Drastic increase in Tor clients from Germany | Hacker News Reader

Drastic increase in Tor clients from Germany

metrics.torproject.org

275 pointsakyuu223 comments

From an average of significantly below 500k to almost 2.5M users. This drives up the global number of connecting users from approx. 3M to almost 5M.

Hard to imagine that so many people in Germany suddenly switched to TOR, especially since there has not been any significant event lately that may have triggered such a decision (afaik)?

My personal experience with TOR (as an administrator of various websites and services) is that it is a major source of unwanted/malicious traffic (spam, etc.) and most of it is automated. The big increase is probably not users but bots?

do you believe these numbers?

It would be much helpful if you could provide one or two reasons why the number could be wrong.... or maybe make some comments on the methodology, etc..

Just question about the accuracy without any context or reasons are not contributing to the argument.

The interesting question is if there is a bot net spreading in Germany since the 17th of June. What would be the likelihood of that going undetected. If you like conspiracy theory, the rise in one country could point to state actors.

Why would it be so localized to one country? Does Germany have a unique enemy compared to other NATO countries?

Maybe German state itself is the actor.

What state actor doesn’t understand statistical deanoymization attacks against tor?

(e.g., if you single-handedly double the network traffic, then an outside observer can figure out what ingress/egress traffic is yours)

Why pay attention to this if you can simply blame another state actor?

And German federal government have a history for covert shitposting.

    And German federal government have a history for covert shitposting.

Wow, I never heard this before. Can you provide some examples famous examples?

I remember there was a series of articles several years ago that German intelligence officers generated a lot activity in far-right websites. To the point that frequently it was mostly undercover „extremists“ discussing between themselves.

The closest article I can quickly find is about Germany intelligence informants doing the same in meatspace though.

> There was a "risk that sources of the intelligence service (Office for the Protection of the Constitution) could goad each other on to undertake bigger actions;" in other words, the system threatened to create an "incendiary effect."

https://www.spiegel.de/international/germany/german-police-d...

My bet is Russia.

I work in a German institution. I was recently hacked by such a botnet recently (lessons learned: use AuthorizedKeys, allow only one SSH user, proxy all http connections to a webhoster, and check your SSH and UFW logs often!)

It setup a virtual environment where it downloaded some kind of Tor node and ran some sort of code that used 100% of my CPU. My guess is crypto-mining. I purged the account, deleted everything before I could do forensics, but I checked the logs for the connections and they all came from Russia.

Can you explain more?

My guess is that a certain router is getting infected with a botnet because ISPs usually hand out the same router to their customers. And ISPs are usually limited to a single country.

That would be an explanation and probably by okhams razor be more likely. But wouldn't that ISP notice the difference in traffic patterns drastically and react? It is just unlikely (but far from impossible) that this is something 'normal' happening.

My fear would be that someone still is trying to gather a critical mass of nodes to contact controll servers via TOR to cause mass havoc in a single country from within a single country. Generally IMHO Germany would be a good target for destabilisation currently. But I think and hope this could just a bit of overinterpreting. Probably one would need a good statistic on the subnets the users come from.

> That would be an explanation and probably by okhams razor be more likely. But wouldn't that ISP notice the difference in traffic patterns drastically and react?

I hope to be wrong but I am afraid you are overestimating the technical competency of the average ISP.

I can't speak to German ISPs or anyone outside of these USA. But I believe that ISPs are absolutely the weakest link when it comes to malicious botnets and other types of widespread network-based compromises.

ISPs certainly have the tooling and the positioning to be able to detect C&C channels, outgoing DDOS attacks, and compromised customer premises equipment. But do they? And if they do detect any of it, do they take action? When is the last time you heard about an ISP disconnecting a paying customer because of the customer's compromised device(s)? When is the last time you even heard of an ISP notifying a customer about such a thing?

Two months ago, my router was compromised and joined to some sort of botnet in the capacity of a DNS resolver. I would never have been able to detect such WAN-side traffic if I hadn't had a special setup on my part. My ISP was the first to hear when I'd detected it, and I sincerely doubt that they receive many such reports, especially with logs as evidence.

Can you imagine receiving a phone call, "Hello, this is your ISP! You're pwned! Please follow through these remediation steps as I prompt you: ..." You'd undoubtedly think it was a phishing scam. Because ISPs just don't seem to care about abuse.

They will send you copyright strikes and prosecute you for BitTorrent, but it does't seem like they'd lift a finger to prevent the next big DDOS or spam factory originating from their own customers.

