12 ms·

Maybe I'm a cranky, old-school network operator, but this is a very cut and dry problem. Tor runs a network that is rife with abuse and fraud. Tor needs to clea

by scurvy 11y ago

Maybe I'm a cranky, old-school network operator, but this is a very cut and dry problem. Tor runs a network that is rife with abuse and fraud. Tor needs to clean up and police its network. If it doesn't, it will be put on blacklists and customers will take active measures to block traffic from it. This is no different than a network or AS that is spammer friendly, botnet friendly, carder friendly, etc. All of those networks eventually end up on blacklists or Spamhaus lists and their efficacy goes down. Eventually, the network dies out and the criminals move somewhere else. Yes, it's a game of whack-a-mole, but it's proven to work well. I know Tor doesn't want to be in the network regulation business, but they need to be if they want their product to thrive. Otherwise, good bye Tor.

_Codemonkeyism 11y ago
The main point I took away from the article, that from one exit node many users originate. Some users are spammer. They contaminate the exit node IP. CF blocks an IP for spam, but does not remove the block after some time (when the spammer moved on).
- scurvy 11y ago
  That's definitely a legitimate point, but not the main point IMHO. The main point is that Tor makes zero effort to clean up the problem and uses the legitimate Tor users as helpless, scapegoated victims and a bullying tactic. "But think of the oppressed users!" Sorry, not buying it. The blacklisted IP lifetime problem is real though. It's a problem I've had to raise several times with our product and network teams. People would see an abusive IP and just ban it...without a TTL or lifetime. This really upset me as they seemed to think that was OK not just for the time being, but that it was good enough. When I describe IPv6 to them, their faces just melt as it sinks in that they can't just keep banning IP's and must do something higher up the stack to detect and block fraud.
  - _Codemonkeyism 11y ago
    Interesting point, what would "Tor cleans up" mean?
- ryandrake 11y ago
  What will happen when IPv6 takes off and anyone can just go get a unique, random, throwaway IP address each day? Do "IP reputation" systems work in such a world?
  - tonfa 11y ago
    I guess reputation will be based on /64, that's the most practical solution.
  - cronjobber 11y ago
    Maybe coalesce neighboring bad IPs and subnets into larger bad subnets.
- unexistance 11y ago
  The somewhat-faster way to reduce this annoyance (I've been hit by this) is to 'block'/captcha the offending IPs for a time (depends on whatever metrics CloudFlare think is best) then unblock it. At least this will reduce legitimate user's annoyance, instead of being blocked indefinitely My own experience: Tried accessing wikialpha from work LAN, 'blocked' by endless captcha (for a few months already) and opening the said wiki from home network, all is perfectly fine... well at least now I know why, still does NOT makes it OK from end-users perpective
  - Kalium 11y ago
    Given how much of TOR traffic is malicious (94%), what you propose would get all TOR traffic always considered malicious.
    - _Codemonkeyism 11y ago
      Care to share a source for "TOR traffic is malicious (94%)"? What does malicious percentage of traffic in this case mean? Malicious sessions? IPs used? Packets? Users?
      - Kalium 11y ago
        The number is in the CloudFlare blog post that started this. > Based on data across the CloudFlare network, 94% of requests that we see across the Tor network are per se malicious. That doesn’t mean they are visiting controversial content, but instead that they are automated requests designed to harm our customers.
baldfat 11y ago
> I know Tor doesn't want to be in the network regulation business, but .... That is exactly why there is a Tor. Tor is for enabling anonymous communication. Now deciding who can do what or why would limit use and that would limit its ability to anonymous communication.
- scurvy 11y ago
  It's not a binary thing. You can regulate out fraud, abuse, and DDoS attacks without harming the legitimate use cases. It's like selling alcohol (cigarettes, porn, gambling), but not to minors. You can say "it's OK for this crowd not OK for this crowd". Otherwise you'd probably claim that said regulation would go against the very thing that the merchant is trying to do: make as much money as possible.
  - dublinben 11y ago
    >You can regulate out fraud, abuse, and DDoS attacks without harming the legitimate use cases. How? If you think this was possible without completely compromising the Tor protocol, don't you think it would have been done already?
  - Etzos 11y ago
    It's very easy to say that one can filter out certain things, but in practice I think it's far more difficult. Especially in Tor's case where the goal is to provide truly anonymous access. Do you have a proposal for filtering out that kind of traffic while allowing other traffic? I can't think of a way off the top of my head and I'm sure the people behind Tor would at least consider a logical solution. Edit: This sounds kind of confrontational, but I don't mean it like that. I honestly would like to hear of a potential solution to this because I really can't think of one.
  - Spearchucker 11y ago
    "It's like selling alcohol (cigarettes, porn, gambling), but not to minors." It's not like that at all, because selling to everyone other than minors requires identity. Sure, you just need to verify the subject is over 18, i.e. you don't need to know name, birth date or address. But you DO need to know identity to issue the token that provisions the token that proves an age > 18. And that breaks Tor's raison d'être.
dublinben 11y ago
>they need to be if they want their product to thrive. Otherwise, good bye Tor. The ironic thing is actually that by applying any kind of "network regulation" the Tor project would abandon its own primary purpose. The only way it can continue to exist is actually if it doesn't practice any kind of censorship of its users.
