The flipside of that is that it's reasonable to assume that most (not government run) TOR nodes are run at hosters offering cheap small VPS with cheap traffic and high bandwidth. That gives a few select datacenters where sniffing and correlating network traffic is extremely beneficial for deanonymizing TOR traffic. And if the datacenter operator doesn't cooperate and isn't vulnerable to covert sniffing there are always their uplink providers.

"That gives a few select datacenters where sniffing and correlating network traffic"

Uh,

This was the whole premise of Carnivore... installed in room 641A

https://en.wikipedia.org/wiki/Room_641A

(Btw - this is the room that Twitter was originally routed through...)

Basically I take the defeatest stance at this point...

There is NO privacy or anon. It doesnt exist any longer.

I ran a TOR exit node at home for a while, I don't recommend it.

Within 30 minutes of my public IP changing, CloudFlare would get wind of it again and then it'd be back to hitting a captcha for 75% of all of my own NOR tor traffic with the same origin IP as a TOR exit node. This among myriad other misadventures resulted in me shutting it off after ~6 months.

> Running Tor exit node is dangerous. Very few people would dare to do so. Most of hosters will forbid that.

Even in the richest parts (relevant because they love forbidding things) of the EU you can find hosters that accept tor exit nodes. As for it being dangerous, that is kind of a spurious argument. Why do you think it is dangerous? Do you know because you tried, or do you "know" because you heard someone tell you it was?

> So there's absolutely no reason for people not to run Tor node on every server they have access to.

There is at lest one: list of tor relays IP addresses is public. Some mail servers use this list as an additional source for RBLs (probably people, who are not familiar with tor don't know the difference between exit nodes and relays and bun all just in case). So it is not a good idea to share mail server IP with a tor relay.

Im guessing that the .gov doesnt run 'many' of the nodes -- but im guessing they have MAPPED them all out and are 0-day exploiting as many as possible.

THIS is what I would guess a state entitiy would be training an AI to do as a function...

Its extremely risky to use 0 days in an indiscriminate manner, especially against targets that are likely to be watching closely.

Govts have almost unlimited resources and willpower. They could easily just detect the tor nodes running, then spin up n /2 + 1 to compensate, giving them majority control. This could be automated.

And if two governments do this at the same time?

Then you have 2(n/2+1) = n+2 servers. QED.