@nieldk
i think there is no problem, i will try to produce some number about the blacklist effects.

@nthn
have you read anything from my posts or are you just polling tor, tor, i want tor....

Yes, did you read mine?

What happened for the initiave to allow Tor access to TMO as a hidden service?

That could be done so that either the access would be read-only or accepted-login only and it would be very easy to set up as there'd be only the one channel to block (meaning, Tor-internal access as hidden service)

Additionally I guess it would cut just about all the random-access-malicious-users-using-Tor-just-to-try-it as not so many would even try to find out that we actually have a hidden gateway.

@juiceme
who proposed this thing has also an idea about how to realize it?

If the point is ensure that Tor ip could have access, it means give to a bunch of potentially dangerous ip addresses a priority.

If the point is use a blacklist ip based or not, it requires an alternative.

Another example is wiki. The same blacklist protects also wiki and bugs since there is no other plugin that we can use to stop spam there.
What do you suggest to apply there?

I propose this as a study item.

In simplest implementation would be to run a Tor node on one of our VM's to use it as the hidden site access gateway.
Yes, I grant it it sounds dangerous but there are ways to isolate the traffic and keep the node contained. Access to TMO (and wiki I suppose) would only be allowed either read-only or authenticated from that node.
It could even be set up as a request-only use; an user wanting to have Tor access to our sites would need to be pre-authenticated by staff to do that.

An example of the blacklist job:
On 20 October 2016 we stopped 35916 requests.

Here are listed the 100 ip more present in the block log:

https://public.etherpad-mozilla.org/p/XV1d8eHFTY

Feel free to check these ip against http://www.stopforumspam.com/search

and evaluate the statistical possibility to match username/email - ip and what those ip are doing during the last months.

I hope this could explain why tor is only the smallest part of the problem.

@juiceme
I appreciate your point of view, your idea and your try to find a solution to satisfy all....but sincerely talking, do you really want to try to secure a service creating an even bigger risk running a tor node?

I think that evaluating the situation of the community (active members, number of people involved into techstaff and maintenance tasks..) choose a conservative approach is the only possibility we have to survive.

For sure we can decide to upgrade some service,wiki, vbb..or others but create a situation of risk bigger than the actual imperfect status could make damages unfixable for all the servers of the community.

You guys are talking like we block TOR in general, we don't. The blacklists in use contain major exit-nodes most commonly used by bot-nets as they are fast. I do not like the idea of a limited node on our infra, but how about an onion route to tmo? Block registration from within tor? Then as soon as you log in to a site you authenticate your tor connection to be one of our members which is as stupid as it sounds... you can track single IDs within a browsing history even if the browsing was from different devices and with different cookie settings. For some IDs it is enough to determine the kind of searches they do on google as they can be reverse engineered to be lined up to your "put public accounts here"

How do we measure that the blacklist is actually working?
How about that as soon as we activated we have 90% less registrations of sleeper accounts, they get active after exactly 31 days to circumvent a basic 30day grace period of most forum software - we even filter that to some extend but the plug-in we use is failing too.

All those single-link-spam-posts are a mystery. There is no filter or any plug-in that detects them properly.

If anything, we should think about if it is time to get a new forum and use something that is state of the art in any aspect, incl. using garage accountsDB, replacing the wiki software and midgard all at once.

My guess, recent spammers are using an open proxy server.
Do we block those ?

slightly OT because not tor related:
But how many legit registration of new users are there in a week or day?
My guess is there are fewer legit new users than successful spam attempts, right?
So if manuall work is necessary anyway, why not turn it around and only activate the legit ones on daily basis instead of being forced by the spammers to react more often?

Is it fisable to restrict new accounts to only sent a pm to admins or post in a special thread and ask for activation before posting anywhere else?