Hello all,
I just spun up 2 relays (1 exit, 1 non-exit) in Amsterdam using DigitalOcean as the VPS provider. It's been up for about 8 hours now. Here was the message I sent to them regarding the servers:
/* Quote
Hello,
I just spun up a couple servers in Amsterdam to act as relays in the Tor network (see https://www.torproject.org/about/overview.html.en). I just wanted to file this ticket so that you were aware of those servers' purpose. One is simply a non-exit relay meaning that all traffic is encrypted and ultimately routed to another tor server before it connects to the destination IP (no risk there). The other is an exit relay that establishes the final connection for the client. This box has a bit more risk because it's IP will be used for the connection. Now, according to law, the exit relay cannot be held responsible for the traffic because it is merely a pass-through server with no knowledge of the traffic - much like any ISP - but there hasn't been a firm legal precedent set yet to my knowledge.
The purpose of the Tor server is to facilitate internet traffic for those that might be subject to laws that censor legitimate content (China, North Korea, Iran, etc...). It also acts as a safety net for the press so that they cannot be easily tracked when working on dangerous assignments.
I read a couple other forum posts regarding your TOC and saw that you pass the liability on to the customer because you don't have control over what each droplet is used for. This is in essence the exact same case with a Tor relay.
I have configured my exit relay to block a large number of ports that are typically used for torrents to reduce the possibility of any complaints.
Please let me know if you have any questions.
Thanks,
Adam
End Quote */
And here is there response:
/* Quote
Hello,
While TOR exit-nodes are allowed under our TOS we strong discourage them because of the abuse complaints they generate. As you mentioned, you are responsible for any traffic generated by your droplets. While in the future there may be a precedent that grants safe-harbor status to TOR exit nodes, there is no such precedent under US Law at this time and the responsibility remains with you. You will be responsible to resolve any abuse complaints lodged against you related to this droplet. If we can be of any further assistance please let us know.
Thanks Ryan
Posted on 08/22/13 at 13:49 Gravatar Ryan Quinn
End Quote */
I am based out of the US. Is there anything I should be careful with hosting an offshore Tor exit node? I already used the limited tor port list that was in the wiki.
The other thing that I am weighing is just a moral question regarding misuse of the Tor network for despicable things like child porn. I understand that of all the traffic it is a small percentage and that ISPs essentially face the same dilemma, but I wonder if more can be done to make Tor resistant to evil usage.
Thanks.
You cannot make Tor resistant to "evil usage". Evil usage is defined by your personal morals on one level, and by governments via the laws the enact and prosecute on the other level. Tor's raison d'etre is to allow people to use the internet freely when their personal morals and their government's collide. You could put a censoring proxy in front of your exit node. But that would defeat the purpose of Tor entirely...
Other people will have to comment on the possible problems you face operating a tor node in the Netherlands via a US company being in the US. That should be a common enough scenario to find a few people who have done that.
Best, Luke
2013/8/22 a432511 a432511@mail49.org:
Hello all,
I just spun up 2 relays (1 exit, 1 non-exit) in Amsterdam using DigitalOcean as the VPS provider. It's been up for about 8 hours now. Here was the message I sent to them regarding the servers:
/* Quote
Hello,
I just spun up a couple servers in Amsterdam to act as relays in the Tor network (see https://www.torproject.org/about/overview.html.en). I just wanted to file this ticket so that you were aware of those servers' purpose. One is simply a non-exit relay meaning that all traffic is encrypted and ultimately routed to another tor server before it connects to the destination IP (no risk there). The other is an exit relay that establishes the final connection for the client. This box has a bit more risk because it's IP will be used for the connection. Now, according to law, the exit relay cannot be held responsible for the traffic because it is merely a pass-through server with no knowledge of the traffic - much like any ISP - but there hasn't been a firm legal precedent set yet to my knowledge.
The purpose of the Tor server is to facilitate internet traffic for those that might be subject to laws that censor legitimate content (China, North Korea, Iran, etc...). It also acts as a safety net for the press so that they cannot be easily tracked when working on dangerous assignments.
I read a couple other forum posts regarding your TOC and saw that you pass the liability on to the customer because you don't have control over what each droplet is used for. This is in essence the exact same case with a Tor relay.
I have configured my exit relay to block a large number of ports that are typically used for torrents to reduce the possibility of any complaints.
Please let me know if you have any questions.