My ISP actually sent me an email that said that one of my devices have an open TCP 445 port and advised me to fix it. Apparently Windows opens it by default and it can be exploited by some malware.

But I've never received a threatening letter about piracy. ISPs in my country simply don't send those.

Many ISPs have clauses in their TOS that prohibit running any server of any kind. So it may be the case that your ISP regularly runs sweeps to detect customers who are running servers, and this warning may be a side effect of that sweep.

I often used to poke holes in my firewall and run VPN or ssh servers that were discoverable using my dynamic DNS service. My ISP never got involved with that. Of course, that was a case of me running a server for my exclusive use, rather than some sort of public web or login server that would have randos sending traffic across my link.

My ISP will send letters or emails, but only if they get a complaint from the company in question. Usually what ends up happening is a company watches a torrent, and takes down a list of all the ip addresses downloading it. They then send boilerplate complaints to the isps associated with said ip addresses, who are legally required to do something about it. My little brother got in trouble this way lmao, they sent a letter to our house about it.

In Germany, I doubt they have the tooling or staff anymore. For almost a decade we've been in a race to the bottom regarding pricing and as a result, service quality. I wouldn't be surprised if critical parts of the infrastructure are maintained by outsourced jobs from half around the world.

The only somewhat professional player is the Deutsche Telekom, which was kinda the Bell of Germany and got privatized in the 90s, when the phone network was also opened to other players. They are more expensive though. Other than that, you might be lucky and have some small regional ISP that's competent enough. Otherwise there are just two other companies left that offer service nationwide, after a lot of mergers.

My parents home lan got caught up in a bot net and their isp was sending emails about it to their isp provided email address.

But it's possible they were just passing on abuse reports from the numerous targeted victims of this botnet who bothered to complain.

The intrusion point was a Linux system with a 3 letter password and ssh exposed on a nonstandard port. So if you're someone who still thinks the bad guys won't find your computer because you changed the port, know that that is very outdated thinking.

I don't even know how to log in to my ISP provided email., so it goes without saying that I'm not reading it. I'm surpised that ISPs still offer email.

> My guess is that a certain router is getting infected with a botnet because ISPs usually hand out the same router to their customers.

This seems trivial to figure out with an analysis of the connecting IPs - which is absent on TOR's report page.

I'm also a bit confused why no one here on HN has asked about the connecting IP data (at this writing). Are these commercial IPs, dynamic (biz/residential) IPs or a mix? If they're mostly dynamic IPs, are they from more than one ISP?

TOR has country of origin data so it seems reasonable they'd also have network of origin.

All that said, I don't precisely know how TOR determines country of origin. Entry node data would seem to be the likely source. However I've long assumed that entry nodes are public supplied, like Relay and Exit nodes. Within that assumption it isn't clear to me how that data would flow to TOR - while maintaining anonymization of traffic.

> The interesting question is if there is a bot net spreading in Germany since the 17th of June.

A minor addendum: Looking at the csv file, it looks to me like traffic began drifting above the mean about June 6. From there I see a ramp-up, growing at an increasing rate.

That’s when the Kakhovka dam was destroyed, shortly after the Ukrainian counteroffensive began.

Off the top of my head - Germany hosts a disproportionate amount of sensitive data because it's the location of choice for cloud providers storing things for EU member countries. They have lots of fiber, lots of ISPs, plenty of datacenter space, a stable government, and data security laws that meet or exceed everyone else in the EU.

    Germany hosts a disproportionate amount of sensitive data because it's the location of choice for cloud providers storing things for EU member countries.

Hat tip to this. My German teammate and I have discussed exactly this point. The Microsoft Azure cloud has a German specific cloud that targets exactly this market. Some marketing genius made billions for Microsoft with that idea.

One weird thing to me: You are right about "lots of fiber" -- specifically Frankfurt Internet Exchange is (was?) the busiest in the world for a long time. Why does non-urban, non-commercial (retail) Internet access suck so hard in Germany? It is the topic of endless (but understandable) crying by German residents on HN!

> Why does non-urban, non-commercial (retail) Internet access suck so hard in Germany?

To cut a very long story short, what should have happened a long time ago in Germany is to treat internet access at a reasonable speed (however that is determined) like access to electricity or the plain old telephone system: It's the law you get connected like everyone else at the price everyone else pays, even when you are in a very rural setting. Leaving that decision to commercial interests, has lead to very slow or unavailable rural internet infrastructure because either the price would be ridiculously high to become connected or the companies would lose money.

It's political failure, plain and simple.

