5 ms·

“@zedshaw If you don't trust Tor because of me, you clearly do not understand how Tor works. You can BadExit my nodes buddy.” Appelbaum, https://twitter.com/#!

by alanh 16y ago

“@zedshaw If you don't trust Tor because of me, you clearly do not understand how Tor works. You can BadExit my nodes buddy.” Appelbaum, https://twitter.com/#!/ioerror/status/19703396818747392 https://twitter.com/#!/ioerror/status/19703396818747392

zedshaw 16y ago
I was curious about this, so I started googling for how to do this. Sure enough, it's a bitch and the only way to really do it easily is to use a GUI like Tork. Not to mention I can't seem to figure out how you find his nodes in order to BadExit them, and I very seriously doubt his nodes will get listed in anything official. Anyone got good instructions on how to actually BadExit his nodes? I want to post them so people actually can.
- praptak 16y ago
  Why would you even want to BadExit his nodes? Using Tor you're vulnerable anyway. Any exit node can snoop on your traffic or even change it. Enumerating some bad nodes does not substantially improve this. The above can only be prevented by using something like SSL plus a trusted certificate on top of Tor.
  - marcinw 16y ago
    Right, and the people who are running malicious Tor exit nodes won't tell you that either. Good luck with that.
  - mfukar 16y ago
    It's up to the Tor user to encrypt her end-to-end traffic. If that's what she wants.
  - ahn 16y ago
    > Why would you even want to BadExit his nodes? To further malign him of course.
- insect 16y ago
  If you add this to your torrc: ExcludeNodes $0AD3FA884D18F89EEA2D89C019379E0E7FD94417,$3100A70862157E5F9136B6AAEB7571745D4DC055,$49E2C345FDA5E9ADFE13320690BF2C77EA803E6C,$4A0CCD2DDC7995083D73F5D667100C8A5831F16D,$5FABB67A4C229ECACD53F5E02B62C87E5300728D,$62665FD8A07D2E0F6ABDB4A36283A5A8824C0128,$6AF64BD1DF8B92D5194760C2256EBF80F70273DD,$71B7F2406DDAE829979B53963B952E17CD021125,$8522EB98C91496E80EC238E732594D1509158E77,$D67C5F501DAA0EE65AF9422A36385217D8AD3927,$EFE02E652CA2EB6FD96B30DC77EA55ABF7EFC1A5 Then your traffic will never pass through any Tor node that Jacob has publicly admitted to controlling. To verify this: Check https://www.torproject.org/docs/tor-manual-dev.html.en https://www.torproject.org/docs/tor-manual-dev.html.en for the ExcludeNodes directive. There is an ExcludeExitNodes option, if you're willing to tolerate him as a middle-man, and just not exit out his nodes. Check one of the online directory servers (e.g. http://torstatus.blutmagie.de/ http://torstatus.blutmagie.de/) and use the Advanced Query Options to find all the nodes where "Contact" - "Contains" - "appelbaum.net" to find which nodes he administers. Then add the fingerprint of every node you want to avoid to the ExcludeNodes entry. You should obviously confirm the list above with other sources, because one or all of the following might be true: 1. I may be in cahoots with Jacob, plotting to hack your codez. 2. The directory server I linked to may be a co-conspirator. Fortunately, there are other directory servers you can query. 3. There is no three. Anybody can put up a node and declare anything. If Jacob, or I, are using Tor nodes nefariously, do you really think we'll put our names on them? P.S. Don't forget to restart Tor after you change the torrc.
