Hacker News Reader

Comment by seven4 | Hacker News Reader

I often wonder what incentives drive people to run TOR exit nodes; the risk even if remote of getting raided is enough to stop most I'd imagine. Got me thinking on the legal implications and interestingly TOR doesn't recommend running an exit node at home -

Found this FAQ quite interesting https://2019.www.torproject.org/eff/tor-legal-faq.html.en

Particularly

~Has anyone ever been sued or prosecuted for running Tor? No, we aren't aware of anyone being sued or prosecuted in the United States just for running a Tor relay. Further, we believe that running a Tor relay — including an exit relay that allows people to anonymously send and receive traffic — is legal under U.S. law.

~Should I run an exit relay from my home? No. If law enforcement becomes interested in traffic from your exit relay, it's possible that officers will seize your computer. For that reason, it's best not to run your exit relay in your home or using your home Internet connection.

View on HN

I’ve read [citation needed] that some people enjoy doing it because they want to give (back) to the community and because they would like to try having to deal with anything from spam complaints (e.g. Automatically) and legetimate complaints and requests. Maybe also because “somebody has to”. :)

For me, my middle relay is sufficient entertainment. It’s like a digital pet that doesn’t need much attention except an update/upgrade about once or twice a month.

Interesting, thanks for sharing. What - if any costs are involved for you?

I am running a couple of relays. There are no costs if your servers have spare resources available. The tor daemon barely eats anything, and you can always limit how much bandwidth it's allowed to use. Please spend half an hour and set up a relay if you can, it doesn't help as much as running an exit node, but it's still something.

Thanks for doing that! I think a viable long term strategy to increase the health of the Tor network, is to increase the number of relays (not exit nodes) and make it easier for companies/websites to expose their services as native Tor services. That way the amount of bandwidth insides the Tor network would increase, without exposing anyone to increased liability.

Which country do you operate in? One issue in some of the Western world is that your IP becomes blacklisted by some websites. There's also the issue that some ISPs cut you off for running a relay (yes, not an exit node).

I've been running a relay for ~9 months, and have been blocked by a few websites, but it's fairly limited (I honestly can't remember the last time I ran into an issue).

I know you get a lot of hassle/blocking if you're a Tor exit node - do you get some of the same problems being a middle relay, just by virtue of appearing in lists of tor nodes?

You do - there are a few sites that have blocked me, but it's fairly limited.

I ran few exit nodes several years ago on 3rd world country VPS hoster with bitcoin payments and fake data. They had never care until abuse notice from Korean Government during some crime investigation.

BTW, they didn't even ban my account, just froze the external IP address of the node and ask to rent new VPS instance because they needed to answer to the legal letter.

That drops the reputation of the node (the longer node is staying online, the more it is trusted by network), but it's okay.

Stay free!

Pretty sure the reason is the same as for seeding stuff on filesharing, editing Wikipedia (legitimately) and developing open-source software. Namely, that one likes all of that being available to them and recognizes that it relies on people doing those things.

I think that is one of the reasons why in Germany a registered association named "Zwiebelfreunde e.V." (can be translated to "Onion friends") was founded.

By this it is a legal entity and legal trouble can be handled better than if its against a person but the members of the board still gets trouble with the law. Not long ago they were raided because they were treated as witnesses in a case. (Yes, in Germany even as a witness you can be raided ...)

Not just in Germany. US providers can also be forced to hand over data to be used in cases against others. It's just usually not done with a raid since providers will turn over data when asked.

Just for context: This is relativly new in Germany. In 2017 there was a change which has as consequences

- witnesses _have to_ appear in person if requested (by police or DA)

- witnesses _have to_ make statements regarding the case at hand

This is quite a nice tool if you lack moral. You might request the suspect to appear as a witness and try to leverage the new requirements to make the suspect reveal damaging information.

Maybe this was the reason that Germany was mentioned before.

Do you have a source for that and/or an article where they elaborate on the implications of those changes?

>This is quite a nice tool if you lack moral. You might request the suspect to appear as a witness and try to leverage the new requirements to make the suspect reveal damaging information.

Germany doesn't have protections against self-incrimination? Or does this rely on the suspect being too cooperative for his own good?

Germany does have such protection. Parent was probably wildly speculating:

https://de.m.wikipedia.org/wiki/Auskunftsverweigerungsrecht

I think you meant to link to https://de.m.wikipedia.org/wiki/Aussageverweigerungsrecht . Auskunftsverweigerungsrecht, according to the article, is a right of witnesses.

We were talking about the rights of witnesses?

I was referring to this question by the grandparent which I read as being about a suspect's (not a witness's) rights:

> Germany doesn't have protections against self-incrimination?

In France we have at least one not-for-profit dedicated to operating Tor exit nodes:

https://nos-oignons.net/ (french) https://nos-oignons.net/%C3%80_propos/index.en.html

They host their nodes on not-for-profit ISP and friendly commercial ISP:

https://nos-oignons.net/Services/index.en.html

(0.57% exit probability)

They open or close (never happened yet) nodes based on donations:

https://nos-oignons.net/Donnez/index.en.html

Disclaimer: I'm a volunteer in one of the not-for-profit ISP hosting a nos-oignons node.

Running an exit node safely at a vps provider is equivalent to donating 10 USD/month, and you can often choose a region where you want this help to go like asia or the americas.

The risk is only involved if you're running an exit node, which you don't have to.

My server is running a middle node for almost two years (~0.3-0.4% chance you'll go through it) without a slightest inconvenience. I've put a daily cap on the bandwidth so that I can use the server for other purposes without increasing my server bill. As a result, I'm basically donating bandwidth that'd otherwise be wasted.

One reason would be to sniff cleartext traffic and extract useful info from it.

Almost everything is HTTPS at this point anyways though, so that's not as big an issue now iirc.

I guess the packet headers are still plaintext though, so there is that.

Back when I was a younger, even more naive idiot, I ran a tor exit node on a server at home and one night had the idea to mirror that switch port and run software on another machine that would display all photos from a data stream.

Its one of the more regrettable decisions I've ever made. There is no computer advice I'd give anyone that I'd more desperately implore they follow than to never ever fucking look into that abyss.

I ran a Tor exit relay from home for a few years, eventually had to stop because I kept getting blocked from sites due to having my IP address listed on the Tor exit node list.

They can potentially collect NSA zero days

Reply on news.ycombinator.com