Looking back in time, the original sin was committed in Germany in the early 80s when the SPD run government understood that fiber optic networks were the future for the telephone system and television distribution. They had a 30 year plan to convert West-Germany's telecom infrastructure to fiber. That was way before the internet, but would that plan have been enacted, Germany would have sat on a high speed fiber infrastructure in the 90s when the Internet exploded onto the scene.

Unfortunately the conservative CDU government under Kohl immediately scrapped that plan when they came into power and went for cable as the distribution medium for TV and the telephone system continued to operate on copper at least on the last mile. So here we are in the 2020s with crappy cable modems and crappy DSL connections. (Where available.)

Did modern Germany (after reunited) ever discuss the idea of a national broadband network, like Australia and New Zealand? I cannot belive more highly industrialised countries have not followed this route. The long term economic impacts will be HUGE.

> Why does non-urban, non-commercial (retail) Internet access suck so hard in Germany?

Lack of competition and laws tailored to the privatized Deutsche Telekom: If I dig up the street to put fiber optics, they may join in for free. So may I, if they dig up streets - they just don't.

Note that the growth is not just in Germany. Ireland, Sweden, Switzerland also show jumps (however in absolute terms they are still much smaller). I would not rule out it's people or bots connecting from third country/countries through VPNs based in Europe... for whatever reason.

VPSs in germany are much cheaper. But I'm guessing this increase is paid with crypto or debit cards so pin pointing it to a specific provider like hetzner is hard

Hetzner used by criminals would be my guess.

Is it a bug in a client that accidentally spawns sub-clients?

Any UX changes to something like Brave browser perhaps? Making it easier to use tor mode. Although this is a big jump.

I faced a recent distributed attack averaging 20,000 RPS[1] around the same time which makes me think that there might be a bot. I wonder if there’s a network of website operators similar to NANOG or the RIPE NCC mailing lists where I could compare my own experience with those of other operators.

[1] https://news.ycombinator.com/item?id=36561930

If there isn't, lets make one. We could self host it, lock it down to invite-only.

Why not CAPTCHA protect these pages instead of blocking tor? Same attack can go through regular web.

I already have per-IP ratelimiting, and I'm against using captchas have bad UX (including the much-hailed Turnstile).

I'll probably migrate to some proof-of-work based schemes and some algorithms to detect anomalous requests, but it would require some engineering work on my part (for a free website FWIW), and the quickest way to mitigate it would be to block Tor.

IP blocking blocks most of the people on our local ISP. They are small, and use CGNAT, so one owned windows machine across town breaks sites like yours for everyone, and the root cause is extremely difficult to debug for end users.

As much as I deeply, deeply dislike captchas, ip blocking is far worse.

IP blocks also just don't work on IPv6. Unless you're prepared to block entire by ASN, an adversary can cheaply just buy up a lot of address space and churn through them. It gets even messier when dealing with real ISP networks because some hand out /40s for residential customers whereas others give just a /56.

I'm sure you can buy a table that says what size subnet to block for various ipv6 ranges.

>I'll probably migrate to some proof-of-work based schemes and some algorithms to detect anomalous requests, but it would require some engineering work on my part

Have you tried mcaptcha? https://github.com/mCaptcha/mCaptcha

Interestingly a similarly drastic increase in German Tor clients also happend back in 2017: https://www.chip.de/news/Raetselhafter-Nutzeranstieg-Zahl-de...

if you configure the graph to show more years you can see the similarities: https://metrics.torproject.org/userstats-relay-country.html?...

Is someone trying to compromise the Tor network?

I read that Tor needs a certain percentage of non-malicious nodes to function, though I am not sure if that is applicable clients.

It's not applicable to clients. A clients traffic never touches another client, only the nodes.

Of course, malicious clients can ruin it for everyone else in the form of DoS attacks but that's clearly not happening here.

I think you're thinking of blockchain

Sybil attacks are more general than just in cryptocurrencies. They actually apply to Tor as well, just not to _this_ part of Tor.

No, the problem also applies to Tor. If a malicious actor controls large parts of the network, there is a high probability that the attacker controls your entire circuit or at least your entry and exit node.

In the latter case, you can do timing attacks to determine which traffic on the exit node belongs to whom on the entry node.

Could these be attempts at data mining for unmasking Tor users?

Back in 2017 the German BND was revealed to have a history with that: https://netzpolitik.org/2017/secret-documents-reveal-german-...

I would be shocked if any intelligence service in the world wouldn't have their hands in that, even in the most respected democracies. Infiltrating "underground" networks and communities, and breaking encryption, is literally their job.