- scurvy 11y ago
  This is a very simplistic, binary view of the world. Just because the Internet's view of a product differs from the author's, it doesn't make the Internet wrong. It means the author probably needs to step back and re-evaluate things. By your logic, gun owners would be able to shoot whatever they want. The primary purpose of a gun is to shoot things. To paraphrase: "To regulate what you can and can't shoot would go against the primary purpose of a gun and the gun manufacturers can't exist that way."
  - yarrel 11y ago
    Something working or not is a binary.
AnthonyMouse 11y ago
The main point of Tor is that nobody knows where the traffic comes from. Realize you're asking them to break their own service. Your premise seems to be that you can't be bothered to protect your networks so you want to put that responsibility on someone else. It's called intermediary liability and it's terrible because the intermediary has all the wrong incentives. You demand that the intermediary eliminate malicious traffic but they suffer much less than individual users if they also eliminate non-malicious traffic, so they set up a system with a high rate of false positives and harm many honest people. YouTube does this with Content ID. Spam registries do this with innocent small mail servers. CloudFlare does this with Tor. What you're doing is called externalizing costs. It's generally recognized as antisocial behavior. So if you're going to claim benefits to yourself at the expense of other people, at least recognize that you're doing it.
- jcoffland 11y ago
  Google does this with Linode servers. I route my HTTP traffic through a proxy on a Linode server. Google blocks me all the time for no reason other than that some other IPs in my range are doing bad things. I've tried to contact Google about this but they could care less about a handful of users.
  - kuschku 11y ago
    Complain to a Google dev here on HN, I had the same issue with my OVH proxy.
  - neoCrimeLabs 11y ago
    I've experienced the same issue from multiple service providers, including but not limited to Google, Akamai, Cloudflare, and more. My Linode IP address was assigned to me years ago. I do not use it maliciously, do not share it with other people, and have never used it for tor. Yet find myself regularly blocked for no logical reasons when I proxy my web-request through it.
- themartorana 11y ago
  "...you can't be bothered to protect your network..." Huh? Isn't this exactly what CF is attempting to do? And Tor traffic tends to be abusive so the good is caught up with the bad, but it's all in the name of protection.
ryandrake 11y ago
At a point in the recent past, around 90% of all E-mail traffic was spam. Now it's down to around 50% or so [1]. What happened? It could have been due to thousands of ISPs simultaneously cleaning up and policing their networks. But it also could be due to blocking tools getting better. Maybe the spammers moved away from E-mail to more profitable spam channels. Or is there just more legit traffic now, and the percentage is down because the denominator is larger? 1. http://www.bbc.com/news/technology-33564016 http://www.bbc.com/news/technology-33564016
- sp332 11y ago
  It's definitely because of the major botnets being taken down. I remember the McColo bust specifically, spam volumes never recovered to their previous levels after that bust. (PDF) https://www.rsaconference.com/writable/presentations/file_upload/cle-w03_final_2.pdf https://www.rsaconference.com/writable/presentations/file_up...
- dredmorbius 11y ago
  Email didn't outrun the bear. It outran the other hiker. The honeypot space for spam is now systems other than email. Social media. Blogspam. Web advertising. Dating services. SMS. (I'm not sure precisely which, but pick from among there and you'll likely turn up the issues.) Email is fairly well defended at this point, though not without considerable collateral damage (small / self-hosted email is quite difficult, most of us rely on a small number of high-volume providers who may present a considerable privacy risk).
deleted 11y ago
[deleted]
danielrhodes 11y ago
This is exactly what is wrong with this form of idealism. People create these things which remove accountability/reputation, it works great for awhile and is lots of fun (just like a mask party), and then the leeches move in and use it for spam/trolling/illegal stuff. It's usually the leeches who are the real long-term beneficiaries of these kinds of networks. However, the idealistic people who originally created it don't want to admit that their experiment failed and they actually created something which is now serving the interests of something not so idealistic and perhaps even quite sinister. Bitcoin has the same issue: there are lots of legit uses of it, but to make it a good widely used currency, a reputation system is going to emerge, and from there you've already erased half the benefits of using Bitcoin. However, in the mean time Bitcoin is used by a bunch of people purely interested in speculation or as a way of avoiding taxes/money laundering laws/etc. There are people, just like Tor, using it for legit reasons, but my bet it's for mostly reasons nobody in the Bitcoin community likes to admit.
- lqdc13 11y ago
  Exactly. But I strongly disagree. You don't blame mask manufacturers for malicious people wearing masks. It's like city guards banning everyone with a mask from entering and issuing IDs to them. Then they're using those IDs to determine what they should and shouldn't see in the city, tracking them everywhere "across cities" etc. In the interest of privacy, it is best to instead use the dynamic nature and types of the requests to figure out what the behavior is like. Going with the mask analogy, they should instead check if a person is brute forcing lock combinations. Maybe even condition on the fact that they're wearing a mask.
