[or-cvs] r10232: Eased up geoip-configuration by introducing a GeoIPConfig-cl (torflow/trunk/TorCtl)

[Johannes Renner]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Roger Dingledine wrote:
> More generally, is there a write-up somewhere of what properties we're
> aiming to provide, or know we don't provide, etc with respect to this
> geolocation stuff?

No, the first things I implemented were the two security options that are
included in OnionCoffee and based on geoip, that are:

1. Exclude a list of countries, if there are any legal problems
2. Use countries in a unique style to include as many different
   jurisdictions in a single path as possible

The other ideas are from torflow's todo-list.

> Which leads to the question of what we're actually trying to accomplish
> with the UniqueCountryRestriction idea.

As I wrote, the original purpose of this restriction, as it was included in
OnionCoffee as a security configuration option, was simply to include as many
different jurisdictions as possible in one path. This exception was actually
not intended to be comitted, since this of course is not the consistent way
(I will remove it on the next commit).

I included it when I was testing the restriction in conjunction with the
ContinentRestriction (with 1 continent-hop at max) and the src-country
option: When choosing the first hop in my src-country, which is Germany and
second hop randomly was in the US, the third hop had to be in North-America,
but _not_ in the US. So PathBuilder bravely was finding routers for me in
Canada and Mexico, but I thought "Hey, it's ok for me, the US is so big
and there are so many of the routers in the US, give me just one on the
east coast and one on the westcoast...", but if you are sitting in the US
you could then easily end up with US-US-US, which should maybe be avoided?

Anybody any ideas what else to do with geolocation-info?

Greetings,
Johannes
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGUc2S1TFW0/n+aNgRApwrAJ9coP2v8HF+HHhrBoK+PbE7BFGcYwCeMGmp
g8jB5E3nocvAVReEHDqK+WU=
=fOh8
-----END PGP SIGNATURE-----