[HN Gopher] Tell HN: Stack Exchange (Stack Overflow) is now bloc...
       ___________________________________________________________________
        
       Tell HN: Stack Exchange (Stack Overflow) is now blocking Tor
        
       I tried visiting Stack Exchange today using Tor Browser, and
       apparently my IP is blocked. I tried with several different
       circuits, and they're all blocked. Several people on IRC confirmed
       this as well.  I tried to contact them by e-mail and they didn't
       bother to respond, as is par for the course these days.  The full
       error message:  ---                 Access Denied            This
       IP address (185.220.101.37) has been blocked from access to our
       services. If you believe this to be in error, please contact us at
       team@stackexchange.com.            When contacting us, please
       include the following information in the email:            Method:
       block            XID: 820408900-HHN            IP: 185.220.101.37
       X-Forwarded-For: 185.220.101.37            User-Agent: Mozilla/5.0
       _Windows NT 10.0; rv:91.0_ Gecko/20100101 Firefox/91.0
       Reason: Blocked.            Time: Tue, 08 Feb 2022 08:11:50 GMT
       URL: tor.stackexchange.com/            Browser Location:
       https://tor.stackexchange.com/
        
       Author : yanmaani
       Score  : 395 points
       Date   : 2022-02-08 08:12 UTC (14 hours ago)
        
       | fabian2k wrote:
       | There was no intentional blocking of Tor there in the past as far
       | as I understand. But there are some mechanisms that block users
       | from IP addresses that posted spam or abusive content. Those are
       | automated and based on flags and not directed towards Tor
       | specifically, but of course TOR addresses are more likely to have
       | been misused that way so your chances of encountering these
       | blocks is dramatically higher when using Tor. But these blocks
       | only apply to low reputation users, I think once you're above 100
       | they don't matter anymore. And they also don't block reading the
       | sites.
       | 
       | There have been DDoS attacks recently on Stack Overflow and Stack
       | Exchange, I think it's quite plausible those have something to do
       | with this. They still seem to be under active attack
       | intermittently.
        
         | Renaud wrote:
         | That doesn't explain why you can't read the site. OP is
         | mentioning that they can't access the site at all.
        
           | zalebz wrote:
           | It potentially could be related to all of the "knock-off"
           | websites that scrape StackExchange data. Maybe they are going
           | outbound on various Tor nodes and getting the IPs blacklisted
           | as a result of reading thousands of pages too rapidly.
        
             | capableweb wrote:
             | Given my experience with the network quality of Tor, I'd be
             | surprised if scraping was A) efficient to do over Tor and
             | B) that Stack Overflow would even notice it because as I
             | said, the network speed is too slow, so can't add that much
             | traffic compared to the absolutely staggering amount of
             | traffic they get from non-Tor.
        
               | jks wrote:
               | Also, what would be the point? It's easier to download a
               | data dump from https://archive.org/details/stackexchange
        
               | raverbashing wrote:
               | You would be surprised/disappointed at the amount of
               | abuse the bigger sites have to handle
               | 
               | Things like this
               | https://news.ycombinator.com/item?id=26072025
        
               | capableweb wrote:
               | Interesting, but doesn't fit the context of Stack
               | Exchange blocking Tor. Your example there is regarding a
               | mobile app hotlinking a image of a flower, which seems
               | easy enough to block/fix, while Stack Exchange blocking
               | all Tor users from even reading Stack Overflow doesn't
               | make so much sense.
        
               | rovr138 wrote:
               | 1 image abused enough, they dig, find the culprit being
               | an app.
               | 
               | Fixes, updating the app, blocking the image, blocking all
               | requests with empty user agents.
               | 
               | ------
               | 
               | 1 person abused enough SO, they dig, find the culprit
               | being someone using Tor network.
               | 
               | Fixes, identify the user and ask them to stop, block all
               | traffic from Tor.
               | 
               | -------
               | 
               | Do you propose an alternative fix?
        
               | zalebz wrote:
               | I wasn't aware that existed and obviously that would make
               | any scraping utterly useless
        
           | fabian2k wrote:
           | That's why I suspect it's something new and might be related
           | to the DDoS. The main spam and abuse problems are handles by
           | the system I mentioned, which is not the reason here. So this
           | is likely a defense against something else.
        
             | yanmaani wrote:
             | You're looking at simple, static pages. Unless something is
             | horribly wrong with their infrastructure, these should take
             | milliseconds to generate, if even that.
        
