Gentoo Forums :: View topic - Forums upgrade feedback and questions

Forums upgrade feedback and questions

View unanswered posts
View posts from last 24 hours

Goto page Previous 1, 2, 3, 4, 5 Next

Gentoo Forums Forum Index

Gentoo Forums Feedback

View previous topic :: View next topic

Author

Message

nixnut
Bodhisattva

Joined: 09 Apr 2004
Posts: 10974
Location: the dutch mountains

Posted: Sun Jul 31, 2005 1:02 pm Post subject:

TrueDFX wrote:

nixnut wrote:

TrueDFX wrote:

The reason for blocking posting from Tor has been given. The reason for blocking reading for Tor has not.

Actually it has.

If you're referring to "Due to the way that this is implemented, it is impossible to differentiate between users who are logged in and those who are not, this is why you can't read the forums whilst using Tor." -- that says neither why it's required nor why it's desirable, plus I already responded to that earlier.

I was refering to the entire text. Why are you ignoring the parts of tomks post that do address the reason of banning tor?

For your convenience I've edited into parts that may be easier to digest for you :wink:

The reason to take measures:

Quote:

We've had people who are abusing the forums whilst using Tor in an attempt to hide their identity from the admins, simply disabling their accounts isn't effective as they can create a new one straight away.

The action taken:

Quote:

We have been discussing this issue and eventually the only option available was to ban Tor.

The consequences:

Quote:

Due to the way that this is implemented, it is impossible to differentiate between users who are logged in and those who are not, this is why you can't read the forums whilst using Tor.

The conclusion:

Quote:

It may be seen as a drastic measure, but it's one that had to be taken.

If you have questions concerning the technical aspects of the implementation you should address them to the admins. Personally I am willing to defer to their judgement that the choosen implementation was the only one realistically feasable in the circumstances.
_________________
Please add [solved] to the initial post's subject line if you feel your problem is resolved. Help answer the unanswered

talk is cheap. supply exceeds demand

TrueDFX
Retired Dev

Joined: 02 Jun 2004
Posts: 1348

Posted: Sun Jul 31, 2005 1:13 pm Post subject:

Either I am just fucking stupid or that post says absolutely nothing about why reading is disallowed. Were these forums abused by reading them? (Edit: Fuck this. Count me gone.)

TorOp
n00b
n00b

Joined: 31 Jul 2005
Posts: 3
Location: California

Posted: Sun Jul 31, 2005 6:33 pm Post subject:

Quote:

Look, if you are trying to convince me that tor and freenet and other anonymisers have a real reason to exist, that's not necessary. I'm aware of all that and I agree that there is a need for such tools. But I simply fail to see why the Gentoo forums should accept traffic from tor. And so far I've not heard arguments to convince me that there is a real reason to use tor to access these forums.

A roommate (behind the same ip - nat) could not access these forums (just to browse) yesterday, he was NOT using tor, however I run a tor exit server, and the first line of my configuration is "reject *:80"- my exit server's ip did not show up in your logs (unless people are browsing these forums on some non-standard port). I'm not blocking 80 to be nice, I do it because my AV software altering the port 80 traffic, so that excludes my exit node from being used for http:80 traffic.

How exactly are you choosing to block tor nodes? If you're just grabbing the OR directory, you need to also check that a port 80 exit exists for each node; unless this is really just a case of FUD and you just don't like tor, so all ORs are blocked.

While I agree that sometimes tor (and the internet itself) is used by some jerks to crapflood, I don't see the point of also disabling reading of these forums, as I can't picture a workable DOS attack being done through tor.

I think your current solution is using too big of a tool for the problem, kind of like banning an entire isp's subnet based on one ip's bad behavior.
_________________
-No sig, I'm on the patch....

TorOp
n00b
n00b

Joined: 31 Jul 2005
Posts: 3
Location: California

Posted: Sun Jul 31, 2005 6:43 pm Post subject:

Quote:

Due to the way that this is implemented, it is impossible to differentiate between users who are logged in and those who are not, this is why you can't read the forums whilst using Tor.

