[Forum] Unable to access talk.maemo.org using Tor
 

Hi, I would like to use the talk.maemo.org site while I am connected to the Tor Network. However, I alsways get the following error message:

Even some apps discussed in t.m.o are made for using tor. Please allow these kind of traffic as well.

Thanks jukey

Re: [Forum] Unable to access talk.maemo.org using Tor
 

How do you suggest to solve the problem if there is some massive spammer on tor that is using the same exit node as you?

Re: [Forum] Unable to access talk.maemo.org using Tor
 

Exactly.

There was/is a massive attack against (our) forum from tor exit nodes.
So to keep it up running there was the need to blacklist those (few) bad guys/IPs.

Why the heck do you need to access a forum via tor???

Re: [Forum] Unable to access talk.maemo.org using Tor
 

1. The more people using Tor at the same time the better it helps to protect those who need.

2. I would like to hide my location and browsing habits.

3. I would like to have a weapon against Telecommunications data retention.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

While I sort of understand the reasoning for not allowing access from tor exit nodes, I have to agree with Jukey.
My God to honest opnion - blocking tor exit nodes is a violation of our privacy rights on this forum, and completely the oposite as supporting SFOS and opensource.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

So... What do we do when folks using TOR exit nodes perform a successful DOS attack on this forum?

Re: [Forum] Unable to access talk.maemo.org using Tor
 

By not allowing posts from new accounts for a time period
By not allowing multiple posts within XX minutes
By observing nicks of spammers and removing them (This can somewhat be scripted btw)

Anyways, that is not an excuse for blocking tor services at all.
We have also seen massive spams from certain countries, why are those countries not entirely blocked ? I will answer that myself. We dont want to harm friendly users from those counties.
Why do we want to harm friendly tor users then?

edit: aboy (D)DoS: https://www.torproject.org/docs/faq-abuse.html.en#DDoS

Re: [Forum] Unable to access talk.maemo.org using Tor
 

I'm just basically saying that I see no reason to give TOR exit points additional privileges over normal IP addresses. If your main defense against malicious accesses coming from a particular address is to block that address, and you decide that some addresses now cannot be blocked, well... now you've got a giant hole in your defense, right?

If a particular address is being used maliciously, it should be treated as any other address being used for malicious purposes. Treating some addresses as special would seem to defeat the purpose...

Re: [Forum] Unable to access talk.maemo.org using Tor
 

This makes no sense, sorry.

Allow me to qoute a reply from another forum, adressing the same issue.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

Cool! So, this forum is entirely infeasible to begin with. :)

I've gotta admit, I think a good 20% to 30% of the folks around me have never reached the age of 14, even though some of them are in their 60s or 70s already. There are some pretty crude adults out there today, and there really is no police force available to deal with them when they act out on the internet. (And this takes no account of the folks who "professionally" spam internet sites.)

My take is that there are more humans willing to spend their time to come and mess up an internet forum than there are humans willing to spend their time to moderate the forum. (Especially sites like TMO with relatively small numbers of participants.) As such, if you're going to try and fight all your battles hand-to-hand, the 14-year-olds are always going to win. :(

Re: [Forum] Unable to access talk.maemo.org using Tor
 

This!

Whilst I understand that IP-based defence is quick and easy, I agree with nieldk that it is not the best option. The best defence would be behavioral based. It may require more effort to set up but should be easily automated once done, with no (manual) moderating involved.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

Absolutely. There is no point in trying to fight it by blacklisting tor, that is my point (well, one of them).
As You have noticed, we have also been spammed from other sources, like China.
There is not point, we cant prevent it from happening, but we can minimize it by making it harder.
The clever spammer, or professional if you want, dont need tor, and probably is not even using it.
Any proxy will do even better.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

and...

So yeah, the problem here then is not with blacklisting TOR; it is with blacklisting. :)

I guess all I've been trying to say here is that there's no good reason to treat TOR any different than any other IP provider. Everyone should be treated equally.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

As I understand it, the primary reason for why Tor access has been blocked is to prevent spam. Whilst DDoS attacks are of course possible, I wouldn't have thought that TMO would be a likely target and even if we were targeted, anonymous proxies are only used in one fifth of DDoS attacks so blocking Tor does very little to prevent them.