               | jasode wrote:
               | _> You're looking at simple, static pages. _
               | 
               | Stackoverflow pages have many _dynamic_ components like
               | vote counts, reputation points, sidebar related-
               | questions-links, new comments, etc. An excerpt from their
               | blog explains they can 't cache the output :
               | https://nickcraver.com/blog/2019/08/06/stack-overflow-
               | how-we...
               | 
               | Even though Stackoverflow's website io access pattern has
               | higher reads than writes, the resultant generated html is
               | still not as static as Wikipedia pages. Even if they're
               | efficiently using cpu to generate the dynamic elements,
               | the cost of egress traffic may also be a factor.
               | 
               | All that said, I don't have any insight into what
               | heuristics they use to block certain ip addresses.
        
               | southerntofu wrote:
               | That blogpost is intriguing!
               | 
               | > variants of cache... anonymous, or not? mobile, or not?
               | deflate, gzip, or no compression?
               | 
               | I don't understand why the markup would vary between
               | mobile/desktop, or why they would even consider
               | compression a varying factor to account for in cache.
               | Maybe that's because their backends produce such specific
               | variants that they have a hard time caching in the first
               | place?
               | 
               | If 80% of pages are only requested every two weeks, then
               | it doesn't make sense to cache those. There's still
               | probably lots of stuff you can cache, such user
               | profile/stats and question/answer scores for several
               | minutes. You can also cache many parts of the markup that
               | are not going to change often. I mean it's always even
               | better when you cache the entire markup, but there can
               | still be lots to gain if you cache only small bits that
               | are expensive to acquire/template.
               | 
               | > But the cost of memory to store those strings (most
               | large enough to go directly on the large object heap) is
               | very non-trivial. And the cost of the garbage collector
               | cleaning them up is also non-trivial.
               | 
               | It looks like their cache implementation could (should?)
               | have been based on better foundations. First, i think the
               | cache doesn't have to reside in memory: disk accesses are
               | fast, certainly much faster than running a database query
               | over the network which will need to access several files
               | and cross-reference data with extra latency on top. Then,
               | because if you're gonna store long-lived stuff in memory
               | you should probably use a garbage collector based that's
               | tailored for this usecase, not your language's (.Net)
               | default GC... maybe Redis? Don't get me wrong, i find it
               | pretty cool if some engineers want to develop a homebrew
               | cache, but that sounds like a huge project in itself.
               | 
               | > the cost of egress traffic
               | 
               | I'm not aware of SO tech stack, but i'd be surprised if
               | they have much egress fees. They're a _very_ big site so
               | they probably run off unmetered dedicated servers if not
               | their own hardware on cheap transit. Who knows, they may
               | even have their own AS and peer with other providers in
               | some locations? From a quick request, it looks like
               | stackoverflow.com is served from Fastly AS but i
               | personally don 't understand why: i don't remember seeing
               | any heavy content (video/images) on SO so in that kind of
               | situation a CDN would hurt more than help on slow links.
               | Maybe that's because they bundle megabytes of javascript
               | crap? Now that they're blocking tor users i can't check
               | for myself :-)
        
               | badprose wrote:
               | They do use Redis. They have a page on their tech here:
               | https://stackexchange.com/performance
        
               | yanmaani wrote:
               | OK, that's true, they're not static, but we're still
               | talking about a few database queries which quickly hit
               | indexed columns. If you're running a public website like
               | this, it's not like each page takes several seconds to
               | load.
               | 
               | The egress traffic is also trivial - a page seems to
               | clock in at below 50k. If they're paying $0.02/GB, that's
               | $1 / million requests.
               | 
               | More importantly, if it really were a DoS attack, there's
               | way less obtrusive methods, such as a CAPTCHA or similar
               | verification screen.
        
               | fabian2k wrote:
               | They're not static pages, the lists of questions, users
               | and everything else are dynamic. Some of them are
               | obviously heavily cached, but you can't cache everything.
               | It's certainly possible to find more expensive pages if
               | you put in some effort.
        
               | yanmaani wrote:
               | Grant that some of them are more expensive. But why can't
               | I visit _any_ page?
        
