[tor-dev] What's the explanation for weekly cycles in user graphs?

[Philipp Winter]

On Tue, Mar 17, 2015 at 06:09:00PM -0700, David Fifield wrote:
> You can eyeball more examples in the omni-graph:
> https://people.torproject.org/~dcf/graphs/relays-all.pdf

That's a really useful overview!  It would be great if we could include
that on the metrics page.

> Is there a usual story we tell to explain what's happening? A few
> hypotheses:
>  * People use Tor at work to get their job done (work firewall blocks
>    sites they need).
>  * People use Tor at work to goof off.
>  * People are relaxing and partying on the weekends, not sitting in
>    front of a computer.
>  * People don't have good Internet at home, so they use it more at work
>    (and Tor use just correlates with Internet use).

It looks like many of these patterns started emerging after the big
botnet spike.  It might be caused by infected office computers whose
owners don't know that Tor is running and who tend to turn off their
computers over the weekend.  There are probably also infected home
computers that tend to be used only over the weekend.  That wouldn't
explain the meek-specific pattern, though, because the botnet only used
vanilla Tor as far as I know.

Apparently several countries such as Ethiopia and Uzbekistan had these
weekly patterns for a long time, even before the botnet.  These
countries have a rather small user base and the few users might only use
Tor in an office setting, like you said.

Cheers,
Philipp