Thanks,
Adam
End Quote */
And here is there response:
/* Quote
Hello,
While TOR exit-nodes are allowed under our TOS we strong discourage them because of the abuse complaints they generate. As you mentioned, you are responsible for any traffic generated by your droplets. While in the future there may be a precedent that grants safe-harbor status to TOR exit nodes, there is no such precedent under US Law at this time and the responsibility remains with you. You will be responsible to resolve any abuse complaints lodged against you related to this droplet. If we can be of any further assistance please let us know.
Thanks Ryan
Posted on 08/22/13 at 13:49 Gravatar Ryan Quinn
End Quote */
I am based out of the US. Is there anything I should be careful with hosting an offshore Tor exit node? I already used the limited tor port list that was in the wiki.
The other thing that I am weighing is just a moral question regarding misuse of the Tor network for despicable things like child porn. I understand that of all the traffic it is a small percentage and that ISPs essentially face the same dilemma, but I wonder if more can be done to make Tor resistant to evil usage.
Thanks. _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
Am 2013-08-22 17:28, schrieb Lukas Erlacher:
You could put a censoring proxy in front of your exit node. But that would defeat the purpose of Tor entirely...
... and will eventually lead to your relay being flagged as a bad exit node. Tampering with exit traffic is strongly discouraged [1].
Paul
[1] https://trac.torproject.org/projects/tor/wiki/doc/badRelays
On Thu, 22 Aug 2013 08:45:33 -0500 a432511 a432511@mail49.org allegedly wrote:
I just spun up 2 relays (1 exit, 1 non-exit) in Amsterdam using DigitalOcean as the VPS provider. It's been up for about 8 hours now. Here was the message I sent to them regarding the servers:
I have three DigitalOcean VMs. One in Amsterdam is a (non-exit) relay (https://baldric.net/2013/01/13/what-a-difference-a-gig-makes/), the other two, in SanFrancisco and NYC, are tails mirrors. /Before/ starting the tor relay I specifically asked DO if they had any problems with tor. They told me much what they have apparently told you. Certainly I gained the impression that they would not be happy if their IP addresses appeared in abuse complaints. (https://www.digitalocean.com/community/questions/tor) I followed up that conversation in a support ticket and they have been fine with me running a relay ever since.
The other thing that I am weighing is just a moral question regarding misuse of the Tor network for despicable things like child porn. I understand that of all the traffic it is a small percentage and that ISPs essentially face the same dilemma, but I wonder if more can be done to make Tor resistant to evil usage.
Tor is neutral. You and I may agree that certain usage is unwelcome, even abhorrent, but we cannot dictate how others may use an anonymising service we agree to provide. If you have a problem with that, you probably should not be running a tor node.
Best
Mick
---------------------------------------------------------------------
Mick Morgan gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 http://baldric.net
---------------------------------------------------------------------
On Aug 22, 2013, at 11:56 AM, mick mbm@rlogin.net wrote:
The other thing that I am weighing is just a moral question regarding misuse of the Tor network for despicable things like child porn. I understand that of all the traffic it is a small percentage and that ISPs essentially face the same dilemma, but I wonder if more can be done to make Tor resistant to evil usage.
Tor is neutral. You and I may agree that certain usage is unwelcome, even abhorrent, but we cannot dictate how others may use an anonymising service we agree to provide. If you have a problem with that, you probably should not be running a tor node.
Then why have exit policies? Exit nodes regularly block "unwelcome" traffic like bittorrent, and there's only a slight functional difference between that and using a filter in front of the node to block things like porn (which, come to think of it, also tends to be a bandwidth hog like bittorrent--so it doesn't have to be just a moral question). If someone has a problem with exit nodes blocking things like porn (or bittorrent, or...), then they probably should not be using Tor.
The very idea of Tor is based on moral convictions (e.g., that personal privacy is a good thing, that human rights violations and abuse of power are bad things, etc.). So Tor is most definitely not neutral, nor can it be--because, if it is to exist and flourish, those moral convictions must remain at its foundation. One cannot on the one hand claim that human rights violations are "wrong" while on the other hand claiming that pornography (especially child porn) is "right." If one wants further proof that Tor has a moral component, one has only to visit http://www.torproject.org, click the "About Tor" link, and notice the discussion points. I doubt that anyone could convince the Tor team to add "...for unfettered access to pornography..." as a bullet point under "Why we need Tor."
