Hi tor-dev folks,
Long-time Tor supporter, first-time
posting here! I'm Jo
seph Lorenzo Hall, a
nd I lead the Security portfolio at the Internet Society
in my day job. I'm one of the partners who
help evaluate domains for sponsorship through Cloudflare's Project Galileo
(free tools for non-profits and public-interest orgs).
For more than ten years (first at CDT and now at ISOC), I
've made it a policy not to sponsor domains that aren't reachable over Tor.
To help with this, I maintain a small Tor reachability scanner:
https://github.com/josephlhall/check_tor . It compares HTTPS requests using curl over Tor against direct connections. I'm trying to better understand how reliably t
hese scanner results reflect the experience of someone using Tor Browser
(or a browser with a SOCKS proxy over Tor).Before building and maintaining my own test
endpoints and infrastructure, I wanted to ask whether controlled test endpoints already exist for a few cases
(some of these may be very simple):
* Deliberate Tor blocking:
An endpoint that allows direct connections but refuses or challenges Tor exits.
* Client-specific filtering:
One that rejects
tools like curl
in this case but allows a browser through.
* Browser challenges
: An endpoint (or set of them) that presents a documented challenge that Tor Browser might pass automatically, require interaction to complete, or fail.
(Don't want to make this an endless list of bad challenges, but still...)Ideally, these would be endpoints with known configurations
, rather than inferring what's happening from arbitrary websites... and they'd have testing- and research-oriented data retention policies (etc.).
W
e have some of these for HTTPS/HTTP/TLS errors, but I'm not aware of any for Tor testing.Does anything like this already exist? Or is there a better community to ask?
Maybe our OONI friends?Thanks!
--Dr. Joe