Hi,
I've configured proxy_check and wgBlockOpenProxies, which seems to be working, but am still able to edit our wiki anonymously using Tor. Is there anyway to tighten this up? It seems the majority of edits coming from Tor proxies are from vandals.
Thanks, Travis
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Travis Derouin wrote:
I've configured proxy_check and wgBlockOpenProxies, which seems to be working, but am still able to edit our wiki anonymously using Tor. Is there anyway to tighten this up? It seems the majority of edits coming from Tor proxies are from vandals.
There's no system built-in to MediaWiki for detecting Tor nodes (they are not open HTTP proxies, so a search for them would not work even if the old proxy-blocking code still works, which I don't know if it does).
You'd have to rig up a system for detecting Tor nodes, and/or use a list of open Tor nodes.
- -- brion vibber (brion @ pobox.com / brion @ wikimedia.org)
Brion Vibber wrote:
There's no system built-in to MediaWiki for detecting Tor nodes (they are not open HTTP proxies, so a search for them would not work even if the old proxy-blocking code still works, which I don't know if it does).
You'd have to rig up a system for detecting Tor nodes, and/or use a list of open Tor nodes.
This said, an extension for this has long been on my to-do list. I might look into it at some stage.
Andrew Garrett (werdna)
Travis Derouin wrote:
Hi,
I've configured proxy_check and wgBlockOpenProxies, which seems to be working, but am still able to edit our wiki anonymously using Tor. Is there anyway to tighten this up? It seems the majority of edits coming from Tor proxies are from vandals.
Thanks, Travis
There is a list of Tor exit nodes. Block them all :P
On 2/19/07, Platonides Platonides@gmail.com wrote:
Travis Derouin wrote:
Hi,
I've configured proxy_check and wgBlockOpenProxies, which seems to be working, but am still able to edit our wiki anonymously using Tor. Is there anyway to tighten this up? It seems the majority of edits coming from Tor proxies are from vandals.
Thanks, Travis
There is a list of Tor exit nodes. Block them all :P
They change constantly.. and many people screw up doing this and manage to block tor middle nodes. So take the time to actually understand what you are doing. Ideally you would only block tor exits which could be used to access your site.
(I was blocked on several wikimedia projects in the past due to such sloppy blocking)
On 19 Feb 2007 at 23:28, Platonides wrote:
Travis Derouin wrote:
Hi,
I've configured proxy_check and wgBlockOpenProxies, which seems to be working, but am still able to edit our wiki anonymously using Tor. Is there anyway to tighten this up? It seems the majority of edits coming from Tor proxies are from vandals.
Thanks, Travis
There is a list of Tor exit nodes. Block them all :P
That's bad practice in my opinion. Such nodes could also be border points for universites or large businesses or ISPs. Plus exit points change like the hours on a clock - people drop in and drop off the network on a whim, and many using dymanic DNS. So blocking Tor nodes is very iffy, and could wind up blocking a bunch of legitimate contributors.
Mark
Hello,
I would highly recommend requiring Tor users to sign up for an account, and just block edits from Tor exit nodes. Many home users run Tor servers to donate some of their bandwidth, and it would damage your website if you permanently blocked all IPs from exit nodes. You might also want to run a cron job that updates the list of blocked IPs, being sure to remove ones which are no longer exit nodes and add in new ones.
Kasimir
On 2/19/07, Mark E mark@edwards.org wrote:
On 19 Feb 2007 at 23:28, Platonides wrote:
Travis Derouin wrote:
Hi,
I've configured proxy_check and wgBlockOpenProxies, which seems to be working, but am still able to edit our wiki anonymously using Tor. Is there anyway to tighten this up? It seems the majority of edits coming from Tor proxies are from vandals.
Thanks, Travis
There is a list of Tor exit nodes. Block them all :P
That's bad practice in my opinion. Such nodes could also be border points for universites or large businesses or ISPs. Plus exit points change like the hours on a clock - people drop in and drop off the network on a whim, and many using dymanic DNS. So blocking Tor nodes is very iffy, and could wind up blocking a bunch of legitimate contributors.
