is some way I might change the parameters of the exit to suit a policy against specific traffic (to certain IP blocks, port ranges); I'd surely comply.
Finally, in this time where repressive regimes are cracking down on Internet traffic and persecuting their countrymen and where free access to the internet is nearing the stature of 'human right': if your policy is indeed a general one against all Tor exits, I urge you to reconsider your policy. It would be a great service to tens-of-thousands of Tor users (refugees, political activists, religious minority, abused spouses, law enforcement, &c) to revise your policy to allow well-maintained exits to remain on your network.
I appreciate any attention you could give to this serious matter.
-- nock@aphr.asia (OpenPGP: 0x6FDA11EE 3BC412E3)
On Thu, 15 May 2014 13:44:36 -0400 Shawn Nock <nock@aphr.asia> allegedly wrote:
Hello friends,
As I recall, there are several exits running on DigitalOcean's infrastructure. This is presented FYI:
Hello Shawn Thanks for posting this. Please let us know how you get on. I run a middle node on DO (plus two tails/whonix mirrors) and would be concerned if their policy is hardening against Tor. Best Mick --------------------------------------------------------------------- Mick Morgan gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 http://baldric.net ---------------------------------------------------------------------
Hello, Thanks for the info. I chose DO based on pricing, relay owners' opinions and DO's positive attitude towards tor. I wonder what they'll do, and if I should start thinking about different provider. Peter On 2014-05-15 14:14, mick wrote:
On Thu, 15 May 2014 13:44:36 -0400 Shawn Nock <nock@aphr.asia> allegedly wrote:
Hello friends, As I recall, there are several exits running on DigitalOcean's infrastructure. This is presented FYI:
Hello Shawn
Thanks for posting this. Please let us know how you get on. I run a middle node on DO (plus two tails/whonix mirrors) and would be concerned if their policy is hardening against Tor.
Best
Mick ---------------------------------------------------------------------
Mick Morgan gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 http://baldric.net [1]
---------------------------------------------------------------------
_______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays [2]
Links: ------ [1] http://baldric.net [2] https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
Shawn Nock <nock@aphr.asia> writes:
Hello friends,
As I recall, there are several exits running on DigitalOcean's infrastructure. This is presented FYI:
Background: I've run an exit on DigitalOcean for about a year without issues (lost track of uptime duing heartbleed key regen). It wasn't hidden (the droplet name was 'tor-exit') and it had valid reverse DNS and the standard informational page was hosted there. At the time of droplet creation, tor exits were not prohibited by their ToS. I've mentioned to DigitalOcean staff during support tickets that it was a Tor exit.
Update: HOLY CRAP!
Hello
Thanks for your well worded response.
You have argued your case well and we have decided to allow your tor exit node.
However please understand this is a unique case with a custom solution, by no means does this reflect our overall policy on TOR.
All cases are reviewed individually.
We will let you know if we see any further issues.
Thanks for your understanding, we have resumed your tor node.
Let us know if you have any other questions or feedback
Regards Support
-- Shawn Nock (OpenPGP: 0x6FDA11EE 3BC412E3)
On Thu, 15 May 2014 14:59:05 -0400 Shawn Nock <nock@aphr.asia> allegedly wrote:
Shawn Nock <nock@aphr.asia> writes:
Update: HOLY CRAP!
Hello
Thanks for your well worded response.
You have argued your case well and we have decided to allow your tor exit node.
Congratulations on a good outcome. Your response to DO support was obviously good enough to be used as a model for others in a similar position in future. And congrats also to DO for seeing some sense and taking the right decision. Best Mick --------------------------------------------------------------------- Mick Morgan gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 http://baldric.net ---------------------------------------------------------------------
Hi Shawn, I also run an exit on DO's infrastructure and have been for the past six months. I have received some complaints as well. Besides the usual blacklisting, DO support has contacted me twice about my exit which I've had to explain as well: My email is not relevant to this IP address. There is no information in the whois that identifies me. However, I am the owner and operator of xxx.xxx.xxx. If you access that IP directly you can see that it is a Tor Exit Router. ln which I received the response: We strongly recommend against running tor exit nodes on our droplets for this reason. Please be aware that you are responsible for any abuse generated from your droplet including that that comes across the Tor exit node you are running. Failure to resolve these issues could result in account suspension. l responded assuring them I would take care of all issues. But for them to shut down your exit is shocking. Were there any issues that needed resolving that you ignored probably? Regards, Jason On Thu, May 15, 2014 at 1:44 PM, Shawn Nock <nock@aphr.asia> wrote:
Hello friends,
As I recall, there are several exits running on DigitalOcean's infrastructure. This is presented FYI:
Background: I've run an exit on DigitalOcean for about a year without issues (lost track of uptime duing heartbleed key regen). It wasn't hidden (the droplet name was 'tor-exit') and it had valid reverse DNS and the standard informational page was hosted there. At the time of droplet creation, tor exits were not prohibited by their ToS. I've mentioned to DigitalOcean staff during support tickets that it was a Tor exit.