         | GentooInstaller wrote:
         | It was never "TOR", it's; Tor:
         | https://matt.traudt.xyz/posts/2021-02-22-tor-spelling.
         | 
         | The new blocking completely blocks access to the site, not just
         | posting. See for yourself; https://www.torproject.org/
         | 
         | Tor is next to useless for DDoS attacks, as it doesn't offer
         | any amplification. For every byte you send in via TCP, you get
         | one byte out. For attackers with large botnets, it doesn't make
         | sense to DDOS over Tor, as the number of exiting IP addresses
         | are limited and it's easy to block them all. It makes more
         | sense to use your thousands of available botnet IP's that
         | aren't on any lists.
        
           | dotancohen wrote:
           | > Tor is next to useless for DDoS attacks, as it doesn't
           | offer any amplification.
           | 
           | It seems that these attacks are not being carried out to take
           | down the Stack Exchange network. It seems that these attacks
           | are to take down Tor as a legitimate technology. Here me out.
           | 
           | In order to carry out these attacks, the attacker already
           | controls enough machines to DDoS one of the largest websites
           | on the internet. So, huge botnet or nation state. Now, we
           | have one of the largest websites on the internet telling it's
           | tech audience:                 > An immediate solution for
           | users who find themselves blocked is to access our site
           | > from other IP addresses, via home internet, work internet,
           | or other VPN services
           | 
           | https://meta.stackexchange.com/questions/376060/update-on-
           | th...
           | 
           | They are normalizing the "workaround" of using an insecure IP
           | address when Tor is inaccessible. This will lead to all non-
           | secretive and non-illicit Tor usage to go back to the open
           | insecure internet. Thus, everyone still using Tor "has
           | something to hide" (as if that wasn't the case already). By
           | forcing all but the most desperate users off Tor, Tor can be
           | discredited as a nefarious tool.
        
             | Centigonal wrote:
             | >They are normalizing the "workaround" of using an insecure
             | IP address when Tor is inaccessible. This will lead to all
             | non-secretive and non-illicit Tor usage to go back to the
             | open insecure internet. Thus, everyone still using Tor "has
             | something to hide" (as if that wasn't the case already). By
             | forcing all but the most desperate users off Tor, Tor can
             | be discredited as a nefarious tool.
             | 
             | I think this is a reach - after all, if you wanted to
             | discredit a tool for people in oppressive regimes, people
             | who care about their privacy, and people doing illegal
             | things, why start with the programming help site? (I know
             | SE has other sites, but the biggest ones are for tech help)
             | 
             | ...That said, I could see this being a way LE could try and
             | unmask a very high-value darkweb programmer. Still a reach.
        
               | DoctorOW wrote:
               | > I think this is a reach - after all, if you wanted to
               | discredit a tool for people in oppressive regimes, people
               | who care about their privacy, and people doing illegal
               | things, why start with the programming help site? (I know
               | SE has other sites, but the biggest ones are for tech
               | help)
               | 
               | My guess is they'd target websites that are important to
               | TOR users, and tor.stackexchange.com is one of them. I
               | also don't think they started with SE. TOR IPs are
               | continually filtered by Google, Cloudflare, and other
               | automated firewalls.
        
           | colinmhayes wrote:
           | Their blog is claiming most of the ddos traffic came over
           | tor.
        
           | Centigonal wrote:
           | Maybe SO has blocked all the the attacker's available IPs
           | after their previous attacks, and is now resorting to Tor to
           | mask their traffic?
        
       | cletus wrote:
       | This isn't _necessarily_ deliberate.
       | 
       | Example: years ago at Google we had proxies for Web traffic.
       | Around lunch time you could hit an issue with HN where the
       | traffic was blocked for too many visits from the same IP. There
       | were thousands of engineers and they were concentrated on 1-2
       | proxy IPs.
       | 
       | A lot of systems tackle potential abuse (eg brute forcing
       | passwords, DoS attacks) with a token and bucket algorithm.
       | Example: a given source IP might get 20 tokens. Each visit uses a
       | token and those tokens are regenerated 1 per 2 seconds.
       | 
       | So with a Tor exit node you may just be hitting abuse protection
       | and that could happen on the CDN, gateway servers, internal
       | servers and so on.
        
         | miohtama wrote:
         | Also, as a user the solution is to use high quality VPN, not
         | Tor or any free VPN that are ripe for abuse.
        
       | chaoz_ wrote:
       | Maybe Stackoverflow finally started to aggressively block
       | everything that might "crawl" their data. I'm super tired of all
       | the paraphrased/translated copies in Google results.
        