Mark
Wikitech-l mailing list Wikitech-l@lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/wikitech-l
On 2/19/07, Mark E mark@edwards.org wrote:
That's bad practice in my opinion. Such nodes could also be border points for universites or large businesses or ISPs. Plus exit points change like the hours on a clock - people drop in and drop off the network on a whim, and many using dymanic DNS. So blocking Tor nodes is very iffy, and could wind up blocking a bunch of legitimate contributors.
I think you're somewhat overstating how frequently the exit node list changes. Nodes may change regularly, but there are a lot of IPs that have been steady Tor exit nodes for a long time, no?
In any case, it should be noted that it's Foundation policy to block all open proxies, including Tor exit nodes. The harm outweighs the benefit when it comes to trying to stop vandalism.
On 19 Feb 2007 at 19:52, Simetrical wrote:
On 2/19/07, Mark E mark@edwards.org wrote:
That's bad practice in my opinion. Such nodes could also be border points for universites or large businesses or ISPs. Plus exit points change like the hours on a clock - people drop in and drop off the network on a whim, and many using dymanic DNS. So blocking Tor nodes is very iffy, and could wind up blocking a bunch of legitimate contributors.
I think you're somewhat overstating how frequently the exit node list changes. Nodes may change regularly, but there are a lot of IPs that have been steady Tor exit nodes for a long time, no?
In any case, it should be noted that it's Foundation policy to block all open proxies, including Tor exit nodes. The harm outweighs the benefit when it comes to trying to stop vandalism.
I see. Block Tor exit nodes. Translated: "Punish 10's of thousands of college students, business users, and ISP customers, because of the actions of one or two people." Uh, ya.
Blocking open proxies is one thing. No wonder one of the settings in the Tor client was called "Fascist Firewall" -- if you catch my drift.
Mark
Currently Wikipedia blocks all anonymous edits from Tor exit nodes. This is not harmful to real users but protects from vandalism. You should do the same, instead of blocking *everything* from tor exit nodes. (Allow account creation, allow edits from accounts).
I agree with Mark, however, on the subject of flat out blocking all exit nodes. Tor is used for legitimate use in many cases above illegal use. A few examples... people behind restrictive firewalls (such as China and soldiers in Iraq) can access Wikipedia through Tor without anything being filtered. I would not block all Tor users.
Kasimir
On 2/19/07, Mark E mark@edwards.org wrote:
On 19 Feb 2007 at 19:52, Simetrical wrote:
On 2/19/07, Mark E mark@edwards.org wrote:
That's bad practice in my opinion. Such nodes could also be border points for universites or large businesses or ISPs. Plus exit points change like the hours on a clock - people drop in and drop off the network on a whim, and many using dymanic DNS. So blocking Tor nodes is very iffy, and could wind up blocking a bunch of legitimate contributors.
I think you're somewhat overstating how frequently the exit node list changes. Nodes may change regularly, but there are a lot of IPs that have been steady Tor exit nodes for a long time, no?
In any case, it should be noted that it's Foundation policy to block all open proxies, including Tor exit nodes. The harm outweighs the benefit when it comes to trying to stop vandalism.
I see. Block Tor exit nodes. Translated: "Punish 10's of thousands of college students, business users, and ISP customers, because of the actions of one or two people." Uh, ya.
Blocking open proxies is one thing. No wonder one of the settings in the Tor client was called "Fascist Firewall" -- if you catch my drift.
Mark
Wikitech-l mailing list Wikitech-l@lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/wikitech-l
On 2/19/07, Mark E mark@edwards.org wrote:
I see. Block Tor exit nodes. Translated: "Punish 10's of thousands of college students, business users, and ISP customers, because of the actions of one or two people." Uh, ya.
Are there tens of thousands of college students, business users, and ISP customers who are forced to use Tor? I'm not aware that college campuses tend to make all their machines Tor exit nodes as a matter of course. Chinese users, now, there you may have a case for permitting edits from accounts, but I don't think anyone suggested banning edits from accounts.
On 2/19/07, Kasimir Gabert kasimir.g@gmail.com wrote:
Currently Wikipedia blocks all anonymous edits from Tor exit nodes. This is not harmful to real users but protects from vandalism. You should do the same, instead of blocking *everything* from tor exit nodes. (Allow account creation, allow edits from accounts).
That may make sense, yes. Or allow edits from accounts but not account creation, perhaps, so that users from China or whatnot will have to go to a one-time effort of getting someone to create an account for them (if you have to ask an admin, it's going to be rather difficult to pile up dozens of sleeper accounts). But that might be too harsh, depending on the wiki.
