5 ms·

I think some comments here are misunderstanding the intent of the article. For those saying TLS already solves... it is not advocating Tor as a replacement for

I think some comments here are misunderstanding the intent of the article. For those saying TLS already solves... it is not advocating Tor as a replacement for transport layer security, indeed most Tor users also use TLS (and site certs) with little overhead. No, the article is asking how you could, as a website owner, make things easier on Tor users and yourself! It starts with the assumption that you care, and want to help users who require better privacy. It answers, though not in detail, the many HN readers who invariably post replies concerning Tor that "All my abuse comes through Tor". Creating an .onion address mitigates that significantly.

tempestn 5y ago
I'm not clear from the article how having an onion address helps website operators who receive abusive traffic through Tor. Perhaps some of that abusive traffic will come in via the onion address instead, but presumably such an operator will want to continue serving their regular site to Tor exit nodes as well, so I don't see how it would actually mitigate anything, nor make the malicious traffic easier to segregate from valid traffic over Tor. What am I missing?
- nonrandomstring 5y ago
  > I'm not clear from the article how having an onion address helps website operators who receive abusive traffic through Tor. No, it's not clear. Also "abusive traffic" is vague. Are you mainly concerned with shitposters, trolls, DOS attacks? > What am I missing? Maybe you're not missing it, but essentially it's a behavioural/social rather than technical challenge. Most abusers, ones that technical changes can address, operate at scale over HTTP/S and use Tor simply as a free VPN via regular exit nodes to hide their IP. The author calls this the "Wheat/chaff problem". Viewed this way, it's easiest for a site owner to just block all of Tor and kill all legitimate users too. Most of those bulk abusers cannot be bothered to deal with marginal cases like using an overlay network with .onion addresses whereas those who _need_ Tor are highly motivated. Other kinds of abusers, like persistent troll posters, are better dealt with by other means even if you're using HTTP/S.
  - mst 5y ago
    Back when I was staff on (pre-madness) freenode providing an onion address was pretty much the only way we could afford to support tor at all given the moderation resources available. Smaller networks often (usually regretfully) end up blocking tor entirely if they don't have the capacity to set up such infrastructure.
    - tempestn 5y ago
      So you'd offer an onion address, but then block Tor traffic that didn't use it?
      - mst 5y ago
        That's how we did it and so far as I'm aware is the most common answer to "How do we keep Tor while keeping the abuse mitigation efforts required within the resources available?" for services in general.

tempestn 5y ago

I'm not clear from the article how having an onion address helps website operators who receive abusive traffic through Tor. Perhaps some of that abusive traffic will come in via the onion address instead, but presumably such an operator will want to continue serving their regular site to Tor exit nodes as well, so I don't see how it would actually mitigate anything, nor make the malicious traffic easier to segregate from valid traffic over Tor. What am I missing?

nonrandomstring 5y ago
> I'm not clear from the article how having an onion address helps website operators who receive abusive traffic through Tor. No, it's not clear. Also "abusive traffic" is vague. Are you mainly concerned with shitposters, trolls, DOS attacks? > What am I missing? Maybe you're not missing it, but essentially it's a behavioural/social rather than technical challenge. Most abusers, ones that technical changes can address, operate at scale over HTTP/S and use Tor simply as a free VPN via regular exit nodes to hide their IP. The author calls this the "Wheat/chaff problem". Viewed this way, it's easiest for a site owner to just block all of Tor and kill all legitimate users too. Most of those bulk abusers cannot be bothered to deal with marginal cases like using an overlay network with .onion addresses whereas those who _need_ Tor are highly motivated. Other kinds of abusers, like persistent troll posters, are better dealt with by other means even if you're using HTTP/S.
- mst 5y ago
  Back when I was staff on (pre-madness) freenode providing an onion address was pretty much the only way we could afford to support tor at all given the moderation resources available. Smaller networks often (usually regretfully) end up blocking tor entirely if they don't have the capacity to set up such infrastructure.
  - tempestn 5y ago
    So you'd offer an onion address, but then block Tor traffic that didn't use it?
    - mst 5y ago
      That's how we did it and so far as I'm aware is the most common answer to "How do we keep Tor while keeping the abuse mitigation efforts required within the resources available?" for services in general.