The Tor devs go to great lengths to try to keep "evil" governments from using Tor against itself. Why not devote some effort toward keeping "evil" traffic off of Tor? Given the fact that "we need more relays" is the common mantra, it seems to me that if the Tor community could come up with a technical answer to address at least some of the most egregious abuses of Tor--things like child porn, or even porn in general, that either have nothing to do with Tor's foundational mission, or (like child porn) are antithetical to it--the result would be greater public support for the technology, and a wider deployment base.
It's worth discussion.
Jon
On Tue, 27 Aug 2013 11:08:34 +0000, Jon Gardner wrote: ...
Then why have exit policies?
To keep spammers at bay (or getting your exit blacklisted); to keep traffic at bay (bittorrent), to keep law harrassment at bay (again bittorrent, others as well).
Exit nodes regularly block "unwelcome" traffic like bittorrent, and there's only a slight functional difference between that and using a filter in front of the node to block things like porn
THe point is that the exit policy is a decision of the exit operator in question, not of the network as a whole. If you want to access something you just need to find some exit that allows it.
Who should even decide what 'porn' means, or do you expect each exit operator to maintain his own blacklist?
The very idea of Tor is based on moral convictions (e.g., that personal privacy is a good thing, that human rights violations and abuse of power are bad things, etc.). So Tor is most definitely not neutral, nor can it be--because, if it is to exist and flourish, those moral convictions must remain at its foundation.
No. The underlying conviction of tor is that communication shall be free, not censored. Besides there is pretty little whose transport via a network should reasonably be illegal.
One cannot on the one hand claim that human rights violations are "wrong" while on the other hand claiming that pornography (especially child porn) is "right." If one wants further proof that Tor has a moral component, one has only to visit http://www.torproject.org, click the "About Tor" link, and notice the discussion points. I doubt that anyone could convince the Tor team to add "...for unfettered access to pornography..." as a bullet point under "Why we need Tor."
No. But if you want to ensure unfettered access to X, that necessarily implies unfettered access ot Y, for any values of X and Y. Any mean to disable access to Y implies that the tor network can be forced as well to disable access to X.
The Tor devs go to great lengths to try to keep "evil" governments from using Tor against itself. Why not devote some effort toward keeping "evil" traffic off of Tor? Given the fact that "we need more relays" is the common mantra, it seems to me that if the Tor community could come up with a technical answer to address at least some of the most egregious abuses of Tor--things like child porn, or even porn in general, that either have nothing to do with Tor's foundational mission, or (like child porn) are antithetical to it--the result would be greater public support for the technology, and a wider deployment base.
What do you think how long it takes, when we block X, we start getting requests (or worse, think NSL) to block Y. The moment tor gets a global block list I will pull the plug on my relays.
Besides: You didn't mention any idea how to actually find and enumerate the things you apparently want to block. Or how not to overblock. There isn't even a government entity that has this problem solved.
Andreas
On 08/28/2013 12:08 AM, Jon Gardner wrote:
Then why have exit policies? Exit nodes regularly block "unwelcome" traffic like bittorrent, and there's only a slight functional difference between that and using a filter in front of the node to block things like porn (which, come to think of it, also tends to be a bandwidth hog like bittorrent--so it doesn't have to be just a moral question).
I do not wish to comment on the morality or desirability of traffic filters, but on the implementation:
It is much easier to block the majority of BitTorrent traffic than it is to block specific content served through HTTP. Torrent traffic can be blocked by the reduced exit policy https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy, which is a static whitelist of ports to allow. To do the same thing for content over HTTP, one would have to maintain a dynamic blacklist of IPs (or IP/port combinations) to block, which is much more challenging. An even more challenging alternative would be to implement deep packet inspection https://en.wikipedia.org/wiki/Deep_packet_inspection at the exit nodes---I think this is completely unpalatable to most Tor developers and exit node operators (and maybe illegal under US wiretapping laws).
Vincent
On Tue, 27 Aug 2013 11:08:34 -0500 Jon Gardner jon@brazoslink.net allegedly wrote:
On Aug 22, 2013, at 11:56 AM, mick mbm@rlogin.net wrote:
Tor is neutral. You and I may agree that certain usage is unwelcome, even abhorrent, but we cannot dictate how others may use an anonymising service we agree to provide. If you have a problem with that, you probably should not be running a tor node.