On 2/19/07, Mark E mark@edwards.org wrote: [snip]
college students, business users, and ISP customers, because of the actions of one or two people." Uh, ya.
[snip]
A nit, it's not the minor actions of one or two people.. if we don't block tor exist all the technically competent high-speed vandals will just use tor. Because these vandals operate at fairly high speed playing whack-a-mole after they've acted just isn't effective. (especially with tor because it's quite possible to make every edit come from a different exit)
I'm a tor user, I run a fairly high traffic non-exit tor node, I've advocated that we do things to avoid harming tor users and folks who happen to share an IP with a tor exit.... but the claim that blocking tor exits isn't important to English Wikipedia (if not all the wikimedia wikis) is false.
On 20/02/07, Mark E mark@edwards.org wrote:
I see. Block Tor exit nodes. Translated: "Punish 10's of thousands of college students, business users, and ISP customers, because of the actions of one or two people." Uh, ya. Blocking open proxies is one thing. No wonder one of the settings in the Tor client was called "Fascist Firewall" -- if you catch my drift.
The reason they're blocked is the practical problem: despite theoretically being sources of valuable content, in practice they're a firehose of sewage.
Even Freenode blocked all Tor users for quite a while.
<Tony_Sidaway> "WHY DO YOU HATE FREEDOM?" nearly always translates to "WHY DO YOU HATE PEOPLE COMING AND SPRAYING PISS ALL OVER YOUR LIVING ROOM?"
- d.
FWIW, I did some data gathering. From this list of Tor IPs:
I found that there were only 84 edits on our wiki coming from these IPs. Most of these edits were vandal edits:
Ex:
http://www.wikihow.com/index.php?title=Special:Contributions&target=149.... http://www.wikihow.com/index.php?title=Special:Contributions&target=149....
I can appreciate both sides of the argument in this situation, but it does remain an issue that Tor users are able to change IP addresses easily and remain anonymous. For smaller wikis, like ourselves, this can be really problematic if we encounter a motivated vandal.
From my understanding, if a registered user uses an IP that has been
blocked, they will also be blocked, correct? If a solution that works as a compromise is to ban just the anonymous edits from this these IPs, while allowing registered users to edit from these IPs, some sort of changes to Mediawiki will have to be put in place to accomodate this, as far as I know. Additionally, this doesn't prevent a vandal from creating multiple accounts, unless there's a way to increase the blocking on the IP to the normal, usual level so that registered users from that IP are also blocked.
Another possibility is that registered users from these IPs will have to confirm their registration via e-mail, if the wiki isn't configured to do so already. It'd be nice to have this option just for this special case.
Travis
On 2/20/07, Travis Derouin travis@wikihow.com wrote:
From my understanding, if a registered user uses an IP that has been blocked, they will also be blocked, correct? If a solution that works as a compromise is to ban just the anonymous edits from this these IPs, while allowing registered users to edit from these IPs, some sort of changes to Mediawiki will have to be put in place to accomodate this, as far as I know.
Such changes were committed some time ago. They're definitely in 1.9, possibly in 1.8 (can't remember offhand). There's now an option to block only anonymous edits from an IP.
Additionally, this doesn't prevent a vandal from creating multiple accounts, unless there's a way to increase the blocking on the IP to the normal, usual level so that registered users from that IP are also blocked.
It's also possible to block only account creation from an IP, thanks to the same set of changes to blocking. I don't think anyone minds if Tor accounts are allowed to edit from registered accounts, the question is whether they should a) be allowed to edit anonymously (answer: no), and/or b) be allowed to create accounts (answer: maybe).
Another possibility is that registered users from these IPs will have to confirm their registration via e-mail, if the wiki isn't configured to do so already. It'd be nice to have this option just for this special case.
Interesting point, but you could use the same address for all the accounts, surely, and the only ones who could tell (and, e.g., block the address somehow) would be people with database access. So you could just create adjgi39qaikc@hotmail.com and use it for all your accounts, and no one would be the wiser. (I assume we don't enforce unique e-mail addresses, but even if we do, you could have adjgi39qaikc+1@gmail.com, adjgi39qaikc+2@gmail.com, etc., which will all be delivered to you.)
