3 ms·
I wrote a little script to watch Tor traffic to my servers and way more than 94% is either clearly malicious or probably malicious. Malicious is clearly scans,
by blakesterz 8y ago
I wrote a little script to watch Tor traffic to my servers and way more than 94% is either clearly malicious or probably malicious. Malicious is clearly scans, bruteforcing attempts, and so on. Malicious is obvious most of the time when I look at the web logs. "Probably Malicious" is something like an odd single hit to an index page, really not quite sure what they're doing, but it's clearly not a person looking at the site. Tor traffic is almost never a person looking at a website based on what I see in my Apache logs.
Most clearly malicious traffic to my servers is not Tor, but most Tor traffic is malicious. This is what I see to my servers, you may see different traffic on your servers.
- lrvick 8y agoSweeping bans of users based on shared IP addresses should never be more than a very short term stopgap solution. There are other ways to solve these problems. As just one example you could support protocols like U2F or FIDO2 that take brute forcing off the table, and the brute forcers go away. As another example I offer free unix shell services to the general public. Lots of people were using Tor to create accounts for cryptocurrency mining. Instead of banning Tor I blocked all outgoing traffic to all major mining pools. The mining abuse stopped. Try to find ways to remove the incentive for bad behaviour, rather than throwing out the good with the bad.
- ada1981 8y agoI appreciate the way you think. I’d love to hear you brainstorm on social problems using the same approach.