[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: Filtering traffic from your node - for exit points



Benn reading this thread with some interest and just wanted to add my 2
cents on it.. As anyone who has watched this list for any time should
know I'm dead against "filtering" Tor. Not because I like objectionable
content but because "filters" are notoriously badly implemented,
Subjective, and completely fail to address the real problem (i.e. they
don't stop the "evil" people in the least and are at most a minor and
trivial inconvenience. 

So in that vein I just wanted to point out some of the more obvious
problems with this proposed filtering scheme

On Mon, 2007-10-09 at 14:21 -0700, Torified User wrote:

[snipped details of the technical side of the implementation because I'm
not addressing the technicalities of this]

> 
> 8) Configure lists/bannedextensionlist:
> 
> .asx  # Windows Media Audio / Video
> .rar  # Similar to zip
> .mp3  # Music file
> .mpeg # Movie file
> .mpg  # Movie file
> .avi  # Movie file
> .asf  # this can also exploit a security hole allowing virus infection
> .iso  # CD ISO image
> .ogg  # Music file
> .wmf  # Movie file
> .bin # CD ISO image
> .cue # CD ISO image


you're assuming that the "evil" people will be honest about the content.
it's really trivial to change the extension to bypass this filter

> 
> 9) Configure lists/bannedmimetypelist:
> 
> audio/mpeg
> audio/x-mpeg
> audio/x-pn-realaudio
> audio/x-wav
> video/mpeg
> video/x-mpeg2
> video/x-msvideo
> video/msvideo
> application/gzip
> application/x-gzip
> application/zip
> application/compress
> application/x-compress
> #application/java-vm

Again, assuming the web server in question will properly identify the
mime type of the content most things will pass through to the browser
fine for downloading even if labelled with an incorrect mime-type (i.e.
application/octet-stream or no mime type descriptor)

> 
> 10) Configure lists/bannedphraselist: (watch out for /etc/dansguardian
> vs. /usr/local/etc/dansguardian)
> 
> .Include</usr/local/etc/dansguardian/lists/phraselists/pornography/banned>
> 
> 11) Configure lists/bannedurllist: (mine looks like this, again watch
> out for /etc/dansguardian vs. /usr/local/etc/dansguardian)
> .Include</usr/local/etc/dansguardian/lists/blacklists/adult/urls>
> .Include</usr/local/etc/dansguardian/lists/blacklists/aggressive/urls>
> .Include</usr/local/etc/dansguardian/lists/blacklists/audio-video/urls>
> .Include</usr/local/etc/dansguardian/lists/blacklists/hacking/urls>
> .Include</usr/local/etc/dansguardian/lists/blacklists/porn/urls>
> .Include</usr/local/etc/dansguardian/lists/blacklists/proxy/urls>
> .Include</usr/local/etc/dansguardian/lists/blacklists/violence/urls>
> .Include</usr/local/etc/dansguardian/lists/blacklists/virusinfected/urls>
> .Include</usr/local/etc/dansguardian/lists/blacklists/warez/urls>

this assumes that:

1.) the content is sniffable (i.e. not some sort of encrypted
connection, https, vpn, etc.)

2.) The person using the service doesn't use/know other ways to bypass
such filters.

A couple of personal side notes here.

your entire filter set assumes the "bad guys" play by the rules.. they
don't

TOR already provides a wonderful way to block your node from exiting to
all illegal/objectionable materials: reject *:* in tor RC (really about
the only effective way to do such)

This filter seems to cast a very wide net and thus appears to be aimed
more at "objectionable" content rather then "illegal" content. If this
is the case then the person implementing it is trying to thrust their
world view onto others.. (basically starting their own little repressive
regime)

I can almost guarantee that these filters would end up blocking
resources that are helpful to abuse survivors.. but I guess they don't
need or deserve anonymity now do they.  

Please, as others have stated, do not muck up TOR by trying to make it
"safe". You will only end up hurting honest users, slowing things down,
making a royal mess. (directed more at others whom might be considering
something like this the the original author as I am aware he has stated
his server is no longer a going concern).




Freemor <freemor@xxxxxxxx>
Freemor <freemor@xxxxxxxxxx>

This e-mail has been digitally signed with GnuPG

See: http://gnupg.org/ for more details


Attachment: signature.asc
Description: This is a digitally signed message part