[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: Exit node connection statistics
But you are right. Maybe top 100 is too much and I should switch to
a top 20 or so?
No, you should turn it off. Having those statistics doesn't add any
value to the Tor network, you cannot even make broad statements like
"30% of all traffic in Tor goes to xy.com", because you see only a
tiny fraction and the real usage is likely to be entirely different
- think about how different exit policies etc come into play.
Generally, it's always recommended to not log unless you have a
reason (for example a bug you're trying to find).
The question is not, if it adds value to Tor, but if it adds value in
general. And if this is the case I cannot tell yet, and I claim you
can't either. It's just a first idea.
The stats are port specific, so they are independent of exit policies.
Since I assume most users don't use specific exit nodes, I believe
it's a fair assumption that the stats are more or less representative.
So it doesn't tell you anything, that flickr.com for example makes
more than 5% during the last days, while the next host is below 1%?
Massive abuse is as much a reason as a bug in my eyes.
The less verbose your logs are, the less likely it is someone will
find them interesting and makes you give them out. This applies to
the whole community of relay operators - if it is a well-known fact
that most of them log, adversaries might become more persuasive when
they ask for logs.
I doubt this "well-known fact" depends on wether somebody is
publishing stats. You always have to assume, that a Tor relay might be
logging, and so do the investigators. If they become active depends
then on wether they were successful before in getting useful logs. My
logs are not useful for backtracing, so I don't contribute to this
Generally, Tor exit nodes must always be assumed to be malicious,
but this of course doesn't mean that once it's a proven fact that an
exit is malicious, it will be excluded.
Define "malicious". The key feature of Tor is, that it doesn't rely on
the trustworthiness of the relay operators, else it would be useless.
So I think the log issue is being overrated.
So, a personal question: What is your motive? Do you feel you have a
right to know what people are doing? Because this is where the ice
gets really thin...
My motive is that of any researcher: learn something. And yes, I do
feel that I have the right to know what people are doing, but I don't
have the right to know what a person is doing. That's a big
difference. The ice gets thin if the Tor-FAQ argues: "we feel that
we're doing pretty well at striking a balance currently", although we
don't have any idea how much abuse is currently happening. (You cannot
estimate it by the number of complaints.)
There are always side effects, so what side effects does Tor have?
Maybe Tor in the end reduces privacy instead of improving it, if you
look at the big picture? (For example because it enables data-miners
to anonymously break their privacy policies?) If we don't dare to look
what actually happens on the wire, with the excuse that Tor is about
anonymity, we risk to do the wrong thing. And the good thing is: most
of the transport-layer data is already anonymized. If you make studies
in the normal carrier networks, you always have to make a big effort
to anonymize the data before giving something out. With Tor exit
connections that's a lot easier, since the source is already unknown.
One could even take up this provocative position: Everybody can
operate a Tor node. So everything that a Tor node sees, is public by
definition, as it can be seen by a random non-trustworthy person. So
it doesn't make a difference from a security point of view, if any
information of the traffic is made public. What will become public
then is information which is "lost" anyhow. P2P encryption is
essential for sensitive data, with Tor even more, and making all info
public would just make that very clear to everybody.