I use tor for exploring topics that I don't want to tie to my regular profile (ranging from professional software development, through health care issues, but also hobbies, fiction and nsfw content). Having these browsing in a separate profile and also IP address makes it much more relaxed to look for interesting stuff on the internet. (I am not really fond of advertisement that tries to sell me whatever I've visited in the past month, on unrelated pages.)

It saddens me that the default response is ban, increasingly so for services that need account, but even just reading a webpage can become tedious or impossible :(

Please, do not ruin this option, because even though you may not use it today, you may need it in the future.

Note: I also use tor for low volume crawling. When high volume is needed, it is more favorable to subscribe for domestic VPN proxies, so you may be blocking tor, but you won't block those ranges, and the robots will get their content anyway.

> Please, do not ruin this option

I don't believe that I'm the one that ruined this option for you. Small web hosts simply don't have the capacity, budget, or patience to deal with the 95% garbage originating from these IP addresses. Tragedy of the commons, I guess.

There is no reason to allow Tor IPs on most sites sadly. The abuse it is used for far exceeds legitimate traffic

Well, I’ve always tried to make my service available through Tor, but now that I faced an attack of 20,000 RPS distributed over all the exit nodes of the Tor network making requests to a computationally expensive (and non-cacheable) endpoint, and came out with 6x the hosting bill I usually get, I decided to block the entire network.

Maybe there’s an alternative reality where people do the right thing, and in that world I wouldn’t have to block Tor, but I don’t live in that world.

Shouldn't you protect that endpoint, regardless of the traffic coming from tor or not? It is really cheap to get traffic through domestic VPN proxies, so a dedicated attacker will get to it anyway...

Whenever I read something like this I look my access and sshd logs for abuse IPs and check if they are Tor exit nodes. The Tor traffic is always negligible like 100 failed ssh logins out of 170k are from Tor exit nodes. Or 670 out of 400k for my nginx access.log. Am I unique and everyone else sees vastly different numbers where blocking Tor exits makes a significant difference in the abuse they get?

I don't really care if somebody blocks a random port of sshd. I just don't understand why people are eager to block public https traffic, which is exposed to the public internet anyway.

Probably depends on what kind of service you're providing.

I (a legitimate user) get blocked on websites when using Tor quite a lot. It's a pita. :(

That being said, there's no chance in hell I'd ever put a CC or similar private info though a Tor based network connection. Just in case... ;)

> That being said, there's no chance in hell I'd ever put a CC or similar private info though a Tor based network connection. Just in case... ;)

For HTTPS sites, why?

Paranoia. :)

Have used Tor for accessing the Z-library and several other cases where sites where blocked or taken down. Not all of Tor is dark web shadiness or bots.

I constantly use tor as a way to get a third view when debugging connection issues for customers and malware infected websites. If you ever experience the issue of a customer saying they can't connect, but when you test it it works perfectly fine, tor is great to verify if the issue might effect more customers. As a side effect of it being ipv4 only, you can also test issues when one protocol work but not the other (there are alternative tools but tor is by far easiest at hand).

Tor hasn't been IPv4-only since a long time

True, but most exit nodes are IPv4-only, so in practice it works.

Wow, that's terrible, for reasons already explained to you below. Please reconsider.

No the IP blocks are very effective. I don't believe that I have any obligation whatsoever to allow criminal groups on the other side of the world to spam burp suite scans over Tor against my websites nonstop.

The traffic my servers receive from China, India, South America, Africa, and Eastern Europe, and the UK is also almost exclusively boys and exploit scanners.

You can block whatever IP addresses you like but the bot to user ratio of any given IP address is absolutely terrible. Tor concentrates a lot of traffic into a few exit nodes but by this logic most small countries should be blocked from most websites.

Sadly for the concept of the Open Internet, plenty of sites either have or would consider blocking most countries besides their own and closely-linked neighbors e.g. US/CA, since they figure nobody in those other countries could be, say, legitimately placing a takeout order in Chicago, or entering an American contest, etc. So it’s all downside (malicious bots, DDOS etc) with no perceived benefit of allowing them. It’s sad, but it’s probably going to become even more common.

How would you know if they are legitimate if you block them.

It's amusing to me that you're getting crushed on here for blocking/ "defederating" known IPs that you don't want traffic from, but I would bet that these same people would champion your right to do the same if you were blocking a spammy mastadon or lemmy instance that you didn't like!

It's not hypocritical. They have every right to block Tor traffic. I don't want them to do it, but also don't want them to lose the right to do it.