For creating accounts from Tor exit nodes, you might just want to implement a CAPTCHA system and maybe a special form to fill out which would require validation from an admin for IPs that are specific to Tor. This would allow honest users that have to use Tor the ability to use your wiki, and it would keep out vandals.
Kasimir
On 2/20/07, Simetrical Simetrical+wikilist@gmail.com wrote:
On 2/20/07, Travis Derouin travis@wikihow.com wrote:
From my understanding, if a registered user uses an IP that has been blocked, they will also be blocked, correct? If a solution that works as a compromise is to ban just the anonymous edits from this these IPs, while allowing registered users to edit from these IPs, some sort of changes to Mediawiki will have to be put in place to accomodate this, as far as I know.
Such changes were committed some time ago. They're definitely in 1.9, possibly in 1.8 (can't remember offhand). There's now an option to block only anonymous edits from an IP.
Additionally, this doesn't prevent a vandal from creating multiple accounts, unless there's a way to increase the blocking on the IP to the normal, usual level so that registered users from that IP are also blocked.
It's also possible to block only account creation from an IP, thanks to the same set of changes to blocking. I don't think anyone minds if Tor accounts are allowed to edit from registered accounts, the question is whether they should a) be allowed to edit anonymously (answer: no), and/or b) be allowed to create accounts (answer: maybe).
Another possibility is that registered users from these IPs will have to confirm their registration via e-mail, if the wiki isn't configured to do so already. It'd be nice to have this option just for this special case.
Interesting point, but you could use the same address for all the accounts, surely, and the only ones who could tell (and, e.g., block the address somehow) would be people with database access. So you could just create adjgi39qaikc@hotmail.com and use it for all your accounts, and no one would be the wiser. (I assume we don't enforce unique e-mail addresses, but even if we do, you could have adjgi39qaikc+1@gmail.com, adjgi39qaikc+2@gmail.com, etc., which will all be delivered to you.)
Wikitech-l mailing list Wikitech-l@lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/wikitech-l
Simetrical wrote:
On 2/20/07, Travis Derouin travis@wikihow.com wrote:
From my understanding, if a registered user uses an IP that has been blocked, they will also be blocked, correct? If a solution that works as a compromise is to ban just the anonymous edits from this these IPs, while allowing registered users to edit from these IPs, some sort of changes to Mediawiki will have to be put in place to accomodate this, as far as I know.
Such changes were committed some time ago. They're definitely in 1.9, possibly in 1.8 (can't remember offhand). There's now an option to block only anonymous edits from an IP.
Additionally, this doesn't prevent a vandal from creating multiple accounts, unless there's a way to increase the blocking on the IP to the normal, usual level so that registered users from that IP are also blocked.
It's also possible to block only account creation from an IP, thanks to the same set of changes to blocking. I don't think anyone minds if Tor accounts are allowed to edit from registered accounts, the question is whether they should a) be allowed to edit anonymously (answer: no), and/or b) be allowed to create accounts (answer: maybe).
Another possibility is that registered users from these IPs will have to confirm their registration via e-mail, if the wiki isn't configured to do so already. It'd be nice to have this option just for this special case.
Interesting point, but you could use the same address for all the accounts, surely, and the only ones who could tell (and, e.g., block the address somehow) would be people with database access. So you could just create adjgi39qaikc@hotmail.com and use it for all your accounts, and no one would be the wiser. (I assume we don't enforce unique e-mail addresses, but even if we do, you could have adjgi39qaikc+1@gmail.com, adjgi39qaikc+2@gmail.com, etc., which will all be delivered to you.)'
Really? Does that work for all domains?...
Matthew Flaschen
On 2/21/07, Matthew Flaschen matthew.flaschen@gatech.edu wrote:
Simetrical wrote:
(I assume we don't enforce unique e-mail addresses, but even if we do, you could have adjgi39qaikc+1@gmail.com, adjgi39qaikc+2@gmail.com, etc., which will all be delivered to you.)'
Really? Does that work for all domains?...
Not really on-topic, but no. Gmail is probably the best known, but some other hosts have similar schemes. See: http://www.google.com/search?hl=en&safe=off&q=plus+addressing&btnG=Search
wikitech-l@lists.wikimedia.org