4 ms·

Number of Tor users recently halved

42 points by frabcus 11y ago

wspeirs 11y ago
Is there something wrong with the counting, or is this an actual drop in users?
- VoidWhisperer 11y ago
  Edit: NVM, it's happening in every country.
- krazydad 11y ago
  Its interesting, although perhaps coincidental, that the drop occurs on the day of the Paris attacks.
deleted 11y ago
[deleted]
nyargh 11y ago
I wonder if it was a botnet going offline?
- mirimir 11y ago
  In August 2013, about five million Sefnit slaves joined the Tor network, increasing client count from about 800 thousand to almost six million. About two thirds of them have dropped off over the past two years. Maybe this is just the rest going away. https://metrics.torproject.org/userstats-relay-country.html?graph=userstats-relay-country&start=2012-1-1&end=2015-11-19&country=all&events=off https://metrics.torproject.org/userstats-relay-country.html?...
abdullahkhalids 11y ago
If you break it down by country, you can see the same halving for every country. It is unlikely that a social reason behind this, or a botnet going down as someone has suggested. It is more likely an intentional or unintentional change in how the number of users are counted.
- 3pt14159 11y ago
  Or an institutional Tor user like say the NSA realized a flaw in it and executed a predetermined strategy of ceasing use uniformly in order to shroud that there is a previously undetermined weakness that they just discovered. I'm not saying that the above situation is likely, just that it is possible.
  - sp332 11y ago
    An institutional Tor user with proportionally the same number of endpoints as all other Tor users in each country? Probably not even the NSA would qualify.
    - 3pt14159 11y ago
      If they had this strategy ahead of time, what would stop them from rooting a proportional number of Wordpress servers in order to give this illusion? I think the better counter argument is this: Why would they even take actions which disclose the change? Why not just change the nature of their queries?
pizza 11y ago
Q: Why do the graphs end 2 days in the past and not today? A: Relays and bridges report some of the data in 24-hour intervals which may end at any time of the day. And after such an interval is over relays and bridges might take another 18 hours to report the data. We cut off the last two days from the graphs, because we want to avoid that the last data point in a graph indicates a recent trend change which is in fact just an artifact of the algorithm. Q: But I noticed that the last data point went up/down a bit since I last looked a few hours ago. Why is that? A: The reason is that we publish user numbers once we're confident enough that they won't change significantly anymore. But it's always possible that a directory reports data a few hours after we were confident enough, but which then slightly changed the graph. from the Q&A https://gitweb.torproject.org/metrics-web.git/tree/doc/users-q-and-a.txt https://gitweb.torproject.org/metrics-web.git/tree/doc/users...
- pfg 11y ago
  Edit: nvm, thanks to Caer for figuring this one out. The drop appears to happen on Nov 13th[1], I think that period should've been fully reported. The only event I could find in the tor repo on that day was a version bump for 0.2.7[2], but node lists don't report any usage for that version yet, so I doubt it's related. It's all quite weird, because there seems to be no drop in consumed bandwidth in the same period[3]. [1]: https://metrics.torproject.org/userstats-relay-country.png?start=2015-11-12&events=off&end=2015-11-14&country=all https://metrics.torproject.org/userstats-relay-country.png?s... [2]: https://gitweb.torproject.org/tor.git/commit/?id=741d2dc685a0e380bc4d8fbcda5a33b70272b3f7 https://gitweb.torproject.org/tor.git/commit/?id=741d2dc685a... [3]: https://metrics.torproject.org/bandwidth.png?start=2015-11-12&end=2015-11-14 https://metrics.torproject.org/bandwidth.png?start=2015-11-1...
Paul_S 11y ago
Can't know if this is indeed the case but quite a few tor alternatives are out there so this drop needn't be sinister. This is seemingly tangential but when untargeted surveillance is used steganography beats encryption.
- mirimir 11y ago
  What alternatives? I2P is much smaller, and has only ad hoc clearnet gateways. JonDo is too small. VPNs provide much weaker anonymity than Tor does.
Caer 11y ago
According to the metrics-team mailing list[1] it's likely due to an aborted cronjob and should be sorted out soon. [1] https://lists.torproject.org/pipermail/metrics-team/2015-November/000013.html https://lists.torproject.org/pipermail/metrics-team/2015-Nov...
Tornado666 11y ago
Tor moved the metrics to new servers and there was a temporary glitch in the metrics counting the relays. It's a metrics issue, not an actual change in the number of relays. https://twitter.com/torproject/status/664168624467386368 https://twitter.com/torproject/status/664168624467386368
deleted 11y ago
[deleted]
tacojuan 11y ago
https://twitter.com/torproject/status/664168624467386368 https://twitter.com/torproject/status/664168624467386368

42 points by frabcus 11y ago

wspeirs 11y ago

Is there something wrong with the counting, or is this an actual drop in users?

