Slashdot Mirror
Tor Project Pilots Exit Nodes In Libraries
An anonymous reader writes: The Tor Project has announced a new initiative to open exit relays in public libraries. "This is an idea whose time has come; libraries are our most democratic public spaces, protecting our intellectual freedom, privacy, and unfettered access to information, and Tor Project creates software that allows all people to have these rights on the internet." They point out that this is both an excellent way to educate people on the value of private internet browsing while also being a practical way to expand the Tor network. A test for this initiative is underway at the Kilton Library in Lebanon, New Hampshire, which already has a computing environment full of GNU/Linux machines.
Here in the US any library that deals with children must have mandatory filtering software installed. Given the typical puritanical attitude, quite a few public libraries also have filters.
https://en.wikipedia.org/wiki/...
So lets pretend that we've just completed writing this code, as opposed to having just completed sabotaging it -Altera
Most admins block TOR exit nodes at the router and many other places because they are the source of many attacks. All this means is that libraries wind up on IP blacklists.
how many are willing to risk their benefactor's wrath (federal government) by supplying an anti government spying device?
I got to the chocolate box before you, that's why the hard ones have teeth marks.
It is astonishing how mindset about computing can vary among librarians. On one hand we have the one that set up TOR exit nodes to save our privacy, and on the other hand we have the one that purchase strongly vendor-locked and opaque proprietary library softwares.
Why would public libraries allow the use of their bandwidth to be exit nodes? Why would the government pay for something beyond the policy behind libraries? Libraries are places for people to read and get information, which they can do with a web browser. An exit node just makes the library a feeder tube to other places.
Why not i2p nodes https://geti2p.net/en/comparison/tor
Firewalls can prioritize traffic already. As long as the bandwidth is a flat fee and not per bit, seems pretty harmless. A waste would be to let an underutilized network sit idle.
Don't be giving the government yet another reason to cut funding to public libraries.
I think that is why the requirements seem to imply that the exit node needs to have its own IP address.
There are definite costs to running TOR infrastructure. You have to be aware of them. Some of the costs can be mitigated, but some can't. At the end, you have to be able to show that the benefits outweigh the costs.
First we examined the benefit. We made a clear statement of the benefit. It is:
USU has many researchers and students who deal in sensitive subjects such as Climate Change, Reproductive Issues, Political Systems, Animal Research, etc.. These students and researchers frequently need privacy and security to advance the goals of USU.
Then we discussed the various costs and methods of mitigating the costs. Afterwards, we decided that the costs could be made acceptable, if we were careful.
Here is our standard response to an abuse report against USU's TOR infrastructure:
=BEGIN ABUSE RESPONSE=
The activity that you have reported is being emitted by a TOR exit node:
------------
$ host 129.123.7.6 6.7.123.129.in-addr.arpa domain name pointer tor-exit-node.cs.usu.edu.
$ host 129.123.7.7
7.7.123.129.in-addr.arpa domain name pointer tor-exit-node-2.cs.usu.edu.
------------
This TOR node is a project of USU's CS department. USU has many researchers and students who deal in sensitive subjects such as Climate Change, Reproductive Issues, Political Systems, Animal Research, etc.. These students and researchers frequently need privacy and security to advance the goals of USU.
Almost all TOR traffic is generated by innocent people who are attempting to escape the shadow of a totalitarian government. But, unfortunately, sometimes criminals attempt to use TOR to attack others.
We are in discussion with our TOR admins to try to find ways to limit the attack activity. Of course, this rapidly becomes a sticky issue. If we start inspecting and censoring some of the TOR activity, then we have less of a defense when we get pressure to inspect and block the rest. And, even starting down this path may make us legally liable for ALL the TOR traffic. Our best action may be to keep our hands off and observe strict network neutrality.
We are still pondering our options.
Please accept our apologies in the mean time.
USU IT Security
=END ABUSE RESPONSE=
TOR exit nodes are nothing but trouble.
I knew someone who maintained one from 2003 to 2008. It was neat at first, but watching him get worn down by the relentless pestering from his ISP and the police (later the FBI as well) was not cool. Then they raided his house one night (which I'll never forget, mostly because everyone landed up crashing at my place for two days) and took nearly every single piece of technology that plugged into a wall, ripping apart mostly everything else in the process while presumably looking for hidden data storage devices.
He had another exit node working within a week, much to the dismay of nearly everybody who knew him. That was when the feds showed up. I'm told they were extremely polite about the whole thing and only stayed for a couple of hours, but beyond that I have no idea what they said to him. A day later he dragged the exit node out into his backyard and took a sledgehammer to it. That same year he took his family on a once in a lifetime vacation over Christmas, and hasn't spoken about TOR since. The few times I've tried to jostle a few details out of him have only been met with "You know I can't talk about that".
There were rumours that the company he founded was looking to eject him after the raid, and I think at one point someone else was trying to threaten him with criminal charges (though I can't imagine they would have stuck). I can only assume that it got to the point where that idiot exit node was literally threatening his livelihood, and his wife finally convinced him that enough was enough and that was it.
In any case, I have upmost respect for the exit node operators who can deal with that kind of abuse, but damn. It really says something about both the society we live in (and how privacy is slowly being eroded away), but also the general state of the TOR network. I suppose you can't have anonymity without the usual whack jobs running around, but it just seems like the amount of illegal shit flying around TOR severely outweighs any legitimate use the network offers.
So for that reason, I'm not sure why you'd want to run an exit node these days, unless you're looking for trouble and the challenge of dealing with that.
Most admins
That's not true.
A few Admins, perhaps.
Not most.
Akamai optionally (optional to the Akamai customer) blocks Tor exit nodes AND relay nodes that have no exits whatsoever. I made it through several levels of support (up to executive support) to nothing but deaf ears.
I'm not even sure how they figure out relays without port-scanning clients (like open HTTP proxy scans from IRC servers of yore) but it essentially shut down my high-bandwidth Tor relay. I'd run an IPv6-only Tor relay because, well, if you have IPv6 you have plenty of addresses to burn, but Tor doesn't support that yet.
I'm not even sure how they figure out relays without port-scanning clients
A full list of relays is available from any directory authority (except bridges -- which are not the same as non-exit nodes*)
From torrc:
Bridge relays (or "bridges") are Tor relays that aren't listed in the
main directory. Since there is no complete public list of them, even an
ISP that filters connections to all the known Tor relays probably
won't be able to block all the bridges. Also, websites won't treat you
differently because they won't know you're running Tor. If you can
be a real relay, please do; but if not, be a bridge!