         | 1337shadow wrote:
         | Which don't even link to original contents to look like their
         | content is actually original... Do something about it google
         | please!
        
         | userbinator wrote:
         | Ironically, you can probably reach the copies via Tor and get
         | the information you want there instead.
        
         | xxs wrote:
         | > their data
         | 
         | The "data" is under creative commons. It does not belong to
         | them.
        
         | flawn wrote:
         | I feel this one.
        
         | petercooper wrote:
         | PSA: Anyone who needs a large amount of Stack Overflow data for
         | whatever (legal) reason, they share dumps at
         | https://archive.org/details/stackexchange - and perhaps
         | elsewhere.
        
           | fao_ wrote:
           | The license is CC-BY-SA 4.0, so the sites that host copies of
           | their data verbatim are (arguably) legal.
        
             | peschkaj wrote:
             | Yup! Mostly legal. We maintain a legal guidance page[1]
             | covering what you can and can't do with the data. I assume
             | our lawyers have been involved, but what do I know?
             | 
             | [1]: https://stackoverflow.com/legal/trademark-guidance
        
             | zozbot234 wrote:
             | It depends. The "attribution" requirements can be a bit
             | onerous at times, in ways that might put the most casual
             | and opportunistic reusers of even CC-BY-SA data at some
             | legal risk. (It's of course easier for a legitimate reuser
             | with an actual stake in the data to dot the i's and cross
             | the t's.)
        
         | southerntofu wrote:
         | The problem is with Google not with StackOverflow letting
         | people read their stuff. A search engine which does not
         | prioritize pages with advertisements and broken Google-powered
         | translations (yes the french version of those SO/GH sites are
         | hilarious) will filter that crap out.
         | 
         | I mean anyone who'd like to crawl/scrap a website can do it
         | from home, with the help of friends, or by renting "resential
         | VPN" services for a few bucks a month. Blocking Tor does not
         | prevent scrapping.
        
           | chaoz_ wrote:
           | You will be shocked how many paraphrasing enthusiasts will
           | not finish their implementations, if the first steps require
           | additional expertise / investment.
           | 
           | Google should definitely resolve this problem on their side,
           | but language models got huge and complex. It's hard to tell
           | (especially with their scale) if a website if composed from
           | paraphrased content of 20 other websites.
           | 
           | I'm kinda shocked how successful those "doorway pages" are at
           | reaching the top and how long they live there.
        
         | technion wrote:
         | I don't understand how these crawlers even work. Last week I
         | published a PoC for CVE-2022-0316. The next day you Google that
         | CVE, and a whole bunch of foreign language sites with an exact
         | copy of my blog would show up. My own original content wasn't
         | on the first two pages. I hadn't linked it anywhere at all and
         | Google Analytics shows literally 0 viewers. Yet they found it,
         | scraped it, and had winning SEO. Seems fixed today.
        
           | redwall_hp wrote:
           | Link farming, probably. If you have a network of scraper
           | sites already, you inject links to the posts into other
           | posts. That's one of the motivations behind comment spam as
           | well: it builds links pointing to a site, whether people look
           | at the spam or not.
           | 
           | I don't know how much Ye Olde PageRank still factors into
           | Google results, but I'm assuming it's still a significant
           | factor.
        
           | is_true wrote:
           | Your page got "fixed" because probably got some backlinks.
        
           | spupe wrote:
           | That's pretty crazy. I think Google is currently losing vs
           | these SEO exploiters, at least for some domains such as
           | programming. The fact things switched within a week suggests
           | they are trying to finetune their algorithm to make it less
           | exploitable again.
        
           | Godel_unicode wrote:
           | > ...Google Analytics shows literally 0 viewers.
           | 
           | This at least makes sense, why run the JavaScript in your
           | scraper? It's easy to identify. What do your webserver access
           | logs say?
        
         | oezi wrote:
         | There is a ublock origin list which you can import to filter
         | search results:
         | 
         | https://github.com/quenhus/uBlock-Origin-dev-filter
        
           | stjohnswarts wrote:
           | This needs its own blog/HN entry :)
        
           | imglorp wrote:
           | Thank you.
           | 
           | There are 322 SO copycats alone.
        
             | vient wrote:
             | More like 150 but yeah. SO copycat list is taken from
             | https://github.com/arosh/ublacklist-stackoverflow-
             | translatio...
        
