Re: [tor-relays] G-Core Labs and their humanoid robots

[Roger Dingledine <arma@xxxxxxxxxxxxxx>]

On Tue, Jun 08, 2021 at 01:56:33PM +0200, Tor Relays wrote:
> Support agent 1:
> It was blocked because automatic monitoring system find your activity
> suspicious.
> Now, trust level of your traffic for IP has been increased however the
> traffic is still automatically monitored. If the system of automatization
> identifies your traffic as illegitimate or if we receive an infringement
> report, we'll have to disable ports once again.

Right, this is the key part of the explanation.

Typically the way these blocklists work is that they run "honey services"
somewhere secret on the internet, often on ports like 80 that are
different from the ones they will apply the blocklist to. And if anybody
connects to their secret honey IP address on port 80, they call them a
likely spammer and refuse to allow emails/etc to their other services
from that address.

And Tor exits are particularly susceptible to getting put on these kind
of blocklists, because all it takes is one person trying to connect to the
honey address, and bam the exit relay's IP address gets on the blocklist.

And the "cross-protocol" nature of the blocking, where they see you do
one protocol and then block you from doing a different protocol, also
does not match well with Tor's notion of exit policies.

I guess that the scale of jerks on the internet is huge compared to what
they imagine is the scale of non-jerks on Tor, and so they have little
incentive to change the design of their honeypot systems. :(

--Roger

_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays