Re: [tor-relays] Netcraft spam

2023-01-09 Thread Matt Corallo
Some time ago I started publishing the regexes I run on my mailserver to drop spam like this. The criteria for showing up is that you have to repeatedly send garbage and not bother responding (or respond with disdain) to followups. Happy to accept patches to grow the list! https://git.bitcoin.n

Re: [tor-relays] Collaborative Bad-Abuse-Sender Blocklist

2020-10-19 Thread Matt Corallo
A few replies inline, but, in general, I only run two small exits, so the level of effort and amount of spam I get is very low (my blocklist currently only has three entries :) ). If any other exit operators have a similar "I try to help educate you, if you don't bother responding I'll start drop

Re: [tor-relays] Collaborative Bad-Abuse-Sender Blocklist

2020-09-28 Thread Matt Corallo
Tor exit node operators with similar policies and collaborating on such blocklists would save all of us with similar policies time. Matt On 9/28/20 2:18 PM, Tortilla wrote: On Mon, September 28, 2020 5:04 pm, Matt Corallo wrote: Hi all, I run a few relatively-small exit nodes, and still get a decent

[tor-relays] Collaborative Bad-Abuse-Sender Blocklist

2020-09-28 Thread Matt Corallo
Hi all, I run a few relatively-small exit nodes, and still get a decent flow of the usual Fail2Ban, blocklist.de, and such garbage to abuse PoCs. I tend to proactively find appropriate abuse/noc contacts to provide a response informing them of how they can appropriately block all Tor exits from

Re: [tor-relays] Blog: How Malicious Tor Relays are Exploiting Users in 2020 (Part I)

2020-08-14 Thread Matt Corallo
This may be true, but I think you underestimate how few sites are on the HSTS preload list or are enforced by SSL Everywhere. Ultimately, unless the first site you load in a browsing session is HTTPS or unless you end up at an HSTS preload-enforced site, sslstrip can just keep taking the "s" pa

Re: [tor-relays] >23% Tor exit relay capacity found to be malicious - call for support for proposal to limit large scale attacks

2020-07-07 Thread Matt Corallo
While I fully support the direction here I do wonder if there’s not also other information that could be used. Eg in bitcoin-land we have persistent issues with anti-privacy services operating large numbers of relays all one three ASNs. In the future, we’ll likely be shipping a compressed netbl

Re: [tor-relays] TCP CCA for Tor Relays (and especially Bridges)

2020-01-12 Thread Matt Corallo
s, but it sounds like there’s no good existing work in this domain? Matt > On Jan 10, 2020, at 17:36, Roman Mamedov wrote: > > On Fri, 10 Jan 2020 16:24:56 + > Matt Corallo wrote: > >> Cool! What did your testing rig look like? > > A few years ago I've go

Re: [tor-relays] TCP CCA for Tor Relays (and especially Bridges)

2020-01-12 Thread Matt Corallo
Cool! What did your testing rig look like? I suppose the real question is what does the latency/loss profile of the average Tor (bridge) user look like? On 1/10/20 8:18 AM, Roman Mamedov wrote: > On Thu, 9 Jan 2020 00:58:36 -0500 > Matt Corallo wrote: > >> BBA should handle ran

[tor-relays] TCP CCA for Tor Relays (and especially Bridges)

2020-01-09 Thread Matt Corallo
I’m sure this exists somewhere so this is more of a request-for-links, but what’s the current thinking on TCP CCA selection for Tor relays? While it has fairness issues (and reported long-tail issues for higher-latency links, though I can’t find good in-practice analysis of this), BBA should han

Re: [tor-relays] SSH scanning on TOR Exit - Nerfing Rules

2019-09-16 Thread Matt Corallo
I've taken to contacting the sender of the automated abuse reports and noting that sending such emails may actually not be legal (at least in the US) under CAN-SPAM. In some cases I've seen positive response as people aren't even aware their random server with fail2ban is sending these things. Mat