               | tonyedgecombe wrote:
               | It's a shame Google doesn't import that list.
        
         | bttger wrote:
         | In my opinion this is even worse when searching for GitHub
         | issues on Google. I prefer searching for issues on Google but
         | since last year there are so many results of websites that show
         | nothing else than crawled GitHub issues. No idea why they are
         | higher ranked than the original GitHub issues. These results
         | don't link to the original issue on GitHub, are often outdated,
         | have bad UX (e.g. the code snippets), and don't allow
         | participating in the discussion.
        
           | PhantomGremlin wrote:
           | _No idea why they are higher ranked than the original GitHub
           | issues._
           | 
           | Not to be too cynical about it, but who serves the ads on
           | those sites?
           | 
           | If it's Google Ads, then I think you have your answer as to
           | why they are higher ranked.
        
             | nomilk wrote:
             | Genuinely curious to know now..
        
             | onionisafruit wrote:
             | My theory is github is getting down ranked due to
             | performance. When you view an issue on github the page gets
             | built from mysql queries and can be slow for large issues.
             | gitmemory and the others just serve the content they
             | scraped, so they load much faster.
        
               | stjohnswarts wrote:
               | Seems like they would ignore that "performance" parameter
               | for major information sites like github/reddit/stack/etc
        
             | HWR_14 wrote:
             | Or it could be because Google dislikes MS owning so much
             | developer mindspace.
        
           | tessie4 wrote:
           | You can use site: or inurl: (or a combination) to constrain
           | the search to GitHub.
        
             | wanderer_ wrote:
             | Often just putting the site name (e.g. "github.com") at the
             | end of the query is enough to do that for me.
        
         | [deleted]
        
         | Zobat wrote:
         | The Stackoverflow database is available for download, no need
         | to scrape the site.
         | 
         | https://www.brentozar.com/archive/2015/10/how-to-download-th...
        
           | dspillett wrote:
           | Is that dump going to be maintained under the new regime?
           | While they can't redact existing data bumps due to the
           | license those are covered by, they don't have to keep
           | publishing updates. If that happens then scraping becomes
           | required for the copy-spam sites and such.
           | 
           | Though that is a bit conspiracy-theory-y and I expect
           | blocking Tor is more an issue of a small but very active
           | number of people using it to create accounts to post
           | anonymous spam or abuse. For that, which can be a very real
           | problem, I would suggest a more fine-grained block: stop
           | people from those addresses creating accounts, or posting
           | from relatively new (or recently inactive) accounts, or
           | perhaps somewhere in the middle: prevent connection from Tor
           | addresses posting at all, but still let people use the site.
           | That way you still block the abuse, but have less impact on
           | others accessing via Tor.
        
             | peschkaj wrote:
             | We intend to keep publishing data dumps and with the same
             | regularity.
        
             | tenebrisalietum wrote:
             | I'm a 70K rep contributor to a Stack Exchange site.
             | 
             | StackExchange is composed of contributions from the
             | Internet at large. I've appreciated over the years how
             | StackExchange took this stewardship very seriously without
             | hoarding it behind paywalls - the ethical thing to do.
             | 
             | One of the reasons I was motivated to contribute is because
             | 10-12 years ago, putting tech questions in Google often led
             | to Experts Exchange, a site that takes contributions from
             | the public and makes you pay to see them. (Really need a
             | StackExchange-type site to take on Pinterest now ...)
             | 
             | So ... no, they should not stop publishing updates. People
             | need to bookmark sites and go directly to them instead of
             | relying on an increasingly broken search engine that's past
             | its heyday.
        
       | 02020202 wrote:
        
       | floatingatoll wrote:
       | Tor provides anonymity without accountability; having some doors
       | closed to all Tor users is the price paid for that anonymity. If
       | that price isn't acceptable, either modify Tor to allow more
       | granular accountability in some privacy-protecting way, or don't
       | use Tor when accessing services that are closed to it.
        
         | jbentham wrote:
         | If by 'accountability' you mean the ability for site ops to
         | unilaterally de-anonymise Tor users, then no; Tor users will
         | never agree to that.
         | 
         | If SE executives are really concerned about spam and vandalism
         | by anonymous actors, then SE could Tor users to post assets in
         | escrow (e.g. Monero) before posting. Similarly, if SE
         | executives are concerned about denial-of-service attacks, then
         | SE could rate-limit the sites that are causing the attacks; Tor
         | is not efficient for that kind of attack anyway. There is no
         | sound argument that blocking Tor entirely would further the
         | interests of SE users.
         | 
         | This is the act of a monopolist in secular decline.
        
