Tor and proxy_check - Wikitech-l - lists.wikimedia.org

List overview All Threads
Download

Tor and proxy_check

MediaWiki automated test run...

Re: [Wikitech-l] Bot edit rates,...

Travis Derouin

19 Feb 2007 19 Feb '07

11:27 a.m.

Hi, I've configured proxy_check and wgBlockOpenProxies, which seems to be working, but am still able to edit our wiki anonymously using Tor. Is there anyway to tighten this up? It seems the majority of edits coming from Tor proxies are from vandals. Thanks, Travis

Reply

Show replies by date

Brion Vibber

19 Feb 19 Feb

2:31 p.m.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Travis Derouin wrote:

I've configured proxy_check and wgBlockOpenProxies, which seems to be working, but am still able to edit our wiki anonymously using Tor. Is there anyway to tighten this up? It seems the majority of edits coming from Tor proxies are from vandals.

There's no system built-in to MediaWiki for detecting Tor nodes (they are not open HTTP proxies, so a search for them would not work even if the old proxy-blocking code still works, which I don't know if it does). You'd have to rig up a system for detecting Tor nodes, and/or use a list of open Tor nodes. - -- brion vibber (brion @ pobox.com / brion @ wikimedia.org)

...PGP SIGNATURE...

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFF2gkiwRnhpk1wk44RAinnAJ44r0+U4sKbFohyoMCUG8bsZ8TggwCguBe5 mF6jncGuUhJuZ69SlTisAUs= =5NtX -----END PGP SIGNATURE-----

Reply

Andrew Garrett

20 Feb 20 Feb

1:51 a.m.

Brion Vibber wrote:

There's no system built-in to MediaWiki for detecting Tor nodes (they are not open HTTP proxies, so a search for them would not work even if the old proxy-blocking code still works, which I don't know if it does).

You'd have to rig up a system for detecting Tor nodes, and/or use a list of open Tor nodes.

This said, an extension for this has long been on my to-do list. I might look into it at some stage. Andrew Garrett (werdna)

Reply

Platonides

19 Feb 19 Feb

4:28 p.m.

Travis Derouin wrote:

Hi, I've configured proxy_check and wgBlockOpenProxies, which seems to be working, but am still able to edit our wiki anonymously using Tor. Is there anyway to tighten this up? It seems the majority of edits coming from Tor proxies are from vandals. Thanks, Travis

There is a list of Tor exit nodes. Block them all :P

Reply

Gregory Maxwell

4:56 p.m.

On 2/19/07, Platonides <Platonides(a)gmail.com> wrote:

Travis Derouin wrote:

Hi, I've configured proxy_check and wgBlockOpenProxies, which seems to be working, but am still able to edit our wiki anonymously using Tor. Is there anyway to tighten this up? It seems the majority of edits coming from Tor proxies are from vandals. Thanks, Travis

There is a list of Tor exit nodes. Block them all :P

They change constantly.. and many people screw up doing this and manage to block tor middle nodes. So take the time to actually understand what you are doing. Ideally you would only block tor exits which could be used to access your site. (I was blocked on several wikimedia projects in the past due to such sloppy blocking)

Reply

Mark E

6:47 p.m.

On 19 Feb 2007 at 23:28, Platonides wrote:

Travis Derouin wrote:

Hi, I've configured proxy_check and wgBlockOpenProxies, which seems to be working, but am still able to edit our wiki anonymously using Tor. Is there anyway to tighten this up? It seems the majority of edits coming from Tor proxies are from vandals. Thanks, Travis

There is a list of Tor exit nodes. Block them all :P

That's bad practice in my opinion. Such nodes could also be border points for universites or large businesses or ISPs. Plus exit points change like the hours on a clock - people drop in and drop off the network on a whim, and many using dymanic DNS. So blocking Tor nodes is very iffy, and could wind up blocking a bunch of legitimate contributors. Mark

Reply

Kasimir Gabert

6:50 p.m.

Hello, I would highly recommend requiring Tor users to sign up for an account, and just block edits from Tor exit nodes. Many home users run Tor servers to donate some of their bandwidth, and it would damage your website if you permanently blocked all IPs from exit nodes. You might also want to run a cron job that updates the list of blocked IPs, being sure to remove ones which are no longer exit nodes and add in new ones. Kasimir On 2/19/07, Mark E <mark(a)edwards.org> wrote:

On 19 Feb 2007 at 23:28, Platonides wrote:

Travis Derouin wrote:

Hi, I've configured proxy_check and wgBlockOpenProxies, which seems to be working, but am still able to edit our wiki anonymously using Tor. Is there anyway to tighten this up? It seems the majority of edits coming from Tor proxies are from vandals. Thanks, Travis

There is a list of Tor exit nodes. Block them all :P

That's bad practice in my opinion. Such nodes could also be border points for universites or large businesses or ISPs. Plus exit points change like the hours on a clock - people drop in and drop off the network on a whim, and many using dymanic DNS. So blocking Tor nodes is very iffy, and could wind up blocking a bunch of legitimate contributors. Mark _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/wikitech-l

-- Kasimir Gabert

Reply

Simetrical

6:52 p.m.