Especially now that there's a war on our borders, the spooks have a plethora of reasons to use to justify their invasiveness.

We just need to make sure to keep them accountable, which is the tricky part, as their work is always classified and our human and privacy rights often clash with their jobs, so unless any whistleblower comes through we might never know the extent of their rule breaking.

Seems most likely, either by academics or government.

Not really the most subtle way about it though and likely to face some response.

I'd assume both have the capability to run a fairly accurate simulated network without anyone noticing so it's a bit strange.

I doubt it's either of those - it would be extremely unethical and illegal for academics to do, and governments don't need to take this approach because they have a bunch of systemic attacks that are less obvious. Perhaps someone with a botnet looking to sell unmasking, which has been popping up as a service recently. Or trying to use it against a specific DWM or vendor.

> it would be extremely unethical and illegal for academics to do

Nothing illegal about it.

Hugely depends on the country. Don't assume the law you know, to apply here

Can you give just one example of a country with a law making it illegal for academics conducting research to attempt to demask tor users?

EU? Basically researchers tries to get PII from people connected to Tor without consent of these people.

That's an interesting argument. Not sure it would hold up. I don't think an IP alone counts as PII, since the ISP would have to be queried to actually get any contact info.

IP addresses are PII under GDPR.

Not by themselves, surely?

Even so, GDPR has research exemptions which would protect the academics doing research in the example being discussed.

Only of they are connected to a short list of more sensitive PII, of which "tor user" is not one.

IP logs are fully legal in the UE under GDPR and Tor deanonymization is just an IP log of connected users.

Also there is already plenty of research of this type out of the EU. It's quite common in infosec.

There is, because it's a botnet

That would likely make researching and demasking the entities involved explicitly legal.

My claim is that researchers are unlikely to be operating the botnet

I don't think anyone claimed or implied otherwise?

The original comment raised the possibility that researchers or the government were responsible for the 2m new tor users

What is unmasking? What does it have to do with a botnet

Revealing the identities of tor users or hidden services. One way to do it is by controlling a large share of the network.

Yes but this clients, not nodes. So this actor does not control a large share of the network, they just use a large share of the network.

Mentioned it because there's been many papers which specifically used the live network to do such a thing already. Some researchers have spun up large numbers of relays in the past to conduct their work.

I personally don't see how it's unethical for either academics or governments to do this? Both have an interest in breaking tor, even when in the governments case where they both utilise it and want to know who else is using it.

The tor people themselves acknowledge the work in their blogs

https://blog.torproject.org/research-problem-measuring-safet...

https://www.researchgate.net/publication/314521450_Character...

Could it be someone using Hetzner?

Would regularly changing circuits/identities mitigate this? E.g., pressing ctrl/cmd + shift + L every few minutes?

It's not clear to me how you'd do that with clients, rather than relays.

DDOS a hidden service and track the request spike through your exit nodes. I think this is how the original silk road was investigated.

Silk Road was a hidden service so exit nodes were not involved (they would use rendezvous points). If my recollection from American Kingpin is correct, Silk Road was caught because it leaked its IP address in error messages, and Ulbricht posted questions about bitcoin on Stack Overflow using the same name as the bitcointalk post announcing Silk Road. Its clearnet IP was visible for almost the entire lifespan of the site, I believe.

It’s quite an interesting spike, though I doubt that such an operation would be so obviously.

Most of the comments suggest strange conspiracy theories, but the traffic is an exponential ramp (drive into 2023). Also, there has been rapid growth in some neighboring countries.

It could be organic growth. There have apparently been a few wiretapping scandals this year; people may be using it to access Ukraine/Russia, and a bunch of laws passed last year that incentivize US companies to block EU traffic (to avoid fines for data leaks).

Any of those seem more plausible than a single actor renting a rack or dc in one country, and using tor to try to evade detection.

Clicking around and looking at the chart for random other countries shows a spike for Sweden too, whereas Finland has a different but interesting pattern all of its own.

Wonder if the fact that they’re related to NATO, who is at war, have anything to do with it.

Can you elaborate on this a bit?

I can think of a country currently at war that has a much more aggressive and longer history of being a bad actor on the internet than NATO countries...

Nato is not at war.

Don't know how Finland's government deal with Ukraine/Russian agenda, but here in Czechia, government acts like totalitarian authority. Blames Putin for every economical problems (there is official guide how to propagate problems with food shortage [1]), they block on DNS level (cz.nic) some websites that, according to government, spread Russian propaganda [2] and also announced that supporting Russian invasion is crime by law and Russia is terrorist state.

