Hacker News Reader

Answers are in the article , agents used SSH tunnels, it was evidenced by the wiki’s referrer logs. The Tor - agents did edit the wiki via SOCKS and relay R6 instantly.

The questions should be more like was CONNECT open or they didn’t even need it:)

There's nothing magic about GET, it found old wikis that would allow you to make edits using GET requests. GET being read-only is only by convention, there's no guarantee of what happens server side with GET or any other HTTP verb. It's up to the server.

Possibly via compromised php sites with webshells on AWS and DigitalOcean they could run shell commands to install and use Tor. We don't have forensics of the AWS/DigitalOcean sites although maybe can find signs using shodan etc.