  - bskap 11y ago
    > Going with the mask analogy, they should instead check if a person is brute forcing lock combinations. Maybe even condition on the fact that they're wearing a mask. That's what they're doing. They are seeing brute forcing come from a bunch of IPs and they're blocking those. What do you expect them to block on? The people using the anonymous service voluntarily identifying themselves on every request (cookies, browser fingerprinting, or pretty much anything else coming from the client side that can be faked)?
atmosx 11y ago
> I know Tor doesn't want to be in the network regulation business, but they need to be if they want their product to thrive. Otherwise, good bye Tor. I'm not sure if you know what you're talking about. From your comment, it's crystal-clear that you don't understand what their service is. Plus, calling a free service based largely based on volunteers, university and non-profits a product is derogatory.
user_0001 11y ago
As is cloudfare. I have lost count of sites that pirate our software that are using cloudfare. Cloudfare know of the problem and refuse to do anything about it.
- kristofferR 11y ago
  Thankfully. They're already the "Wifi Captive Portal" of the internet, be glad that they're not also the police of the internet.
nly 11y ago
Filtering of outbound traffic from Tor exit nodes can only be done by Tor exit node operators. The Tor project can kick out some defaults (like, say, blocking SMTP) but ultimately it wouldn't matter...the bad actors will just find ways around the filters, or devise new ways to abuse the system. Static filters will never work. It's like hoping everyone will do source address verification on egress. Cloudflare just have to get smarter here. It's their business to do dynamic filtering and balance this stuff, not Tors.
- nickpsecurity 11y ago
  "Cloudflare just have to get smarter here. It's their business to do dynamic filtering and balance this stuff, not Tors." It's not their business given Cloudfare doesn't make shit off Tor: it looses bandwidth and time fighting malice instead. It's actually their business to block it. Tor needs a reputation system or some other method to deal with this stuff.
baby 11y ago
> Tor needs to clean up and police its network I think you don't understand what Tor is or how it works. Tor is a way to anonymize its users. You have no way to analyze a packet until it reaches an exit node, and you have no way to analyze that packet if it's done over https, and you have no way to block an ip from that exit node because it comes from another node where plenty of other ips are coming from. If you start blocking this node, then the spammer can choose a different path and come from another node, or just change his exit node. tl;dr: what you are saying goes against Tor's principles.
- MBCook 11y ago
  I think it's clear he understands how it works. > what you are saying goes against Tor's principals That's why it will probably never be cleaned up. That's also why more and more people will probably block access from Tor. CloudFlare says they get a 95% attack rate from it. A blog post the other day said FotoForensics gets about 91% attacks from Tor. No one is going to put up with 91% attacks for long. And if that means Tor becomes it's own walled garden that doesn't 'interact' with the public internet, so be it.
  - baby 11y ago
    > I think it's clear he understands how it works. Agree to disagree :) > if that means Tor becomes it's own walled garden that doesn't 'interact' with the public internet, so be it Most websites are not using Cloudflare and have no idea how to block a range of ips. So no Tor is not going to become its own walled garden.
    - MBCook 11y ago
      I work for a company that makes appliances to secure companies' networks. I'm promise you that CloudFlare isn't the only group that offers to block TOR as an option (or just has it blocked by default).
    - scurvy 11y ago
      >> I think it's clear he understands how it works. > Agree to disagree :) I know very well how it works thank you very much. It doesn't mean I have to like it. Since you're apt to throwing around unfounded accusations, I'll join the party. I have more experience than you do at running large networks, dealing with fraud, dealing with abuse, dealing with malware, and dealing with law enforcement/government agents. The Internet has enough problems with the well-run networks that actually care. We could care less about Tor users that might be blocked.
zeveb 11y ago
Actually, I think the real problem is the idea that networks are responsible for policing their users, rather than the idea that servers should be responsible for policing their clients. The former is what people want (because it's easy: blame an IP, ban it, be done), but the latter is the reality. CloudFlare's CAPTCHAs are an attempt to deal with that reality, but they're heavy-handed. Worse, they're at the wrong level: the protected site may have already verified that the user is legitimate, but CloudFlare imposes its block when the user's source IP changes again. CAPTCHAs belong at the application layer, not the transport layer.
- drvdevd 11y ago
  You've made one of the most compelling points I've seen in this discussion so far. Really - why mix an application security mechanism into the transport layer? DDoS attacks will happen whether Tor is blocked or not. Add to this some other interesting points I've read here regarding: IPv4 exhaustion, NAT and IPv6 growth. All signs seem to point to the need for an application level solution.
dredmorbius 11y ago
I hate to admit it, but I think you and Tor both have fair points. The facilitator of much abuse isn't anonymity per se, but impunity. The ability to act without consequence. Finding a way to imbue reputation across an anonymised connection seems to be one way to operate. Not an easy problem. There's some work toward solutions, though none are yet widespread.