           | jbentham wrote:
           | If by 'accountability' you mean the ability for site ops to
           | unilaterally de-anonymise Tor users, then no; Tor users will
           | never agree to that.
           | 
           | If SE executives are really concerned about spam and
           | vandalism by anonymous actors, then SE could Tor users to
           | post assets in escrow (e.g. Monero) before posting.
           | Similarly, if SE executives are concerned about denial-of-
           | service attacks, then SE could rate-limit the sites that are
           | causing the attacks; Tor is not efficient for that kind of
           | attack anyway. There is no sound argument that blocking Tor
           | entirely would further the interests of SE users.
           | 
           | A site looking to grow its influence would be more concerned
           | with attracting new users than repelling them. This is the
           | act of a monopolist in secular decline.
        
           | fabian2k wrote:
           | This is not the spam or vandalism counter-measure, those work
           | differently and only block posting to the sites. And you can
           | avoid them if you establish a reputable account, they won't
           | affect you anymore then.
        
             | jbentham wrote:
             | If it is not to block spam, or vandalism, or denial-of-
             | service attacks, then what is the purpose of this new
             | policy?
             | 
             | To your other point, how can one establish a 'reputable
             | account' if it is not even possible to access the site in
             | the first instance.
        
               | floatingatoll wrote:
               | Reputation is a feature of identity. Tor users are, by
               | definition and intent, unidentifiable. Opting out of
               | identification naturally opts one out of reputation, as
               | is the case in reality as well -- for example, Anonymous
               | using Guy Fawkes masks to prevent reputation from being
               | associated with their citizenship identity.
               | 
               | I don't understand why Tor users would be interested in
               | reputation at all, given the implicit identification it
               | requires.
        
           | Cthulhu_ wrote:
           | Tor is used for shady practices, just like proxies of old. SE
           | has a lot of measures in place already to prevent shady
           | practices. If 90% of traffic from Tor exit nodes is shady,
           | why shouldn't they block Tor entirely?
           | 
           | If you access any website through Tor (or proxies) you're
           | already more suspicious than the average user. If enough
           | people cause trouble through Tor exit node IPs, it's only
           | natural they get blocked.
        
             | zxcvbn4038 wrote:
             | Pure propaganda. I used to work at a top five web site, Tor
             | never caused us any problems, our problems were 1) hacked
             | university accounts from eastern Europe 2) China 3) Russia
             | 4) super-fans trying to download every video and picture of
             | their favorite porn star at once.
             | 
             | We occasionally had people upload child porn, they did it
             | over the public internet and not tor, our lead counsel was
             | a former US district attorney, his hobby was doxing the
             | uploaders and providing all the evidence and information to
             | the authorities in a "ready to prosecute" package. I forget
             | the exact number but I think he got almost a dozen people
             | prosecuted and jailed.
        
             | jbentham wrote:
             | Actually, there is no evidence that Tor is any shadier than
             | the rest of the Internet, especially given that most
             | attacks and vandalism originate from botnets and other
             | compromised systems, not Tor.
             | 
             | Akamai published an analysis that affirms this:
             | 
             | https://web.archive.org/web/20170317110115/https://www.akam
             | a...
        
               | harabat wrote:
               | Great resource, a surprisingly clear and detailed
               | introduction to the various attacks faced by websites!
               | 
               | The relevant part:
               | 
               | > "we concluded that approximately 1 in 380 http requests
               | coming out of Tor is verified to be malicious, while only
               | 1 in 11,500 http requests coming out of a non-Tor ip were
               | verified to be malicious. In essence, an http request
               | from a Tor ip is 30 times more likely to be a malicious
               | attack than one that comes from a non-Tor ip."
        
             | yanmaani wrote:
             | Because 'shady' traffic does you more or less no harm,
             | unless your web application executes arbitrary untrusted
             | input?
             | 
             | For a serious site, the cost of allowing passive reading is
             | going to be ~0.
        
             | Scoundreller wrote:
             | I think it's more like Tor traffic is 99.9999% less
             | profitable.
             | 
             | "Legit" Users likely block ads, are unlikely to enter their
             | credit card numbers because of MITM shenanigans and it's
             | one of the few browsers that takes non-fingerprintability
             | of its users seriously.
        
