Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of petertodd.org
	designates 62.13.149.95 as permitted sender)
	client-ip=62.13.149.95; envelope-from=pete@petertodd.org;
	helo=outmail149095.authsmtp.com; 
User-Agent: K-9 Mail for Android
In-Reply-To: <CANEZrP10sFWiBv=yi0YaPszzxrygfRhwTP8fdqKapSL1yucfow@mail.gmail.com>
References: <CAD5xwhhKKooGBfSY3nZzMmS=3WD=EdX9FQ7mZtQL3fkikuwyLg@mail.gmail.com>
	<20140728024030.GA17724@savin>
	<CAAS2fgR+r6VoUse_ropq=p3WTy_qWq68fpCQim1FhcbkCXYtsQ@mail.gmail.com>
	<E0F82AAE-1B71-4B8B-A5D5-0301BBECC317@osfda.org>
	<53D5BB5F.2060200@bitwatch.co>
	<CAAS2fgRVUbEM=7KQt-Haue=+sgAFu=HrfDdS0hhatNawci_eZQ@mail.gmail.com>
	<CANEZrP10sFWiBv=yi0YaPszzxrygfRhwTP8fdqKapSL1yucfow@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain;
 charset=UTF-8
From: Peter Todd <pete@petertodd.org>
Date: Mon, 28 Jul 2014 07:28:15 -0400
To: Mike Hearn <mike@plan99.net>, Gregory Maxwell <gmaxwell@gmail.com>
Message-ID: <b2f6693f-db93-4cb9-9c80-25f123c0b24e@email.android.com>
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Development <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Abnormally Large Tor node accepting only
	Bitcoin traffic
Precedence: list

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

I've got a bitcoin-only exit running myself and right now there is absolu=
tely no traffic leaving it. If the traffic coming from that node was legi=
t I'd expect some to be exiting my node too.

Multiple people have confirmed the node is connected to an abnormally lar=
ge % of the Bitcoin network. Looks like a Sybil attack to me, trying to h=
ide behind a Tor exit node for plausible deniability.


On 28 July 2014 06:16:16 GMT-04:00, Mike Hearn <mike@plan99.net> wrote:
>> As I pointed out above, =E2=80=94 it isn't really.  Without the exit f=
lag, I
>> believe no tor node will select it to exit 8333 unless manually
>> configured. (someone following tor more closely than I could correct
>> if I'm wrong here)
>>
>
>The "exit" flag doesn't mean what you would expect it to mean. The
>reason
>such a node won't get much traffic is that Tor speculatively builds
>circuits at startup on the assumption they'll be used for web browsing.
>Thus if you don't exit web traffic you won't get much in the way of
>traffic
>at least not until bitcoinj based wallets start shipping Tor mode.
>
>There's a perfectly reasonable explanation for why someone would run
>such a
>node. In fact I run a Tor exit that only allows port 8333 too: it's a
>way
>to contribute exit bandwidth without much risk of getting raided by the
>cops.
>
>Occam's razor and all ....
>
>
>------------------------------------------------------------------------
>
>------------------------------------------------------------------------=
------
>Infragistics Professional
>Build stunning WinForms apps today!
>Reboot your WinForms applications with our WinForms controls.
>Build a bridge from your legacy apps to the future.
>http://pubads.g.doubleclick.net/gampad/clk?id=3D153845071&iu=3D/4140/ost=
g.clktrk
>
>------------------------------------------------------------------------
>
>_______________________________________________
>Bitcoin-development mailing list
>Bitcoin-development@lists.sourceforge.net
>https://lists.sourceforge.net/lists/listinfo/bitcoin-development
-----BEGIN PGP SIGNATURE-----
Version: APG v1.1.1

iQFQBAEBCAA6BQJT1jPPMxxQZXRlciBUb2RkIChsb3cgc2VjdXJpdHkga2V5KSA8
cGV0ZUBwZXRlcnRvZGQub3JnPgAKCRAZnIM7qOfwhcFSB/9Sr+2an63QQe7TpGMA
zH5AG1bjcl4Tf/VGVBYK8K2kXsdtfEWNS+nJ9eCglPE1A7/Cc2LL3pksoJwdnt82
VyuH8FlWUXwnBeZvK/rYUvBz2FQupHYg5+ee+HZ6nYjKTDYrHuSUX+GlqMO2GPII
D3FhQRIfluuTQTpYoN0ui0DXQ4QDqZgwxFXWiblctA2m986bKFrqrJ5ohZXTDCnE
mTq//ZABykPPtEcou5G1kLjH9l5YMU4XeMyz6uzADXt0ZTHBDN3lOZ8sFPpJEi0z
VGh4QlT6fRQIiYsq0AzMyUvopSwsCyQy6yeMt/bCOdanmAIcGm+l8og3mlX2Ml5g
nQsg
=3D/w5n
-----END PGP SIGNATURE-----