[tor-talk] Doctor's possible sybil attack report from 2015-07-02 - 'cloudvps' (XL Internet Services)

[l.m]

Hi nusenu,

I'm glad you asked. Why don't they have the exit flag? It probably has
something to do with MinMeasuredBWsForAuthToIgnoreAdvertised being 500
by default. If you look at consensus-health [0] you see much more than
500. This means, and I'm only quoting the spec [1], that these relay
need measured bandwidth to have a weight assigned to them. In the
absence of a consensus weight (note they're all zero), these relay
have 0 probability of being chosen. So they need to respond to a
bandwidth scan, and they haven't.

[0] https://consensus-health.torproject.org/#bwauthstatus
[1] https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n1895

Is it any consolation that the running relay are, by default, in two
family? 85.222.0.0/16, and 213.187.0.0/16 form a family by default in
tor (unless EnforceDistinctSubnets is 0).

Regards
--leeroy