No wonder, that Tor users in Czechia rised over 60% since 2020, when government use totalitarian practices like state that they trying to fight against.

Also overall trust in government is historical low here. 74% citizens disapprove what government does here. [3] Which does not mean that we approve invasion on Ukraine at all. We host far more Ukrainian refugees as we should - over 500 000 which is 5% of Czechia population [4].

[1] https://www.mvcr.cz/soubor/krit-memo-putin-hlad-komunikacni-...

[2] https://en.wikipedia.org/wiki/Internet_censorship_and_survei...

[3] https://pro.morningconsult.com/trackers/global-leader-approv...

[4] https://data2.unhcr.org/en/situations/ukraine

Does anyone understand the mass flagging and downvotes going on in this comment section? I'm very confused as I've never seen anything like it.

I'm guessing that there is some automatic system that works on certain words in comments. Flame detection has been mentioned before. Probably in combination with account age or karma. I also imagine that users vouching for these might offset the behaviour.

If the number of comments in a post or subthread exceeds the upvotes, this leads to the flame detector activating.

But also some accounts are just banned.

Banned accounts can still comment, but they start dead and have to be vouched first before showing to anybody who didn't enable showdead in their profile.

I have noticed a trend that some of my friends accounts get rate limited extremely easily while others don't. Not sure what's happening there, I assume there's a flag set by a mod or its otherwise calculated by karma total number of times the account has been flagged. it doesn't seem to correlate with recent controversial posting

Just the usual political flamewar that happens here from time to time, not sure why it escalates on some threads and not on others though.

Probably the posters involved. Blessing and a (minor) curse that HN doesn't use avatars. Harder to avoid commenters you know you don't like.

If you click the timestamp there should be a "vouch" button for comments to restore them.

It's quite annoying, possibly NAFO or similar.

There is no way these are organic users. Could it be, that some VPN is using Germany as an entrypoint?

Why? VPN users mostly care about the Exit IP country, not the Entry IP country.

Some VPNs have a “then connect to tor” option for extra anonymity against malicious tor entrypoints and against your local ISP seeing that you are browsing tor [hosted sites].

Could be that someone is using a Cloud Provider in Germany, for example Hetzner

Doubt it. Hetzners smallest machine is something like $4/month, additional IPv4 addresses come with extra cost. They have quite tight service quotas, and this 2M additional IPs would be almost their entire IPv4 pool.

I don’t know about the details, but I know Hetzner has quite a backstory with their servers being abused by spammers. I don’t know how the state is today, but maybe it’s not as unlikely as it seems?

If they even think you are spamming, you get banned. Pretty much closed to individuals (according to Reddit, if they don’t even like the way your ID looks, you’re banned) while businesses get more leeway to do things.

I didn’t realize they’re that strict. I have an individual account with them I occasionally use and didn’t encounter any issues with ID (I can’t even recall being ID’d tbh). That being said, I am located in Germany and have a German billing address, so maybe international customers have more issues?

No one I know has had issues like that. They also don’t spam, but Hetzner is generally considered in ny circles to be a pretty newbie-friendly service especially for people looking to use basic baremetal machines. Maybe we’ve just gotten lucky, or maybe we all hail from the right geographies.

Those machines are pretty nice though. Great for “base load” (handling the scale you almost never go below).

They’re not closed to individuals. I’ve run two VPSs on Hetzner cloud for 2 years now…

I have an account with them for my website/email. No problems. Even asked them to open up the IP for SMTP requests and they asked how many emails I wanted to send per month, and I told them it was my personal email and less than 100/month. They happily granted me access.

Hetzner was just an example, because they are a well known. Interestingly a similar sudden increase of German Tor users also happend in 2017: https://www.chip.de/news/Raetselhafter-Nutzeranstieg-Zahl-de...

Hetzner (and other German entities) seem to operate quite a few relays though: https://metrics.torproject.org/rs.html#aggregate/as not sure if this might have something to do with it...

They don't operate the relays themselves, rather users install relays on hetzner vpses/servers.

The obvious explanation is that German ISP's blocked 711chan, so the onion service is the only way for them to access the site.

Jk, but if you change 711chan to Krautchan maybe it's true

Sudden 2 mill extra isn’t organic Chan users

From around September 2022 to March 2023 media in Germany promoted the Snowflake Browser Extension (https://addons.mozilla.org/de/firefox/addon/torproject-snowf...) to help Iranians circumvent censorship. Is this a possible explanation?

