9 ms·
That's great, too bad I can't run this for my own sites because a bunch of idiot network admins (like those running IRC servers) will ban all traffic from Tor e
by avar 16y ago
That's great, too bad I can't run this for my own sites because a bunch of idiot network admins (like those running IRC servers) will ban all traffic from Tor exit nodes without taking into account exit policies.
- mike-cardwell 16y agoYou could dedicate an IP specifically for Tor?
- avar 16y agoYes, but that requires paying extra for a dedicated IP just for that.
- mike-cardwell 16y agoTrue. How come your irc client lives on the same IP address as your website(s) though?
- avar 16y agoBecause I'm renting a single (Linode) VPS for development and hobby projects, not a bunch of machines. It's not just IRC either, a bunch of other services do naïve checking of Tor exit nodes.
- joeyh 16y agoI know tor publishes lists of exit nodes, but does it need to publish ips of exit enclaves? It clearly does not publish lists of ips running hidden services, and an exit enclave seems closer to that than an exit node.
- avar 16y agoWell yeah, it needs to publish a list of those, how else would Tor clients know how to exit through them?
- joeyh 16y agoSame way clients are routed to hidden service nodes?
- avar 16y agoNo, that's different. With a hidden service you're not exiting the Tor network, but when you're exiting you always know where you're exiting from. That's why the Tor project itself publishes a list of Tor routers and exit nodes, if they didn't do it it would be trivial for someone else to compile and publish the list.
- aw3c2 16y agoRelays (no-exit) are published and stupid ip blocklist admins happily add them to their "service".
- deleted 16y ago[deleted]
- abstractbill 16y agoAbout two years ago, spam and abuse were firmly among Justin.tv's biggest problems. It turned out the worst offenders were using tor for all network traffic. Unfortunately just configuring all of our servers to reject traffic from tor was by far the biggest bang-for-buck thing we did to kill the abuse. If there's a better way, I'd love to know about it.
- mike-cardwell 16y agoWhen Wikipedia had this problem they just blocked edit access from Tor exit nodes: https://secure.wikimedia.org/wikipedia/meta/wiki/Editing_with_Tor https://secure.wikimedia.org/wikipedia/meta/wiki/Editing_wit... Seems like a more measured response than outright blocking of everything.
- avar 16y agoWell, firstly this isn't a big problem for HTTP based services like justin.tv, almost all Tor exit nodes allow HTTP exits, but it's a bigger issue for non-HTTP exits. But the better way is to take into account exit policies. Only ban access from those IPs that are Tor exits and allow access through to justin.tv. You can query the exit policies of a given exit with TorDNSEL: https://www.torproject.org/tordnsel/ https://www.torproject.org/tordnsel/ I also whipped up a quick script that can be fed a list of Tor exit nodes on STDIN and will spew out a list of exits that aren't allowed to access a given IP:PORT: http://gist.github.com/523328 http://gist.github.com/523328 According to that 5/1338 Tor exits have policies that don't allow exits to justin.tv on port 80 (199.9.249.22:80), but e.g. 309/1338 ban exits to irc.freenode.org:6667. That means that justin.tv is needlessly banning ~0.4% of Tor exit nodes, but someone using the same approach with an IRC server is needlessly banning ~23%. With SMTP (checked on a random GMail server) that percentage rises to 98.8%.
- seabee 16y agoExcuse me if I'm being dense; obviously it is unnecessary, but what's the drawback of banning a Tor exit node that disallows access to your IP? It just seems far easier to ban them all.