Re: Exit node connection statistics

[blau <blaumeer@xxxxxxxxx>]

mplsfox02@xxxxxxxxxxxxxx ha scritto:
> Can you explain what the threat scenario is for what I'm doing?

Three lines of thought come to my mind:

Point # 1: to be relevant, a statement about an exit node should allow
fact-checking.
For example, if you say you collect and publish traffic stats of your
exit node, you should provide your node's nick and publish that info in
a way that everybody can check, e.g. in a web page on the node's IP
address (BTW, this won't influence your traffic stats since users would
connect to an IP that has a Tor node on it).

Point # 2: bad exit nodes exist, Tor is designed to limit the impact of
a bad node on overall anonymity. Moreover, Tor clients can use the
ExcludeNodes directive to avoid using known bad nodes.
The Tor Exit Scanner project, moreover, wants to "notice misconfigured,
broken, and even malicious exit relays".
Traffic analysis is bad for anonymity, so if i can prove that node X
does traffic inspection, I would avoid using that node.

Point # 3: curiosity about one's own relay traffic is normal. You can
use ntop, IDS software or whatever to inspect your exit traffic: the bad
things will always stand out (ssh scans, web attacks, bittorrent tracker
traffic) while the normal users will go unnoticed. This is especially
true if you have an NIDS.
When you run an exit relay for the public, you should accept that a
small fraction of the traffic may be undesirable. If ExitPolicy is not
enough for you, you can run a middleman relay.

> My personal motivation is that [...] I don't want
> to spend my time and efforts for people abusing Tor [...]
> So I'd like to get an idea how
> the ratio between the two use-cases is and if there is something I can
> do to improve the situation.

We can improve the situation by spreading Tor among everyday users and
fostering the diversity of its user base. The lame/nice user ratio is
very low and it reflects the actual usage patterns on the Internet.

Jan