> Are you doing anything the maximise the effect that (say) a ban based on
> IP can have?
Ah, I see - I mistook your intent, please let me clarify:
From a threat perspective we basically treat our onion site like an large web proxy with a mix of (by far the majority) normal and (remainder) malicious activity emanating from it.
There are a bunch of such proxies "out there" on the net anyhow - e.g.: any Tor exit node - so having one more is not a big deal.
The "rewrite the onion to a 169.254/*" is a book-keeping measure so that we don't have to special case either RFC-1918 or publicly routable IP addresses in our stack.
We don't use the onion's virtual IP for any sense of "session" management.
> Have you made any changes lower down (similar to the patch str4d posted,
> i guess) so that you can do it on a per-circuit basis (making things a
> little harder)
We are currently running a vanilla tor daemon binary. No mods, no magic, basic config.
>>
>> I agree that sometimes itâs overkill. Iâm okay with an occasional bit
>> of overkill in this area.
>
> It depends, here's a massively oversimplified example
> [...]
> Switch to HTTPS.
>
> Every 300 requests, the connection is still torn-down by the origin but
> now you have to redo your SSL handshake etc. With VoD that's once every
> 600 seconds (as you only need to retrieve the manifest once).
[deletia]
That's a really interesting example, thank you! Food for thought...
> the point I'm trying to make is that people tend to assume that the
> traditional overhead of SSL is largely negated by the power of the
> systems we use now, but there are definitely areas where that assumption
> might be incorrect.
Yep.
Our approach so far has been to "just try it and see what works" - and then measure and fix the issues later, in-situ.
There have been far fewer issues than we expected. :-)
- alec
Attachment:
signature.asc
Description: Message signed with OpenPGP using GPGMail
-- tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk