headers
Ryan Day | 2 Nov 2009 14:54
Picon

Distribution of bridge information

I was playing around with an idea of how to distribute bridge information on a mass scale without censor groups being able to automate the process of collecting and filtering the bridges.  I came up with a pretty simple script that contacts bridges.torproject.org, grabs some bridge info, and obfuscates it using the same methods that CAPTCHA systems use to obfuscate images. Now people can read the bridge info, but machines can't(most of the time).


I've put this together as a Wordpress plugin that is available at 



What this plugin does is grab bridge information, cache it, and obfuscate it for display on your blog.  Since that bridge information won't update for that IP, the plugin only contacts the site about once a day for new information.

My goal here is to allow people everywhere to help distribute bridge information without increasing the chance it will be filtered.  This will hopefully help people in firewalled countries be able to get on the Tor network a little easier.

I'm interested in your thoughts and comments and criticisms.  Is this a good idea?  Do you think people will use it and it will be beneficial?  Is it good but needs improvement?  Also where else could bridge information be grabbed from(rss, twitter, etc)? 

Thanks for any comments!
Permalink | Reply | 0 comments |
headers
Thomas Anderson | 2 Nov 2009 17:57
Picon

Load external content? message seems inappropriate

I was playing around with Tor Browser to see what it was like and
tried to download a small 1mb file from a server of mine.  In the
process, I got the following message:

---------------------

An external application is needed to handle:

http://domain.tld/path/to/my/file.ext

NOTE: External applications are NOT Tor safe by default and can unmask you!

---------------------

My question is...  why is an external package being loaded?  All I
want to do is to download a file via HTTP to my hard drive.  I don't
want to open it up in whatever application would be appropriate and
even if I did, it's not as if that application would be the one that
downloads the file - Tor Browser would still download it and just
place it in the Windows temporary directory or where ever.

All in all, the message seems inappropriate.  Sure, if I was
downloading, say, an *.exe, that *.exe might connect me to the
internet, but even then, the message seems misleading, since, at that
point, it's not that an external package is needed to handle the file
so much as the file *is* an external package.
***********************************************************************
To unsubscribe, send an e-mail to majordomo <at> torproject.org with
unsubscribe or-talk    in the body. http://archives.seul.org/or/talk/
Permalink | Reply | 0 comments |
headers
grarpamp | 2 Nov 2009 18:08
Picon

getinfo ns/desc question

getinfo ns/id/fp
 552 Unrecognized key "ns/id/39ADCFF60B1A5ED1982F1303451F4F35A7521E37"
getinfo desc/id/fp
 router kyuu 82.17.80.64 9001 0 9030
 ...

5373 BUILT ...,$7156581726CCAA0EFCFDB7F61B8FB9FE0FCD0B97~kyuu PURPOSE=GENERAL
15397 SUCCEEDED 5373
64.233.163.99.7156581726ccaa0efcfdb7f61b8fb9fe0fcd0b97.exit:80

getinfo ns/id/fp
 552 Unrecognized key "ns/id/39ADCFF60B1A5ED1982F1303451F4F35A7521E37"

Even after I map and use the exit successfully, why do I still get
the "Unrecognized key" for such nodes under tor-0.2.1.19?

And is there no way to generally tell within tor if a router
descriptor is functional without trying to pass traffic over it?
***********************************************************************
To unsubscribe, send an e-mail to majordomo <at> torproject.org with
unsubscribe or-talk    in the body. http://archives.seul.org/or/talk/
Permalink | Reply | 0 comments |
headers
moris blues | 17 Nov 2009 23:11

private exit node


 helo,

what is a private exit node? 
---- 
versendet mit www.oleco.de Mail - Anmeldung und Nutzung kostenlos!
Oleco www.netlcr.org - jetzt auch mit Spamschutz.
***********************************************************************
To unsubscribe, send an e-mail to majordomo <at> torproject.org with
unsubscribe or-talk    in the body. http://archives.seul.org/or/talk/
Permalink | Reply | 0 comments |
headers
dreamcat four | 22 Nov 2009 23:49
Picon
Gravatar

Tor: Scroogle blocked, Google not ? (November 2009)

Hi,

The past few days I've noticed that all http requests to
https://ssl.scroogle.org have invariably failed. This appeared as a
DNS failure. After switching over to the regular http (non-ssl)
version of scroogle, I found that was generally working for another
couple of days then that went away too with the same can't resolve
host / No such domain. Anyone else also experienced this?