Perhaps you need change the way this is implemented, as the union of the sets of tor users and gentoo users is quite large.

slashdot also bans ips that abuse their site (but NOT PREEMPTIVELY): they also manage to allow browsing of the site from banned ips, whether or not a user is logged in at the time. Maybe you could ask them for some tips and help...
_________________
-No sig, I'm on the patch....

ian!
Bodhisattva

Joined: 25 Feb 2003
Posts: 3829
Location: Essen, Germany

Posted: Sun Jul 31, 2005 7:01 pm Post subject:

TorOp wrote:

A roommate (behind the same ip - nat) could not access these forums (just to browse) yesterday, he was NOT using tor, however I run a tor exit server

That's not our problem then. It's you who is blocking your roommates access to the forums due to the fact that you're running a tor exit server.

I don't see a reason why to discuss this topic any further.

If you want to use/browse the gentoo forums don't use tor.

It's that simple.
_________________
"To have a successful open source project, you need to be at least somewhat successful at getting along with people." -- Daniel Robbins

TorOp
n00b
n00b

Joined: 31 Jul 2005
Posts: 3
Location: California

Posted: Sun Jul 31, 2005 8:37 pm Post subject:

Quote:

That's not our problem then. It's you who is blocking your roommates access to the forums due to the fact that you're running a tor exit server.

I can only assume that your actual reason for doing this is as an attack against the tor project, and not a measure to prevent abuse of the gentoo forums, as it has been pointed out that not all tor exit servers allow connections to port 80.

Since you don't allow even the browsing, it must be because you don't wish to spend the time, or don't have a programmer talented enough to modify the code to just ban posting as opposed to browsing and posting.

Quote:

I don't see a reason why to discuss this topic any further.

Neither do I, there is obviously no way to reason with uninformed, uneducated FUD.
_________________
-No sig, I'm on the patch....

pjp
Administrator

Joined: 16 Apr 2002
Posts: 20067

Posted: Mon Aug 01, 2005 12:30 am Post subject:

TrueDFX wrote:

Either I am just fucking stupid or that post says absolutely nothing about why reading is disallowed. Were these forums abused by reading them?

(Edit: Fuck this. Count me gone.)

Quote:

it is impossible to differentiate between users who are logged in and those who are not, this is why you can't read the forums whilst using Tor.

If you could clarify why you think that is unclear, that'd be great. I'm sure we'd all like an explanation that was as clear to as many users as possible.

And since he's apparently gone, if anyone else finds it confusing, please try co clarify. (Posting "why?" when a why has clearly been given doesn't help.)
_________________
Quis separabit? Quo animo?

jmbsvicetto
Moderator

Joined: 27 Apr 2005
Posts: 4734
Location: Angra do Heroísmo (PT)

Posted: Mon Aug 01, 2005 1:54 am Post subject:

pjp, can you comment my previous post? Can any Admin or Moderator please comment my post? https://forums.gentoo.org/viewtopic-p-2613434.html#2613434 edit: corrected the link _________________ Jorge. Your twisted, but hopefully friendly daemon. AMD64 / x86 / Sparc Gentoo Help answer \|\| emwrap.sh Last edited by jmbsvicetto on Wed Aug 03, 2005 7:41 pm; edited 1 time in total

Pseud
Apprentice

Joined: 19 Mar 2004
Posts: 273
Location: Bangalore, India

Posted: Mon Aug 01, 2005 6:15 am Post subject:

Ok, for a change, since this thread is supposedly for any questions or feedback, here's a small non-Tor issue This url reference doesn't work anymore, for some reason: Look at the changelog. Probably because of the '*'s? I know it worked before the upgrade ... was in an earlier post of mine. _________________ eschew obfuscation

kallamej
Administrator

Joined: 27 Jun 2003
Posts: 4975
Location: Gothenburg, Sweden

Posted: Mon Aug 01, 2005 10:06 am Post subject:

Pseud wrote:

Probably because of the '*'s? I know it worked before the upgrade ... was in an earlier post of mine.

