[roy at rant-central.com: Re: [arma at mit.edu: Re: Wikipedia & Tor]]

[Jimmy Wales]

David Benfell wrote:
> On Tue, 27 Sep 2005 19:50:52 -0400, Jimmy Wales wrote:
> 
>>Actually, the transport layer *is* to blame.  I don't know how much more
>>clear I can be about it.  Because Tor users are almost universally bad,
>>because almost no good edits come out of the Tor network, we block them.
> 
> With statements like this, why are you even here?

Because I want to improve the situation.  I want there to be a great
method for people to be able to edit Wikipedia safely and securely no
matter what their personal situation may be, and I want that method to
be sufficiently abuse-free that we can allow it.

I am here in part because I often see statements from _some_ people in
the Tor community which I think misunderstand our position.  Things
like: "Why does Wikipedia hate privacy?"  or "Wikipedians don't get it"
or "Well, it's Wikipedia's fault for allowing open editing" or "People
can abuse any system, like AOL proxies, why single out Tor?"

>  This is a statement
> that allows no room for negotiation.  You are, in essence, claiming
> that Tor servers exist for the sole purpose of aiding and abetting the
> defacing of Wikipedia and other mischief.  Therefore, those of us who
> host Tor servers are bad people, whether by intent or otherwise.

I said no such thing.  Tor servers exist for the sole purpose of aiding
people who have a genuine need for privacy.  Tor operators by and large
are unhappy that Tor users can't edit Wikipedia, and are genuinely
interested in exploring solutions, especially solutions which involve
changes or enhancements to the Tor architecture which help solve the
problem not just for Wikipedia but for _all_ internet services which
desire to carefully balance a desire for privacy and openness against abuse.


> What it is you don't get is that you have already decided that Tor is
> evil.  You do so based on your claim that almost everything you get
> through Tor servers is vandalism.  You want us to authenticate users,
> in direct contradiction to the entire idea of anonymity.  Therefore,
> you would have us emasculate Tor.

Every single sentence in this paragraph is mistaken.

I have not decided that Tor is evil.  It is true that the overwhelming
vandalism coming from Tor servers makes it impossible for us, in the
current situation, to allow Tor users to edit Wikipedia most of the
time, but this does not imply that Tor is evil.  (It does imply that Tor
is broken, in the sense that it fails to achieve one important objective
(usability), but broken is not the same as evil.)

Authentication of users is _not_ in direct contradiction to the entire
idea of anonymity.  I'm sure that people smarter than me can explain
this to you better than I can.

And I do not propose in any way shape or form that you emasculate Tor.
Rather, I want to encourage some serious thinking about the issue of
abuse because this will _strengthen_ Tor.

Focus on the customer you care about: the person who is genuinely trying
to have a voice on the Internet while living in some situation that
makes privacy a central concern.  This customer needs a method of
accessing the Internet that is private and usable.  "Usable" means that
you can freely access all sorts of services on the web _just like anyone
else_, and if Tor is being abused to the point that it has to be
blocked, then the usability goes down.

In the case we're discussing now, the service is friendly to privacy.
So yes, we are happy to work to modify our service to allow people to
edit privately.  There are limits to how much we can do, but we'll do
what we can.

But consider a case where users of Tor want to speak out in places on
the Internet which aren't hostile to privacy, but which also aren't
friendly to privacy either.  I'm thinking of things like MSN message
boards or Yahoo message boards or any of tens of thousands of blogs
which accept comments.  If all those web services have to jump through
hoops to deal with Tor abuse, they'll take the easy way out: block Tor
exit servers from have write-access to anything.

> And at the same time, you claim to endorse the idea of anonymity, by
> 1) not authenticating users, while 2) claiming that you *do*
> authenticate users.

I don't have any idea what you think this means.

> If you have security problems, then you need to address your security
> problems.  Instead, you are asking us to address your security
> problems.  And you twist logic to accuse us of sticking our heads in
> the sand when it is your authentication model--whether in fact you
> actually do authenticate or not--that seems fundamentally
> contradictory and fundamentally flawed.

I hope that my explanation has been helpful to you.

--Jimbo