[tor-talk] General questions about Tor proxy

[Roger Dingledine]

On Sun, May 18, 2014 at 12:34:37AM +0400, Akater wrote:
> So, supposedly, Tor community wants Tor spreaded, at least in the
> relays direction.

Yep. But increasingly, it's becoming clear that a relay that can do
100mbit is more than 10 times more valuable than a relay that can do
10mbit. Plus the 100mbit relay is way less than 10 times the price of
the 10mbit relay.

So from a capacity and performance perspective, we really want to cut
out all the low and medium speed relays (say, the ones under 10mbit):
https://trac.torproject.org/projects/tor/ticket/1854

And your intuition might be (mine was) that removing those small relays
really harms diversity (and thus anonymity), but actually, Tor's load
balancing and path selection means those relays are very rarely chosen
anyway, so they don't contribute much to the anonymity the Tor network
can provide.

But from a community perspective, that's a crummy way to run a project.
So we haven't moved forward with that plan -- but it makes me unexcited
to work on a plan to get many new small relays.

> (I believe the proper goal would be rather to
> encourage common people to run exit nodes from home but that seems to
> be to extremist an idea for the community.)

First, most home connections are quite poor indeed, especially if you
need symmetric bandwidth levels.

But the reason running exits at home is now considered extremist
is because every so often some jerk will do something through
the exit relay that attracts some law enforcement group, and
while we're making great progress at teaching some organizations
(like FBI) about why and how to check if the door they're about
to kick down is a Tor relay (bad for us, but also bad for them,
since it's a waste of time that could have been spent elsewhere:
https://blog.torproject.org/blog/trip-report-october-fbi-conference ),
it seems like there's always another law enforcement agency somewhere
in the world that claims jurisdiction but has no idea how the Internet
works.

And when they kick down the door, they don't know what to take, so they
take everything electronic. And then they don't have the specialists
to examine the stuff they took, so it sits on a shelf for six months.

All it takes is a few stories of ordinary people who've had their spouse
surprised at 6am to make it seem like it happens to every relay operator
every time. But that said: how many such stories are too many? It's
really crummy when it happens to even one person who didn't expect it.

> Anyway, growth is the goal because the very idea is basically ???hiding
> in the crowd???. That means getting more users. The basic (the only?) way
> to communicate with newcomers is through mailing lists, it appears.
> Well, yes, I personally find it very alarming. I monitor some
> communities whose products I'd love to see getting the popularity they
> deserve (Tor, PGP, XMPP, GNU in general being some.) Let's call them
> G-communities. (GNU captures a lot of the spirit, and it may also stand
> for Geeks.)

Are you arguing for forums? So far we've avoided having Tor forums
because most competent people will ignore them, leaving users to fend
for themselves among other users, which isn't really a great outcome.

The tor.stackexchange.com experiment is a step in the right direction
I think.

But to be clear, I should point out that your questions in your original
mail are all "expert" questions. If you want to use some application
with Tor that isn't Tor Browser, somebody needs to audit it to see if
it will work as you want. Very little auditing has been done so far,
and it's not really the sort of thing normal users should (can) do.

> G-communities look rather hostile. They are not aggressive, of course,
> since it's all words and talking, but hostile and unfriendly they often
> are. Which is weird: you answer, for example, is better than anything
> I'd ever expected to get from a convenient support service.

Did you try Tor's support service?
https://www.torproject.org/about/contact

I think part of our challenge is that we have too *many* communities and
ways to interact with us -- there's the blog, the mailing lists, irc,
stackexchange, conferences, talking to journalists with traditional
phones, etc. Few people know about all of these avenues, but worse,
once somebody has found one they assume it's the only one.

> I wonder if Tor (the company, or the community) even has a PR
> department. Just some people who work, as volunteers, or not, on
> promoting all the products and (which is also important) ideas behind
> them?

Actually yes. Whether we're doing everything the right way is a separate
question, but there are in fact people who work on teaching broader
communities about Tor. You might like these two links to start:
https://www.torproject.org/press/press
https://www.torproject.org/docs/documentation#UpToSpeed

> The public image is *awful:* it's ???evil??? at worst, and ???extremely
> complex??? at best. I wonder how many people think it's just nothing but
> a tool for direct violators of rights. It's the same with all
> G-communities.

Funny story, speaking of the law enforcement agency discussion above:
I was talking to an FBI agent recently who uses Tor for his job and
is a huge fan, and he pointed out that we have a PR problem, and his
suggestion was that we redirect 20 of our employees ("not too many,
but a few") to do PR for a while. He was stunned to learn that 20 is
more employees than we have in total -- he thought surely Tor is a 120
person company, what with all the great things we do and have done.

Tor has a special challenge in that we want to reach many different
user communities -- activists, ordinary people, companies, journalists,
law enforcement, and everyone in between -- and everybody thinks that
whatever they just learned about Tor is what everybody else learned too.

For more details you might like (or dislike) our 30c3 talk:
http://media.ccc.de/browse/congress/2013/30C3_-_5423_-_en_-_saal_1_-_201312272030_-_the_tor_network_-_jacob_-_arma.html

> You suggested (or I jumped to a conclusion) that geeks just search for
> zone of comfort, and that explains it. Well, it may be so but the fact
> is: it doesn't help to grow network(s), like, /at all/. Geeks are
> reasonable people first, but this behavior is irrational, childish and,
> honestly, strikingly contrasting with their intelligence. How do they
> think users will jump in if they use outdated media as a primary
> communication channel? I had even seen someone here discouraging to
> contribute to tor.stackexchange.com , on some irrational basis
> (stackexchange beng for-profit, or something). StackExchange is one of
> the best things happen to Internet (maybe also the only community in
> the Internet where karma actually works) and also extremely helpful.
> And free to enter, by the way, unlike quora.  Mailing lists are bad for
> a multitude of reasons.

Please help make tor.stackexchange.com succeed.

> Having barriers for entry is generally OK. But I recently came to a
> hypothesis that G-communities built the way they are for a simpler
> reason: this process replicates the building of one particular
> community lots of geeks observed forming in their lives: the school
> community where bullies rule. For some of geeks, I speculate, this
> could actually be the /only/ example. Only now they have a chance to do
> it themselves in their own universe, or universes. They probably could
> do better but, in case bullies' gangs were the only live examples ever,
> a geek may had concluded, due to poor state of education in this
> domain, that no other way exist.

Wow. I think that qualifies as enough off-topic that I'm going to
skip over it. But I encourage you to meet Tor people in person rather
than extrapolating from these assumptions.

> But my main point is: there's nothing good about barriers, because it
> prevents network from growing ??? which in the long run sinks the whole
> thing (when lots of nodes go under control of a single entity, for
> example). If you want to hide in the crowd you have to do at least some
> interaction with the crowd. If you hate it so much, hire professionals,
> or find volunteers, or students who might be interested in pratice. If
> this part of work gets done too, who is involved? Do they post here?

They do -- see the above links for example. But it's certainly not only
on the mailing lists. You might also like the Tor Weekly News posts. But
most of all, we sure can't teach the whole world about security while
also making good software, so we need you all to step up and help.

--Roger