           | floatingatoll wrote:
           | Not deanonymise, no.
           | 
           | Come up with a way for siteops to block someone and all their
           | sockpuppet accounts, _without_ knowing the underlying
           | identity, and you'll become a billionaire.
           | 
           | Without that, the only option we have today is
           | deanonymization, which is a terrible option. We ought to do
           | better.
        
             | zozbot234 wrote:
             | It's really just a matter of balancing the difficulty of
             | creating a new "identity", so that legitimate users can
             | occasionally use multiple identities to partition their
             | traffic and make it harder to get doxxed, but are still
             | deterred from creating identities cheaply to engage in
             | sybil attacks or escape blocks. There are various ways of
             | committing real-world resources to an identity to deter
             | such abuse. Actual meatspace identity is of course one way
             | of doing this, but there are probably others.
        
               | floatingatoll wrote:
               | That's all plausible sounding, but no one's connected the
               | dots and done it yet. We're still at "step 2: ???".
        
             | jbentham wrote:
             | What you are assuming is possible is a logical
             | contradiction. To be able to recognise two persons as being
             | the same is in fact the definition of de-anonymisation.
             | Please check your math.
        
               | paxys wrote:
               | It is not a contradiction. See
               | https://en.wikipedia.org/wiki/Zero-knowledge_proof as a
               | somewhat similar example.
        
             | [deleted]
        
         | fouc wrote:
         | It might be interesting to have some sort of cryptographic
         | identity that costs money to generate, and then gets associated
         | with tor in some anonymity-safe way. But the identity would
         | would need to somehow remain unidentifiable, so maybe that's
         | not an identity after all. Tor has enough trouble with
         | maintaining anonymity as is, with the lack of trust in the
         | various routers because government runs many nodes in an
         | attempt to identify tor users.
        
         | capableweb wrote:
         | I could understand Stack Overflow blocking access to
         | register/signup for Tor users to avoid abuse, as sometimes
         | spammers use Tor, so that kind of makes sense.
         | 
         | But not allowing Tor users to not even read the website? What's
         | the justification for that? You couldn't even perform DDOS over
         | Tor as the network speed is too slow, so Tor activity can't
         | even be a blimp in terms of usage activity for logged out
         | users, so what's the deal here?
        
         | fyzix wrote:
         | There's no such thing as "granular accountability". It's
         | binary...there's no in-between.
        
           | stjohnswarts wrote:
           | Of course there is. It depends on who might know you're on a
           | certain website for example. My wife vs my best bud for
           | example. One would hold me a lot more to account for some
           | websites for example whereas my buddy couldn't care less.
        
         | yanmaani wrote:
         | I can use more or less all other websites with Tor fine,
         | though. It's _only_ Stack Overflow that insists on this
         | nonsense. On most other sites, including this one, I can even
         | make an account and post.
         | 
         | Is their site really so sensitive as to make _reading_ with Tor
         | impossible?
        
           | alexb_ wrote:
           | If "fine" means "answering a new captcha every time you
           | blink" then yeah, every other website works fine on Tor.
        
             | yanmaani wrote:
             | In my experience, this has gotten better. That was
             | CloudFlare, and they've stopped now. I can't think of a
             | single site that requires CAPTCHAs for Tor users other than
             | archive.is, actually.
        
               | foxfluff wrote:
               | archive.is wastes your time on captchas even if you're
               | not using tor
        
               | floatingatoll wrote:
               | archive.is requires captchas for iCloud Relay users as
               | well as blocking Cloudflare DNS users, so I wouldn't
               | consider them to be a Tor-specific example.
        
           | asmr wrote:
           | Please define "fine", a majority of websites and services
           | either outright block Tor or severely limit the traffic.
        