And google. Nearly as strange have been my experience google lately.
The reason I started using Scroogle a while back was simply because
google had been blocking Tor exit nodes from performing searches. But
just today my first 2 searches worked. By prior experience this is
very uncommon. The first search had accepted cookies, the second
search cookies were disabled and it still worked just fine. Maybe
simply a coincidence and/or blind luck? Again, can anyone confirm /
deny?

Best regards

dreamcat4
dreamcat4 <at> gmail.com
***********************************************************************
To unsubscribe, send an e-mail to majordomo <at> torproject.org with
unsubscribe or-talk    in the body. http://archives.seul.org/or/talk/
Permalink | Reply | 0 comments |
headers
Hannah Schroeter | 23 Nov 2009 02:21

Re: Tor: Scroogle blocked, Google not ? (November 2009)

Hi!

On Sun, Nov 22, 2009 at 10:49:59PM +0000, dreamcat four wrote:
>The past few days I've noticed that all http requests to
>https://ssl.scroogle.org have invariably failed.

>[...]

After a few tries, it worked for me (FoxyProxy, NoScript though, no
TorButton in the profile I used).

The first few tries, though, yielded a *firefox* generic error message
(oh, I "like" those, no real error reason message...), no Privoxy one!

Kind regards,

Hannah.
***********************************************************************
To unsubscribe, send an e-mail to majordomo <at> torproject.org with
unsubscribe or-talk    in the body. http://archives.seul.org/or/talk/
Permalink | Reply | 0 comments |
headers
Scott Bennett | 26 Nov 2009 11:23
Favicon

DisableAllSwap question

     I'm currently running 0.2.2.5-alpha but will probably move to
0.2.2.6-alpha fairly soon.  In the Changelog there is a note about a new
option available in 0.2.2.6-alpha called DisableAllSwap.  I'm running
FreeBSD, and my only swap area is GELI-encrypted disk slice.  Doesn't
that effectively accomplish the same thing on my system without requiring
a lot of real memory to be tied up in fixed pages (a.k.a. "wired" pages)?
Or is there some further advantage to be gained by using both that I've
missed?

                                  Scott Bennett, Comm. ASMELG, CFIAG
**********************************************************************
* Internet:       bennett at cs.niu.edu                              *
*--------------------------------------------------------------------*
* "A well regulated and disciplined militia, is at all times a good  *
* objection to the introduction of that bane of all free governments *
* -- a standing army."                                               *
*    -- Gov. John Hancock, New York Journal, 28 January 1790         *
**********************************************************************
***********************************************************************
To unsubscribe, send an e-mail to majordomo <at> torproject.org with
unsubscribe or-talk    in the body. http://archives.seul.org/or/talk/
Permalink | Reply | 0 comments |
headers
Scott Bennett | 27 Nov 2009 14:18
Favicon

Re: Danish TPB DNS Blocks

     On Thu, 26 Nov 2009 14:18:11 -0500 Flamsmark <flamsmark <at> gmail.com>
wrote:
>2009/11/26 Scott Bennett <bennett <at> cs.niu.edu>
>
>> >Changing the DNS server to DNS rootservers would fix this problem.
>> >
>>      Bzzzt!!  That would eventually get an exit marked as a bad exit, too.
>> Why?  Because the root name servers serve only information in the root
>> domain and the so-called top-level domains (e.g., .com, .edu, .gov, .info,
>> .mil, country domains, and so on).  They are much, much too busy to act
>> as forwarders, so if you ask for anything that they don't serve themselves,
>> you will get a "no answers" response.
>
>
>How odd. I use the root servers on my personal machine, and have never

     Here's an example of attempting to do what you suggested.