Today the exit was shutdown, the message received was this:
Hello
We do see that you are running an exit node for the TOR network.
Unfortunately we are unable to resume services to this droplet and ask you that you please not run any other TOR exit nodes.
Please get back to us as soon as possible so we can resolve this.
Thanks Support
I sent the following response:
Hello,
My droplet has been running for months (perhaps a year) with no significant incidents. It is well managed, allows only a strict subset of traffic to exit and the very few complaints that have been lodged have been dealt with quickly and professionally (as said by your support team). The droplet has been configured to limit the rate of traffic below the droplet's monthly network transfer quota.
It's well established that under US law ISPs are excluded from liability under the safe-harbour provisions of the DCMA for any copyright infringing traffic. More generally, the probability under US law that an ISP would be held liable carrying user-generated traffic is extremely low. Tor exits have been operated by Universities, Churches, and corporations (large and small) for slightly more that 10 years. During this time not a single criminal or civil complaint has been brought against an operator's ISP (to my knowledge).
While it is surely your right to operate your business in the manner of your choosing; I politely request an explanation for your apparent policy against Tor exit nodes. If there is some way I might change the parameters of the exit to suit a policy against specific traffic (to certain IP blocks, port ranges); I'd surely comply.
Finally, in this time where repressive regimes are cracking down on Internet traffic and persecuting their countrymen and where free access to the internet is nearing the stature of 'human right': if your policy is indeed a general one against all Tor exits, I urge you to reconsider your policy. It would be a great service to tens-of-thousands of Tor users (refugees, political activists, religious minority, abused spouses, law enforcement, &c) to revise your policy to allow well-maintained exits to remain on your network.
I appreciate any attention you could give to this serious matter.
-- nock@aphr.asia (OpenPGP: 0x6FDA11EE 3BC412E3)
_______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
Jason Odoom <jasonodoom@gmail.com> writes:
I responded assuring them I would take care of all issues. But for them to shut down your exit is shocking. Were there any issues that needed resolving that you ignored probably?
I received two complaints in the ~11 months the node has been up: 1. Someone upset about a http 'DDoS' attack who spammed the netblock owners of all traffic detected during the attack interval. It was mentioned on this list, a lot of exits got abuse complaints that day. I removed the complainers netblock from my ExitPolicy and said 'Sorry, it's Tor!' to the complainant (who was a tool). Ticket resolved in <2 hours. 2. DO does a periodic scan of it's netblocks against DroneBL (aparently). My exit turned up as 'compromised' one day for, as it turned out, connecting to Efnet... something about command and control for botnet, blah, blah. DO responded favorably to my explanation of the problem, ticket resolved <4 hours. Later DroneBL granted my removal request, but I assume my node'll show up again if anyone connects to Efnet via my exit. So no unhandled complaints. I don't know why they opened the ticket today. Maybe just funzies? Their policy page still doesn't outlaw Tor exit nodes... I've written a fair number of appeals to save exit nodes now; DO is the only reasonable response I've ever received from an ISP. Frankly, I am floored. -- Shawn Nock (OpenPGP: 0x6FDA11EE 3BC412E3)
On 2014-05-15 20:59, Jason Odoom wrote: [..]
l responded assuring them I would take care of all issues. But for them to shut down your exit is shocking.
Please note that most VPS providers work under the "everything cheap" notion. Handling abuse is expensive as it involves man power. Thus, cutting down on anything perceived as "abuse" (eg Tor, which might not be abusive per se, but can be used for purposes causing abuse), is a way to keep the costs of abuse handling down. As such, if you have a cheap VPS, it is not unlikely that they kill it off at one point or another. Thus use it as long as possible as an exit, then try it as a relay... and then well, swap provider... Greets, Jeroen
participants (5)
-
Jason Odoom -
Jeroen Massar -
mick -
Shawn Nock -
Zefir