I'm running exits since about 9 months. Have been running non exits for over a decade before. The exits are run by a non-profit (a Swiss Verein) and use the recommended setup like described in the blog post. The ISP knows it's an exit, it has a page on port 80 describing it and a PTR record that contains tor-exit.

No contact with the police till now.

If you would like to support the Tor network but don't want to run nodes yourself you can donate to one of the relay associations https://community.torproject.org/relay/community-resources/r...

Thanks for doing this. Early 2010s, I provided free wifi when I lived across the street from a subsidized housing block. I tunneled all their traffic through Tor (including DNS via a hacky script).

I was too much of a coward to take the risk of the police breaking down my door because of something done by some random person using the free wifi. Thanks to others like you who were braver than I was, a bunch of folks had free Internet access.

But then weren't you leaking all their HTTP traffic to a possibly malicious exit node?

Good point. I considered adding more details, but felt they were off-topic to the purpose of my post, and didn't want to have the "thank you, brave soul for running an exit node. Your actions might enable other good things that you might not have expected" message lost in noise.

There was a captive portal page (another hacky script running as a CGI) where the user had to agree to, "not be a dick" to continue. And, the user also had to agree that they were aware that others, who were dicks, could be accessing their data if it was not encrypted and gave the example of http vs. https in the address bar of the browser.

There was also a picture of an onion on the captive portal page, and a link to a FAQ which talked about open wifi and Tor. Exit nodes were not geo restricted, so if nothing else, the warnings and explanations allowed the users to understand why sites often seemed to think they were in a different country.

There is a limit to what people are able to digest about a subject that is not one they focus on. But, the warnings (right on the main captive portal page; without having to navigate to the FAQ) were sufficiently scary to encourage caution.

The most likely available alternative would have been public access terminals in the library, or other open wifi for those with portable devices. Public access terminals could be running keyloggers and worse. Even if the public terminal is free of malware, the non-technical user might just close a logged in browser tab/window, not realizing that is not sufficient to log them out.

Yes, even with users being careful about looking for https in the URL bar, some websites are broken and use https for their login page, but use http for their session cookies. But, trying to protect from these incompetent websites would require shutting down all public wifi everywhere (OWE [opportunistic wifi encryption without authentication] did not exist yet).

I think my open wifi (and open wifi generally, as well as Tor) were/are a net good. If, after this additional detail you still disagree, then we will just have to disagree.

You went above and beyond with it all, yes I was mainly concerned how informed the users were and agree open wifi and Tor are a net good. Appreciate the writeup!

These are people who connected to a random open wifi network. Tor exit nodes were probably the least of their worries.

That's no justification for adding a known-malicious network to the list.

While supporting funding more nodes is a noble goal another concern I consider overlooked is the potential 'centralisation' of nodes e.g how a large number of Tor nodes are hosted in Germany and near countries and the implications for network surveillance.

It is widely suspected that the US NSA runs a large number of Tor exit nodes themselves. Tor was originally developed by a US military research lab and received additional funding under the justification that it would help dissidents in China and North Korea evade their country's censorship and surveillance. It also doubles as a way for the US government to surveil anyone seeking to evade surveillance as well.

See the sources cited at: https://en.wikipedia.org/wiki/Tor_(network)#Exit_node_eavesd...

> It also doubles as a way for the US government to surveil anyone seeking to evade surveillance as well.

Supposing they own now enough Tor node, which the Wikipedia link is unclear about

It seems like a reasonable claim judging by how much easier and cheaper it is to spin up 10s of thousands of nodes than it was a decade ago. Even a wealthy person with a miniscule fraction of the US defense budget could do the same.

Idk if there is a technical solution to this attack problem.

There are solutions, but they come at a steep cost with regards to usability, so would shrink the anonymity set to what would be an unacceptable level for the uses Tor cares about. The reality is that these attacks, while theoretically possible, require more work and money than the rewards justify (you can't just bulk buy nodes from a provider, Tor doesn't allow connections that route to the same host or close IPs, and does somewhat regularly block relays that were all created suspiciously close chronologically without identifying as the same operator), so are considered an acceptable risk. Snowden was willing to rely on Tor, the rest of us who just want some extra privacy will be just fine.

> It also doubles as a way for the US government to surveil anyone seeking to evade surveillance as well.

On a technical level, exit node operators aren't supposed to be able to trace the origin of data flowing through them... so this indicates a failure of protocol.

Unless you control enough nodes. Tor was never designed to be 100% surveillance proof

I've been running exit nodes in europe for years and not even a call from the police, what's wrong with me? huh? ;)

I do regularly handle abuse complaints by blocking IPs or other actions.

Have you been blocked by any major services? I've heard horror stories from colleagues of their static IP address eventually being blocked from their bank.

I'm sure they have been blocked, many times. Some online services simply fetch the tor exit node IP lists from the tor project and block them all pre-emptively.

The thing is that I rotate my tor nodes every other month, manually. No pipeline setup for this yet. So I destroy old VPS and create new ones with the same signing key and family in the node info.

I suspect you're talking about running an exit node at home, or on an IP-address that matters. That's a stupid thing to do.

Running an exit from your home IP is a very, very bad idea so he most likely has rented a server somewhere and is running the exit node there.

I've had my IP blacklisted for running a non-exit node, just a relay. So it's definitely a thing.

I once tweeted something like:

> "For those of you interested in running an exit node, just be safe. Always remember to run it via your company's VPN to ensure the safety of those making passage through."

The engagement was nuts and the sheer amount of people who use ToR but were unfamiliar with what a statement actually says was frightening.