Script started on Fri Nov 27 06:54:46 2009
mp% dig  <at> k.root-servers.net. www.torproject.org. a

; <<>> DiG 9.3.1 <<>>  <at> k.root-servers.net. www.torproject.org. a
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1041
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 6, ADDITIONAL: 12

;; QUESTION SECTION:
;www.torproject.org.            IN      A

;; AUTHORITY SECTION:
org.                    172800  IN      NS      a0.org.afilias-nst.info.
org.                    172800  IN      NS      a2.org.afilias-nst.info.
org.                    172800  IN      NS      b0.org.afilias-nst.org.
org.                    172800  IN      NS      b2.org.afilias-nst.org.
org.                    172800  IN      NS      c0.org.afilias-nst.info.
org.                    172800  IN      NS      d0.org.afilias-nst.org.

;; ADDITIONAL SECTION:
a0.org.afilias-nst.info. 172800 IN      A       199.19.56.1
a2.org.afilias-nst.info. 172800 IN      A       199.249.112.1
b0.org.afilias-nst.org. 172800  IN      A       199.19.54.1
b2.org.afilias-nst.org. 172800  IN      A       199.249.120.1
c0.org.afilias-nst.info. 172800 IN      A       199.19.53.1
d0.org.afilias-nst.org. 172800  IN      A       199.19.57.1
a0.org.afilias-nst.info. 172800 IN      AAAA    2001:500:e::1
a2.org.afilias-nst.info. 172800 IN      AAAA    2001:500:40::1
b0.org.afilias-nst.org. 172800  IN      AAAA    2001:500:c::1
b2.org.afilias-nst.org. 172800  IN      AAAA    2001:500:48::1
c0.org.afilias-nst.info. 172800 IN      AAAA    2001:500:b::1
d0.org.afilias-nst.org. 172800  IN      AAAA    2001:500:f::1

;; Query time: 63 msec
;; SERVER: 193.0.14.129#53(193.0.14.129)
;; WHEN: Fri Nov 27 06:55:07 2009
;; MSG SIZE  rcvd: 441

mp% exit
script done on Fri Nov 27 06:55:10 2009

     Notice in the example above that the answer count is zero and that no
IP address or any other information is returned in response to the request
for the A RR for www.torproject.org.

>noticed this phenomenon. If you are correct, does DNS work? How does a user
>know which DNS servers are authoritative for other blocks?
>
     The resolver library routines on your computer start--at least in
principle, though cacheing may cause a deviation from this procedure--at the
top.  After finding the addresses of one or more root servers from locally
kept data, a root (.) server is queried for the top-level domain's
authoritative name servers.  To track down the authoritative name servers for
a university in the U.S., for example, a query is sent to a root server to get
the list of authoritative name servers for the edu. domain:

Script started on Fri Nov 27 06:57:16 2009
mp% dig  <at> k.root-servers.net. edu. ns

; <<>> DiG 9.3.1 <<>>  <at> k.root-servers.net. edu. ns
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 813
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 7, ADDITIONAL: 8

;; QUESTION SECTION:
;edu.                           IN      NS

;; AUTHORITY SECTION:
edu.                    172800  IN      NS      a.gtld-servers.net.
edu.                    172800  IN      NS      c.gtld-servers.net.
edu.                    172800  IN      NS      d.gtld-servers.net.
edu.                    172800  IN      NS      e.gtld-servers.net.
edu.                    172800  IN      NS      f.gtld-servers.net.
edu.                    172800  IN      NS      g.gtld-servers.net.
edu.                    172800  IN      NS      l.gtld-servers.net.

