[tor-talk] Fwd: [tor-consensus-health] Possible Sybil Attack

[Damian Johnson]

Hi Sebastian, glad there's other's keeping an eye on the reports.

> the doctor tells me a lot of stuff, like
> "not reporting bandwidth scanner results: turtles"

I notified Mike a couple times about that. He's aware of it, though it
hasn't been much of a priority for him since the network can make do
without a bandwidth authority or two.

> ... what's really
> annoying, but he is also telling me the following below.
> I saw no talk about this at all, but think there should be at least some
> confirmation or statement. It could be a false-alert after all.
>
> There was another possible attack, but I dismissed it. This one is a lot
> more obvious.
>
> What's the course of action that is taken by anyone in charge if the
> doctor reports someone's potentially messing with the network?
>
> Is there a place where the doctors' diagnostics get confirmed or
> declared false-positives?

In this case I forwarded the heads up to tor-assistants@ a couple days
ago. There were 58 new middle hop relays appear from the 50.7.* block.
If they were exits we'd be a little more concerned. In this case my
plan is to simply loop back in a week, see how they're doing, then let
the authority operators know.

Cheers! -Damian