cloudflare-tor/cloudflare

from the wiki:

Torblocks Philosophy

What is the darknet if not the (parts of the?) net that doesn't like to be accessed?

This is the new pad for all tangents and rants from
https://pad.okfn.org/p/cloudflare-tor
https://pad.okfn.org/p/noncloudflare-torblocks

Have fun!

0. Read this ticket https://trac.torproject.org/projects/tor/ticket/18361
one guy, marek apparently from Clownflare, utters unapologetic remarks that should come as no surprise.
  "I will restrain myself and not comment on the political issues Jacob raised. I'll keep it technical."
  hey, in times of mass surveillance, technology is political. money is political. therefore Clownflare's policy is political. so?
  discussion is on. with "marek" and "jgrahamc" of Clownflare. last I looked they were unapologetic & attempting to snark Tor developers into building expensive client/Tor/TBB-side functionality to suit them. meanwhile stalling and offering minor workarounds (on the bright side, jgrahamc promised to make tor blocking optional for "free-" tier sites. (opt-out though)). 

BTW someone quickly wrote a (unhelpful & biased & not in-depth researched, rather "he said this and then the other guy said that" style) article about the discussion on the ticket for "TheRegister", which at first I couldn't read because it was behind ... TADA: a clownflare CAPTCHAwall. Luckily there's archive.is and they don't block that.

There's also the rather amusing fact that Tor trac bugtracker also required CAPTCHAs (which was commented on several times) and the less amusing fact that these came from freakin' Google.

0. Lies, damn lies and statistics
especially if you make up the "ground truth" to suit your own smear campaign ...
https://blog.torproject.org/blog/trouble-cloudflare
Cloudflare is a wilfully malicious actor, there can be no more doubt.

1. Unamed's take on the situation:

Praise the awesome wisdom of blocking Tor access to websites!!!
There must be some advantage. Something? Anything? Some rational explanation?
Especially curious: why have so many hacking / OS / security / internet freedom themed websites chosen to go dark?
Is it selection bias because only nerds contribute to the lists?

Let's see. FNORD FNORD FNORD

Torblocks make awesome sense because (imagined conversation)
A: what is Tor anyway? some kind of a darknet?
B: no, it's not. it's an anonymity tool. actually there are parts of the net that have chosen to go dark. want a hint?

A: who uses Tor anyway? everyone knows it's only for freaks and criminals.
B: that's not true. normal people use it too. as a precaution, if nothing else.

A: but you don't need Tor. you can access our site over the clearnet like everybody else.
B: who are you to judge? the internet is a dangerous place. by the way, turns out I can't access it over the clearnet either.

A: you must be up to no good. I don't trust you.
B: actually, I just want to read / contribute / buy / whatever it is, but not in plain sight. in fact, I just lost interest in your site. none of your competitors feel the need to bully Tor users, so it can't be necessary.
hah, at the risk of going off topic but since we're hopefully all privacy-minded here: actually a similar argument is valid (in fact even stronger, since clownflare does offer some measurable protection) against the idiotic spread of gratuitous CCTV recording in modern cities. training optical bugs on one's customers or passengers offers little objective protection for anyone. the main effect is to alienate privacy-minded people, degrade quality of life, offer a false sense of security to gullible people and the illusion of protection for the owner. as businesses that don't do it do just fine (and it presumably doesn't lower insurance fees), it can't be really necessary.

A.1 sometimes there are necessary websites for some degree of necessary.  Government websites, public service, etc.  How long until those are behind the great cloudwall ?  
B: Not long. Our service is competitive and convenient. If public service websites choose to use our service for awesome DDos protection, it's their choice.

A Don't you know it's inevitable that everything is going to be behind the great cloudwall?  Might as well get it over with.
B: Just wait until Microsoft takes up the challenge & enters the market. Then at least we can be SURE our data ends up with the NSA, where it belongs. How else can we expect them to know who to drone?

A: it is well known that no one with intent to cause damage, post spam or abuse can circumvent a tor block!1!!
B: actually, that's completely wrong. you'll end up inconveniencing good people too and nurturing a false sense of security.
B1: good thing no one on the clearnet ever posts abusive content, and everyone plays nice together in perfect harmony outside of the tor network

A: so what? if we can't sell your soul to ad networks, we don't want you as a customer. google would be cross and we'd lose revenue that we like to make on our visitor's backs!
B: that's more like it. but are you sure it makes that much of a difference?

