[tor-bugs] #23863 [Core Tor/Tor]: When our directory guards don't have each others' microdescs, we should mark some dead

[Tor Bug Tracker & Wiki]

#23863: When our directory guards don't have each others' microdescs, we should
mark some dead
-----------------------------------------------+---------------------------
 Reporter:  teor                               |          Owner:  (none)
     Type:  defect                             |         Status:  new
 Priority:  Medium                             |      Milestone:  Tor:
                                               |  0.3.2.x-final
Component:  Core Tor/Tor                       |        Version:  Tor:
                                               |  0.3.0.6
 Severity:  Normal                             |     Resolution:
 Keywords:  tor-guard, tor-bridge, tor-client  |  Actual Points:
Parent ID:  #21969                             |         Points:  1
 Reviewer:                                     |        Sponsor:
-----------------------------------------------+---------------------------

Comment (by asn):

 Replying to [comment:3 teor]:
 > Replying to [comment:2 asn]:
 > > Seems to me that the ways to deal with the edge case you describe
 above are:
 > >
 > > a) Eventually clients try authorities to fetch mds if all else fails
 (bad for the health of dirauths). I think that's what you suggested
 basically.
 >
 > Yes, we should implement this, if the other fixes don't resolve the md
 issue.
 > It's only bad for the authorities if a lot of clients do it all the
 time.
 >

 True. But we have lots of clients, so I think before doing this we might
 want to calculate the probability of this happening, to try to understand
 how many clients will end up doing this behavior.

 > > b) We remove dirauths from the fallback list (less traffic on
 dirauths. any drawback?)
 >
 > You can't avoid this issue by stopping clients contacting authorities.
 Because there are other ways that a client can have a consensus with some
 microdescs that are not on its guards.
 >

 True. But it's less likely if dirauths are not in the picture, since
 basically your edge-case is guaranteed to happen everytime a client
 randomly picks a dirauth early in the hour (e.g. between hh:00 and hh:05).

 > And we already weight dirauths low on the fallback list, so not many
 clients contact them.
 >
 > Removing authorities from the fallback list would break clients that
 disable fallbacks, and clients on non-standard networks. Also, it would
 break clients if too many fallbacks go down on the public network.
 >

 Hmm, I don't understand these points exactly. Can you expand? Why would
 clients break worse than currently if we remove dirauths from fallbacks?
 We can add a few more relays in the fallbacks to compensate.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/23863#comment:7>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online