Discussion:
[tor-talk] Fishy MegaCorpsArchy (ie CloudFlare), and Censorship...
grarpamp
2018-09-23 10:16:51 UTC
Permalink
Fishy CloudFlare....
Noting some things others have said...

1) Two faced CEO declares to be fighting for "free speech",
yet goes anti and shuts down those like DS whose users
speak unbelievable nonsense about CF, yet is freespeech.
EFF and many others condemned this censorship.
Censorship is rapidly spreading in part due to CF's choice.
2) Breaks e2e encryption by MITM browser and website.
Everything you do with such "TLS" website is MITM'd by a
secret closed entity you have no explicit reason to trust
with your data.
2a) The list of entities in history that have been able to resist
datamining such a global trove, and further resist selling /
giving / renting / cracking / leaking / partnering / surveilling /
spying / manipulating / social mind controlling / court ordering /
etc it all away... is approximately zero.
3) Premeditatively chose to do 2 / 2a as a profit business model.
4) CF's [pre] history loves partnering with law enforcement.
5) Todays such "partnering" is often doublespeak for
secret surveillance fuckery against peoples.
6) Involved against what some say are victimless paper
issues of copyright trademark etc via historical partners.
7) Set the CF defaults to block torizens, requiring websites
to manually configure CF to accept torizens and their
perfectly good revenue, content, etc. Torizens lost much
time in their quest to exist and participate with the rest
as human beings.
8) CloudBleed
9) ...

While the individual techy projects of these megacorps may be
interesting, advanced, useful, and even pro to whatever some
segments might believe in, that does not excuse the responsibility
of the internet to constantly examine and call out what
they're doing in other areas.

Example in some investigations, balance checks, and backlash
against them starting to rise up, ie: Facebook and others taking
heat now for various things.

https://www.theguardian.com/technology/2013/aug/12/cloudflare-kavkaz-center-censorship-row

https://www.propublica.org/article/how-cloudflare-helps-serve-up-hate-on-the-web
https://www.wired.com/story/free-speech-issue-cloudflare/
https://www.theverge.com/2017/8/16/16157710/cloudflare-daily-stormer-drop-russia-hate-white-nationalism
http://dstormer6em3i4km.onion/matthew-prince-of-cloudflare-admits-he-killed-the-internet-because-he-thinks-andrew-anglin-is-an-asshole/
https://www.eff.org/deeplinks/2017/08/fighting-neo-nazis-future-free-expression

https://www.reddit.com/search?q=alex+jones+censored


https://onlinecensorship.org/


Wait till someone says "Hey Tor and its DA's are secretly our people".

[Or whichever sueable / persecutable / censorable / arrestable
hardly distributed network they choose to sink.]

That day is coming... become unsinkable.
--
tor-talk mailing list - tor-***@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torprojec
TNT BOM BOM
2018-09-23 12:34:00 UTC
Permalink
Thank you for the article.