A: traffic that would otherwise be used to serve a few pages over Tor can now be allocated to updating blocklists and serving cute error messages instead!!!!!
B: that must be it.

A: outsourcing this to a third party blocklist supplier (or a man in the middle such as clownflare) has the added benefit of centralizing web blocking decisions. surely that's a good thing.
B: You're welcome to check our transparency report: before that vanished behind a CAPTCHAwall, the number of NSLs served by US KGB used to be something between 0 and 249. Cloudflare, no stranger to unwitting irony, has decided to hide its transparency report behind a damp cloudy opaque CAPTCHA fogwall so who knows?

A: is your website just for you or for more people?
B: works for me

You see, it all makes sense.


Imagined conversation with clownflare management. Dunno if it's entirely fair: there seem to be some genuinely Tor-friendly tech people on their payroll. Anyway, it reflects my perception of clownflare management not giving a shit (the problem started appearing in 2014). So sue me, corporate dinosaurs.
A: Care to comment on this Tor captcha business?
C: We're committed to providing best possible service for our customers.

A: You call that service, breaking half the web?
C: It ain't broken, it's a feature. By the way, paying customers (not the ones we lure with so-called free plans, in the Sillycon-Valley meaning of that word) can turn it off.

A: Your captcha's don't even work.
C: Yes, they do.

A: Let's agree to disagree on that one. At least it's a nice reminder of your man in the middle position. Otherwise we might forget that a sizeable fraction of TLS connection terminate at your place.
C: Tough. We have to do it, though, because of DDOS.

A: Yeah, right. You can handle shitloads of traffic, but have to fuck with Tor, which represents a tiny fraction of all the packets that arrive?
C: Clownflare is committed to a free and open internet. And we're so big, we can just sit it out. We're a wannabe Sillycon Valley giant. You are just fly shit to us. By the way, we foster research on internet freedom. And it's not Clownflare, it's "Cloud"flare. as in "Clouded judgment".

A: I can see we're getting somewhere.

point being that they cannot get away with claiming lack of awareness. this is deliberate or so boneheaded as to be indistinguishable from deliberate action. of course they know. they have people well up the hierarchy who know. not fixing this was/is a decision that was made by people inside this corporation.

B: Has anyone ever successfully DDOS'd anything from within tor? outside of hidden services maybe how much unused bandwidth do exit nodes even have?  Clearnet botnets have way more bandwidth and if the threat model is DDOS we should be calling them out on
tor loud and clear.
The ticket on Tor trac offers some insight. It seems to be about forum spam (the "threat scores" originate with "Project Honey Pot", which labors under the drastic oversimplifying assumption that maintaining long term IP based address scores is somehow a sensible approach - invalidated by communal exit nodes of all stripes and colors and even carrier-grade NATs, as people have pointed out) port scans (how the hell is that abuse? run a public server and expect a "safe space" no matter how bad your security? seriously it's hard to understand why someone who needs to be protected from port scans wants to run their own domain on their own fucking servers. there's lots of hosters that will expertly & gladly solve these problems in-house), SQL injections (again, responsiblity of the guys who made the website!!!) and so on.

2. The wikimedia way

Even as a registered user in good standing, exemption from the Tor block has to be requested through a bureaucratic process (even though Wikipedia is "not a bureaucracy") and will be granted under exceptional circumstances only. I completely fail to see the rationale. this is probably an artefact of  the blocking system they use to bar anonymous vandals from editing  Wikipedia, viz. the unblocking process might be messy to perform, behind  the scenes, I don't know. The upshoot for me as a user is that they regard Tor use as  "exceptional" and not a normal thing. The result is that errors I notice on Wikipedia pages while using TBB go uncorrected. They even block paid vpn servers as "open proxies". Seems like they just do not want help. Because in times of NSA they should expect that clever people hide from spying. Precisely. It's a crying shame, though. Maybe the wikipedia of the future will use gnunet-git/freenet/i2p-lafs based backend. I will never donate to wikimedia again unless they come up with a concept for letting users contribute over Tor and other banned proxy networks (not "exceptionally", but casually) OR hell freezes over. Until then, I don't feel they deserve the money. Dear Jimmy, figure this one out first. There's gotta be a good way. This isn't "security". WORST OF ALL, It doesn't even stop rotten people from manipulating Wikipedia. It's not helpful. OK?
Has anyone seen the greenstadt(?) talk on the value of anonymous contributions yet?