;; ADDITIONAL SECTION:
a.gtld-servers.net.     172800  IN      A       192.5.6.30
c.gtld-servers.net.     172800  IN      A       192.26.92.30
d.gtld-servers.net.     172800  IN      A       192.31.80.30
e.gtld-servers.net.     172800  IN      A       192.12.94.30
f.gtld-servers.net.     172800  IN      A       192.35.51.30
g.gtld-servers.net.     172800  IN      A       192.42.93.30
l.gtld-servers.net.     172800  IN      A       192.41.162.30
a.gtld-servers.net.     172800  IN      AAAA    2001:503:a83e::2:30

;; Query time: 62 msec
;; SERVER: 193.0.14.129#53(193.0.14.129)
;; WHEN: Fri Nov 27 06:57:47 2009
;; MSG SIZE  rcvd: 292

Note that the list of NS RRs above comprises only a subset of the list of root
servers.  Take a look at the different list of servers authoritative for the
za. domain:

mp% dig  <at> k.root-servers.net. za. ns

; <<>> DiG 9.3.1 <<>>  <at> k.root-servers.net. za. ns
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1737
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 7, ADDITIONAL: 10

;; QUESTION SECTION:
;za.                            IN      NS

;; AUTHORITY SECTION:
za.                     172800  IN      NS      ns1.dns.aq.
za.                     172800  IN      NS      nsza.is.co.za.
za.                     172800  IN      NS      hippo.ru.ac.za.
za.                     172800  IN      NS      ns-za.ripe.net.
za.                     172800  IN      NS      auth00.ns.uu.net.
za.                     172800  IN      NS      ns-ext.isc.org.
za.                     172800  IN      NS      ucthpx.uct.ac.za.

;; ADDITIONAL SECTION:
ns1.dns.aq.             172800  IN      A       198.32.71.12
nsza.is.co.za.          172800  IN      A       196.4.160.27
hippo.ru.ac.za.         172800  IN      A       146.231.128.1
ns-za.ripe.net.         172800  IN      A       193.0.12.205
auth00.ns.uu.net.       172800  IN      A       198.6.1.65
ns-ext.isc.org.         172800  IN      A       204.152.184.64
ucthpx.uct.ac.za.       172800  IN      A       137.158.128.1
hippo.ru.ac.za.         172800  IN      AAAA    2001:4200:1010::1
ns-za.ripe.net.         172800  IN      AAAA    2001:610:240:0:53::193
ns-ext.isc.org.         172800  IN      AAAA    2001:4f8:0:2::13

;; Query time: 62 msec
;; SERVER: 193.0.14.129#53(193.0.14.129)
;; WHEN: Fri Nov 27 06:58:16 2009
;; MSG SIZE  rcvd: 401

mp% exit
mp% 
script done on Fri Nov 27 06:58:36 2009

     Now that the list of edu. authorities has been obtained, any one of
those may be queried for the NS RRs for a particular subdomain of edu.  Then
any of those servers may be queried for any desired RRs within that domain,
and so on down any further subdomain levels that may exist.

                                  Scott Bennett, Comm. ASMELG, CFIAG
**********************************************************************
* Internet:       bennett at cs.niu.edu                              *
*--------------------------------------------------------------------*
* "A well regulated and disciplined militia, is at all times a good  *
* objection to the introduction of that bane of all free governments *
* -- a standing army."                                               *
*    -- Gov. John Hancock, New York Journal, 28 January 1790         *
**********************************************************************

***********************************************************************
To unsubscribe, send an e-mail to majordomo <at> torproject.org with
unsubscribe or-talk    in the body. http://archives.seul.org/or/talk/
Permalink | Reply | 0 comments |
headers
Gert Robben | 1 Dec 2009 18:34
Picon

My system clock only jumps, not ticks? (Linux)

Hello,

Tor logs these messages continuously:

Nov 29 23:30:15.618 [warn] Your system clock just jumped 2189 seconds forward; assuming established
circuits no longer work.
Nov 30 00:35:45.024 [warn] Your system clock just jumped 3930 seconds forward; assuming established
circuits no longer work.
Nov 30 01:10:21.651 [warn] Your system clock just jumped 2076 seconds forward; assuming established
circuits no longer work.

As can be seen, every jump is exactly the time since the last jump (I've tested this for a day).
So the clock doesn't seem to progress in between the jumps.

