[tor-dev] Why the seeming anticorrelation between obfs3 and vanilla bridges in metrics graphs?

[David Fifield]

On Sun, Oct 26, 2014 at 09:08:49AM +0100, Karsten Loesing wrote:
> On 23/10/14 19:32, David Fifield wrote:
> > In the past few months of bridge user graphs, there is an apparent
> > negative correlation between obfs3 users and vanilla users: when one
> > goes up, the other goes down. If you draw a horizontal line at about
> > 5500, they are almost mirror images of each other. I don't see it with
> > any other transport pairs. Any idea why it might be?
> 
> I briefly looked at the raw data behind this graph, but didn't find any
> obvious problems with the algorithm.  I'm running out of time now, but I
> can share some preliminary results in case you want to dig deeper:
> 
>  - https://people.torproject.org/~karsten/volatile/bridge-users-obfs3-or-mean.png
> is the graph that you posted with a third line for mean values.
> 
>  - https://people.torproject.org/~karsten/volatile/bridge-responses.csv.xz
> contains numbers of responses (for requested consensuses) by bridge,
> transport, and time interval.

I don't understand this file. Is it the number of times a bridge
answered a directory request? The number of times a bridge appeared in a
consensus? The number of times it was given out by BridgeDB?

>  - https://people.torproject.org/~karsten/volatile/bridge-responses-by-transport.pdf
> shows responses by transport.
> 
>  - https://people.torproject.org/~karsten/volatile/bridge-responses-over-time.pdf
> shows only <OR> and obfs3 responses over time.
> 
>  - https://people.torproject.org/~karsten/volatile/bridge-responses-or-by-fingerprint.pdf
> shows only <OR> responses higher than 1000 by fingerprint.

I had trouble opening these in Evince, so I'm attaching PNGs I generated
with
	convert -density 150 x.pdf x.png

>  - https://onionoo.torproject.org/details?fingerprint=231E2DE81DC4314F2035D2C0D0D043A425FF8999
> is the bridge reporting those high numbers for <OR> responses.  Is
> PacificSunset maybe one of the bundled bridges?

It is indeed:
pref("extensions.torlauncher.default_bridge.obfs3.5", "obfs3 208.79.90.242:35658 BA61757846841D64A83EA2514C766CB92F1FB41F");

I don't understand your line of reasoning in singling it out, though.
What do high numbers for <OR> responses suggest to you?

David
-------------- next part --------------
A non-text attachment was scrubbed...
Name: bridge-responses-by-transport.png
Type: image/png
Size: 32879 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20141031/4c3650f3/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: bridge-responses-or-by-fingerprint.png
Type: image/png
Size: 69273 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20141031/4c3650f3/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: bridge-responses-over-time.png
Type: image/png
Size: 78083 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20141031/4c3650f3/attachment-0005.png>