„These estimates are derived from the number of directory requests counted on directory authorities and mirrors.“

Depending on how these numbers are obtained, there is a non-zero chance at least part of this increase is caused by us.. note that this number is not indicative of the amount of users or origins (i.e. physical source addresses), but only count directory requests.

Plausible options seem to be malware, another attempt to crack tor by enforcement or some sort of app that added tor browsing

I'm not sure who titled this post, but the word "drastic" isn't found in the target web page. And as a native English speaker, "drastic" feels wrong for this usage. I would say it's an inadvertent swap of meaning with the term "dramatic" which would make more sense.

"Drastic" has a negative connotation of intent behind it. For example, "drastic increase in police enforcement of laws in Germany" would make sense. In the case of the headline, it just rubs me the wrong way.

Probably submitted by a Genglish speaker? The German word is drastisch. Dramatisch also exists, but as a native speaker I would say drastisch is the better choice here. Dramatisch would suggest that there a serious consequences like e.g. bringing Tor to its knees.

What English word would fit best I leave native speakers to comment.

Tor metrics don't really tell you much about the actual human users of the networks. They mostly tell you about current bot/etc usage. It's why inferred tor v3 datarates have been wildly inflated (10gbps) ever since support was turned on in the release binaries despite 99% of human people using tor v2 (at the time).

You've been posting about Onion v3 and "human people" for years at this point, nothing is going to happen. v2 onion addresses are not secure, plain HTTP is not secure unless you run it over Wireguard or IPSec with path filtering and use DNSSEC, and almost no one ever does that.

Have something changed in how German police goes after drug dealers? It's the most important use case for Tor anyway.

No new law or something was passed, so if at all, it's a technique/method that won't be published.

I have to wonder how many of these are from cheap German servers, from criminals trying to DDoS rival markets.

I've noticed VPN severs in Germany to be busier than usual too.

Any updates in regards to this data?

It could be INTERPOL

Germany is blocking a lot of websites ( i.e. rt.com)

But that's been happening for some time already, while this spike is recent.

Russian-run sites like RT are banned through the whole EU. However, such spikes cannot be seen in other EU countries such as France.

Might also depend on how it’s enforced. The blocks in Austria basically do not exist because they are only done by carrier DNS servers. Use 1.1.1.1 or 8.8.8.8 and you would not know.

The vast majority of people use their ISP’s DNS server, though.

I don’t think that is relevant here. If in one country you need a VPN to bypass blocking but others you only need a different DNS server I would expect most users to go for the latter if given a choice.

I just opened rt.com on my home connection with no tor or VPN and everything worked. I'm physically in the Czech Republic if that matters.

I just read on Al-Jazeera that Putin is back in control, that's why :)

Source? I’m in NL and I can access it just fine. I use Cloudflare for DNS though

I would say this is the best solution. I live in another EU country where ISPs also block it via DNS.

No excuse for that censorship honestly.

Eliminating enemy propaganda is extremely common and a long running practice. It's less censorship and more self defense.

Looking at it from that perspective it makes a kind of sense, although I think it is less defensible in modern day with the internet.

It's more defensible! Propaganda is far, far, less effective as a blind radio broadcast or air pamphlets than micro-targeted interactive sessions intricately engineered to maximize neurological reinforcement loops. Absolutely insidious.

No, it's far less defensible, because people have the internet to look up and verify things as needed.

This kind of censorship is just nannying, which I'm generally against.

Then again, given how inept people are at thinking for themselves, maybe a nanny state is what's best.

> No, it's far less defensible, because people have the internet to look up and verify things as needed.

Actual it is far more defensible, as I already clarified earlier. Propaganda remains effective regardless if there is the ability to verify it or not - and that is assuming everything can and will be checked by every person, which isn't realistic.

> This kind of censorship is just nannying, which I'm generally against.

It's not nannying at all. It's basic national self defense. Pen is mightier than the sword and all that. Brainworms are an insidious contagion.

> Actual it is far more defensible, as I already clarified earlier.

You didn't clarify, you just gave your opinion. One I disagree with.

> Propaganda remains effective regardless if there is the ability to verify it or not

So you claim. Even so, the correct approach is for the government to fight propaganda with corrective disclosures. Censorship is not the answer.

> It's not nannying at all. It's basic national self defense.

It is certainly the former, even if it is the latter also, something I'm skeptical of. The two are not mutually exclusive.

> Brainworms are an insidious contagion.

You fight them with truth, not censorship.

You're confusing opinion with facts. If I say the sky is blue and you say it is yellow, one of us is sharing an opinion, and it isn't me.