Then why have exit policies? Exit nodes regularly block "unwelcome" traffic like bittorrent, and there's only a slight functional difference between that and using a filter in front of the node to block things like porn (which, come to think of it, also tends to be a bandwidth hog like bittorrent--so it doesn't have to be just a moral question). If someone has a problem with exit nodes blocking things like porn (or bittorrent, or...), then they probably should not be using Tor.
The very idea of Tor is based on moral convictions (e.g., that personal privacy is a good thing, that human rights violations and abuse of power are bad things, etc.).
Nope. Not in my view. Tor's USP is anonymity of access to any and all network resources. I say again, tor is neutral. It cares not about what those resources are - it just shovels bits.
And as a relay operator I cannot say that bits of type A are OK to retrieve but not bits of type B. I do not even know what type of bits are transferred.
As someone else here said "censorship implies surveillance".
The Tor devs go to great lengths to try to keep "evil" governments from using Tor against itself. Why not devote some effort toward keeping "evil" traffic off of Tor?
Define "evil" (or its converse "good"). I'd bet that given any random selection of people in a room you'd get a broad spectrum of views. The only way you can safely meet /all/ those views is not to take a position at all and remain neutral.
I repeat tor is neutral.
It's worth discussion.
I agree.
Best
Mick ---------------------------------------------------------------------
Mick Morgan gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 http://baldric.net
---------------------------------------------------------------------
On Tue, Aug 27, 2013 at 11:08:34AM -0500, Jon Gardner wrote:
Then why have exit policies? Exit nodes regularly block "unwelcome" traffic like bittorrent, and there's only a slight functional difference between that and using a filter in front of the node to block things like porn
The exit policy is a public statement to the Tor network by the exit node about what traffic it is willing to transport. Users who wish to use a particular TCP port can consult the consensus and find an exit node which meets their needs.
By contrast, a porn blacklist would presumably prevent particular HTTP requests from being satisfied, based on analysis of the contents of the requests. In other words, the pornfiltering-exit-node offered to transport port 80, but then reneged on the offer when it looked inside the box and didn't like what it found.
If only there were a separate TCP port for HTTP-with-Porn and all the pornographers used it, then an exit policy for "HTTP-without-porn" would be possible. But alas, we don't even have vague agreement on what constitutes porn, much less a social contract requiring all pornographers to segregate their traffic for our convenience.
RFC6969, Pornographic HTTP. #ideasforapril1
Consider http://www.ietf.org/rfc/rfc3514.txt --
Firewalls, packet filters, intrusion detection systems, and the like often have difficulty distinguishing between packets that have malicious intent and those that are merely unusual. The problem is that making such determinations is hard. To solve this problem, we define a security flag, known as the "evil" bit, in the IPv4 header. Benign packets have this bit set to 0; those that are used for an attack will have the bit set to 1.
-andy
On Tue, 27 Aug 2013 19:34:13 -0700 Andy Isaacson adi@hexapodia.org allegedly wrote:
If only there were a separate TCP port for HTTP-with-Porn and all the pornographers used it, then an exit policy for "HTTP-without-porn" would be possible. But alas, we don't even have vague agreement on what constitutes porn, much less a social contract requiring all pornographers to segregate their traffic for our convenience.
RFC6969, Pornographic HTTP. #ideasforapril1
Wonderful! Love it. (I have often pondered the possibility of a DPI "porn filter" which rejects traffic based on the "proportion of flesh coloured packets to the total" or some such nonsense. Second order problem - define "flesh coloured".)
Best
Mick ---------------------------------------------------------------------
Mick Morgan gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 http://baldric.net
---------------------------------------------------------------------
HTTP-without-porn should be called BurkaHTTP. I'm sure there's a backronym that will fit… On Aug 28, 2013 4:15 AM, "mick" mbm@rlogin.net wrote:
On Tue, 27 Aug 2013 19:34:13 -0700 Andy Isaacson adi@hexapodia.org allegedly wrote:
If only there were a separate TCP port for HTTP-with-Porn and all the pornographers used it, then an exit policy for "HTTP-without-porn" would be possible. But alas, we don't even have vague agreement on what constitutes porn, much less a social contract requiring all pornographers to segregate their traffic for our convenience.
RFC6969, Pornographic HTTP. #ideasforapril1
Wonderful! Love it. (I have often pondered the possibility of a DPI "porn filter" which rejects traffic based on the "proportion of flesh coloured packets to the total" or some such nonsense. Second order problem - define "flesh coloured".)
