Re: [tor-dev] Running doctor's sybil checker over archived consensuses

[David Fifield <david@xxxxxxxxxxxxxxx>]

On Thu, Jan 15, 2015 at 04:25:10PM +0100, Philipp Winter wrote:
> 2014-01-30: A clearly related group of relays comes online, presumably
>             the one from the pulled Blackhat talk. (A)
> 2014-11-17: Several probably related relays in the Google cloud get
>             online. (B)
> 2014-12-26: Many relays named LizardNSA and FuslVZTOR come online. (C)
> 2014-12-30: Many relays named anonpoke come online. (D)

The visualizer program only works on archived microdescriptors, which
only go back through 2014. But I ran it on all of 2014 and you can see
the four incidents above.

The stripes in the background are months.

https://people.torproject.org/~dcf/graphs/microdescs/microdescs-2014.png (8760Ã62986 pixels)
https://people.torproject.org/~dcf/graphs/microdescs/microdescs-2014-short.png (8760Ã2048 pixels)

(Wow, who knew there were over 60000 distinct descriptors in 2014?)

Maybe the checker should also check for when a lot of relays go away at
once. It looks that happened in mid-April, where relays that had been
started at different times in the beginning of the year all stopped at
once.

(Oh, on further reflection, that must have been Heartbleed!)

David Fifield

_______________________________________________
tor-dev mailing list
tor-dev@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev