[tor-relays] T-shirts and Confirming Relay Control

[Matthew Finkel]

On Mon, May 04, 2015 at 12:46:01AM +0200, Markus Hitter wrote:
> Am 03.05.2015 um 22:49 schrieb Matthew Finkel:
> > This requires that
> > operators trust us, so letting anyone help take care of these requests
> > is not wise.
> 
> Maybe I'm unique with this opinion, but usually I trust groups open to helping hands more than those who consider them selfs to be wiser than the average.
> 

I don't think what I said contradicts this. You are certainly not alone
with that opinion and we, the thousands of people in the Tor community,
make Tor what it is. There is a smaller subset of the community which
handles some personal information, and, as it turns out, most people
prefer only revealing their information to a few people instead of
thousands. Hopefully we will move toward an automated system for these
t-shirts, so that the only people in the trusted-set are those who pay
for the t-shirts, in this case. But, in general, when dealing with
finances and PII, there's certain information that should remain
private. That being said, we want more people to help us. Please, come
work on some of Tor's projects. We want more review, more input, more
feedback. I was not saying we were wise because we aren't 100% public
and transparent with what we do. I was saying revealing the personal
information about operators to random, unvetted volunteers was not
wise - I hope this makes sense.

> > We're a group of security and privacy conscious individuals who want
> > a world where everyone has secure and private communications, this isn't
> > exactly a good combination which leads to publically discussioning
> > everything.
> 
> Sounds almost like the advertising from companies which try to sell their closed source software as the most secure thing since the invention of sliced bread.

Heh. Good thing that wasn't an advertisement and Tor is not a company
selling closed-source software :)

> 
> Of course it's not a good idea to publish the addresses of the t-shirt receivers, neither to email them randomly around the globe, but printing a hundred stickers and placing them on as many bags also isn't something which keeps a group of people busy for months.

Absolutely, but what's the cost? Our current solution using Printfection
is neither ideal nor cheap, but it is convenient. Tor pays Printfection
a bunch of money and Printfection creates the t-shirts, gives us
one-time links, and takes care of the shipping and handling. If we crowd
sourced creating bags with stickers in them we would need someone who
can organize all the volunteers, ship the bags and stickers around the
world, pay the return shipping for the filled bags, and then ship them
again to the relay operators. That seems like it will become expensive.
I would love to find a better solution than Printfection, so if anyone
has suggestions we'd love to hear about it.

- Matt