[anti-censorship-team] Crash in Snowflake users since 2021-01-17

[Cecylia Bocovich]

I find this unlikely. I should have been more clear in my wording. From
what I can tell there wasn't a massive group of proxies disappearing or
joining. The group of proxies is more or less the same. The only change
is what type of NAT the proxies think they have.

Let me give a bit more background information. Each proxy performs a
test once a day to determine what type of NAT they have (see
https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/wikis/NAT-matching).
If the proxies fail to complete the check (i.e., the probe server is
down), then they set their NAT type to "unknown". Given that the number
of proxies with "unknown" types rose drastically, and the number of both
unrestricted and restricted proxies fell, I'm guessing there is an issue
with the probe server responsible for the NAT test. It might have been
overloaded or ended up misconfigured.

Looking at the metrics, there doesn't seem to be a change in the
geolocation of proxy IP addresses either.

Cecylia

On 2021-01-20 6:23 p.m., Eric Burger wrote:
> Not to be overly paranoid, but if a bunch of thought to be OK proxies disappear and a bunch of mystery proxies pop up around the same time, my first thought would be an attempt to insert a bunch of malicious machines in the middle.
> 
> —
> Sent from a small device with autoerror
> 
>> On Jan 20, 2021, at 3:18 PM, Cecylia Bocovich <cohosh at torproject.org> wrote:
>>
>> I'm still pretty sure that the complete drop off of snowflake users has
>> to do with Tor Browser crashing when configured to use the default
>> snowflake bridge.
>>
>> But, I did notice some other weird behaviour. The number of unrestricted
>> snowflake proxies dropped off at around the same time (and the number of
>> unknown proxies rose dramatically). This should not affect most users (I
>> have been able to bootstrap Tor fully using snowflake with the same
>> torrc configurations options that Tor Browser uses). However, it is
>> weird. I'm not sure yet of the cause, and it could be a coincidence that
>> these two events coincided.
>>
>> See https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/issues/40030#note_2722730
>>
>>> On 2021-01-19 12:59 p.m., Cecylia Bocovich wrote:
>>> Hi David,
>>>
>>> I'm able to use snowflake on the command line, but not in Tor Browser.
>>> This seems to be due to this bug:
>>> https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40282
>>>
>>> I'm a bit surprised that it took so long for the issue to be reflected
>>> in snowflake statistics, I also hadn't run across it myself until I
>>> tried to change my Tor Browser config after reading this email. Philipp
>>> and I are talking with the browser and core tor developers about a fix.
>>> I'm a little surprised we are only finding out about this now. But, it
>>> seems to not be an issue with Snowflake itself.
>>>
>>> Cecylia
>>>
>>>> On 2021-01-18 11:30 p.m., David Fifield wrote:
>>>> I happened to look at the Snowflake bridge's bandwidth and user history
>>>> page, and the counts are close to zero since yesterday. I haven't
>>>> investigated it at all.
>>>>
>>>> https://metrics.torproject.org/rs.html#details/5481936581E23D2D178105D44DB6915AB06BFB7F
>>>>
>>>> _______________________________________________
>>>> anti-censorship-team mailing list
>>>> anti-censorship-team at lists.torproject.org
>>>> https://lists.torproject.org/cgi-bin/mailman/listinfo/anti-censorship-team
>>> _______________________________________________
>>> anti-censorship-team mailing list
>>> anti-censorship-team at lists.torproject.org
>>> https://lists.torproject.org/cgi-bin/mailman/listinfo/anti-censorship-team
>> _______________________________________________
>> anti-censorship-team mailing list
>> anti-censorship-team at lists.torproject.org
>> https://lists.torproject.org/cgi-bin/mailman/listinfo/anti-censorship-team