by scurvy 11y ago

_Codemonkeyism 11y ago

The main point I took away from the article, that from one exit node many users originate. Some users are spammer. They contaminate the exit node IP. CF blocks an IP for spam, but does not remove the block after some time (when the spammer moved on).

scurvy 11y ago
That's definitely a legitimate point, but not the main point IMHO. The main point is that Tor makes zero effort to clean up the problem and uses the legitimate Tor users as helpless, scapegoated victims and a bullying tactic. "But think of the oppressed users!" Sorry, not buying it. The blacklisted IP lifetime problem is real though. It's a problem I've had to raise several times with our product and network teams. People would see an abusive IP and just ban it...without a TTL or lifetime. This really upset me as they seemed to think that was OK not just for the time being, but that it was good enough. When I describe IPv6 to them, their faces just melt as it sinks in that they can't just keep banning IP's and must do something higher up the stack to detect and block fraud.
- _Codemonkeyism 11y ago
  Interesting point, what would "Tor cleans up" mean?
ryandrake 11y ago
What will happen when IPv6 takes off and anyone can just go get a unique, random, throwaway IP address each day? Do "IP reputation" systems work in such a world?
- tonfa 11y ago
  I guess reputation will be based on /64, that's the most practical solution.
- cronjobber 11y ago
  Maybe coalesce neighboring bad IPs and subnets into larger bad subnets.
unexistance 11y ago
The somewhat-faster way to reduce this annoyance (I've been hit by this) is to 'block'/captcha the offending IPs for a time (depends on whatever metrics CloudFlare think is best) then unblock it. At least this will reduce legitimate user's annoyance, instead of being blocked indefinitely My own experience: Tried accessing wikialpha from work LAN, 'blocked' by endless captcha (for a few months already) and opening the said wiki from home network, all is perfectly fine... well at least now I know why, still does NOT makes it OK from end-users perpective
- Kalium 11y ago
  Given how much of TOR traffic is malicious (94%), what you propose would get all TOR traffic always considered malicious.
  - _Codemonkeyism 11y ago
    Care to share a source for "TOR traffic is malicious (94%)"? What does malicious percentage of traffic in this case mean? Malicious sessions? IPs used? Packets? Users?
    - Kalium 11y ago
      The number is in the CloudFlare blog post that started this. > Based on data across the CloudFlare network, 94% of requests that we see across the Tor network are per se malicious. That doesn’t mean they are visiting controversial content, but instead that they are automated requests designed to harm our customers.