VoidWhisperer 11y ago
Edit: NVM, it's happening in every country.
krazydad 11y ago
Its interesting, although perhaps coincidental, that the drop occurs on the day of the Paris attacks.

deleted 11y ago

[deleted]

nyargh 11y ago

I wonder if it was a botnet going offline?

mirimir 11y ago
In August 2013, about five million Sefnit slaves joined the Tor network, increasing client count from about 800 thousand to almost six million. About two thirds of them have dropped off over the past two years. Maybe this is just the rest going away. https://metrics.torproject.org/userstats-relay-country.html?graph=userstats-relay-country&start=2012-1-1&end=2015-11-19&country=all&events=off https://metrics.torproject.org/userstats-relay-country.html?...

abdullahkhalids 11y ago

If you break it down by country, you can see the same halving for every country. It is unlikely that a social reason behind this, or a botnet going down as someone has suggested. It is more likely an intentional or unintentional change in how the number of users are counted.

3pt14159 11y ago
Or an institutional Tor user like say the NSA realized a flaw in it and executed a predetermined strategy of ceasing use uniformly in order to shroud that there is a previously undetermined weakness that they just discovered. I'm not saying that the above situation is likely, just that it is possible.
- sp332 11y ago
  An institutional Tor user with proportionally the same number of endpoints as all other Tor users in each country? Probably not even the NSA would qualify.
  - 3pt14159 11y ago
    If they had this strategy ahead of time, what would stop them from rooting a proportional number of Wordpress servers in order to give this illusion? I think the better counter argument is this: Why would they even take actions which disclose the change? Why not just change the nature of their queries?

pizza 11y ago

Q: Why do the graphs end 2 days in the past and not today? A: Relays and bridges report some of the data in 24-hour intervals which may end at any time of the day. And after such an interval is over relays and bridges might take another 18 hours to report the data. We cut off the last two days from the graphs, because we want to avoid that the last data point in a graph indicates a recent trend change which is in fact just an artifact of the algorithm. Q: But I noticed that the last data point went up/down a bit since I last looked a few hours ago. Why is that? A: The reason is that we publish user numbers once we're confident enough that they won't change significantly anymore. But it's always possible that a directory reports data a few hours after we were confident enough, but which then slightly changed the graph. from the Q&A https://gitweb.torproject.org/metrics-web.git/tree/doc/users-q-and-a.txt https://gitweb.torproject.org/metrics-web.git/tree/doc/users...

pfg 11y ago
Edit: nvm, thanks to Caer for figuring this one out. The drop appears to happen on Nov 13th[1], I think that period should've been fully reported. The only event I could find in the tor repo on that day was a version bump for 0.2.7[2], but node lists don't report any usage for that version yet, so I doubt it's related. It's all quite weird, because there seems to be no drop in consumed bandwidth in the same period[3]. [1]: https://metrics.torproject.org/userstats-relay-country.png?start=2015-11-12&events=off&end=2015-11-14&country=all https://metrics.torproject.org/userstats-relay-country.png?s... [2]: https://gitweb.torproject.org/tor.git/commit/?id=741d2dc685a0e380bc4d8fbcda5a33b70272b3f7 https://gitweb.torproject.org/tor.git/commit/?id=741d2dc685a... [3]: https://metrics.torproject.org/bandwidth.png?start=2015-11-12&end=2015-11-14 https://metrics.torproject.org/bandwidth.png?start=2015-11-1...

Paul_S 11y ago

Can't know if this is indeed the case but quite a few tor alternatives are out there so this drop needn't be sinister. This is seemingly tangential but when untargeted surveillance is used steganography beats encryption.

mirimir 11y ago
What alternatives? I2P is much smaller, and has only ad hoc clearnet gateways. JonDo is too small. VPNs provide much weaker anonymity than Tor does.

Caer 11y ago

According to the metrics-team mailing list[1] it's likely due to an aborted cronjob and should be sorted out soon. [1] https://lists.torproject.org/pipermail/metrics-team/2015-November/000013.html https://lists.torproject.org/pipermail/metrics-team/2015-Nov...

Tornado666 11y ago

Tor moved the metrics to new servers and there was a temporary glitch in the metrics counting the relays. It's a metrics issue, not an actual change in the number of relays. https://twitter.com/torproject/status/664168624467386368 https://twitter.com/torproject/status/664168624467386368

deleted 11y ago

[deleted]

tacojuan 11y ago

https://twitter.com/torproject/status/664168624467386368 https://twitter.com/torproject/status/664168624467386368