Yes, this is due to a security fix in upstream phpBB 2.0.17. Previously, there was a set of characters not allowed in url tags, whilst the current implementation has a set of allowed characters. Although easily fixable, we have to make sure that there are no security implications. As a workaround, you can link to the directory, leaving the desired target one click away.
_________________
Please read our FAQ Forum, it answers many of your questions.
irc: #gentoo-forums on irc.libera.chat

incubator
Guru
Guru

Joined: 05 Jun 2003
Posts: 584
Location: Belgium

Posted: Mon Aug 01, 2005 1:39 pm Post subject:

stupid question maybe but ehm...i run Tor in the background here now, it said it successfolly opened a circuit. So how come I can post and read in the forum now ? _________________ Programming today is a race between Software Engineers striving to build bigger and better idiot-proof Programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning!

pilla
Bodhisattva

Joined: 07 Aug 2002
Posts: 7729
Location: Underworld

Posted: Mon Aug 01, 2005 1:54 pm Post subject:

TorOp wrote:

That's FUD. We don't have anything against the Tor project itself, the problem is that we have users that have been banned but still they come back through Tor to abuse the forums. I'm sorry if banning Tor hurts some users and that we haven't had implemented a fine grain Tor blocking policy, but we are a OSS project with limited resources.
_________________
"I'm just very selective about the reality I choose to accept." -- Calvin

amne
Bodhisattva

Joined: 17 Nov 2002
Posts: 6378
Location: Graz / EU

Posted: Mon Aug 01, 2005 1:58 pm Post subject:

jmbsvicetto wrote:

... refusing to serve any page to a server on the Tor network.

Yes, this is what we currently do. If your IP is the one of a tor exit node allowing traffic to the forums on port 80, you get redirected (by the webserver) to a page telling you that access with tor is disabled. The list is updated every 24 hours.
If you run a tor server/exit node that does not allow traffic to f.g.o you should not be affected by the ban.
_________________
Dinosaur week! (Ok, this thread is so last week)

pjp
Administrator

Joined: 16 Apr 2002
Posts: 20067

Posted: Mon Aug 01, 2005 3:07 pm Post subject:

jmbsvicetto wrote:

can you comment my previous post? Can any Admin or Moderator please comment my post?

First, your URL takes people to a "quote." Not ideal. As for your questions, I don't know the details.
_________________
Quis separabit? Quo animo?

PacketCollision
n00b
n00b

Joined: 15 Sep 2003
Posts: 13
Location: Davis, California

Posted: Tue Aug 02, 2005 8:42 am Post subject:

I am very much against the Tor decision for the simple reason that it means no one in the Gentoo community can run Tor exit points. For users, it's quite simple to add

Code:

forward forums.gentoo.org .

to the privoxy config file (right after the tor line)

Code:

forward-socks4a / localhost:9050 .

so as to bypass Tor for forums.gentoo.org.

I am still very angry about this decision, and would much rather deal with some flames/spam on these forums than have what software I can run be dictated by the very community that is supposedly all about choice.

Perhaps the problems (that people abusing tor could were causing) be explained more clearly so that people can understand better the reasoning behind the decision, and possibly come up with an alternate solution.

(btw, the block isn't even very effective. I was using Tor for about 10 minutes on the forums before I got an error message.)

amne
Bodhisattva

Joined: 17 Nov 2002
Posts: 6378
Location: Graz / EU

Posted: Tue Aug 02, 2005 9:01 am Post subject:

PacketCollision wrote:

I am very much against the Tor decision for the simple reason that it means no one in the Gentoo community can run Tor exit points.

As stated several times before, only exit nodes that allow traffic to the forums are banned. So if you run an exit point and don't want to be blacklisted, just don't allow traffic to these forums.

PacketCollision wrote:

I am still very angry about this decision, and would much rather deal with some flames/spam on these forums than have what software I can run be dictated by the very community that is supposedly all about choice.

Why do people always come up with that all about choice argument? These are support forums and if we feel tor is hurting us, why don't we have the choice to ban it?

PacketCollision wrote:

Perhaps the problems (that people abusing tor could were causing) be explained more clearly so that people can understand better the reasoning behind the decision, and possibly come up with an alternate solution.