In the past I never had this problem, however I don't know when it appeared (maybe 1-2 months ago?), or what I
might have done to cause it. Old logs are lost because they are kept in RAM.

I use an Alix 2C2 board, with Debian Lenny.
I tried Linux kernels 2.6.28-2.6.31 from kernel.org, and Tor 0.2.0 (from Debian) and 0.2.1 (from
deb.torproject.org), which don't make a difference.
IIRC, I used 2.6.28 long ago, at that time I didn't have a problem. So I assume it's not the kernel.

Below this mail is the output of various commands. What can be concluded:
- The 2 NTP servers I tried both agree about the time
- RTC drifts only 2s/day
- System time drifts only 26s/day
- (I didn't have any time daemons running during the below commands)

Also, after this test, I used adjtimex to set the kernel clock frequency from 0 (see below) to 5347487, but
that didn't make any difference either.

What is also weird, is that Tor doesn't respond well to SIGINT. It seems to shutdown in forever instead of in
30 seconds. Maybe it's related?
# killall -INT tor
# sleep 3m;tail -n1 /var/log/tor/log
Dec 01 18:13:03.813 [notice] Interrupt: will shut down in 30 seconds. Interrupt again to exit now.
# killall -INT tor
# tail -n2 /var/log/tor/log
Dec 01 18:13:03.813 [notice] Interrupt: will shut down in 30 seconds. Interrupt again to exit now.
Dec 01 18:16:43.917 [notice] Sigint received a second time; exiting now.

I've looked at previous posts about clock jumps, but I have the idea I have a different problem because these
jumps are much larger, and because in this case the starting point of the jump is always the previous jump.
And I don't use virtualization.

Or could it be faulty hardware? A friend of mine has the exact same board, if it's really necessary maybe I can
test with his.

Any advice? Thanks!

Gert Robben

---- 8< ----

alix:/rw# ls /etc/adjtime
ls: cannot access /etc/adjtime: No such file or directory

alix:/rw# ls -l /dev/rtc*
lrwxrwxrwx 1 root root      4 Sep 26 16:38 /dev/rtc -> rtc0
crw-rw---- 1 root root 254, 0 Sep 26 16:38 /dev/rtc0

# cat /sys/devices/system/clocksource/clocksource0/available_clocksource
tsc 

# rdate -vn ntp.uu.nl
Mon Nov 30 00:23:36 CET 2009
rdate: adjust local clock by 0.033507 seconds

# rdate -vn 0.nl.pool.ntp.org
Mon Nov 30 00:24:05 CET 2009
rdate: adjust local clock by 0.008656 seconds

# hwclock --debug --noadjfile --systohc --utc
hwclock from util-linux-ng 2.13.1.1
Using /dev interface to clock.
Assuming hardware clock is kept in UTC time.
Waiting for clock tick...
...got clock tick
Time read from Hardware Clock: 2009/11/29 23:24:06
Hw clock time : 2009/11/29 23:24:06 = 1259537046 seconds since 1969
Time elapsed since reference time has been 0.004192 seconds.
Delaying further to reach the next full second.
Setting Hardware Clock to 23:24:07 = 1259537047 seconds since 1969
ioctl(RTC_SET_TIME) was successful.
Clock drifted 0.0 seconds in the past 1259537035 seconds in spite of a drift factor of -0.000000 seconds/day.
Adjusting drift factor by 0.000000 seconds/day

# cat /proc/driver/rtc
rtc_time	: 23:24:07
rtc_date	: 2009-11-29
alrm_time	: 00:00:00
alrm_date	: ****-**-**
alarm_IRQ	: no
alrm_pending	: no
24hr		: yes
periodic_IRQ	: no
update_IRQ	: no
HPET_emulated	: no
DST_enable	: no
periodic_freq	: 1024
batt_status	: okay

# adjtimex -p
         mode: 0
       offset: 0
    frequency: 0
     maxerror: 16000000
     esterror: 16000000
       status: 64
time_constant: 2
    precision: 1
    tolerance: 32768000
         tick: 10000
     raw time:  1259537047s 509299us = 1259537047.509299
 return value = 5