i think if TorProject gave any space for CF, it will be the day that
Torproject draws its end.
Post by grarpamp
Fishy CloudFlare....
Noting some things others have said...
1) Two faced CEO declares to be fighting for "free speech",
yet goes anti and shuts down those like DS whose users
speak unbelievable nonsense about CF, yet is freespeech.
EFF and many others condemned this censorship.
Censorship is rapidly spreading in part due to CF's choice.
2) Breaks e2e encryption by MITM browser and website.
Everything you do with such "TLS" website is MITM'd by a
secret closed entity you have no explicit reason to trust
with your data.
2a) The list of entities in history that have been able to resist
datamining such a global trove, and further resist selling /
giving / renting / cracking / leaking / partnering / surveilling /
spying / manipulating / social mind controlling / court ordering /
etc it all away... is approximately zero.
3) Premeditatively chose to do 2 / 2a as a profit business model.
4) CF's [pre] history loves partnering with law enforcement.
5) Todays such "partnering" is often doublespeak for
secret surveillance fuckery against peoples.
6) Involved against what some say are victimless paper
issues of copyright trademark etc via historical partners.
7) Set the CF defaults to block torizens, requiring websites
to manually configure CF to accept torizens and their
perfectly good revenue, content, etc. Torizens lost much
time in their quest to exist and participate with the rest
as human beings.
8) CloudBleed
9) ...
While the individual techy projects of these megacorps may be
interesting, advanced, useful, and even pro to whatever some
segments might believe in, that does not excuse the responsibility
of the internet to constantly examine and call out what
they're doing in other areas.
Example in some investigations, balance checks, and backlash
against them starting to rise up, ie: Facebook and others taking
heat now for various things.
https://www.theguardian.com/technology/2013/aug/12/cloudflare-kavkaz-center-censorship-row
http://youtu.be/SWFX-zEYwN0
https://www.propublica.org/article/how-cloudflare-helps-serve-up-hate-on-the-web
https://www.wired.com/story/free-speech-issue-cloudflare/
https://www.theverge.com/2017/8/16/16157710/cloudflare-daily-stormer-drop-russia-hate-white-nationalism
http://dstormer6em3i4km.onion/matthew-prince-of-cloudflare-admits-he-killed-the-internet-because-he-thinks-andrew-anglin-is-an-asshole/
https://www.eff.org/deeplinks/2017/08/fighting-neo-nazis-future-free-expression
https://www.reddit.com/search?q=alex+jones+censored
https://onlinecensorship.org/
Wait till someone says "Hey Tor and its DA's are secretly our people".
[Or whichever sueable / persecutable / censorable / arrestable
hardly distributed network they choose to sink.]
That day is coming... become unsinkable.
--
tor-talk mailing list - tor-***@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/lis
Alec Muffett
2018-09-23 13:36:33 UTC
Permalink
I've seen lots of postings from Grarpamp and I feel sure that I'm never
going to change any opinions that Grarpamp holds; but what I do want to
raise with everyone is "the possibility of change":

To a good approximation, literally *zero* percent of the organisations
which will benefit from "Opportunistic Onions" have ever used Onion
Services until now

However literally 100% of the websites who can benefit from "Opportunistic
Onions" are Cloudflare customers by choice, who choose to trust Cloudflare
with their traffic, and I respect the choices of the website owners to
select different ways of scaling their services and of keeping their
systems safe from being DDoS'ed.

The people who *use* those websites can and should make their feelings
known to the website owners; but the opinions they feed back should be
balanced and considered and up-to-date and fair.

Yes, there is much to criticise of Cloudflare's past approach towards Tor
(including tweets by the CEO) but as I have also said so many times before:
it's amazing what a little engagement and mutual respect will achieve.

To go back through my own history at Facebook Engineering, the turning
point was this Reddit post from June 2013:

https://www.reddit.com/r/technology/comments/1gkxje/facebook_blocks_logins_from_tor_browser_putting/

...where one of Facebook's IP reputation systems burped after eating some
new config software, and blocked a large number of Tor exit nodes.

The civil society & reddit communities started commenting at speed, flaming
Facebook for "censorship"; and I had to argue against my own management,
some of whom suggested "why not just block Tor totally?" - because it
apparently caused nothing but vitriol and bad headlines.

I said "Give me a chance" and pinged Runa Sandvik (who was then at Tor)
asking her on behalf of Tor to explain the situation to the world:

https://blog.torproject.org/facebook-and-tor

quote> A number of users have noticed that Facebook is blocking connections
from the Tor network. Facebook is not blocking Tor deliberately. However, a
high volume of malicious activity across Tor exit nodes triggered
Facebook's site integrity systems which are designed to protect people who
use the service. Tor and Facebook are working together to find a resolution.

...and the anger faded. People were nonplussed: Facebook had merely goofed.
Facebook was working with Tor to "fix things". As I think one commenter put
it: "What do I do with this pitchfork, now?"

The important thing is what happened next:

This single event - proving that it was possible to get constructive
assistance from Tor - was enough to provide me traction for the concept of
building a Facebook onion site; I started building it 1 year later (needed
to learn some stuff, first) and launched it 3 months after that.

