Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Robert Smith
I want to setup a Tor relay, but know nothing.  Got a minute to read a page of questions? On Thursday, April 17, 2014 10:27:31 PM, Roger Dingledine wrote: On Fri, Apr 18, 2014 at 01:40:17AM +0200, Tobias Markus wrote: >> Tor circuits (a "way" through the Tor network) and thus nodes are >> ent

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Roger Dingledine
On Thu, Apr 17, 2014 at 12:17:02AM -0400, Roger Dingledine wrote: > Thanks Andrea. 374 of the 380 lines from Sina's file overlap with yours. > > I've moved moria1 to reject the union of the two lists. Four other directory authority operators have also blacklisted these keys, and they've now been

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Roger Dingledine
On Fri, Apr 18, 2014 at 01:40:17AM +0200, Tobias Markus wrote: > Tor circuits (a "way" through the Tor network) and thus nodes are > entirely chosen by clients based on the consensus given by dirauths > (see my earlier post). The ExcludeNodes statement you use basically > instructs the Tor *client*

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Tobias Markus
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, (again a Disclaimer: I am not a Tor dev/guru and might be talking bullsh*t.) Tor circuits (a "way" through the Tor network) and thus nodes are entirely chosen by clients based on the consensus given by dirauths (see my earlier post). The ExcludeN

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread tor
Perl script attached which I made to take this !reject formatted list of bleeding tor nodes and reformat it into a mega-long ExcludeNodes line and put it at the end of my exit node's torrc. My tor daemon did not bomb or complain upon seeing the line. Hopefully that is the right way to use that

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Lars Kumbier
Thanks Andrea, Thanks Scott, Keys have been replaced and I tested the relay with the script on github as well. I guess it was something stupid like forgetting to restart. For the rest: test your server via the script on https://github.com/wwwiretap/bleeding

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Scott Bennett
Andrea Shepard wrote: > On Thu, Apr 17, 2014 at 08:58:46PM +0200, Lars Kumbier wrote: > > I'm supposedly running one of the still affected tor-relays and since my > > relay is also a guard, I'm in the latest blocklist[1] (pre-upgrade > > fingerprint). I did upgrade the system on April 9th to open

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Andrea Shepard
On Thu, Apr 17, 2014 at 09:20:10PM +0200, Yoriz wrote: > Dear Andrea, > > Could you please elaborate if/how we can use your file on a Tor node? Should > we use these as 'ExcludeNodes' rules in the `torrc` configuration files of > our Tor nodes? Or is the file merely intended for Tor clients? It

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Yoriz
Dear Andrea, Could you please elaborate if/how we can use your file on a Tor node? Should we use these as 'ExcludeNodes' rules in the `torrc` configuration files of our Tor nodes? Or is the file merely intended for Tor clients? Best regards, Yoriz -- Operator of the privshield.com Tor exit node

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Lars Kumbier
I'm supposedly running one of the still affected tor-relays and since my relay is also a guard, I'm in the latest blocklist[1] (pre-upgrade fingerprint). I did upgrade the system on April 9th to openssl 1.0.1-4ubuntu5.12 - base system is an ubuntu 12.04. According to the changelog[2], this should

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Andrea Shepard
On Thu, Apr 17, 2014 at 08:58:46PM +0200, Lars Kumbier wrote: > I'm supposedly running one of the still affected tor-relays and since my > relay is also a guard, I'm in the latest blocklist[1] (pre-upgrade > fingerprint). I did upgrade the system on April 9th to openssl > 1.0.1-4ubuntu5.12 - base s

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Tom van der Woerdt
A lot of relay operators were contacted within 12 hours of the heartbleed bug being published. Of course, not everyone lists their mail address in the directory, so those didn't get contacted. Tom AJ B schreef op 17/04/14 20:04: Can we do anything to attempt to contact those relay operators

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread AJ B
Can we do anything to attempt to contact those relay operators that are still affected by Heartbleed? I might be a little late to the discussion and this has already taken place, just wanted to check. On Thu, Apr 17, 2014 at 9:47 AM, Saint Aardvark the Carpeted wrote: > Tobias, thanks so much fo

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Saint Aardvark the Carpeted
Tobias, thanks so much for the explanation! -- Saint Aardvark the Carpeted http://saintaardvarkthecarpeted.com Because the plural of Anecdote is Myth. signature.asc Description: Digital signature ___ tor-relays mailing list tor-relays@lists.torproject

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Chris Whittleston
I was going to ask something similar, and this sounds like the best kind of answer - 'you don't need to do anything' :D On 17 April 2014 17:05, Tobias Markus wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Hi, > > (Disclaimer: I am just a "regular" supporter and have no great > in-

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Tobias Markus
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, (Disclaimer: I am just a "regular" supporter and have no great in-depth knowledge about Tor internals.) there is a difference between a directory *authority* and a directory *mirror*. There are only 8 or so directory authorities in the Tor networ

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Saint Aardvark the Carpeted
Roger Dingledine disturbed my sleep to write: > On Wed, Apr 16, 2014 at 08:03:51PM -0700, Andrea Shepard wrote: > > > http://charon.persephoneslair.org/~andrea/private/hb-fingerprints-20140417002500.txt > > > > The SHA-256 hash of that file, for the sake of stating it under a PGP > > signature, is:

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Steve Snyder
On 04/17/2014 12:17 AM, Roger Dingledine wrote: On Wed, Apr 16, 2014 at 08:03:51PM -0700, Andrea Shepard wrote: http://charon.persephoneslair.org/~andrea/private/hb-fingerprints-20140417002500.txt The SHA-256 hash of that file, for the sake of stating it under a PGP signature, is: dadd2beca51

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-17 Thread Chris Whittleston
FYI guys - The Guardian just published an article about the effect of Heartbleed on the network: Tor may be forced to cut back capacity after Heartbleed bug http://gu.com/p/3zfqj On 17 Apr 2014 12:51, "Steve Snyder" wrote: > On 04/17/2014 12:17 AM, Roger Dingledine wrote: > >> On Wed, Apr 16, 2

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-16 Thread Roger Dingledine
On Wed, Apr 16, 2014 at 08:03:51PM -0700, Andrea Shepard wrote: > > http://charon.persephoneslair.org/~andrea/private/hb-fingerprints-20140417002500.txt > > The SHA-256 hash of that file, for the sake of stating it under a PGP > signature, is: > > dadd2beca51d1d5cd7ffe7d3fe3a57200c7de7e136cad23b0

Re: [tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-16 Thread Andrea Shepard
On Wed, Apr 16, 2014 at 06:24:40PM -0700, Andrea Shepard wrote: > A list of 1777 proposed reject lines of fingerprints which have > ever turned up as potentially exposed by Heartbleed in my scans > is available at the URL below. This was generated with the following > query: > > (select distinct

[tor-relays] Recommended reject lines for relays affected by Heartbleed

2014-04-16 Thread Andrea Shepard
A list of 1777 proposed reject lines of fingerprints which have ever turned up as potentially exposed by Heartbleed in my scans is available at the URL below. This was generated with the following query: (select distinct hb.probe_identity_digest as identity_digest from heartbleed_probe_result