Best
Mick
Mick Morgan gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 http://baldric.net
tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
On Tue, Aug 27, 2013 at 11:08:34AM -0500, Jon Gardner wrote:
Then why have exit policies? Exit nodes regularly block "unwelcome" traffic like bittorrent, and there's only a slight functional difference between that and using a filter in front of the node to block things like porn
There's a considerable functional difference: an exit policy is a defined list of specific hosts and ports to accept/reject, and it's advertised in the exit's descriptor. Your client can just pick a different exit node if the connection it wants to make is not permitted by a given exit's policy. A "porn filter" is inherently fuzzy and unpredictable, so couldn't be implemented without breaking clients trying to use that node. Filtering traffic other than as declared by your exit policy should and will get your exit the BadExit flag.
(which, come to think of it, also tends to be a bandwidth hog like bittorrent--so it doesn't have to be just a moral question). If someone has a problem with exit nodes blocking things like porn (or bittorrent, or...), then they probably should not be using Tor.
LOL
The very idea of Tor is based on moral convictions (e.g., that personal privacy is a good thing, that human rights violations and abuse of power are bad things, etc.). So Tor is most definitely not neutral, nor can it be-- because, if it is to exist and flourish, those moral convictions must remain at its foundation. One cannot on the one hand claim that human rights violations are "wrong" while on the other hand claiming that pornography
What the epic fucking fuck? You want to censor *porn in general*, even aside from the arbitrary age line? What's wrong with you?
(especially child porn) is "right." If one wants further proof that Tor has a moral component, one has only to visit http://www.torproject.org, click the "About Tor" link, and notice the discussion points.
Why, yes, some of us are actually consistently against enforcing thoughtcrimes. What a concept!
I doubt that anyone could convince the Tor team to add "...for unfettered access to pornography..." as a bullet point under "Why we need Tor."
I don't write the web site, but I'd be all in favor of it. The Anti-Sex League is as pernicious as the rest of the damn censors.
The Tor devs go to great lengths to try to keep "evil" governments from using Tor against itself. Why not devote some effort toward keeping "evil" traffic off of Tor?
Because the whole point is to build a censorship-resistant infrastructure that doesn't wire your notions of 'evil' into the network.
Given the fact that "we need more relays" is the common mantra, it seems to me that if the Tor community could come up with a technical answer to address at least some of the most egregious abuses of Tor--things like child porn, or even porn in general, that either have nothing to do with Tor's foundational mission, or (like child porn) are antithetical to it--the result would be greater public support for the technology, and a wider deployment base.
If I were going to work on filtering by technical means, it'd be filters to keep neo-Puritans like you out of my life, thanks.
On 8/30/13, Andrea Shepard andrea@torproject.org wrote:
On Tue, Aug 27, 2013 at 11:08:34AM -0500, Jon Gardner wrote:
Then why have exit policies? Exit nodes regularly block "unwelcome" traffic like bittorrent, and there's only a slight functional difference between that and using a filter in front of the node to block things like porn
There's a considerable functional difference: an exit policy is a defined list of specific hosts and ports to accept/reject, and it's advertised in the exit's descriptor. Your client can just pick a different exit node if the connection it wants to make is not permitted by a given exit's policy. A "porn filter" is inherently fuzzy and unpredictable, so couldn't be implemented without breaking clients trying to use that node. Filtering traffic other than as declared by your exit policy should and will get your exit the BadExit flag.
This is why we need to implement extended exit flags for exits that want to run post-exit filtering/enhancement policies, say for example "noporn" that way we can get all the religious groups dumping their tithes into not just beaming reruns of the 700 club around the world, but a pile of uber fast exits too.
And how about "novirus" delivered by microsoft "doublesyourcoins" propped up by the donations of fools "trusted" run by legit governments
On Sat, Aug 31, 2013 at 12:27:22AM -0400, grarpamp wrote:
On 8/30/13, Andrea Shepard andrea@torproject.org wrote:
On Tue, Aug 27, 2013 at 11:08:34AM -0500, Jon Gardner wrote:
Then why have exit policies? Exit nodes regularly block "unwelcome" traffic like bittorrent, and there's only a slight functional difference between that and using a filter in front of the node to block things like porn
There's a considerable functional difference: an exit policy is a defined list of specific hosts and ports to accept/reject, and it's advertised in the exit's descriptor. Your client can just pick a different exit node if the connection it wants to make is not permitted by a given exit's policy. A "porn filter" is inherently fuzzy and unpredictable, so couldn't be implemented without breaking clients trying to use that node. Filtering traffic other than as declared by your exit policy should and will get your exit the BadExit flag.