It's no coincidence that Runa subsequently helped with testing & launching
facebookcorewwwi, nor that three years later the New York Times launched
its own onion site.

I am sure that there are lots of people here who hate Facebook too - and
that's okay; my point is that without constructive engagement we would
probably not be where we are today, with Onion SSL Certificates, with an
official ".onion" top-level domain, with a increasing number of
"respectable" onion websites which are putting the lie to the "Dark Web"
mythos.

Tor, and Onion Networking, is just the "More Secure Web"; and you grow it
by giving people and companies the opportunities and space to engage with
it, so that they can offer value to others.

tl;dr - Tor will grow by engagement and reconciliation, not by rehashing
old debates and historical enmities.

- alec

--
http://dropsafe.crypticide.com/aboutalecm
--
tor-talk mailing list - tor-***@lists.torproject.org
To unsubscribe or change other settings go to
https://
grarpamp
2018-10-16 08:35:36 UTC
Permalink
Post by Alec Muffett
"the possibility of change"
Of course, corporations and people can and do change all the time.
Corps, often when bought / sold, or with top level staff changeover.
People, whenever upon some new thought process / info / situation.
And they often change back as well.
Post by Alec Muffett
To a good approximation, literally *zero* percent of the organisations
which will benefit from "Opportunistic Onions" have ever used Onion
Services until now
And they're not really involved with them under CF plan either.
So they might be missing out on some oppurtunities to
directly learn and participate in some neat things about
tor / philosophies.
Post by Alec Muffett
However literally 100% of the websites who can benefit from "Opportunistic
Onions" are Cloudflare customers by choice, who choose to trust Cloudflare
with their traffic, and I respect the choices of the website owners to
select different ways of scaling their services and of keeping their
systems safe from being DDoS'ed.
Perhaps it is fully informed choices that should be respected.
Not necessarily degress of blind ones presented by want to be
saviours that might trend saying say "Tor bad" to sell product.
Post by Alec Muffett
The people who *use* those websites can and should make their feelings
known to the website owners; but the opinions they feed back should be
balanced and considered and up-to-date and fair.
it's amazing what a little engagement and mutual respect will achieve.
True.
Post by Alec Muffett
Yes, there is much to criticise of Cloudflare's past approach towards Tor
(including tweets by the CEO)
Is the suggested accepted gone-ness of that phase now qualified
by its current censorship actions.
Post by Alec Muffett
Facebook [...] blocked a large number of Tor exit nodes
The civil society & reddit communities started commenting at speed, flaming
for "censorship"
Is it not good that there is now such a global rapid response
awareness and capability forming to tackle censorship,
privacy, human rights, and other abuses by States, Religion,
and Corporations as they happen in real time.
Post by Alec Muffett
it apparently caused nothing but vitriol and bad headlines.
Which mistakes are ultimately rightly resolved as oops with
no lasting effect.

At least the capability is excercised peacefully without physical
force, no one dies. Unlike murder and other things by the trio
above, and even just peoples too.
Post by Alec Muffett
launching facebookcorewwwi [...] three years later the New York
Times launched its own onion site.
without constructive engagement we would
probably not be where we are today
Right, and the above two stories are wins for both the
sites and users, and many tech toolsets, and philosophy.

However that's still rare, the historical pattern remains...

1) Users of site X notice or want something and say so openly
in constructive engagement, or at least initial friendly query.
2) Site X ignores them, many times because they have no
protocol to even talk with users, no interfacers, it's not in
their biz plan / vision, or manageable, cut expenses, clam up.
3) Users escalate.

Many of us have been deep in enough Site X's to know
that (2) is the hard problem.

There is a curious divide between vision / profit, and users.
Maybe this blockchain thingy enables micro share and
stake holding, and governance, to bridge it. Who knows.
Post by Alec Muffett
with Onion SSL Certificates
Not sure that letsencrypt does this yet, if not, they should.
Post by Alec Muffett
an official ".onion" top-level domain
Yes Jacob Appelbaum et al's work resulting in RFC7686 was good.