baldfat 11y ago

> I know Tor doesn't want to be in the network regulation business, but .... That is exactly why there is a Tor. Tor is for enabling anonymous communication. Now deciding who can do what or why would limit use and that would limit its ability to anonymous communication.

scurvy 11y ago
It's not a binary thing. You can regulate out fraud, abuse, and DDoS attacks without harming the legitimate use cases. It's like selling alcohol (cigarettes, porn, gambling), but not to minors. You can say "it's OK for this crowd not OK for this crowd". Otherwise you'd probably claim that said regulation would go against the very thing that the merchant is trying to do: make as much money as possible.
- dublinben 11y ago
  >You can regulate out fraud, abuse, and DDoS attacks without harming the legitimate use cases. How? If you think this was possible without completely compromising the Tor protocol, don't you think it would have been done already?
- Etzos 11y ago
  It's very easy to say that one can filter out certain things, but in practice I think it's far more difficult. Especially in Tor's case where the goal is to provide truly anonymous access. Do you have a proposal for filtering out that kind of traffic while allowing other traffic? I can't think of a way off the top of my head and I'm sure the people behind Tor would at least consider a logical solution. Edit: This sounds kind of confrontational, but I don't mean it like that. I honestly would like to hear of a potential solution to this because I really can't think of one.
- Spearchucker 11y ago
  "It's like selling alcohol (cigarettes, porn, gambling), but not to minors." It's not like that at all, because selling to everyone other than minors requires identity. Sure, you just need to verify the subject is over 18, i.e. you don't need to know name, birth date or address. But you DO need to know identity to issue the token that provisions the token that proves an age > 18. And that breaks Tor's raison d'être.

dublinben 11y ago

>they need to be if they want their product to thrive. Otherwise, good bye Tor. The ironic thing is actually that by applying any kind of "network regulation" the Tor project would abandon its own primary purpose. The only way it can continue to exist is actually if it doesn't practice any kind of censorship of its users.

scurvy 11y ago
This is a very simplistic, binary view of the world. Just because the Internet's view of a product differs from the author's, it doesn't make the Internet wrong. It means the author probably needs to step back and re-evaluate things. By your logic, gun owners would be able to shoot whatever they want. The primary purpose of a gun is to shoot things. To paraphrase: "To regulate what you can and can't shoot would go against the primary purpose of a gun and the gun manufacturers can't exist that way."
- yarrel 11y ago
  Something working or not is a binary.

AnthonyMouse 11y ago

The main point of Tor is that nobody knows where the traffic comes from. Realize you're asking them to break their own service. Your premise seems to be that you can't be bothered to protect your networks so you want to put that responsibility on someone else. It's called intermediary liability and it's terrible because the intermediary has all the wrong incentives. You demand that the intermediary eliminate malicious traffic but they suffer much less than individual users if they also eliminate non-malicious traffic, so they set up a system with a high rate of false positives and harm many honest people. YouTube does this with Content ID. Spam registries do this with innocent small mail servers. CloudFlare does this with Tor. What you're doing is called externalizing costs. It's generally recognized as antisocial behavior. So if you're going to claim benefits to yourself at the expense of other people, at least recognize that you're doing it.