This is why we need to implement extended exit flags for exits that want to run post-exit filtering/enhancement policies, say for example "noporn" that way we can get all the religious groups dumping their tithes into not just beaming reruns of the 700 club around the world, but a pile of uber fast exits too.
What a disastrous notion; the exit policy system works because clients can predict in advance whether an exit will pass a given connection; it depends only on the destination host/port. That could never be the case for any of these.
And how about "novirus" delivered by microsoft "doublesyourcoins" propped up by the donations of fools "trusted" run by legit governments
Oh, please, do tell where you expect to find a 'legit' government and why one should 'trust' it?
I think that's part of the joke
On Sat, Aug 31, 2013 at 12:32 AM, Andrea Shepard andrea@torproject.orgwrote:
On Sat, Aug 31, 2013 at 12:27:22AM -0400, grarpamp wrote:
On 8/30/13, Andrea Shepard andrea@torproject.org wrote:
On Tue, Aug 27, 2013 at 11:08:34AM -0500, Jon Gardner wrote:
Then why have exit policies? Exit nodes regularly block "unwelcome" traffic like bittorrent, and there's only a slight functional difference
between
that and using a filter in front of the node to block things like porn
There's a considerable functional difference: an exit policy is a
defined
list of specific hosts and ports to accept/reject, and it's advertised
in
the exit's descriptor. Your client can just pick a different exit node if the connection it wants to make is not permitted by a given exit's policy. A "porn filter" is inherently fuzzy and unpredictable, so couldn't be implemented without breaking clients trying to use that node.
Filtering
traffic other than as declared by your exit policy should and will get
your
exit the BadExit flag.
This is why we need to implement extended exit flags for exits that want to run post-exit filtering/enhancement policies, say for example "noporn" that way we can get all the religious groups dumping their tithes into not just beaming reruns of the 700 club around the world, but a pile of uber fast exits too.
What a disastrous notion; the exit policy system works because clients can predict in advance whether an exit will pass a given connection; it depends only on the destination host/port. That could never be the case for any of these.
And how about "novirus" delivered by microsoft "doublesyourcoins" propped up by the donations of fools "trusted" run by legit governments
Oh, please, do tell where you expect to find a 'legit' government and why one should 'trust' it?
-- Andrea Shepard andrea@torproject.org PGP fingerprint (ECC): BDF5 F867 8A52 4E4A BECF DE79 A4FF BC34 F01D D536 PGP fingerprint (RSA): 3611 95A4 0740 ED1B 7EA5 DF7E 4191 13D9 D0CF BDA5
tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
This is why we need to implement extended exit flags for exits that want to run post-exit filtering/enhancement policies, say for example "noporn" that way we can get all the religious groups dumping their tithes into not just beaming reruns of the 700 club around the world, but a pile of uber fast exits too.
What a disastrous notion; the exit policy system works because clients can predict in advance whether an exit will pass a given connection; it depends only on the destination host/port.
It works because clients can reject some exits they figure they shouldn't waste their time on trying and can proceed trying matching ones. And because the matching ones have historically not been much problem. Predicting the future behavior of exits based on their past, or their current statements, is an odds game some wouldn't put much faith in.
That could never be the case for any of these.
As with dest ip:port, clients could similarly manage exits based on their postfilter flags.
It could work for various purposes but it was more meant ...
And how about "novirus" delivered by microsoft "doublesyourcoins" propped up by the donations of fools "trusted" run by legit governments
Oh, please, do tell where you expect to find a 'legit' government and why one should 'trust' it?
... "forthelols" ... which would replace all web pages with (re-read as humor) proposals like this when tor-*@ is busy being too serious, flips the occaisional bird to each other in threads, etc ;)
Hopefully all the plaintext protocols will die soon and some replacement for the CA cert model is agreed upon so that there isn't much left to bet on exitwise but the dest ip:port working.
On 08/31/13 08:27, grarpamp wrote:
Hopefully all the plaintext protocols will die soon and some replacement for the CA cert model is agreed upon so that there isn't much left to bet on exitwise but the dest ip:port working. _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
Exactly what I'm proposing with Eccentric Authentication. [0]
It is a way to replace password authentication with client certificates. And to replace plaintext with TLS. Certificates are signed by the web site that will accept them, not by central CAs that can MitM.