  - zedshaw 16y ago
    WOW. So usable. I'm sure everyone who doesn't trust his affiliation with Wikileaks will just sit right down and punch that in.
praptak 16y ago
If Appelbaum actually works on Tor then just BadExit'ing his nodes is obviously not enough. Even a clean compile (for the paranoid: do you trust your compiler?) from a fully audited (do you have the resources?) source code is not enough. In order to use Tor you gotta trust the other nodes, including the code that runs there.
- deleted 16y ago
  [deleted]
- zedshaw 16y ago
  I doubt Jacob is hacking his own code, he'd have way too much to lose and I do believe he actually loves the project. If he were to do anything it'd be handing interesting traffic off various exit nodes he and friends control to Wikileaks. That'd be about all I or anyone else could allegedly claim.
  - praptak 16y ago
    Ok, but (if I understand how Tor works) then the fact that he works on Tor has nothing to do with his control of exit nodes. Anybody can run an exit node, whether or not they work on Tor.
  - blasdel 16y ago
    Especially since bad actors (including governments) have been running exit nodes and sniffing the traffic — Wikileaks got its start by doing it, and the Chinese got access to a bunch of embassy webmail accounts that way. Tor exit nodes are already extraordinarily untrustworthy, one run by anyone associated with Wikileaks might as well be a chinese room with Hitler inside!
redthrowaway 16y ago
Am I the only one who is disappointed that two supposedly professional adults can't manage to have a grown up conversation about this? Reading the back and forth is pretty disheartening.
- rbanffy 16y ago
  I think you are starting from a false supposition.
- zedshaw 16y ago
  Oh, it's pretty much impossible to have any rational conversation these days. The majority of the technology speech these days is manipulative, flat out wrong, very anti free speech, and hyperbolic. When you start from that, there's just no point trying to be reasonable.
  - redthrowaway 16y ago
    While I agree, you started the conversation by breaking Godwin's Law. I don't think Applebaum paid particularly close attention to your piece, but I probably wouldn't either in his position. A cursory skimming of your post reads as, "would you eat a sandwich from Hitler? No? Then why do you use software from Applebaum?" I don't think that's a fair distillation of your argument, but it is reasonable to think that someone briefly scanning your work might think it to be so. Complaining about tech speech being hyperbolic whilst simultaneously [implicitly] comparing Applebaum to Hitler is a little ballsy, tbh.
    - blasdel 16y ago
      You not only got that backwards, but Godwin's law is not one that can ever be 'broken' — just because you haven't used Hitler in an analogy yet doesn't mean you aren't asymptotically approaching such a comparison. Using der Fürher in an internet argument is a realization Godwin's law, not a violation of it.
- burgerbrain 16y ago
  What's so immature about Appelbaum's response? It seems like a pretty reasonable offhand dismissal of a silly accusation.