A simple human verification question that everyone here can answer such as "What is the is the name of Jolla's OS?" or "Which company created Maemo?" would largely solve the spam problem and would help to prevent the spam attacks that still occur despite the current blacklist solution.

I do however think that HTTPS access to TMO should be set up first having read this earlier today.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

What if a spammer creates a bunch of sleeper accounts?
It would bypass most of your suggested checks.

Also what if you remove legit accounts?
It would be the exact same issue as blocking legit Tor users.

Depending on how possible it would be, one option would be just to allow guest access to tor users. This would allow tor users to keep their privacy and read the forums and stop spammers from being able to use Tor.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

afaik the last attack was not only spam but more like a password-steal-attack. And all of above solutions/proposals would not have helped here.
But only blacklisting those adresses where the attack came from.
And yes it is inconvenient. But (just as an analogon): would you like to enter a plane where there is no security check at all? [me for sure not]
Not that I would like Datenvorratsspeicherung nor any other in-advance-protection-by-prediction. But tthere is a price to pay for security.

--
and always remember (at least my knowledge): the more often you use tor the more likely it is you hit an 'official' exit node (run by authorities) and getting noticed...

Re: [Forum] Unable to access talk.maemo.org using Tor
 

I will repeat, I understand all the reasons behind the decision. But I still dont think it really helps using blacklisting.
As for "But tthere is a price to pay for security.". Why are we not using HTTPS all over TMO then ?

Re: [Forum] Unable to access talk.maemo.org using Tor
 

TOR has been under a sustained propaganda attack in the British media. It has been referred to as "dark net", blamed for harbouring paedophiles etc. This image is hardly going to change if even the people who should know better sign up to the same bull****.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

My point of view is: if you are using a proxy, or a Tor exit node, be prepared to it being blocked for a duration of a spam attack ongoing through same proxy (or Tor exit node). To make matters easier for Tor users, the blocking could be of read-only kind: you can read forum, but you cannot log in aka send posts or private messages through it.

Since Tor's purpose is anonymity, logging into an account while using Tor doesn't make much sense, anyway. Right?

And if anonymous users were allowed to post without logging in... How would forum be protected from spambots? Registration of an account includes many "are you human?" checks, and spammers still like to bypass them (even if they have to use actual human-time to do it). Would you still enjoy anonymous Tor access if you had to jump through half a dozen different captchas for every post?

I would run a Tor exit node. But I would have to get a 24/7 server dedicated to it, first. And research the local implications of running it (high traffic? restrictive laws? whatever).

Tor isn't blocked here "just because it's Tor". Tor is blocked for duration of spam attack using this particular Tor exit node. It doesn't make sense to whitelist Tor exit node just because many other-non-spammer people are using it, unless you find a good way to protect forum against spam-attack (which doesn't involve too-many-human-hours of work from moderators). It could make sense to implement particularly nasty captchas-before-making-a-post against this particular IP for the duration of attack from it, if it's possible.

Just my personal opinion. And yes, I would support addition of https access to TMO.

Thank you. Best wishes.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

I'm wading into the morass here too...
looks like fun :)
I concur with Wiki
In fact I go further.
I do believe in the individuals right to protect themselves.
That is something I think everyone here can agree on.
But an individual thinking they can comment anonymously.. express their views...and expect to "stay" anonymous ...and that the result of the state of technological security today is somehow the fault or responsibility of either "Powers" or "Authorities" or "Governments" or "whatever bad people/ groups" or "Maemo" or "TMO" ....and wish or demand some sort of compromise or allowance or whathaveyou...alllll because ...?
Because people wish to post from a position of anonymity in a public forum?
How does any open and accepting community embrace anonymity?
Not well ...when it boils down to it.
I think either an individual should be open and honest and simply accept the consequences for their words and actions uttered and done in the full view of the public...*
or ...don't bother saying a thing.


