3 ms·

Using a massively shared IP space of any kind is only available by submitting to a poor experience. Nobody is saying "hey this guy has privacy, lets make this

by corobo 10y ago

Using a massively shared IP space of any kind is only available by submitting to a poor experience. Nobody is saying "hey this guy has privacy, lets make this experience a pain in the arse". They're saying "Man this set of specific IPs are really hammering my system looking for WordPress exploits and we're not even running that". To treat Tor better than regular traffic would be to discriminate against Tor, which would invite more abuse of Tor.

deno 10y ago
So carrier-grade NATs should also be captchad to hell. Somehow, they aren’t. Very mysterious, indeed.
- corobo 10y ago
  Do many malicious entities have easy access to carrier-grade NATs? Man just read up I'm essentially just summarising this anyway: https://blog.cloudflare.com/the-trouble-with-tor/ https://blog.cloudflare.com/the-trouble-with-tor/
  - deno 10y ago
    Sure they do. They’re called ‘botnets.’[1] [1] https://luminati.io/ https://luminati.io/
  - deleted 10y ago
    [deleted]
- meowface 10y ago
  Pure rough estimates, but consumer ISP subnets are probably ~1-3% malicious, while with Tor's rotating IPs, if you look over the past 5 years odds are at least 40% of exit node IPs have been associated with malicious activity at least once. It makes perfect sense to add additional verification challenges for Tor users. Also, anecdotal, but I work in infosec for a large US company and see a lot of traffic and read a lot of logs every day. The majority of all spam, fraud, and scan activity comes from Tor, or consumer-advertised VPN services, or various European VPSs. Residential ISPs (excluding Chinese and Russian ones) make up almost no part of it, relative to those others. I'm pretty sure Cloudflare's challenge criteria is sourced from real data they've generated from traffic they've seen. They aren't trying to single out Tor users.
  - deno 10y ago
    > It makes perfect sense to add additional verification challenges for Tor users. I’m actually perfectly fine with that. The issue is how Cloudflare does it. They should just offer something like X-Cloudflare-Fraud-Score header or even <x-cloudflare-protected-frame /> tag (they’re already doing SSI), but instead they just nuke the hell out of everything. The way they do ‘protection’ is openly hostile to open web, or even neutral web. Whether this affects Tor disproportionately or not is a minor point.

by corobo 10y ago

deno 10y ago

So carrier-grade NATs should also be captchad to hell. Somehow, they aren’t. Very mysterious, indeed.

corobo 10y ago
Do many malicious entities have easy access to carrier-grade NATs? Man just read up I'm essentially just summarising this anyway: https://blog.cloudflare.com/the-trouble-with-tor/ https://blog.cloudflare.com/the-trouble-with-tor/
- deno 10y ago
  Sure they do. They’re called ‘botnets.’[1] [1] https://luminati.io/ https://luminati.io/
- deleted 10y ago
  [deleted]
meowface 10y ago
Pure rough estimates, but consumer ISP subnets are probably ~1-3% malicious, while with Tor's rotating IPs, if you look over the past 5 years odds are at least 40% of exit node IPs have been associated with malicious activity at least once. It makes perfect sense to add additional verification challenges for Tor users. Also, anecdotal, but I work in infosec for a large US company and see a lot of traffic and read a lot of logs every day. The majority of all spam, fraud, and scan activity comes from Tor, or consumer-advertised VPN services, or various European VPSs. Residential ISPs (excluding Chinese and Russian ones) make up almost no part of it, relative to those others. I'm pretty sure Cloudflare's challenge criteria is sourced from real data they've generated from traffic they've seen. They aren't trying to single out Tor users.
- deno 10y ago
  > It makes perfect sense to add additional verification challenges for Tor users. I’m actually perfectly fine with that. The issue is how Cloudflare does it. They should just offer something like X-Cloudflare-Fraud-Score header or even <x-cloudflare-protected-frame /> tag (they’re already doing SSI), but instead they just nuke the hell out of everything. The way they do ‘protection’ is openly hostile to open web, or even neutral web. Whether this affects Tor disproportionately or not is a minor point.