4 ms·

That's an interesting stress test for I2P. They should try to fix that, the protocol should be resilient to such an event. Even if there are 10x more bad nodes

That's an interesting stress test for I2P. They should try to fix that, the protocol should be resilient to such an event. Even if there are 10x more bad nodes than good nodes (assuming they were noncompliant I2P actors based on that thread) the good nodes should still be able to find each other and continue working. To be fair spam will always be a thorny problem in completely decentralized protocols.

sandworm101 8mo ago
No. They should not try to survive such attacks. The best defense to a temporary attack is often to pull the plug. Better than than potentially expose users. When there are 10x as many bad nodes as good, the base protection of any anonymity network is likely compromised. Shut down, survive, and return once the attacker has moved on.
- martin-t 8mo ago
  Why would an attacker move on if it can maintain a successful DoS attack forever?
  - xmcp123 8mo ago
    Because botnets are mostly there to make money nowadays. Or owned by state actors. Either way, it’s opportunity cost.
  - flipped 8mo ago
    The mentioned botnet didn't intentionally take down I2P. It's run by bunch of kids who don't know what they're doing.
- deleted 8mo ago
  [deleted]
- conradev 8mo ago
  This is why Tor is centralized, so that they can take action like cutting out malicious nodes if needed. It’s decentralized in the sense that anyone can participate by default.
  - notpushkin 8mo ago
    > so that they can take action like cutting out malicious nodes if needed How does that work?
    - cyphar 8mo ago
      While anyone can run a Tor node and register it as available, the tags that Tor relays get assigned and the list of relays is controlled by 9 consensus servers[1] that are run by different members the Tor project (in different countries). They can thus easily block nodes. [1]: https://consensus-health.torproject.org/ https://consensus-health.torproject.org/
      - flipped 8mo ago
        It's 10, not 9. And there are severe problems with having a total of 10 DA be the essential source of truth for whole network. It would be trivial to DDoS the DAs and bring down the Tor network or at the very least, disrupt it: https://arxiv.org/abs/2509.10755 https://arxiv.org/abs/2509.10755. It's the only complaint I have of the current state of Tor. Anyone should be able to run directory authority, regardless if you trust the operator or not (same as normal relays).
        _yclj 8mo ago
        Anyone can. The DA code is open source and is used whenever you run a testnet. You can also run a DA on the mainnet - how do you think the 10 primary DAs exist? They're not 10 computers owned by a single organization - they're 10 mutually trusting individuals. However, most of the network won't trust you.
        flipped 8mo ago
        [flagged]
        michaelmrose 8mo ago
        Couldn't you A: Run your own network that trusts the existing plus whatever nodes you think ought to be and convince everyone that this is better if it is B: Run a node and convince others to trust yours so that eventually there is 11 then 12 and so forth?
01HNNWZ0MV43FF 8mo ago
Finding good nodes is a thorny problem for human friendship, too!
- kkfx 8mo ago
  That's why the Web of Trust, or classic GNUPG key signing parties are a forgotten/ignored must have. Anyone can change and go rouge of course, but it's statistically less likely.
  - kbrkbr 8mo ago
    If I understand gp correctly, the web of trust comes after finding these human nodes, and will not help you in the process.
    - kkfx 8mo ago
      It doesn't work for I2P due to its design, but for things like Nostr, it works well. Essentially, the goal is to build up a list of "known" reliable relays over time, while simultaneously blacklisting anyone who joins and proves to be unreliable relying on the statistic that collaborative individuals outnumber hostile ones in any sufficiently large cohort. Of course, it's far from being 100% effective, but it mitigates the issue significantly.
      - _yclj 8mo ago
        Hostile entities generally have a lot of money they can use to perform a Sybil attack.
        kkfx 8mo ago
        Sure, but can't break the trusted part of the network who can remain operational in that case, even if not really anonymous anymore.
- seertaak 8mo ago
  Funny and excellent comment!
embedding-shape 8mo ago
> Even if there are 10x more bad nodes than good nodes [...] the good nodes should still be able to find each other What network, distributed or decentralized, can survive such an event? Most of the protocols break down once you hit some N% threshold of the network being bad nodes, asking it to survive 1000%+ bad nodes when others usually is something like "When at least half the nodes are good". Are there existing decentralized/distributed protocols that would survive a 1000% attack of bad nodes?