We've had a constant level of abuse coming from tor IPs - same stuff that also comes from regular IPs. Differently to regular IPs it is much harder to track those folks using tor, which makes it more time consuming work for us.

PacketCollision wrote:

(btw, the block isn't even very effective. I was using Tor for about 10 minutes on the forums before I got an error message.)

Interesting, the block seems to work fine for me. When was that?
_________________
Dinosaur week! (Ok, this thread is so last week)

jmbsvicetto
Moderator

Joined: 27 Apr 2005
Posts: 4734
Location: Angra do Heroísmo (PT)

Posted: Tue Aug 02, 2005 12:52 pm Post subject:

pjp wrote:

jmbsvicetto wrote:

can you comment my previous post? Can any Admin or Moderator please comment my post?

First, your URL takes people to a "quote." Not ideal. As for your questions, I don't know the details.

pjp, yes that's true and I'm sorry for that. Can you tell me how I can add a direct link to the post instead? I didn't do it myself because I wasn't able to figure out how to do it. I also debated for a while if I should include or not the link to a quote, but that was the only way I could point everyone to my previous post.
Once more, I'm sorry for that.
About my questions, can the Administrator(s) or Moderator(s) responsible for the update answer them?
Just for the record, I'm not using Tor and am thus not affected by the update. However, I think that if possible a better solution would be to prevent posting, but not reading from Tor.

edit: Thanks to nixnut, I've corrected the link.
_________________
Jorge.

Your twisted, but hopefully friendly daemon.
AMD64 / x86 / Sparc Gentoo
Help answer || emwrap.sh

Last edited by jmbsvicetto on Wed Aug 03, 2005 7:42 pm; edited 1 time in total

nixnut
Bodhisattva

Joined: 09 Apr 2004
Posts: 10974
Location: the dutch mountains

Posted: Tue Aug 02, 2005 2:43 pm Post subject:

jmbsvicetto wrote:

Can you tell me how I can add a direct link to the post instead?

The image on the left of "Posted: Tue Aug 02, 2005... etc" is a link to the post. You can use the BB code [post] tags to create a link in your post.

Quote:

However, I think that if possible a better solution would be to prevent posting, but not reading from Tor.

The admins are trying to create a workable solution for this. It will take some time to test things and determine what will work and what won't, but the issue is looked into.
_________________
Please add [solved] to the initial post's subject line if you feel your problem is resolved. Help answer the unanswered

talk is cheap. supply exceeds demand

anoland
Tux's lil' helper

Joined: 27 May 2003
Posts: 86

Posted: Tue Aug 02, 2005 3:55 pm Post subject:

amne wrote:

PacketCollision wrote:

I am very much against the Tor decision for the simple reason that it means no one in the Gentoo community can run Tor exit points.

As stated several times before, only exit nodes that allow traffic to the forums are banned. So if you run an exit point and don't want to be blacklisted, just don't allow traffic to these forums.

I'm with PacketCollision on this one. I feel ripped off just because I happen to run a tor server. But, since there isn't anything I can do about it, how exactly do I go about configuring my server to access the forums if you block the whole IP???

ian!
Bodhisattva

Joined: 25 Feb 2003
Posts: 3829
Location: Essen, Germany

Posted: Tue Aug 02, 2005 4:41 pm Post subject:

anoland wrote:

I feel ripped off just because I happen to run a tor server. But, since there isn't anything I can do about it, how exactly do I go about configuring my server to access the forums if you block the whole IP???

Same here:

ian! wrote:

If you want to use/browse the gentoo forums don't use tor.

It's that simple.

On the other hand you could use another public proxy server.
_________________
"To have a successful open source project, you need to be at least somewhat successful at getting along with people." -- Daniel Robbins

pilla
Bodhisattva

Joined: 07 Aug 2002
Posts: 7729
Location: Underworld

Posted: Tue Aug 02, 2005 4:51 pm Post subject:

anoland wrote:

I'm with PacketCollision on this one. I feel ripped off just because I happen to run a tor server.