Moderation and removal is the correct action, so are you flatly incorrect. I'm not going to argue with the stubborn child that wants to put their fingers in the outlet. This isn't up for discussion.

> You're confusing opinion with facts. If I say the sky is blue and you say it is yellow, one of us is sharing an opinion, and it isn't me.

The irony and lack of self-awareness in this statement is honestly astounding.

You hoenstly think your opinion is objetive fact, lol.

> Moderation and removal is the correct action, so are you flatly incorrect.

Because you say so? lol.

> I'm not going to argue with the stubborn child that wants to put their fingers in the outlet. This isn't up for discussion.

There is no discussion to be had with someone that asserts their opinion as fact but can't corroborate it as such. Such a person is indeed a stubborn child, and them calling others a stubborn child can be dismissed like any other nonsense a child may say in an emotional state.

I can open rt.com just fine in Germany. (Not using my ISP's DNS server though. It's true that rt.com won't resolve when using it.)

Lies. I just tried rt.com on my home connection and it opened without a problem

Is tor really the go-to workaround for this and not just a VPN?

VPN seems like it would be vastly preferable for performance and reliability.

Sure but Tor is free

Yeah, but few VPNs are free, and the ones that are tend to be slow and unreliable due to overloading.

This comprises 40% of all global Tor users. I'm not sure it's reasonable to assume they all wouldn't have the budget for Mullvad.

- it's dns blocked -

Uhm...

https://de.wikipedia.org/wiki/Sperrungen_von_Internetinhalte...

Edit: parent poster has now changed his post after claiming there was no blocking in Germany

Maybe related to the Proto-Nazi party AfD winning a district a few days ago. And this 5 day old news story: https://www.politico.eu/article/germany-far-right-afd-securi... "Germany’s far-right AfD placed under security service surveillance" - "The party is now treated as a ‘suspected case’ for far-right extremism".

I wonder if anyone can see inside the right-wing chat networks and if they've been mentioning Tor.

Although in the raw CSV's the spike started around mid-June...

As a Danish person who has been to Eastern Germany (outside Berlin) I'm really not surprised by the rise of the AfD. It's common to see people on social media praise Germans for de-Nazification and criticize the Japanese for not confronting their past in the same way. Those people have clearly not interacted with Eastern Germans. In Eastern Germany the underlying neuroticism, persecution complex, and willingness to believe in every conspiracy theory, things that were foundational for the rise of Nazism, is very much still alive.

This is completely removed from reality.

The right wing movements in Europe started around 2000 in Italy, Austria, the Netherlands and France. Germany was way behind.

In Germany the AfD won voters after Merkel let in too many refugees in 2015 against the will of many CDU voters.

The AfD is probably less extreme than MAGA and most European counterparts, including Scandinavian ones. But it is always easy to pile on Germany, isn't it?

(I don't vote for them, don't like them, but this is getting silly.)

Please you are whitewashing history. Hoyerswerda gruesst. This shit was happening already in the 90s right after reunification and in the context of OP - it’s not surprising at all, eastern germany had a very different take on denazificaiton.

Hoyerswerda was in 1991, please look at the election results:

https://en.wikipedia.org/wiki/1990_German_federal_election

No radical party was of any significance. If they were all Nazis, why didn't the NPD have 20%?

You are the one who rewrites history.

Because at the time that SED follow up was still binding the Nazi vote.

And it bound the "Nazi vote" from 1990 until 2015? And they still don't vote NPD in 2023?

They vote AfD because the traditional parties have failed them and keep doubling down. The AfD would probably also fail them if in power, but that is the nature of protest votes.

Same story in France where Le Pen is currently leading the polls.

"eastern germany had a very different take on denazificaiton."

As opposed to the BRD, where for example the "Auswärtiges Amt" had more ex NSDAP party members after 1945 than before?

There definitely was denazification in the east, but the totalitarian enclosed and literally walled of mindset did not help with creating an open mind towards the world. Add to that high unemployment and poverty after 1990 and you get the usual extremists on both sides of the spectrum.

You will notice I did not say Western Germany was great at it. Different.

I noticed, but in the context it seems to imply a worse take.

I don't know why this is getting down voted.

Poster didn't say it's rampant, just that "it is very much alive."

I'm German, I live in Berlin, I regularly spend time in eastern Germany, outside Berlin. I can sadly confirm this.

Can you say more about East Germany and what is going on there for them to be open to conspiracy theories, neurotic thoughts, etc?

Disenfranchisement, after reunification they were left with little generational wealth, liberalism spiraled them deeper into a hopeless situation, no jobs, no economic future, impoverishment. Under liberalism the only alternative offered to them is the far right.