On 2/19/07, Mark E <mark(a)edwards.org> wrote:

That's bad practice in my opinion. Such nodes could also be border points for universites or large businesses or ISPs. Plus exit points change like the hours on a clock - people drop in and drop off the network on a whim, and many using dymanic DNS. So blocking Tor nodes is very iffy, and could wind up blocking a bunch of legitimate contributors.

I think you're somewhat overstating how frequently the exit node list changes. Nodes may change regularly, but there are a lot of IPs that have been steady Tor exit nodes for a long time, no? In any case, it should be noted that it's Foundation policy to block all open proxies, including Tor exit nodes. The harm outweighs the benefit when it comes to trying to stop vandalism.

Reply

Mark E

7:09 p.m.

On 19 Feb 2007 at 19:52, Simetrical wrote:

On 2/19/07, Mark E <mark(a)edwards.org> wrote:

That's bad practice in my opinion. Such nodes could also be border points for universites or large businesses or ISPs. Plus exit points change like the hours on a clock - people drop in and drop off the network on a whim, and many using dymanic DNS. So blocking Tor nodes is very iffy, and could wind up blocking a bunch of legitimate contributors.

I think you're somewhat overstating how frequently the exit node list changes. Nodes may change regularly, but there are a lot of IPs that have been steady Tor exit nodes for a long time, no?

In any case, it should be noted that it's Foundation policy to block all open proxies, including Tor exit nodes. The harm outweighs the benefit when it comes to trying to stop vandalism.

I see. Block Tor exit nodes. Translated: "Punish 10's of thousands of college students, business users, and ISP customers, because of the actions of one or two people." Uh, ya. Blocking open proxies is one thing. No wonder one of the settings in the Tor client was called "Fascist Firewall" -- if you catch my drift. Mark

Reply

Kasimir Gabert

7:14 p.m.

Currently Wikipedia blocks all anonymous edits from Tor exit nodes. This is not harmful to real users but protects from vandalism. You should do the same, instead of blocking *everything* from tor exit nodes. (Allow account creation, allow edits from accounts). I agree with Mark, however, on the subject of flat out blocking all exit nodes. Tor is used for legitimate use in many cases above illegal use. A few examples... people behind restrictive firewalls (such as China and soldiers in Iraq) can access Wikipedia through Tor without anything being filtered. I would not block all Tor users. Kasimir On 2/19/07, Mark E <mark(a)edwards.org> wrote:

On 19 Feb 2007 at 19:52, Simetrical wrote:

On 2/19/07, Mark E <mark(a)edwards.org> wrote:

That's bad practice in my opinion. Such nodes could also be border points for universites or large businesses or ISPs. Plus exit points change like the hours on a clock - people drop in and drop off the network on a whim, and many using dymanic DNS. So blocking Tor nodes is very iffy, and could wind up blocking a bunch of legitimate contributors.

I think you're somewhat overstating how frequently the exit node list changes. Nodes may change regularly, but there are a lot of IPs that have been steady Tor exit nodes for a long time, no?

In any case, it should be noted that it's Foundation policy to block all open proxies, including Tor exit nodes. The harm outweighs the benefit when it comes to trying to stop vandalism.

I see. Block Tor exit nodes. Translated: "Punish 10's of thousands of college students, business users, and ISP customers, because of the actions of one or two people." Uh, ya. Blocking open proxies is one thing. No wonder one of the settings in the Tor client was called "Fascist Firewall" -- if you catch my drift. Mark _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/wikitech-l

-- Kasimir Gabert

Reply

Simetrical

8:18 p.m.

On 2/19/07, Mark E <mark(a)edwards.org> wrote:

I see. Block Tor exit nodes. Translated: "Punish 10's of thousands of college students, business users, and ISP customers, because of the actions of one or two people." Uh, ya.

Are there tens of thousands of college students, business users, and ISP customers who are forced to use Tor? I'm not aware that college campuses tend to make all their machines Tor exit nodes as a matter of course. Chinese users, now, there you may have a case for permitting edits from accounts, but I don't think anyone suggested banning edits from accounts. On 2/19/07, Kasimir Gabert <kasimir.g(a)gmail.com> wrote:

Currently Wikipedia blocks all anonymous edits from Tor exit nodes. This is not harmful to real users but protects from vandalism. You should do the same, instead of blocking *everything* from tor exit nodes. (Allow account creation, allow edits from accounts).

