[tor-project] Launching Ethics Guidelines

[Matthew Finkel]

On Fri, May 13, 2016 at 04:02:12AM +0800, Virgil Griffith wrote:
> There was and does not exist any document or policy for what
> constitutes something worth checking-in about, or even whom to
> check-in with.  Moreover, my previous impromptu check-in place,
> tor-assistants@, no longer exists.

tor-project at lists.torproject.org is a good place for this now. Alternatively,
the community council may help. It is true there is not a public policy for
this, but hopefully it will exist soon.

> However, if the communtiy is
> simply asking to say aprised of any monetization/sustainability
> changes, sure.  Can do.  Just give me someone to do this with and they
> will be well-informed.  I'll start a blog.

Not exactly. Monetization is an interesting topic but is quite different
from the topic of selling information about users. Not only that, but these
are potentially Tor users who could use Tor Browser instead if you taught
them about it instead of proxying their requests. The situation has changed
over the last 8 years, and using Tor Browser is now significantly easier and
faster than it was previously. These are not good excuses anymore.

> 
> On the topic of monetization, there remains the unexplored strategy of
> doing top-up metering akin to SatoshiPay.io .  The technology hasn't
> been attempted at this scale, but it would resolve the ad-network
> problem.  So yes lets put that on front-and-center for onion.link
> development and see how that goes before being forced to choose ads.
> 
> Okay good.  Yes, this is a step forward.

Unfortunately, no. We disapprove of how you are operating onion.link and
onion.city. Logging client connections is not something the Tor community
should accept, and the Tor Project certainly does not support it. As
Andrew said in 2008 [0]:

  Be aware that if tor2web logs IP addresses, they have yours; I don't believe
  they do log, however. I wonder if Google, Yahoo, and others will crawl
  tor2web and start indexing the content.

As far as we know, the other Tor2Web sites do not log client connections.
Compromising on storing and selling user data so you can obtain some money for
operating the website goes against users' and our expectations of Tor2web, and
Tor's brand. Shutting down your Tor2web sites is the responsible decision if
you can't find another way for funding it. You violated a fundamental, but
unwritten, rule of the Tor community. There are consequences for this.

[0] https://blog.torproject.org/blog/quick-thoughts-tor2web