I hope that engagement was people telling you that in fact: No don't do that.

https://gitlab.torproject.org/tpo/community/team/-/wikis/Exp...

I ran one in my student housing wardrobe a decade or so ago.

I too have some stories, but no one ever met up with me in the flesh.

Come on then, no need to be coy.

For example, once or twice people called me (somehow) and asked why I was hacking their websites. I tried to explain, but I doubt I convinced anyone.

How would a non government entity get a physical address or phone number from an IP ?

Social engineering can be very powerful. Small ISPs could fall victim to this easier.

May I ask: That wasn't enough for you to stop operating a Tor node? People were abusing others thanks to your specific personal efforts and you just said: "eh, it's still worth it". How do you determine that it's still worth it?

Some statistics from one of my servers regarding Tor abuse. From 1130 abuse IPs in my http access log 4 are Tor exit nodes and from the 1905 ssh bruteforce attacker IPs 3 are Tor exit nodes. Stop operating Tor nodes would therefore reduce the abuse by basically nothing but take Tor from the people that need it.

>eh, it's still worth it

Yes it's totally worth it.

My abuse logs for the last two years have overwhelmingly been from compromised Chinese devices, and Spanish servers. Not sure why Spain is so often used, but Tor abuse cases are few and far between.

Do you make the same overclever statements when someone abuses freedom of the press?

There is nothing overclever about it, the tech is obviously being abused by criminals. The question around whether it's worth it to enable some "freedom of the press" is apparently enough to evoke some anger within you.

All tech is abused by criminals. Should an ISP close up shop when one of their subscribers is proven to be a hacker? Likewise, we could argue that many of the legitimate technology companies should be considered criminals. With a few strokes of the pen, they could one day be criminals.

My first interaction with Tor I purchased some weed on Silk Road. All very much illegally then and less so now. Things change and are not always quite right to begin with. I’d wager that many readers here now have legal retail access to euphoria inducing cannabis products that they did not at the time of that transaction on SR.

Also. I understand that Tor isn’t always secure and I may have messed up. But whatever. Even as some obfuscation I’m ok with it. Anyone interested could track the payment and find me.

Rather than playing coy, you should tackle the challenging part of your argument head-on: tell us why you think Tor is different from other technologies that are routinely abused. That would actually be a substantive contribution to the discussion.

Why do I have to tell you this when it should be instantly obvious: Tor is literally designed to obfuscate the identity of people. A coffee machine isn't.

So you think people in oppressive regimes should voice their opinion and/or whistleblow with no identity protection and risk... death?

You either have haven't thought about this topic very long, or you're just a troll.

I assume that since you think that desiring anonymity is criminal that you wouldn't mind replying with your full legal name.

I'm curious if you are also opposed to encryption in general. How about https? Should all traffic be http?

>Why do I have to tell you this when it should be instantly obvious

Because it's only instantly obvious until you consider it for a moment. By your logic, literally any privacy-preserving technology, be it disposable email services or *69 on your telephone, are morally unjustifiable.

Drop your pen, cause that is a tool abused by criminals to make atom bombs (ultimately).

> Does anybody know more about how exit nodes are being run?

They have a good list of points on the Tor site. The most important ones are usually to distance yourself from the exit node and make it obvious what it does so you don't get entangled into whatever is going through the node.

https://blog.torproject.org/tips-running-exit-node/

It's surprising to me that those people haven't been arrested yet. People get raided for far lesser offenses compared to running Tor exit nodes.

Exit nodes are a mistake. The web is a lost cause by now. Most sites already consider access through Tor to be abuse. Exit nodes are also the focus of the deanonymization attacks that I've seen. The Tor hidden service network should be strengthened instead. We should launch hidden services instead of web sites.

You don't arrest people because someone does something you don't like, you arrest them because they break the law. Running an exit node is not illegal.

In France, an ONG collect funds to run exit nodes: https://nos-oignons.net/

I've noticed more exits with VPN IPs.

Do Not Run An Exit Node!

very few people have legitimate uses for an exit node. And it is a security nigthmare for everyone (you owning their crimes, them being at your MiTM attacks mercy, etc)

But Do Run A Tor Node!

everyone should join tor and it should become the main net, with only tor traffic.

> But Do Run A Tor Node!

Just a word of caution, while running a non-exit node is obviously safer from a legal point of view, the entire list of active tor nodes isn’t secret, and there are enough people in the world that do not understand how tor works that the chance is non-zero that you’ll still end up on a block list somewhere for simply being a “tor node”, even though you never let any of the tor traffic out on the Internet.

I know for a fact this can happen because it happened to me.

Happened to me too. Worked from home and it showed up I was logging in via Tor. They were not pleased.

Google shows anti-bot challenges if you run a non-exit relay.

An ISP doesn't own the crimes that an attacker sends through them.

Well, I’m going to burn some karma by agreeing with you.

Running an exit node is a bit like operating a no questions asked gun shop in downtown (some deprived city).

Sure, there’s perfectly legitimate reasons to own and therefore sell a gun to someone, but that particular shop will be in the business of facilitating crime - and that’s a bad thing and therefore not a moral occupation.

If you run an ISP, chances are 100% that people will use it to feed their pornography and gambling addictions. That ISP will be in the business of ruining lives. Does that make running an ISP am immoral occupation?

> Running an exit node is a bit like operating a no questions asked gun shop in downtown (some deprived city).

It's not quite like that. For some use cases that could be a correct metaphore. But for others, it's more like running a self-defense class in a well respected neighborhood.

s/gun/phone card/