That may make sense, yes. Or allow edits from accounts but not account creation, perhaps, so that users from China or whatnot will have to go to a one-time effort of getting someone to create an account for them (if you have to ask an admin, it's going to be rather difficult to pile up dozens of sleeper accounts). But that might be too harsh, depending on the wiki.

Reply

Gregory Maxwell

10:45 p.m.

On 2/19/07, Mark E <mark(a)edwards.org> wrote: [snip]

college students, business users, and ISP customers, because of the actions of one or two people." Uh, ya.

[snip] A nit, it's not the minor actions of one or two people.. if we don't block tor exist all the technically competent high-speed vandals will just use tor. Because these vandals operate at fairly high speed playing whack-a-mole after they've acted just isn't effective. (especially with tor because it's quite possible to make every edit come from a different exit) I'm a tor user, I run a fairly high traffic non-exit tor node, I've advocated that we do things to avoid harming tor users and folks who happen to share an IP with a tor exit.... but the claim that blocking tor exits isn't important to English Wikipedia (if not all the wikimedia wikis) is false.

Reply

David Gerard

20 Feb 20 Feb

6:28 a.m.

On 20/02/07, Mark E <mark(a)edwards.org> wrote:

I see. Block Tor exit nodes. Translated: "Punish 10's of thousands of college students, business users, and ISP customers, because of the actions of one or two people." Uh, ya. Blocking open proxies is one thing. No wonder one of the settings in the Tor client was called "Fascist Firewall" -- if you catch my drift.

The reason they're blocked is the practical problem: despite theoretically being sources of valuable content, in practice they're a firehose of sewage. Even Freenode blocked all Tor users for quite a while.

From http://meta.wikimedia.org/wiki/Bash :

<Tony_Sidaway> "WHY DO YOU HATE FREEDOM?" nearly always translates to "WHY DO YOU HATE PEOPLE COMING AND SPRAYING PISS ALL OVER YOUR LIVING ROOM?" - d.

Reply

Travis Derouin

10:51 a.m.

FWIW, I did some data gathering. From this list of Tor IPs: http://proxy.org/tor.shtml I found that there were only 84 edits on our wiki coming from these IPs. Most of these edits were vandal edits: Ex: http://www.wikihow.com/index.php?title=Special:Contributions&target=149… http://www.wikihow.com/index.php?title=Special:Contributions&target=149… I can appreciate both sides of the argument in this situation, but it does remain an issue that Tor users are able to change IP addresses easily and remain anonymous. For smaller wikis, like ourselves, this can be really problematic if we encounter a motivated vandal.

From my understanding, if a registered user uses an IP that has been

blocked, they will also be blocked, correct? If a solution that works as a compromise is to ban just the anonymous edits from this these IPs, while allowing registered users to edit from these IPs, some sort of changes to Mediawiki will have to be put in place to accomodate this, as far as I know. Additionally, this doesn't prevent a vandal from creating multiple accounts, unless there's a way to increase the blocking on the IP to the normal, usual level so that registered users from that IP are also blocked. Another possibility is that registered users from these IPs will have to confirm their registration via e-mail, if the wiki isn't configured to do so already. It'd be nice to have this option just for this special case. Travis

Reply

Simetrical

11:10 a.m.

On 2/20/07, Travis Derouin <travis(a)wikihow.com> wrote:

From my understanding, if a registered user uses an IP that has been blocked, they will also be blocked, correct? If a solution that works as a compromise is to ban just the anonymous edits from this these IPs, while allowing registered users to edit from these IPs, some sort of changes to Mediawiki will have to be put in place to accomodate this, as far as I know.

Such changes were committed some time ago. They're definitely in 1.9, possibly in 1.8 (can't remember offhand). There's now an option to block only anonymous edits from an IP.

Additionally, this doesn't prevent a vandal from creating multiple accounts, unless there's a way to increase the blocking on the IP to the normal, usual level so that registered users from that IP are also blocked.

It's also possible to block only account creation from an IP, thanks to the same set of changes to blocking. I don't think anyone minds if Tor accounts are allowed to edit from registered accounts, the question is whether they should a) be allowed to edit anonymously (answer: no), and/or b) be allowed to create accounts (answer: maybe).

Another possibility is that registered users from these IPs will have to confirm their registration via e-mail, if the wiki isn't configured to do so already. It'd be nice to have this option just for this special case.

Interesting point, but you could use the same address for all the accounts, surely, and the only ones who could tell (and, e.g., block the address somehow) would be people with database access. So you could just create adjgi39qaikc(a)hotmail.com and use it for all your accounts, and no one would be the wiser. (I assume we don't enforce unique e-mail addresses, but even if we do, you could have adjgi39qaikc+1(a)gmail.com, adjgi39qaikc+2(a)gmail.com, etc., which will all be delivered to you.)

Reply

Kasimir Gabert

7:44 p.m.