I foresee that each user has a multitude of certificates. At least one for each web site where they replace the passwords, probably more as you can have multiple accounts at a site easily.
Each certificate is *an anonymous* identity, not *the user's identity*. Certificates contain only the public key and a chosen username that the user chooses when signing up at a site.
With the certificate, users can authenticate at a site with one of their identities. As the certificates contain the public key, other people can send encrypted messages to each other via the web site. It could be a blog site or dating site. As the messages are encrypted, not even the site operators can learn the contents of the message.
Let's add VOIP.
Say Bob opens a ZRTP-listener on his computer. He does three things:
1. He configures it with his dating-site certificate and private key.
2. He also configures it that it *only* accepts connections that are identified with the certificate of someone else on the dating site, say Alice's certificate.
3. He sends Alice an encrypted message through the dating site where he specifies the ZRTP-endpoint.
Then he waits until Alice places the call. (If she decides to do so). When he receives a call, it can only be Alice as she's the only one with the private key that matches her certificate.
Now they can talk in private. Not even the dating site learns that they are calling. The site is not involved at all. The call goes direct from one computer to the other.
What we have done here is to use the dating site as *introducer* between two strangers so they can exchange public keys without ever having met before.
All it takes is a *public* forum, a dating site, blog site, comments section at a newspaper to introduce strangers to each other so they can communicate *privately*.
The Eccentric protocol makes it easy to create these introducers, so there is not a single identity to block.
Notice. The eccentric authentication protocol does not address traffic analysis/ metadata. Use Tor for that.
Cheers, Guido.
[0] http://eccentric-authentication.org/eccentric-authentication/five-minute-ove...
You can run it yourself (download and run it in a VM!) from here: http://eccentric-authentication.org/blog/2013/06/07/run-it-yourself.html
On 08/30/2013 08:05 PM, Andrea Shepard wrote: [snip]
If I were going to work on filtering by technical means, it'd be filters to keep neo-Puritans like you out of my life, thanks.
Well said. This whole thread is example 87653478965432 of the "censorship is A-OK if I don't like it" mindset.
Maybe we need a competitor to Tor, a privacy network that only allows pictures of cute kittens and puppies as traffic.
On 22.08.2013 15:45, a432511 wrote:
I just spun up 2 relays (1 exit, 1 non-exit) in Amsterdam using DigitalOcean as the VPS provider. It's been up for about 8 hours now.
Thank you and good luck!
While in the future there may be a precedent that grants safe-harbor status to TOR exit nodes, there is no such precedent under US Law at this time and the responsibility remains with you.
You might want to point them to https://www.torproject.org/eff/tor-dmca-response.html.en , which was written by EFF lawyers specifically about US law.
"[...] Therefore, you should continue to be protected under the DMCA 512(a) safe harbor without taking any further action."
I currently have 4 non-exit's with DigitalOcean providing approximately 160mb/s of bandwidth. They've been up for about a month now and I've not run into any issues with DigitalOcean staff.
With that in mind - I also had an exit up for about a month and I never heard anything from them either (just comply with DMCA/etc.) and provide the url that Moritz has given; they haven't ever questioned it.
I'm excited to be an operator!
Thanks, Stracci Systems Admin www.mcbans.com
----- Original Message ----- From: "Moritz Bartl" moritz@torservers.net To: tor-relays@lists.torproject.org Sent: Thursday, August 22, 2013 1:02:12 PM Subject: Re: [tor-relays] new relays
On 22.08.2013 15:45, a432511 wrote:
I just spun up 2 relays (1 exit, 1 non-exit) in Amsterdam using DigitalOcean as the VPS provider. It's been up for about 8 hours now.
Thank you and good luck!
While in the future there may be a precedent that grants safe-harbor status to TOR exit nodes, there is no such precedent under US Law at this time and the responsibility remains with you.
You might want to point them to https://www.torproject.org/eff/tor-dmca-response.html.en , which was written by EFF lawyers specifically about US law.
"[...] Therefore, you should continue to be protected under the DMCA 512(a) safe harbor without taking any further action."
tor-relays@lists.torproject.org
-
a432511 -
Andrea Shepard -
Andreas Krey -
Andy Isaacson -
grarpamp -
Guido Witmond -
Jon Gardner -
lee colleton -
Lukas Erlacher -
mick -
Moritz Bartl -
Niles Rogoff -
Paul Staroch -
Steve Snyder -
Stracci Pwns -
Vincent Yu