And please please please no one rear the specter of being "monitored" and "recorded "by your connection without safeties like tor...yet again.
Because the moment you get off your smart device or computer thinking you are so anonymous and walk outside your home...
there are countless cameras with footage of you walking down the street...there are drones everywhere now ..there are dashcams , atm's, store cameras, parking lot security cameras, cameras at street intersections, satellites in the heavens, and more..and don't forget there is everyone else walking beside you with their bloody iphone ...just hoping you'll snap from societal stresses.. so that they get to film you as the cops are hauling you away for attempting to go on a killing spree with a blunt tongue depressor and put the vid up on youtube before you are even "booked" at the station...as their "claim-to-fame" and subsequent hope to do the talk show circuit....

And if that isn't enough...All the people who have been "smart" to start using tor within the last few weeks, months, year, years, half decade...more...you don't think that the powerful governments of this planet do not have files on you and everyone else "predating" your and everyone else' new interest in security?
really?

Sooo...either man-up and speak your mind responsibly and join in community dialogue..like other people do.
or
do not engage in public discourse and remain anonymous as you wish or you truly, justifiably, and understandably need to be.
But I do believe the ability to have one's cake and eat it too is rapidly ending.



*which people are being put to task with now...
and in fact ...
now sites are going to be held responsible for the utterances of their members and their behaviour...directly.
Hell of a legal precedent was set..
I posted about the landmark decision here in the forum..

This means ...the boys at the helm of the good ship tmo have to steer this ship well or the site is held accountable...
and that means essentially no crap people...no hate mongering...or racism ...or ..well alotta the bad stuff people should know better than to speak anyway..... .
Anyway..in light of the fact sites are now legally accountable for the people in them...members, posts in their forums...etc.

I see the issue of needing a firm hand concerning tor...
in tandem with the issues of stringent moderation.
Both directly pertain to our sites safety, accountability and longevity.

I don't see it as a "desire" or a "wish" or whatever could be taken out of context from my words... that is truly not relevant .
It is what the civilization around us and their courts of law are beginning to demanding of us now.
That is what is truly relevant.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

Wiki, you have a point. There is only one teeny-weeny problem with "blocking for the duration of an attack". How do you know when the attack has finished? When do you know you can take an IP off the black list? Behaviour-based protection takes care of that automatically.

As for you, endso, sorry, your post was waaaay too long. About 3x over the acceptable limit. So, you may have a point too but I did not bother digging through the huge haystack looking for it ;)

Re: [Forum] Unable to access talk.maemo.org using Tor
 

I can see how this thing about protect one community forum could seem a fantastic world of power, decisions and choices...
And i can understand that everyone has a better solution for the world's problems while having a beer in the bar with his friends..

Here a few words to explain the points of the situation:
0 - Your are debating about a report without any relevant information (which is the ip address of the exit point? If it was reported everyone could cross check if there is a clear reason or not for the block)
1 - blacklist is not composed using human choices
2 - blacklist is composed merging more automatic malicious reporting sources
3 - there is no will to block tor exit nodes or common privacy proxies
4 - if one tor exit node has been reported in those reporting systems i think it would be a non-sense to add it in a white list giving them a different priority
4bis - if your privacy proxy has been reported for bad activity why should we take care of it if you don't care to apperar just like a spammer?
5 - blacklist could become more aggressive during an evidence of attack (like it happened some month ago) to block the subnets used by attackers since reporting systems are slow and before a new ip in the same subnet is listed there it could take 6/12 hours. Normal behavior is more relaxed
6 - often those attacks activity is not limited in posting and create new threads, but also in trying any possible attack against vbb/apache/php and the point is not only take care of spam posts
7 - if it wasn't clear, our human resources are not unlimited and we have to make _real_ choices to reach a good security level without forgetting the man power involved.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

Thanks xes.
I believe now this thread shcould be closed.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

With that attitude, I believe this forum should now be closed :(

Re: [Forum] Unable to access talk.maemo.org using Tor
 

If we had blocked all tor exit nodes yes, but we actually don't. We are not blocking tor, we are blocking some specific exit nodes that have caused serious trouble. It is your privacy (actually not it is just your comfort) vs DDOS & spam attacks, guess what we chose.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

Somehow I dont like that statement.....