For creating accounts from Tor exit nodes, you might just want to implement a CAPTCHA system and maybe a special form to fill out which would require validation from an admin for IPs that are specific to Tor. This would allow honest users that have to use Tor the ability to use your wiki, and it would keep out vandals. Kasimir On 2/20/07, Simetrical <Simetrical+wikilist(a)gmail.com> wrote:

On 2/20/07, Travis Derouin <travis(a)wikihow.com> wrote:

From my understanding, if a registered user uses an IP that has been blocked, they will also be blocked, correct? If a solution that works as a compromise is to ban just the anonymous edits from this these IPs, while allowing registered users to edit from these IPs, some sort of changes to Mediawiki will have to be put in place to accomodate this, as far as I know.

Such changes were committed some time ago. They're definitely in 1.9, possibly in 1.8 (can't remember offhand). There's now an option to block only anonymous edits from an IP.

Additionally, this doesn't prevent a vandal from creating multiple accounts, unless there's a way to increase the blocking on the IP to the normal, usual level so that registered users from that IP are also blocked.

It's also possible to block only account creation from an IP, thanks to the same set of changes to blocking. I don't think anyone minds if Tor accounts are allowed to edit from registered accounts, the question is whether they should a) be allowed to edit anonymously (answer: no), and/or b) be allowed to create accounts (answer: maybe).

Another possibility is that registered users from these IPs will have to confirm their registration via e-mail, if the wiki isn't configured to do so already. It'd be nice to have this option just for this special case.

Interesting point, but you could use the same address for all the accounts, surely, and the only ones who could tell (and, e.g., block the address somehow) would be people with database access. So you could just create adjgi39qaikc(a)hotmail.com and use it for all your accounts, and no one would be the wiser. (I assume we don't enforce unique e-mail addresses, but even if we do, you could have adjgi39qaikc+1(a)gmail.com, adjgi39qaikc+2(a)gmail.com, etc., which will all be delivered to you.) _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/wikitech-l

-- Kasimir Gabert

Reply

Matthew Flaschen

21 Feb 21 Feb

3:49 a.m.

Simetrical wrote:

On 2/20/07, Travis Derouin <travis(a)wikihow.com> wrote:

From my understanding, if a registered user uses an IP that has been blocked, they will also be blocked, correct? If a solution that works as a compromise is to ban just the anonymous edits from this these IPs, while allowing registered users to edit from these IPs, some sort of changes to Mediawiki will have to be put in place to accomodate this, as far as I know.

Such changes were committed some time ago. They're definitely in 1.9, possibly in 1.8 (can't remember offhand). There's now an option to block only anonymous edits from an IP.

Additionally, this doesn't prevent a vandal from creating multiple accounts, unless there's a way to increase the blocking on the IP to the normal, usual level so that registered users from that IP are also blocked.

It's also possible to block only account creation from an IP, thanks to the same set of changes to blocking. I don't think anyone minds if Tor accounts are allowed to edit from registered accounts, the question is whether they should a) be allowed to edit anonymously (answer: no), and/or b) be allowed to create accounts (answer: maybe).

Another possibility is that registered users from these IPs will have to confirm their registration via e-mail, if the wiki isn't configured to do so already. It'd be nice to have this option just for this special case.

Interesting point, but you could use the same address for all the accounts, surely, and the only ones who could tell (and, e.g., block the address somehow) would be people with database access. So you could just create adjgi39qaikc(a)hotmail.com and use it for all your accounts, and no one would be the wiser. (I assume we don't enforce unique e-mail addresses, but even if we do, you could have adjgi39qaikc+1(a)gmail.com, adjgi39qaikc+2(a)gmail.com, etc., which will all be delivered to you.)'

Really? Does that work for all domains?... Matthew Flaschen

Reply

Simetrical

11:15 a.m.

On 2/21/07, Matthew Flaschen <matthew.flaschen(a)gatech.edu> wrote:

Simetrical wrote:

(I assume we don't enforce unique e-mail addresses, but even if we do, you could have adjgi39qaikc+1(a)gmail.com, adjgi39qaikc+2(a)gmail.com, etc., which will all be delivered to you.)'

Really? Does that work for all domains?...

Not really on-topic, but no. Gmail is probably the best known, but some other hosts have similar schemes. See: <http://www.google.com/search?hl=en&safe=off&q=plus+addressing&btnG=Search>

Reply

Platonides

11:53 a.m.

And they could use throwable addresses, too...

Reply

6321

days inactive

6323

days old

wikitech-l@lists.wikimedia.org

Manage subscription

18 comments

10 participants

tags (0)

participants (10)

Andrew Garrett
Brion Vibber
David Gerard
Gregory Maxwell
Kasimir Gabert
Mark E
Matthew Flaschen
Platonides
Simetrical
Travis Derouin