3. clownflare vs. non clownflare (homespun or other 3rd party blocklists e.g. against forum spam which overblock tor)

  "Overall there seem to be far fewer sites that impede (reading, not posting!) access via Tor  without Cloudflare than with Cloudflare. It is of course still a deeply flawed and misguided (and clueless, as the stupid little messages about  "security reasons" or "viruses" (how cute ...) etc. show) policy, but unlike Cloudflare which has its tendrils everywhere and MITMs large swathes of the web for the NSA, small-scale blocking alone probably wouldn't drive a lot of would-be casual Tor users back into the arms of mass surveillance. Nevertheless it's annoying and site owners should rethink their approach."

3.1 at least we have technical people marginally friendly to tor within cloudfare...whatever company inevitably buys out/replaces cloudfare we're going to be in rougher shape.  What can we do now to save pain later?

change the architecture of the web ...

4. it's censorship and sabotage, plain and simple

(from cloudflare-tor discussion at bottom of pad: once I wrote "Q: Tor blocks amount to (collateral, in -hopefully- rare cases deliberate) censorship (corporate censorship in the Cloudflare case) against users of a network which is amongst other things a censorship circumvention tool. How twisted is that!? I think I'll set up another etherpad for anti-Cloudflare rants (or open pro- contra- debates and fact checking on the role of Cloudflare and their ilk regarding monopolies, surveillance, analytics, censorship, data ownership (just take a passing look at their official policy, you'll see what I mean) and so on) so we can keep this one neutral ... I'm really angry.". now, wanting to substantiate that with an excerpt of their data use terms, was denied request for https://www.cloudflare.com/terms/ . essentially making my other point on my behalf. stupid, stupid corporate dinosaur ...).

nevertheless, the cloudflare captcha walls serve as a nice reminder of their MitM position. if a corporation gets the power to sabotage a sizeable fraction of the web, that's not good.
  
 4.1 Thinking more about jgrahamc's "We have a simple need: our customers pay us to protect their web sites from DoS" -- which we may as well accept as true, since in practice that is what happens. Given that, and that DDOS is speech[1][2]  it's pretty clear that they are a censorship vendor at least on that level.  Their customers are paying them to "protect" them from their customer's speech.  We can call a spade a spade.

Might even call it a sustained DDOS attack on readers, ironically. Distributed? Check. Denial of service? Check.

[1] http://www.theguardian.com/commentisfree/2013/jan/22/paypal-wikileaks-protesters-ddos-free-speech
[2] https://twitter.com/haq4good/status/703315998523396096

5. Also its a bit rich to have to prove to robots that we're "not robots". Humans should make machines work, not vice versa.
fits amazon's actual business model perfectly  
* Also robots take the test whether we want to or not.  As pointed out in the original thread, User agents end up taking the test for us anyway.  There is no situation where a human is taking the test that Cloudfare actually cares about, it's turtles all the way down 
if I wanted to run a SPAM outfit, I'd find a way to pay humans to do the captchas if OCR can't solve them with enough success chance - I hear this is commonly done. millions and millions of people accept such jobs for want of better alternatives - or build a piece of malware or web trickery to re-route captchas. there goes their main argument.

6. Given the data is going to Google, aren't we training GeneralDynamics(owned by Google/Alphabet) to kill people?
The data kraken stops at nothing to collect ever more input to fuel and hone its dangerous fake "artificial intelligence". It is gobbling up our future byte for byte (while claiming to be doing it because it knows best (TM) what's good for everyone). That's a moral yes.
I don't think that the artificial intelligence need stay fake, if it still even is.  This is training unfriendly AI, byte by byte
Either way, it's extracting labor from humans. One should avoid feeding the data monster[1]. Better still: avoid feeding it *correct* data. Suggest an experiment: let's write and spread a bot that feeds it consistent but wrong classifications. Will that degrade the success rate of bona fide solving attempts? Google could yet be made to choke on its own omnivorous virulent data voracity.

[1] http://themusicgod1.deviantart.com/art/the-great-cloudwall-1-595382698