Find and complain to the users that are abusing our forums. We cannot help providing information about them, as they are hidden by Tor.
_________________
"I'm just very selective about the reality I choose to accept." -- Calvin

anoland
Tux's lil' helper

Joined: 27 May 2003
Posts: 86

Posted: Tue Aug 02, 2005 6:02 pm Post subject:

ian! wrote:

anoland wrote:

Same here:

ian! wrote:

If you want to use/browse the gentoo forums don't use tor.

It's that simple.

On the other hand you could use another public proxy server.

ian!: you just illustrated the ridiculousness of the admin's stance against tor. I happen to run a tor server and had the presence of mind to register it with the tor admins. This means that the IP address of my server is on the list you admins pull down to update the forum's blacklist with. But your solution to my problem is to use ANOTHER proxy service????? Talk about department of redundancy department. What is to keep me from using that proxy service to crapflood or spam or what ever it is that is keeping the admins/mods so busy. I understand you all have better things to do than to delete bogus posts and I appreciate the effort you all go to in order to make this a productive forum, but clearly tor isn't the problem and thereby banning it's use in the forums isn't the solution. I can't see how blacklisting the tor servers is any different from blacklisting a large ISP's network. There is the same problem there: a bunch of lamers using recycled addresses to post garbage. Meanwhile most legitimate users get punished for a few bad apples.

How about these for solutions instead:
1) new accounts can only read for the first day or so.
2) do what slashdot does and throttle the amount of postings per minute or 15 minutes or so.
3) comparing the posting IP to the tor blacklist IP list. If I'm logged in and the IPs match, then I'm tracable to that IP and if I'm abusive then action can be taken.
4) young accounts, say those with <100 posts (yep, mine included) have to jump through extra hoops to post. The idea is to make it to "expensive" to crapflood or get overly abusive.
4a) disallow new accounts from tor servers, instead of banning them outright. Log the IP on account creation. Now you have a way to track down those lusers.
5) get more moderators to deal with the extra posts.

I realize that 1-4 are all upstream to the phpBB maintainers, but I'm sure they are painfully aware of this problem and are working it too. If #5 is a possibility, put me down to help out. I'm willing to help tackle the problem if it means I get to use tor and the forums at the same time.

amne
Bodhisattva

Joined: 17 Nov 2002
Posts: 6378
Location: Graz / EU

Posted: Tue Aug 02, 2005 6:55 pm Post subject:

anoland wrote:

I feel like i'm repeating myself a bit here: Set up your server not to be an exit node to forums.gentoo.org (i don't know how to do that, read the tor docs about it). If your server doesn't allow connections to the forums, it won't be blacklisted.

anoland wrote:

I understand you all have better things to do than to delete bogus posts and I appreciate the effort you all go to in order to make this a productive forum, but clearly tor isn't the problem and thereby banning it's use in the forums isn't the solution.

In fact tor is a problem.

anoland wrote:

I can't see how blacklisting the tor servers is any different from blacklisting a large ISP's network. There is the same problem there: a bunch of lamers using recycled addresses to post garbage. Meanwhile most legitimate users get punished for a few bad apples.

There is a big difference: You can deliberately choose to use the tor network or not. If the bad apples drive someone into banning tor you can still turn it off.
And yes, it's a real pity there'll always be some people turning something into something else than desired and we didn't decide to ban tor easily.

anoland wrote:

How about these for solutions instead:
1) new accounts can only read for the first day or so.
2) do what slashdot does and throttle the amount of postings per minute or 15 minutes or so.

Not really related to tor. 1) doesn't help much against spammers or other trolls, often accounts are created to be used a few days later. We also have implemented a 1 post per 30 seconds feature.

anoland wrote:

3) comparing the posting IP to the tor blacklist IP list. If I'm logged in and the IPs match, then I'm tracable to that IP and if I'm abusive then action can be taken.

Not sure what exactly you are suggesting, but even if you are logged in via tor, you could also log in pretending to be another user via tor.

anoland wrote:

4) young accounts, say those with <100 posts (yep, mine included) have to jump through extra hoops to post. The idea is to make it to "expensive" to crapflood or get overly abusive.