jcoffland 11y ago
Google does this with Linode servers. I route my HTTP traffic through a proxy on a Linode server. Google blocks me all the time for no reason other than that some other IPs in my range are doing bad things. I've tried to contact Google about this but they could care less about a handful of users.
- kuschku 11y ago
  Complain to a Google dev here on HN, I had the same issue with my OVH proxy.
- neoCrimeLabs 11y ago
  I've experienced the same issue from multiple service providers, including but not limited to Google, Akamai, Cloudflare, and more. My Linode IP address was assigned to me years ago. I do not use it maliciously, do not share it with other people, and have never used it for tor. Yet find myself regularly blocked for no logical reasons when I proxy my web-request through it.
themartorana 11y ago
"...you can't be bothered to protect your network..." Huh? Isn't this exactly what CF is attempting to do? And Tor traffic tends to be abusive so the good is caught up with the bad, but it's all in the name of protection.

ryandrake 11y ago

At a point in the recent past, around 90% of all E-mail traffic was spam. Now it's down to around 50% or so [1]. What happened? It could have been due to thousands of ISPs simultaneously cleaning up and policing their networks. But it also could be due to blocking tools getting better. Maybe the spammers moved away from E-mail to more profitable spam channels. Or is there just more legit traffic now, and the percentage is down because the denominator is larger? 1. http://www.bbc.com/news/technology-33564016 http://www.bbc.com/news/technology-33564016

sp332 11y ago
It's definitely because of the major botnets being taken down. I remember the McColo bust specifically, spam volumes never recovered to their previous levels after that bust. (PDF) https://www.rsaconference.com/writable/presentations/file_upload/cle-w03_final_2.pdf https://www.rsaconference.com/writable/presentations/file_up...
dredmorbius 11y ago
Email didn't outrun the bear. It outran the other hiker. The honeypot space for spam is now systems other than email. Social media. Blogspam. Web advertising. Dating services. SMS. (I'm not sure precisely which, but pick from among there and you'll likely turn up the issues.) Email is fairly well defended at this point, though not without considerable collateral damage (small / self-hosted email is quite difficult, most of us rely on a small number of high-volume providers who may present a considerable privacy risk).

deleted 11y ago

[deleted]

danielrhodes 11y ago

This is exactly what is wrong with this form of idealism. People create these things which remove accountability/reputation, it works great for awhile and is lots of fun (just like a mask party), and then the leeches move in and use it for spam/trolling/illegal stuff. It's usually the leeches who are the real long-term beneficiaries of these kinds of networks. However, the idealistic people who originally created it don't want to admit that their experiment failed and they actually created something which is now serving the interests of something not so idealistic and perhaps even quite sinister. Bitcoin has the same issue: there are lots of legit uses of it, but to make it a good widely used currency, a reputation system is going to emerge, and from there you've already erased half the benefits of using Bitcoin. However, in the mean time Bitcoin is used by a bunch of people purely interested in speculation or as a way of avoiding taxes/money laundering laws/etc. There are people, just like Tor, using it for legit reasons, but my bet it's for mostly reasons nobody in the Bitcoin community likes to admit.

lqdc13 11y ago
Exactly. But I strongly disagree. You don't blame mask manufacturers for malicious people wearing masks. It's like city guards banning everyone with a mask from entering and issuing IDs to them. Then they're using those IDs to determine what they should and shouldn't see in the city, tracking them everywhere "across cities" etc. In the interest of privacy, it is best to instead use the dynamic nature and types of the requests to figure out what the behavior is like. Going with the mask analogy, they should instead check if a person is brute forcing lock combinations. Maybe even condition on the fact that they're wearing a mask.
- bskap 11y ago
  > Going with the mask analogy, they should instead check if a person is brute forcing lock combinations. Maybe even condition on the fact that they're wearing a mask. That's what they're doing. They are seeing brute forcing come from a bunch of IPs and they're blocking those. What do you expect them to block on? The people using the anonymous service voluntarily identifying themselves on every request (cookies, browser fingerprinting, or pretty much anything else coming from the client side that can be faked)?

atmosx 11y ago

> I know Tor doesn't want to be in the network regulation business, but they need to be if they want their product to thrive. Otherwise, good bye Tor. I'm not sure if you know what you're talking about. From your comment, it's crystal-clear that you don't understand what their service is. Plus, calling a free service based largely based on volunteers, university and non-profits a product is derogatory.