During the cold war and after, the US and anglosphere was mostly interested in the destruction of left ideology, labor unions, left parties etc. were all targeted. The right offers a safe outlet for people with those grievances, it doesn't threaten capital, so it was always allowed to linger in Germany not just in the east. It's deeply rooted in establishment and civil organizations, in university fraternities (schlagende verbindungen, the CSU etc.). The allied supported and used and bolstered far right groups all around Europe (Gladio, NSU, etc.) in their fight against socialism and people on the left. We still feel the effects to this day and state and federal police and intelligence still operate this way.

Protests in Germany you see police protecting far right groups from leftists, not the other way around. It's a necessary aspect of liberalism to allow the disenfranchised the outlet into right wing extremism.

Fascinating, thanks!

The german lands east of the river Elbe have been different from the western parts of Germany for more than a 1000 years. In the historical record you see a pretty sharp change in marriage patterns,land ownership and political structure when crossing the Elbe.

The enlightenment was less influential in the rural estates of the ultra conservative east elbian Junkernklasse than it was in the more densely populated Rhineland regions. Fukuyama has a nice chapter on the matter in “The Origins of Political Order”.

On top of that you have the separation, and the dislike of the GDR to foster critical thinking and the economic collapse of the east after reunification that lead to a lot of brain drain.

Hardly surprising, treuhand left east Germany extremely poor.

The unification wasn't exactly free. The immense costs for the most part were shouldered by western citizens through the Solidaritätszuschlag. The total price tag is estimated to be between 0.95 and 2 trillion Euro (https://de.wikipedia.org/wiki/Kosten_der_deutschen_Einheit#R...).

I read this comment earlier today, and my thoughts have returned to it through the day. It is an extremely bigoted comment, that prompted further bigoted comments below it. I'm not asking for it to be removed or censored but I have come back to express just how revoltingly bigoted it is, and I think the commenter should reflect on how they got to the mindset that produces statements like this one.

It's really not. A generalization is not de facto bigotry. I wish Americans could figure this out some day.

> In Eastern Germany the underlying neuroticism, persecution complex, and willingness to believe in every conspiracy theory, things that were foundational for the rise of Nazism, is very much still alive.

The grandparent (quoted above) is generalising a population as having these negative aspects and suggesting that support for the AfD is only due to these reasons. It is a form of shallow dismissal based on bigotry. It doesn't seek to understand the population and properly why support for the AfD is rising. It's much easier (for the bigot) to write off people as having entrenched negative characteristics.

And I wouldn't normally say this but if you have a browse through the grandparent's comment history, the majority of their comments are of this ilk, including one comment about 2 months back that they received a warning from dang for.

That is not sufficient in total numbers. That would be in the press that a whole part of the population goes Tor. They would never be quiet enough about it.

Looks anorganic and if it is organic I bet for Netflix and co related.

China has the great firewall, the UK has Hadrian's firewall, I guess this is the Berlin firewall.

As someone from the UK I’ve never seen anything blocked on my home Internet (except actual scam sites but you can turn that off, and yes that’s from my ISP and not the browser)

My mobile data does incorrectly flag some things as 18+ though

Plenty of high seas sites are blocked.

Are you required to provide doxxing personal information proving your age on these sites or can you browse anonymously?

Only on my mobile data. They’re not actually 18+ sites though, for example someone’s blog that was posted here is blocked and it seems the Tor site is too

But I think that’s a Vodaphone thing rather than a UK thing

So private companies are able to decide the websites their customers are allowed to access?

Pretty sure that’s true in the US too, though not common I don’t know of regulation otherwise. Please correct me if I’m wrong, anyone

No - the law that may end up requiring that is a proposal that is at least several months from being enacted [0], although it's been gaining momentum for several years - so unfortunately is looking like it might actually happen

[0] https://www.bbc.co.uk/news/technology-6606560

Is there concern in the press with the state having access to this data and using it to leverage individuals?

I've seen a lot of things blocked, e.g. sci-hub

Ugh I have news for you

Sky and Virgin Media would often block sites I was trying to access, before I bought a vpn service. So yes the UK ISPs do block sites.

Looking at the chart it seems to line up with the war in Ukraine. Germany was a target of Prigozhin’s Internet Research Agency (troll farms). I wonder if we will see a drop in Tor usage now that his coup has failed and his organization is being dissolved.

I think you're missing the last week of that chart. The huge influx happened very recently, not months ago.

yet maybe ukraine's services are using tor for some of their communications ?

Reply on news.ycombinator.com