Next thing would be everyone complaining for being "punished". We already have the tor users complaining about that.

anoland wrote:

4a) disallow new accounts from tor servers, instead of banning them outright. Log the IP on account creation. Now you have a way to track down those lusers.

Playing devil's advocate here: If your IP gets logged once, you're tainted anyway - why still use tor then?

anoland wrote:

5) get more moderators to deal with the extra posts.

We currently have enough moderators to deal with it, but tracking annoying users is a waste of moderator's time in general - It can be used for better purposes than that.
Speaking of time, the current situation has one big advantage: It's less complex to implement than anything else. Our technical todo list is long enough already, e.g. the still pending conversion to UTF-8. Some forums will created only once that is done. In my opinion (and it's really mine) this should have higher priority than having a finer granulated solution for tor.
_________________
Dinosaur week! (Ok, this thread is so last week)

pilla
Bodhisattva

Joined: 07 Aug 2002
Posts: 7729
Location: Underworld

Posted: Tue Aug 02, 2005 7:00 pm Post subject:

anoland wrote:

How about these for solutions instead:
1) new accounts can only read for the first day or so.

What about users that have problems with their installs? Should they wait a day before being allowed to post their questions?

anoland wrote:

2) do what slashdot does and throttle the amount of postings per minute or 15 minutes or so.

We have also problems with users that create new accounts after being banned for other reasons that not flooding the forums.

anoland wrote:

3) comparing the posting IP to the tor blacklist IP list. If I'm logged in and the IPs match, then I'm tracable to that IP and if I'm abusive then action can be taken.

See answer to 2.

anoland wrote:

4) young accounts, say those with <100 posts (yep, mine included) have to jump through extra hoops to post. The idea is to make it to "expensive" to crapflood or get overly abusive.

Who's gonna implement and test it? Besides, see answer to 2.

anoland wrote:

4a) disallow new accounts from tor servers, instead of banning them outright. Log the IP on account creation. Now you have a way to track down those lusers.

It doesn't help with 2.

anoland wrote:

5) get more moderators to deal with the extra posts.

It doesn't help with 2 again, because these users are hard to identify. For now, we are banning Tor from fgo until we get somebody to implement and test a fine control.
_________________
"I'm just very selective about the reality I choose to accept." -- Calvin

anoland
Tux's lil' helper

Joined: 27 May 2003
Posts: 86

Posted: Tue Aug 02, 2005 8:24 pm Post subject:

pilla wrote:

anoland wrote:

How about these for solutions instead:
1) new accounts can only read for the first day or so.

What about users that have problems with their installs? Should they wait a day before being allowed to post their questions?

Uh... yeah. Why not? That would be an ideal opportunity to encourage them to learn and use the search utility instead of posting poorly-formed and inexperienced posts. I don't see this as a bad thing.

pilla wrote:

anoland wrote:

2) do what slashdot does and throttle the amount of postings per minute or 15 minutes or so.

We have also problems with users that create new accounts after being banned for other reasons that not flooding the forums.

This is still possible with or without tor. I could go down to my public library and make a new account on any of their machines. Banning tor doesn't stop this.

amne wrote:

anoland wrote:

PostPosted: Tue Aug 02, 2005 11:55 am Post subject:
anoland wrote:
I'm with PacketCollision on this one. I feel ripped off just because I happen to run a tor server. But, since there isn't anything I can do about it, how exactly do I go about configuring my server to access the forums if you block the whole IP???

I tried adding

Code:

ExitPolicy reject 140.211.166.170:80

to my torrc. I'll try again tomorrow.

Display posts from previous:

	Gentoo Forums Forum Index Gentoo Forums Feedback	All times are GMT Goto page Previous 1, 2, 3, 4, 5 Next
Page 2 of 5

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Copyright 2001-2024 Gentoo Foundation, Inc. Designed by Kyle Manna © 2003; Style derived from original subSilver theme. | Hosting by Gossamer Threads Inc. © | Powered by phpBB 2.0.23-gentoo-p11 © 2001, 2002 phpBB Group
Privacy Policy