Re: [Forum] Unable to access talk.maemo.org using Tor
 

Updated, it is actually not even your privacy vs something... it is just your comfort vs attacks - as said, we do not block tor in general.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

It isn't even a thought to entertain guys...
If measures aren't taken... those ddos attacks would take the whole place down...period.
there is no nefarious or insidious agenda to strip people of their privacy.
this isn't about any individual "right" or "privilege" to something...
this is about the survival of this place.... Flat out ...full stop.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

Ok, I also have problems checking the forum from my work place where I HAVE to use a proxy to go out on the Internet as the company blocks a lot of things. But the thing is that I just want to check the forum, not get in my account and post something (I'm not that stupid and now that the free proxies on the Internet are saving all the data, even user and password, which in this case is easy to get as talk.maemo.org is plain http).

So the ideal would be to block any registering or connecting from the ips that spammers use but not block the entire forum. I would like to check the forum and read what's new even if I use a proxy (because I have to). And as I'm most of the time at work (except when I'm sleeping) this doesn't help.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

Got the same message today while using public WiFi "O2 WiFi" (A popular service in the UK) in All Bar One. Guess some public connection IP is in blacklist as well?

Re: [Forum] Unable to access talk.maemo.org using Tor
 

Yes.
Of course if that net is used by spammers...

Re: [Forum] Unable to access talk.maemo.org using Tor
 

What do we actually use to fight spam here, is it something at the webserver level (like ModSecurity) or is it a vBulletin plugin?

For tools like ModSecurity it's possible to make the RBL lookups just one part of the decision on whether to block or not by calculating an anomaly score for each transaction.

My configuration turns on some extra rules for fighting spam (keyword blocking) when the IP address matches a RBL lookup for spam source.

Something like that might make the blocking less likely to affect legitimate posts. Lots of cool things are possible with ModSecurity, many of them have already been written into the Core Rule Set (CRS):

https://github.com/SpiderLabs/owasp-modsecurity-crs

The Denial of Service rules automatically set and expire blocks without manual intervention, which also ticks the "few human moderator hours" requirement.

modsecurity_crs_11_dos_protection.conf

And there's some protection for slowloris attacks:

modsecurity_crs_11_slow_dos_protection.conf

Re: [Forum] Unable to access talk.maemo.org using Tor
 

Good input.
clearly not working as intended atm

But. Be aware. That using RBL will also give false positives.
pretty positive my ip would at some point join RBL by my experiments with eg mailservers (and possibly tor)

Re: [Forum] Unable to access talk.maemo.org using Tor
 

True, a lot of people using dynamic IP addresses might already be on a RBL, since it only takes one computer to have been infected with spammy malware at some point in the IP's lifetime for it to be on the list.

But that's why you don't block straight away if you get a RBL match - by default in the CRS a RBL match gives an anomaly score of 3, and transactions are blocked at 5, so you'd need something else to push it over the edge (suspected XSS attack, SQLi, protocol violations or anomalies, known bad user agent string etc.)

Re: [Forum] Unable to access talk.maemo.org using Tor
 

Or, incorrect ehlo reply. Etc, etc, etc.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

You mean when EHLO doesn't match the PTR?

Re: [Forum] Unable to access talk.maemo.org using Tor
 

Yes. That will put you on the blacklist in a jiffy.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

I didn't know that, thanks. I figured you'd get put on the list for EHLO'ing with a domain name that doesn't have a DNS A or MX record pointing to that IP address (or one that doesn't have a DNS record at all), but didn't think the lists were that strict.

Luckily my ISP ( https://www.plus.net/ ) is one of the best for technical support - when I built my server I asked them to change my PTR record and they did it within 12h - many ISPs won't let you do it at all.

EHLO based blocking is really useful for mail servers - mine received 30 messages yesterday, 11 were rejected because the client didn't EHLO with a FQDN, a further 10 were rejected because the hostname couldn't be resolved.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

I think it all depends. For example MS outlook 365 service will report any such mismatchs.

Re: [Forum] Unable to access talk.maemo.org using Tor
 

I don't know if this is possible but what would be interesting for the forum is to let anybody access it and read the posts (even when they use a spammer's ip) but block them from signing in or creating an account.

I for example use a proxy at work to just read the posts (I don't sign in), but just to stay up to date, and because of this restriction I can't any more (or I use a php proxy in addition to the web proxy to get access) and it's annoying. I have to use a proxy at work, otherwise a lot of accesses to the Internet are blocked by the company I work at (but strangely the access to some open proxys are not).