Benn reading this thread with some interest and just wanted to add my 2 cents on it.. As anyone who has watched this list for any time should know I'm dead against "filtering" Tor. Not because I like objectionable content but because "filters" are notoriously badly implemented, Subjective, and completely fail to address the real problem (i.e. they don't stop the "evil" people in the least and are at most a minor and trivial inconvenience. So in that vein I just wanted to point out some of the more obvious problems with this proposed filtering scheme On Mon, 2007-10-09 at 14:21 -0700, Torified User wrote: [snipped details of the technical side of the implementation because I'm not addressing the technicalities of this] > > 8) Configure lists/bannedextensionlist: > > .asx # Windows Media Audio / Video > .rar # Similar to zip > .mp3 # Music file > .mpeg # Movie file > .mpg # Movie file > .avi # Movie file > .asf # this can also exploit a security hole allowing virus infection > .iso # CD ISO image > .ogg # Music file > .wmf # Movie file > .bin # CD ISO image > .cue # CD ISO image you're assuming that the "evil" people will be honest about the content. it's really trivial to change the extension to bypass this filter > > 9) Configure lists/bannedmimetypelist: > > audio/mpeg > audio/x-mpeg > audio/x-pn-realaudio > audio/x-wav > video/mpeg > video/x-mpeg2 > video/x-msvideo > video/msvideo > application/gzip > application/x-gzip > application/zip > application/compress > application/x-compress > #application/java-vm Again, assuming the web server in question will properly identify the mime type of the content most things will pass through to the browser fine for downloading even if labelled with an incorrect mime-type (i.e. application/octet-stream or no mime type descriptor) > > 10) Configure lists/bannedphraselist: (watch out for /etc/dansguardian > vs. /usr/local/etc/dansguardian) > > .Include</usr/local/etc/dansguardian/lists/phraselists/pornography/banned> > > 11) Configure lists/bannedurllist: (mine looks like this, again watch > out for /etc/dansguardian vs. /usr/local/etc/dansguardian) > .Include</usr/local/etc/dansguardian/lists/blacklists/adult/urls> > .Include</usr/local/etc/dansguardian/lists/blacklists/aggressive/urls> > .Include</usr/local/etc/dansguardian/lists/blacklists/audio-video/urls> > .Include</usr/local/etc/dansguardian/lists/blacklists/hacking/urls> > .Include</usr/local/etc/dansguardian/lists/blacklists/porn/urls> > .Include</usr/local/etc/dansguardian/lists/blacklists/proxy/urls> > .Include</usr/local/etc/dansguardian/lists/blacklists/violence/urls> > .Include</usr/local/etc/dansguardian/lists/blacklists/virusinfected/urls> > .Include</usr/local/etc/dansguardian/lists/blacklists/warez/urls> this assumes that: 1.) the content is sniffable (i.e. not some sort of encrypted connection, https, vpn, etc.) 2.) The person using the service doesn't use/know other ways to bypass such filters. A couple of personal side notes here. your entire filter set assumes the "bad guys" play by the rules.. they don't TOR already provides a wonderful way to block your node from exiting to all illegal/objectionable materials: reject *:* in tor RC (really about the only effective way to do such) This filter seems to cast a very wide net and thus appears to be aimed more at "objectionable" content rather then "illegal" content. If this is the case then the person implementing it is trying to thrust their world view onto others.. (basically starting their own little repressive regime) I can almost guarantee that these filters would end up blocking resources that are helpful to abuse survivors.. but I guess they don't need or deserve anonymity now do they. Please, as others have stated, do not muck up TOR by trying to make it "safe". You will only end up hurting honest users, slowing things down, making a royal mess. (directed more at others whom might be considering something like this the the original author as I am aware he has stated his server is no longer a going concern). Freemor <freemor@xxxxxxxx> Freemor <freemor@xxxxxxxxxx> This e-mail has been digitally signed with GnuPG See: http://gnupg.org/ for more details
Attachment:
signature.asc
Description: This is a digitally signed message part