sandworm101 8mo ago

No. They should not try to survive such attacks. The best defense to a temporary attack is often to pull the plug. Better than than potentially expose users. When there are 10x as many bad nodes as good, the base protection of any anonymity network is likely compromised. Shut down, survive, and return once the attacker has moved on.

martin-t 8mo ago
Why would an attacker move on if it can maintain a successful DoS attack forever?
- xmcp123 8mo ago
  Because botnets are mostly there to make money nowadays. Or owned by state actors. Either way, it’s opportunity cost.
- flipped 8mo ago
  The mentioned botnet didn't intentionally take down I2P. It's run by bunch of kids who don't know what they're doing.
deleted 8mo ago
[deleted]
conradev 8mo ago
This is why Tor is centralized, so that they can take action like cutting out malicious nodes if needed. It’s decentralized in the sense that anyone can participate by default.
- notpushkin 8mo ago
  > so that they can take action like cutting out malicious nodes if needed How does that work?
  - cyphar 8mo ago
    While anyone can run a Tor node and register it as available, the tags that Tor relays get assigned and the list of relays is controlled by 9 consensus servers[1] that are run by different members the Tor project (in different countries). They can thus easily block nodes. [1]: https://consensus-health.torproject.org/ https://consensus-health.torproject.org/
    - flipped 8mo ago
      It's 10, not 9. And there are severe problems with having a total of 10 DA be the essential source of truth for whole network. It would be trivial to DDoS the DAs and bring down the Tor network or at the very least, disrupt it: https://arxiv.org/abs/2509.10755 https://arxiv.org/abs/2509.10755. It's the only complaint I have of the current state of Tor. Anyone should be able to run directory authority, regardless if you trust the operator or not (same as normal relays).
      - _yclj 8mo ago
        Anyone can. The DA code is open source and is used whenever you run a testnet. You can also run a DA on the mainnet - how do you think the 10 primary DAs exist? They're not 10 computers owned by a single organization - they're 10 mutually trusting individuals. However, most of the network won't trust you.
        flipped 8mo ago
        [flagged]
      - michaelmrose 8mo ago
        Couldn't you A: Run your own network that trusts the existing plus whatever nodes you think ought to be and convince everyone that this is better if it is B: Run a node and convince others to trust yours so that eventually there is 11 then 12 and so forth?

01HNNWZ0MV43FF 8mo ago

Finding good nodes is a thorny problem for human friendship, too!

kkfx 8mo ago
That's why the Web of Trust, or classic GNUPG key signing parties are a forgotten/ignored must have. Anyone can change and go rouge of course, but it's statistically less likely.
- kbrkbr 8mo ago
  If I understand gp correctly, the web of trust comes after finding these human nodes, and will not help you in the process.
  - kkfx 8mo ago
    It doesn't work for I2P due to its design, but for things like Nostr, it works well. Essentially, the goal is to build up a list of "known" reliable relays over time, while simultaneously blacklisting anyone who joins and proves to be unreliable relying on the statistic that collaborative individuals outnumber hostile ones in any sufficiently large cohort. Of course, it's far from being 100% effective, but it mitigates the issue significantly.
    - _yclj 8mo ago
      Hostile entities generally have a lot of money they can use to perform a Sybil attack.
      - kkfx 8mo ago
        Sure, but can't break the trusted part of the network who can remain operational in that case, even if not really anonymous anymore.
seertaak 8mo ago
Funny and excellent comment!

embedding-shape 8mo ago

> Even if there are 10x more bad nodes than good nodes [...] the good nodes should still be able to find each other What network, distributed or decentralized, can survive such an event? Most of the protocols break down once you hit some N% threshold of the network being bad nodes, asking it to survive 1000%+ bad nodes when others usually is something like "When at least half the nodes are good". Are there existing decentralized/distributed protocols that would survive a 1000% attack of bad nodes?