Reimbursement of Exit Operators | Hacker News Reader

Reimbursement of Exit Operators

lists.torproject.org

57 pointsblottsie44 comments

I really want to run an exit node because I'm a firm believer in what the Tor network does-but I'm really worried about being arrested for running one. Does anyone have practical experience running a Tor exit node?

Great question. I would check out this page: https://www.torproject.org/eff/tor-legal-faq.html.en

>It is not a tool designed or intended to be used to break the law

Isn't it though? If you use Tor to bypass an internet filter somewhere like China, are you not breaking the law there?

I ran an exit node on a mostly unused dedicated server for a while. I made the mistake of not limiting traffic to ports 80 and 443, and got a couple DMCA takedowns as a result of people torrenting stuff over tor, which caused the provider to cancel my contract. (I got all my files off first)

It's really bad when out of all the reasons governments can shut down Tor nodes, it's DMCA's that do it. If DMCA's really have that much power, then their reform is long overdue.

The takedown system is one of the very few good parts of the DMCA. Without it, content owners could sue the host (like YouTube) instead of having to go after the uploader. As long as the host takes down the content, they are basically immune to copyright prosecution.

As far as I can tell, you are not "required" to take down content when you get a DMCA notice. Refusing it just makes you liable for the content under the rest of copyright law.

It's better than nothing, but it's severely flawed. There is zero disincentive for filing false claims.

While it could certainly be improved, it does explicitly make false filers liable for damages. http://en.wikipedia.org/wiki/Online_Copyright_Infringement_L...

It makes knowingly false claimers liable. Massive systematic negligence has zero punishment.

Yes, run the exit policy at https://trac.torproject.org/projects/tor/wiki/doc/ReducedExi... and put up the info page that comes in the tarball on your default vhost.

The only problem I ever had in a year of running an exit relay was when I had a default allow-all policy and someone torrented something, triggering a DMCA notice. My provider, Linode, had no problems with it.

Ummm .. but port 80 & 443 are still open, so if someone downloads child porn then you'll get an early morning visit (and a lot more) from the police.

What would be great would be if you could restrict the websites people could go to. I would gladly offer people in internet-oppressed countries access to bbc.co.uk (only).

toss a proxy past your exit and you can restrict it any way you want.

That breaks the Tor protocol. It means that non-bbc websites would appear to be blocked and unblocked at random as users used Tor.

I had a discussion with one of the developers and basically Tor isn't designed to do this -- the blocks on each exit node have to be propagated through the network, and if every exit node did this then it would adversely affect the network in some way that I don't recall the details of.

I don't think bbc.co.uk is blocked in any country.

China, some of the time: http://www.bbc.co.uk/news/world-asia-pacific-11962520

I have no first-hand experience at it, but it seems like the best approach may be to set up and fund an organization which operates an exit node, rather than doing it in your own name.

e.g. http://tor.noisebridge.net/

This might not work so well at a small scale, and it might be difficult to quantify how well this approach worked for them for reducing how the operators personally get harassed in this case -- at least one of the founders of Noisebridge has been harassed a lot about other things (Jacob Appelbaum).

So I rent a VPS in Egypt and provide an exit node there. I am as small time as it gets. Looks like this will not do anything at all for me since they are looking for very large players to provide exit nodes.

I do like the idea of Tor becoming fast. It's painful to use currently. If someone like Netflix was to donate 1% of their bandwidth to Tor, things would look so much better.

Where do you get VPS hosting in Egypt? I am in the region and very interested to hear someone with experience in this, meaning VPS and providers not in Europe. My experience with friends and colleagues is a lot of the latter.

http://citynethost.com/vps.asp

They used to be a lot cheaper. I got mine for $2.50 off a lowendbox.com sale. It has not been super reliable through the turmoil in the region, so there were a few days of downtime for the VPS and the control panel/website. In other words don't rely on it to be your single point of failure, but for me it has worked well as a secondary machine.

I'm not sure there's _any_ amount of money they could give me that'd offset the risk of getting hit with a false-positive dawn raid.

Having documentation on an official-looking letterhead that you're running an exit node may reduce the risk of such a thing happening.

Only after the fact. Maybe.

It might help AFTER the raid, but probably wouldn't help prevent it.

It'll give the police and the prosecutors a good laugh.

Which is why the Tor legal FAQ suggests that you shouldn't run an exit node from your home:

https://www.torproject.org/eff/tor-legal-faq.html.en

You don't need to run it from your home to get a 5am visit from the local SWAT team.

Run exit nodes from VMs in a country you don't live in, and run them entirely from ram.

You forgot to mention choosing a country that doesn't have an extradition treaty or similar with your own. So for me in the UK, it would rule out most of the EU and North America.

I'm in the US; I'm probably going to jail just for talking about this /s

Summary: The total amount being handed out is $3500, to only six organizations right now. In order to qualify, you have to know this guy, and be providing Serious Bandwidth.

So where does the NSA apply? (This is a joke, they don't need exit nodes to break Tor)

You're right, they can piggyback off everybody else's exit node.

Note that since the total amount of $3500 will be handed out every month, as long as we have less than 6 entities signing the contract, each entity will receive their maximum share of 500 Euro.

One of us interpreted that wrong then. I read it as "If we have less than 6 entities, each will get the max cap. More than that and each will get less than the cap." I didn't read anywhere that said how many entities have been contacted and how many are expected to sign the contract.

Look at https://www.torservers.net/misc/reimburse-output-2013-07.txt

That list only has six orgs on it. (Though it doesn't total up to 3500?)

You might be right. That doc is described as: example report at [link] (not the correct numbers, but you'll get the idea).

Does anybody know of a good VPS provider - overseas is fine, perhaps even preferable - that accepts Bitcoin, which I could run an exit node on?

This lists Good/Bad ISPs, but a CMD+F for 'bitcoin' has 0 results: https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISP...

Bytemark in the UK might accept it for this if you have a chat with them. They are ORG sponsors and generally seem to be on side over privacy and free speech issues.

Just remember, Bitcoin is far from anonymous. In fact, it's pretty easy to track, unless you can source the coins anonymously.

So if I have a 15/5 dynamic IP home internet connection, could I make enough money to cover my connnection by running an exit node in a VM? Somehow I imagine a static IP would be needed.

It sounds like since there's only $3k allotted for this, there wouldn't be enough to go around, even if my connection were technically feasible.

Bandwidth in less heavily served countries is worth more. 10 Mbit in the US only gets you two euros a month: https://www.torservers.net/misc/reimburse-output-2013-07.txt

does this mean that TOR will have a close relationship with its exit operators? I dont like the sound of that...

See my top-level comment. TLDR: No, as The Tor Project has nothing to do with this announcement.

Outright incorrect headline. An independent organisation, with no official ties to The Tor Project is now going to start reimbursing other organisations who run exit nodes. Essentially helping to ensure a more diverse set of relay operators. This organisation previously directly took donations to run exit nodes themselves. That's problematic from a decentralisation point of view, so instead their going to use the donations to fund exit nodes run by others.

Within minutes of posting this comment the title has been silently edited to be more neutral. (Although still potentially misleading given the associated domain name).

It originally read: Tor to start reimbursing exit node operators

Reply on news.ycombinator.com