Too bad a number of other efforts got jammed / quit,
because I2P and other overlay networks are a thing now too.
draft-grothoff-iesg-special-use-p2p-names-04
draft-grothoff-iesg-special-use-p2p-bit
draft-grothoff-iesg-special-use-p2p-exit-00
draft-grothoff-iesg-special-use-p2p-gns-00
draft-grothoff-iesg-special-use-p2p-i2p-00

Too bad CJDNS is still improperly overloading upon address space
that IANA has explicitly allocated for other purposes, causing
collisions and general non-interoperability. Least they could
do if they can't get an allocation, or could have done, is camped
on some unallocated, and unlikely to ever be used, space instead.

So there's always things userland [projects] can do better
to play nice. (Well above was mostly technical example.)
Post by Alec Muffett
an increasing number of "respectable" onion websites which
are putting the lie to the "Dark Web" mythos.
Onionland has always been respectable from day one,
only the nonrespectable disrespected it.
And dark web has never been a lie, or a myth,
though perhaps indeed a legendary thing.
Even at its supposed worst maybe driving change
in the face for good.
Post by Alec Muffett
Tor, and Onion Networking, is just the "More Secure Web"
Other overlay networks are More Secure Web too.
Unless that too is trademarked and sic'd upon.
Post by Alec Muffett
grow it by giving people and companies the opportunities and
space to engage ... so that they can offer value to others.
Those open spaces exist, things compete in it, so capitalize
above it and win.
Post by Alec Muffett
rehashing old debates and historical enmities.
Recounting things can be useful, not because they
note any particular actors in example, but because they
note the sort of things any person or entity might want
to look out for before letting something new, and
similarly afflicted, grow bigger without first being fixed.

Arbitrarily killing speech, when there's [almost] nowhere
left for speakers to speak, is pretty fucking lame.
CF did that, so now others are too, seemingly spurred.
And speech around the world suffers.

Perhaps a fair number here like free speech zones
and social credit scores too. Perhaps they've just not
seen enough postings decrying that to change their
minds otherwise. Perhaps such postings were chilled
and censored.

What seems a big CF onion celebration here could easily
have unanalyzed pitfalls, whether currently, or upon
change of mind later on...

Here's a couple...

a) Analysis / Attack
1) Grand excuse and cover for floating the immense number
of nodes needed on the hashring... very convenient for
analysis and exploit attacks, including by their NSA CIA LE
and / or other unknown partners / researchers.
2) Terminating colossal numbers of circuits
into their AS and or administrative realm for
observation / similar.
3) Even unwittingly creating easy locus for GPA / GAA.

b) Key material
1) Holding onion names hostage in [non] custodial /
contractual form, whether they give subscribers
the [offline] crypto keys, or sell / rent / extort them,
portability, multihoming.
2) Security aganst keytheft breach and subsequent
impersonation of the sites from behind 7 proxies,
phishing, etc. Compensation for site and user losses.


Consideration of (a) alone should chill this party out a bit.
--
tor-talk mailing list - tor-***@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-b
Alec Muffett
2018-10-16 20:11:08 UTC
Permalink
On Tue, 16 Oct 2018, 09:35 grarpamp, <***@gmail.com> wrote:

...vast amounts of deletia...


b) Key material
Post by grarpamp
1) Holding onion names hostage in [non] custodial /
contractual form, whether they give subscribers
the [offline] crypto keys, or sell / rent / extort them,
portability, multihoming.
Um; I can only see this being a risk or threat if you imagine that
Cloudflare is assigning abd surfacing permanent "parallel" onion
addresses/names to their customers.

If you do believe that, then you've misapprehended how Alt-Svc works.

Neither clients nor website owners ever see onion addresses; all the onion
addresses are ephemeral and buried at/below the HTTP layer.


2) Security aganst keytheft breach and subsequent
Post by grarpamp
impersonation of the sites from behind 7 proxies,
phishing, etc. Compensation for site and user losses.
Ditto; likewise not an issue with Alt-Svc onionification; the mechanism
never surfaces onion keys to the user, and the onions themselves are
short-lived / ephemeral.

- alec
--
tor-talk mailing list - tor-***@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.to
Loading...