user_0001 11y ago

As is cloudfare. I have lost count of sites that pirate our software that are using cloudfare. Cloudfare know of the problem and refuse to do anything about it.

kristofferR 11y ago
Thankfully. They're already the "Wifi Captive Portal" of the internet, be glad that they're not also the police of the internet.

nly 11y ago

Filtering of outbound traffic from Tor exit nodes can only be done by Tor exit node operators. The Tor project can kick out some defaults (like, say, blocking SMTP) but ultimately it wouldn't matter...the bad actors will just find ways around the filters, or devise new ways to abuse the system. Static filters will never work. It's like hoping everyone will do source address verification on egress. Cloudflare just have to get smarter here. It's their business to do dynamic filtering and balance this stuff, not Tors.

nickpsecurity 11y ago
"Cloudflare just have to get smarter here. It's their business to do dynamic filtering and balance this stuff, not Tors." It's not their business given Cloudfare doesn't make shit off Tor: it looses bandwidth and time fighting malice instead. It's actually their business to block it. Tor needs a reputation system or some other method to deal with this stuff.

baby 11y ago

> Tor needs to clean up and police its network I think you don't understand what Tor is or how it works. Tor is a way to anonymize its users. You have no way to analyze a packet until it reaches an exit node, and you have no way to analyze that packet if it's done over https, and you have no way to block an ip from that exit node because it comes from another node where plenty of other ips are coming from. If you start blocking this node, then the spammer can choose a different path and come from another node, or just change his exit node. tl;dr: what you are saying goes against Tor's principles.

MBCook 11y ago
I think it's clear he understands how it works. > what you are saying goes against Tor's principals That's why it will probably never be cleaned up. That's also why more and more people will probably block access from Tor. CloudFlare says they get a 95% attack rate from it. A blog post the other day said FotoForensics gets about 91% attacks from Tor. No one is going to put up with 91% attacks for long. And if that means Tor becomes it's own walled garden that doesn't 'interact' with the public internet, so be it.
- baby 11y ago
  > I think it's clear he understands how it works. Agree to disagree :) > if that means Tor becomes it's own walled garden that doesn't 'interact' with the public internet, so be it Most websites are not using Cloudflare and have no idea how to block a range of ips. So no Tor is not going to become its own walled garden.
  - MBCook 11y ago
    I work for a company that makes appliances to secure companies' networks. I'm promise you that CloudFlare isn't the only group that offers to block TOR as an option (or just has it blocked by default).
  - scurvy 11y ago
    >> I think it's clear he understands how it works. > Agree to disagree :) I know very well how it works thank you very much. It doesn't mean I have to like it. Since you're apt to throwing around unfounded accusations, I'll join the party. I have more experience than you do at running large networks, dealing with fraud, dealing with abuse, dealing with malware, and dealing with law enforcement/government agents. The Internet has enough problems with the well-run networks that actually care. We could care less about Tor users that might be blocked.

zeveb 11y ago

Actually, I think the real problem is the idea that networks are responsible for policing their users, rather than the idea that servers should be responsible for policing their clients. The former is what people want (because it's easy: blame an IP, ban it, be done), but the latter is the reality. CloudFlare's CAPTCHAs are an attempt to deal with that reality, but they're heavy-handed. Worse, they're at the wrong level: the protected site may have already verified that the user is legitimate, but CloudFlare imposes its block when the user's source IP changes again. CAPTCHAs belong at the application layer, not the transport layer.

drvdevd 11y ago
You've made one of the most compelling points I've seen in this discussion so far. Really - why mix an application security mechanism into the transport layer? DDoS attacks will happen whether Tor is blocked or not. Add to this some other interesting points I've read here regarding: IPv4 exhaustion, NAT and IPv6 growth. All signs seem to point to the need for an application level solution.

dredmorbius 11y ago

I hate to admit it, but I think you and Tor both have fair points. The facilitator of much abuse isn't anonymity per se, but impunity. The ability to act without consequence. Finding a way to imbue reputation across an anonymised connection seems to be one way to operate. Not an easy problem. There's some work toward solutions, though none are yet widespread.