bauruine

It is backwards compatible. There are multiple ways to connect to an IPv4 host with an IPv6 only host. Many mobile networks are IPv6 only. If you want it the other way around. How should that work?

I run a largeish Tor relay family on rented servers and have thought about running exits on my own "ISP" for quite some time. I already have an ASN and IPv6 addresses but Tor needs v4 and those are prohibitively expensive to buy and leasing is not possible because of the blacklist problematic. My email is in my profile if that is something you want to support and could spare a /24 of your assignment.

If you have an embedded device that has to work for 20 years without update you better design it's networking part so that telnet isn't an issue in your threat model.

If you want to go down the rabbit hole have a look at VPP. [0] It's a very fast, like 100GBit/s+ and 100 Mpps+, user space routing engine for commodity x86 hardware. Pim van Pelt has many interesting Videos [1] and articles [2] about it. I only tested it briefly before abandoning it because I'm still stuck on measly ~300/120 g.fast for the foreseeable future so I don't need it yet but especially the Linux CP [3] makes it reasonably workable if you have some Linux networking knowledge.

[0]: https://fd.io/

[1]: https://video.ipng.ch/search?search=vpp&searchTarget=local

[2]: https://ipng.ch/s/articles/

[3]: https://github.com/pimvanpelt/lcpng

Getting it for free with your Apple device sounds like "monetise it via the sale of hardware devices" which they supposedly don't do.

The certificate transparency logs are a merkle tree.

I've looked it up for you. "IIRC it just should look like normal TLS traffic." and "because basically everything does it" was correct.

"/* Browsers use the TLS hostname extension, so we should too. */"

Plain Tor says "Hi there! I'm connecting to a Tor node" because all relay IPs are public. You can't hide that fact with ECH or by not sending the SNI. Every second invested in that is just wasted.

According to the spec [0] it looks like SNI is not needed. It just specifies a TLS connection. Why does it send an SNI? I guess because basically everything does it so why should Tor not send it?

[0]: https://spec.torproject.org/tor-spec/negotiating-channels.ht...

IIRC it just should look like normal TLS traffic. They are unique to each of the already public Tor relays not the users. What benefit would ECH bring? You can still look at the IP and know it's Tor.

All the "let's hide that it's Tor" work is done with pluggable transports [0] used in combination with unlisted relays (bridges). This way there can be multiple completely different protocols like obfs4 (looks completely random), Snowflake (uses WebRTC), meek (uses domain fronting) and WebTunnel (WebSockets over https) without a need to update the Tor spec and all relays.

[0]: https://spec.torproject.org/pt-spec/architecture-overview.ht...

Those random domains belong to Tor relays. The list of relays is public anyway so you can just look at the IP address to see that it's a Tor connection. Obfuscating it would achieve nothing. If you want to hide that you are using Tor you should use a bridge. https://bridges.torproject.org/

The captcha has reCAPTCHA written on it and the Tor Browser does like 15 requests to google.com domains. None of the archive.is|li|ph|today domains use Cloudflare name servers and resolving archive.is from all over the world returns not a single Cloudflare IP.

I'm pretty sure they don't use Cloudflare.

archive.is doesn't use Cloudflare. The captcha is reCAPTCHA.

Bandwidth is about 2 orders of magnitude less on non-cloud even without any negotiation or commitment. How much do you have to commit for e.g. Cloudfront to pay 2 orders of magnitude less than their list price of 0.02 per GB?

I have a few 100million RIPE atlas credits I don't need. So if anyone want to test it just drop me a mail with your RIPE account and I'm gladly send you a few millions. My email is in my profile.

The site provides an onion service [0] I wouldn't call that "opposed to privacy".

[0] http://archiveiya74codqgiixo33q62qlrqtkgmcitqx5u2oeqnmn5bpcb...

Ups forgot that that there is this one relay that I don't run that is also called bauruine. I've updated the link to MyFamily. nusenu shows the authenticated domain which is tuxli.org for my relays.

I run one of the bigger Tor relay families [0] with around 3.5% of the exit bandwidth [1]. Hosting high bw stuff is actually pretty cheap if you stay away from the cloud. I don't pay five figures per month for all these relays it's less than 1k$. For the actual question there was a big attacker uncovered in 2021 [2] and removed from the network. I'm pretty sure there are still malicious relays on the network the hard part is to know which.

[0] https://metrics.torproject.org/rs.html#search/family:C466C9A...

[1] https://nusenu.github.io/OrNetStats/#exit-families (tuxli.org)

[2] https://nusenu.medium.com/is-kax17-performing-de-anonymizati...

>However, clients still need to ask the directory for information about a specific onion address, which would again allow mass collection of onion addresses. With V3 onion services, this is prevented by using key derivation to derive a daily-rotated identifier ("blinded public key"). [0]

This is the information I have. It's not possible for a relay to know an .onion address like it was with v2. Could you please link to something that proofs the contrary?

[0] https://blog.torproject.org/v3-onion-services-usage/

Yes all onion service connections appear from 127.0.0.1 but the current v3 onions are not guess or enumerateable. If you don't publish your address you get 0 attacks ever. Have you put your onion address all over the Internet to get attacked?

And even if you only use 500Mbit/s it's more than 3k$ in cloud egress fees saved.

rfc4941 is from 2011 if you use an OS that isn't using it you have bigger problems.

You can create an account with an email address if you click on "create your account" next to the "Log in" button.

Any chance you are going to implement non http(s) Outbound probes? Not everything is http so a generic TCP connection check would be great.

edit: Is it possible to add services in an automated fashion with an API?

There is still the chance that the person that created the 4 line dependency also just copy pasted it from the flawed StackOverflow answer. Or is the same person or is also just a random person creating the package like the random person that created the SO answer. I'm not sure why random_person1 should be more trustworthy to produce non flawed code than random_person2.

OTO: It's at least easily upgrade able so it has an advantage.

Thats common knowledge because De Beers wants us to think that.

https://archive.ph/eFwVj

What's your problem with the IPv6 end-user experience? Hundreds of millions of end-users are using it without even knowing what an IP is.

Adding to this as a relay operator, while I can't speak for the Tor Project or other operators, I think this is a perfectly valid use case for Tor and I happily provide ressources for it.

It's a tug of war. Disney could route their traffic via their T1s where the Australian ISPs also have to pay to receive the traffic. Who can pay longer? And if there is a working market of ISPs the ones with peering or caches in their network can use the superior Disney+ experience in their advertisement.