by alanh 16y ago

zedshaw 16y ago

I was curious about this, so I started googling for how to do this. Sure enough, it's a bitch and the only way to really do it easily is to use a GUI like Tork. Not to mention I can't seem to figure out how you find his nodes in order to BadExit them, and I very seriously doubt his nodes will get listed in anything official. Anyone got good instructions on how to actually BadExit his nodes? I want to post them so people actually can.

praptak 16y ago
Why would you even want to BadExit his nodes? Using Tor you're vulnerable anyway. Any exit node can snoop on your traffic or even change it. Enumerating some bad nodes does not substantially improve this. The above can only be prevented by using something like SSL plus a trusted certificate on top of Tor.
- marcinw 16y ago
  Right, and the people who are running malicious Tor exit nodes won't tell you that either. Good luck with that.
- mfukar 16y ago
  It's up to the Tor user to encrypt her end-to-end traffic. If that's what she wants.
- ahn 16y ago
  > Why would you even want to BadExit his nodes? To further malign him of course.
insect 16y ago
If you add this to your torrc: ExcludeNodes $0AD3FA884D18F89EEA2D89C019379E0E7FD94417,$3100A70862157E5F9136B6AAEB7571745D4DC055,$49E2C345FDA5E9ADFE13320690BF2C77EA803E6C,$4A0CCD2DDC7995083D73F5D667100C8A5831F16D,$5FABB67A4C229ECACD53F5E02B62C87E5300728D,$62665FD8A07D2E0F6ABDB4A36283A5A8824C0128,$6AF64BD1DF8B92D5194760C2256EBF80F70273DD,$71B7F2406DDAE829979B53963B952E17CD021125,$8522EB98C91496E80EC238E732594D1509158E77,$D67C5F501DAA0EE65AF9422A36385217D8AD3927,$EFE02E652CA2EB6FD96B30DC77EA55ABF7EFC1A5 Then your traffic will never pass through any Tor node that Jacob has publicly admitted to controlling. To verify this: Check https://www.torproject.org/docs/tor-manual-dev.html.en https://www.torproject.org/docs/tor-manual-dev.html.en for the ExcludeNodes directive. There is an ExcludeExitNodes option, if you're willing to tolerate him as a middle-man, and just not exit out his nodes. Check one of the online directory servers (e.g. http://torstatus.blutmagie.de/ http://torstatus.blutmagie.de/) and use the Advanced Query Options to find all the nodes where "Contact" - "Contains" - "appelbaum.net" to find which nodes he administers. Then add the fingerprint of every node you want to avoid to the ExcludeNodes entry. You should obviously confirm the list above with other sources, because one or all of the following might be true: 1. I may be in cahoots with Jacob, plotting to hack your codez. 2. The directory server I linked to may be a co-conspirator. Fortunately, there are other directory servers you can query. 3. There is no three. Anybody can put up a node and declare anything. If Jacob, or I, are using Tor nodes nefariously, do you really think we'll put our names on them? P.S. Don't forget to restart Tor after you change the torrc.
- zedshaw 16y ago
  WOW. So usable. I'm sure everyone who doesn't trust his affiliation with Wikileaks will just sit right down and punch that in.

praptak 16y ago

If Appelbaum actually works on Tor then just BadExit'ing his nodes is obviously not enough. Even a clean compile (for the paranoid: do you trust your compiler?) from a fully audited (do you have the resources?) source code is not enough. In order to use Tor you gotta trust the other nodes, including the code that runs there.

deleted 16y ago
[deleted]
zedshaw 16y ago
I doubt Jacob is hacking his own code, he'd have way too much to lose and I do believe he actually loves the project. If he were to do anything it'd be handing interesting traffic off various exit nodes he and friends control to Wikileaks. That'd be about all I or anyone else could allegedly claim.
- praptak 16y ago
  Ok, but (if I understand how Tor works) then the fact that he works on Tor has nothing to do with his control of exit nodes. Anybody can run an exit node, whether or not they work on Tor.
- blasdel 16y ago
  Especially since bad actors (including governments) have been running exit nodes and sniffing the traffic — Wikileaks got its start by doing it, and the Chinese got access to a bunch of embassy webmail accounts that way. Tor exit nodes are already extraordinarily untrustworthy, one run by anyone associated with Wikileaks might as well be a chinese room with Hitler inside!

redthrowaway 16y ago

Am I the only one who is disappointed that two supposedly professional adults can't manage to have a grown up conversation about this? Reading the back and forth is pretty disheartening.

rbanffy 16y ago
I think you are starting from a false supposition.
zedshaw 16y ago
Oh, it's pretty much impossible to have any rational conversation these days. The majority of the technology speech these days is manipulative, flat out wrong, very anti free speech, and hyperbolic. When you start from that, there's just no point trying to be reasonable.
- redthrowaway 16y ago
  While I agree, you started the conversation by breaking Godwin's Law. I don't think Applebaum paid particularly close attention to your piece, but I probably wouldn't either in his position. A cursory skimming of your post reads as, "would you eat a sandwich from Hitler? No? Then why do you use software from Applebaum?" I don't think that's a fair distillation of your argument, but it is reasonable to think that someone briefly scanning your work might think it to be so. Complaining about tech speech being hyperbolic whilst simultaneously [implicitly] comparing Applebaum to Hitler is a little ballsy, tbh.
  - blasdel 16y ago
    You not only got that backwards, but Godwin's law is not one that can ever be 'broken' — just because you haven't used Hitler in an analogy yet doesn't mean you aren't asymptotically approaching such a comparison. Using der Fürher in an internet argument is a realization Godwin's law, not a violation of it.
burgerbrain 16y ago
What's so immature about Appelbaum's response? It seems like a pretty reasonable offhand dismissal of a silly accusation.