this post was submitted on 11 Aug 2023
66 points (90.2% liked)

Lemmy.world Support

0 readers
1 users here now

Lemmy.world Support

Welcome to the official Lemmy.world Support community! Post your issues or questions about Lemmy.world here.

This community is for issues related to the Lemmy World instance only. For Lemmy software requests or bug reports, please go to the Lemmy github page.

This community is subject to the rules defined here for lemmy.world.

Support tickets can be created by sending an email to info@mastodon.world



founded 1 year ago
MODERATORS
 

I know you all are dealing with DDoS and how that goes. I run DDoS mitigation for some juicy targets and do a lot of on-call response to handle those issues, so believe me when I say I know what you are dealing with.

However, that being said, it appears you are blocking tor exit nodes with a 403, likely at your web termination point (nginx, apache, whatever), and this kind of sucks.

I get that tor can bring some attacks, and I fully support a modulated response to those attacks, preferably one with a reasonable time decay, but please don't just block all of tor

Alternatively, be one of the cool kids, and setup an onion service for lemmy.world!

you are viewing a single comment's thread
view the rest of the comments
[–] Puzzle_Sluts_4Ever@lemmy.world -4 points 1 year ago* (last edited 1 year ago) (1 children)

Again, what are you actually protecting yourself on by preventing random sites from seeing your IP?

Information your IP conveys:

  1. Probably what ISP you have
  2. Probably your general location unless you have gone out of your way to have a static IP for your home (in a way that is not just asking/paying your ISP for it)

So unless you have a very non-standard internet set up, it basically lets me know you are in Faketown, New Jersey. Which is not particularly useful information. And likely has already been conveyed to anyone you care about because of the tracking cookie for said Dominos.

The reason why this CAN be an issue and you see streamers block their IPs: DDOS attacks exist. But if you are going to websites that are likely to DDOS the visitors for poops and giggles... maybe consider going to different sites? Or, yeah, that is a use case for tor.

But the idea of putting ALL traffic through tor (just like ALL traffic through a vpn) just... mostly defeats the purpose of it because you are still making a nice and easily tracked "profile". And it is very clear that site admins can detect what is tor so that they don't assume you are regularly traveling between Faketown and Luxemburg or whatever.

This is an increasingly common problem with people who, quite frankly, are in the Dunning-Kruger regime of cybersecurity/infosec. They see a tool so they want to use it. They don't think about what that tool actually gives them or how using nothing but that tool can actually compromise them.

[–] twistypencil@lemmy.world 2 points 1 year ago* (last edited 1 year ago) (1 children)

Sorry, I cannot possibly match your asymmetric post length in my replies. I'll simply leave it at: I want to use Tor, for a lot of different reasons, not all of them are you going to eventually uncover with your argumentation, because I don't plan on talking about them, not because they are illegal. If you don't want to use it, then fine, its not for you. I was Tor today to get past some train internet, which is heavily filtered. Its very useful, but annoyingly I could not get to lemmy.world because tor was blocked. That ruined my enjoyment of my trip :)

I do not agree with you that using tor actually compromises you, but if you do, then go ahead and keep believing that. Seemed to work fairly well for Snowden, and quite a lot of others who depend on it daily.

[–] Puzzle_Sluts_4Ever@lemmy.world -4 points 1 year ago* (last edited 1 year ago) (1 children)

You have yet to refute a single point and the extent of your argument is "I want it".

Also, Snowden, really? The guy who got caught and had the Espionage Act thrown at him, fled to Russia, and now lives there until the end of his days? Putting his shit posting and memes through tor isn't protecting him. Last dollar in time, the US government (and other governments) know EXACTLY where he is at all times. Him being more useful to Russia as a political pawn than as currency to give to the US government is what keeps him safe.

But, and I realize this might be hard for you to understand: Tor is incredibly useful for some activities (I even said I suggest it to others in the comments you refuse to read). But the more you do through Tor as "you", the more of a profile there is which lets anyone who actually cares about you track you down.

Need to blow a whistle: Tor can be a good tool for that. But only if you are doing it from an identity that has never been linked to any of your personal identities AND the data doesn't contain anything that is identifiable either (that last bit being Snowden's problem, if I remember correctly).

[–] twistypencil@lemmy.world 1 points 1 year ago (1 children)

I suggest you open a post somewhere that is "I dont think people should use Tor" and we can argue that there. This seems fairly off-topic here and I don't plan on arguing with you about if I should use Tor or not. You can count that as a win if you want, I don't mind.

[–] Puzzle_Sluts_4Ever@lemmy.world -2 points 1 year ago* (last edited 1 year ago)

Why would I make that post? I have never said that.

All I have done is:

Ask why you want to use Tor to access Lemmy. Clearly the site team block those endpoints because they are common attack sources. You have yet to provide any argument outside of... literally responding to me talking about why you should not trust Lemmy or The Fediverse for anything that a government would care about by... claiming you need to use it because it protects you from the government.

I then made it a point to respond to the FUD you continue to propagate because, by pretending that putting all of your traffic through tor and then connecting to laughably insecure services, you are actively hurting those who actually need to protect their activities by basically telling them something on the level of "Tape a hideakey rock to the bottom of your car".

All of which seems on topic to me. At least moreso than "I want it"