# adjtimex -c$((60*24)) -i60
                                      --- current ---   -- suggested --
cmos time     system-cmos  error_ppm   tick      freq    tick      freq
1259537048       0.000319
1259537108      -0.016563     -281.4  10000         0
1259537168      -0.033440     -281.3  10000         0   10002   5327175
---- 8< ----
1259623268     -24.240457     -281.7  10000         0   10002   5355560
1259623328     -24.257361     -281.7  10000         0   10002   5356341
1259623388     -24.274265     -281.7  10000         0   10002   5356602

# rdate -vn ntp.uu.nl
Tue Dec  1 00:23:09 CET 2009
rdate: adjust local clock by 26.260063 seconds

# hwclock --debug --noadjfile --systohc --utc
hwclock from util-linux-ng 2.13.1.1
Using /dev interface to clock.
Assuming hardware clock is kept in UTC time.
Waiting for clock tick...
...got clock tick
Time read from Hardware Clock: 2009/11/30 23:23:09
Hw clock time : 2009/11/30 23:23:09 = 1259623389 seconds since 1969
Time elapsed since reference time has been 0.986044 seconds.
Delaying further to reach the next full second.
Setting Hardware Clock to 23:23:11 = 1259623391 seconds since 1969
ioctl(RTC_SET_TIME) was successful.
Clock drifted 2.0 seconds in the past 1259623379 seconds in spite of a drift factor of -0.000000 seconds/day.
Adjusting drift factor by 0.000136 seconds/day

# cat /var/log/tor/log|grep jumped
Nov 29 23:30:15.618 [warn] Your system clock just jumped 2189 seconds forward; assuming established
circuits no longer work.
Nov 30 00:35:45.024 [warn] Your system clock just jumped 3930 seconds forward; assuming established
circuits no longer work.
Nov 30 01:10:21.651 [warn] Your system clock just jumped 2076 seconds forward; assuming established
circuits no longer work.
---- 8< ----
Dec 01 00:04:25.164 [warn] Your system clock just jumped 675 seconds forward; assuming established
circuits no longer work.
Dec 01 00:13:47.230 [warn] Your system clock just jumped 562 seconds forward; assuming established
circuits no longer work.
Dec 01 00:23:11.885 [warn] Your system clock just jumped 564 seconds forward; assuming established
circuits no longer work.

# cat /etc/tor/torrc|grep ^[A-Z]|egrep -v Contact\|Nick
SocksPort 9050
SocksListenAddress 127.0.0.1
Log notice file /var/log/tor/log
ORPort 443
ORListenAddress 0.0.0.0:9030
RelayBandwidthRate 12 MB
RelayBandwidthBurst 12 MB
ExitPolicy reject *:*
AccountingStart week 7 00:00
AvoidDiskWrites 1
CircuitBuildTimeout 30
NumEntryGuards 6
KeepalivePeriod 60
NewCircuitPeriod 15
AccountingMax 80 GB
MaxAdvertisedBandwidth 70 KB

# dmesg|egrep -i 'pit|tsc|time|clock|clk|resolution'
[    0.000000] Fast TSC calibration using PIT
[    0.001017] Calibrating delay loop (skipped), value calculated using timer frequency.. 996.24 BogoMIPS (lpj=498123)
[    0.017055] geode-mfgpt:  8 MFGPT timers available.
[    0.018010] geode-mfgpt:  Registered timer 0
[    0.019036] mfgpt-timer:  Registering MFGPT timer 0 as a clock event, using IRQ 7
[    0.037274] Switched to high resolution mode on CPU 0
[    0.210329] pc87413 WDT: initialized. timeout=1 min
[    0.274223] rtc_cmos rtc_cmos: setting system clock to 2009-11-29 21:04:55 UTC (1259528695)
***********************************************************************
To unsubscribe, send an e-mail to majordomo <at> torproject.org with
unsubscribe or-talk    in the body. http://archives.seul.org/or/talk/
Permalink | Reply | 0 comments |

Gmane