           | fought4thots wrote:
           | > Is their site really so sensitive as to make reading with
           | Tor impossible?
           | 
           | Very much so, strange if people here don't understand that,
           | even at the best of times APT's could be discovered down the
           | track by their SO queries, now compare today, with heightened
           | tensions and certain nuclear armed superpowers talking about
           | going to war with each other.
           | 
           | How is this even slightly surprising? SO is vital shit, if
           | you don't agree feel free to null route the site the next
           | time you have a major incident at work :)
        
             | jbentham wrote:
             | Are you actually suggesting that SO/SE are blocking Tor
             | because they intend to track all of their users by their IP
             | addresses (or browser metadata), using national security as
             | a justification?
             | 
             | I still do not understand how blocking Tor helps here.
             | People who are concerned about their security will either
             | use mirror sites, or use data dumps such as what is
             | available at archive.org, or simply not use the SO/SE
             | content at all. The number of users who will abandon Tor
             | and the protection it provides for the express purpose of
             | visiting SO/SE is negligible.
             | 
             | This move will not increase the number of persons who see
             | SO/SE adverts or who are trackable by SO/SE. It will also
             | not decrease the number of persons who will be able to
             | access SO/SE content. So I continue to be mystified about
             | the rationale behind this policy change.
        
             | yanmaani wrote:
             | There are public dumps of all the questions and answers;
             | you'd imagine that anyone paranoid enough simply runs a
             | local mirror.
        
           | rmbyrro wrote:
           | Good question. They might be trying to fight SPAM or else.
           | Could just block posting, commenting and up/down voting...
        
           | james-redwood wrote:
           | Tor generally doesn't work on Google services.
        
             | jbentham wrote:
             | Is this actually true? I've often used Tor to access Google
             | Docs and Google Maps and to my knowledge have never had a
             | problem. In fact, I'm not even presented with Captchas.
        
               | bigyellow wrote:
        
             | zozbot234 wrote:
             | YMMV. Google Search might as well be blocked completely, I
             | guess they don't want to deal with all the SEO-targeting
             | search queries that would otherwise come from Tor.
        
               | wanderer_ wrote:
               | I guess they could just not generate any data from your
               | searches, but I guess that defeats the purpose, now
               | doesn't it? :)
        
         | hereforphone wrote:
         | Is avoiding accountability the whole point of anonymity?
        
           | [deleted]
        
           | CaptainJustin wrote:
           | For me anonymity can be a part of my privacy posture.
        
       | ravenstine wrote:
       | This is another reason why my interest shifted to I2P over Tor.
       | 
       | Tor is designed more as a proxy to the cleaner, but I2P is
       | focused on internal services, this it would take extra steps to
       | use it for DOS attacks against plain ok websites. If you want to
       | be available to I2P users, you basically opt-in to the network,
       | as opposed to Tor's effectively opt-out approach. I2Ps design is
       | supposedly better at dealing with DDOS attacks, but I don't
       | exactly know the specifics of how that is.
       | 
       | Overall, I think Tor will decline in usage over the next decade
       | because it's too easy to use it nefariously and more institutions
       | will find ways to block it.
        
         | rany_ wrote:
         | > more institutions will find ways to block it
         | 
         | You could detect and block Tor traffic by blocking the exit
         | node IPs. They provide an API that lets you get all exit node
         | IPs so that you could block them:
         | https://check.torproject.org/torbulkexitlist
         | 
         | They are putting no effort in making this hard for site admins.
        
         | Trockiy wrote:
         | There are onion sites in Tor. And no scalability issues of i2p
         | (mentioned in their FAQ).
        
           | ravenstine wrote:
           | Onion sites are pretty secondary. Very few people using Tor
           | know how to set them up or are even acutely aware of their
           | existence. In I2P there is no concept of an exit node; that
           | would only be unofficially possible by creating an eepsite
           | that forwards connections from the clearnet. This is why I2P
           | is overall a better model because it is a totally opt-in
           | network but with no formal exit node distinction. I haven't
           | read about I2Ps scaling issues in a while, but I'm pretty
           | sure that the I2P network design is better at handling DDOS.
        
       | uallo wrote:
       | My tiny side project gets a lot of bot traffic. And just
       | yesterday, I had a large spike from TOR including the IP range
       | 185.220.101.0/24. I was also considering blocking these IP
       | addresses. As the project relies on third-party APIs which are
       | rate-limited, the bots may cause larger loading times for real
       | users.
       | 
       | I'd assume that Stack Exchange might also get lots of bot traffic
       | from TOR.
        
         | yanmaani wrote:
         | A middle-ground might be just putting some kind of CAPTCHA or
         | similar on them, if they're causing actual trouble.
        
           | wanderer_ wrote:
           | Or a regular old rate limiter - who's loading a new page more
           | often than a couple of seconds anyway?
        
         | goodpoint wrote:
         | It's spelled Tor!
        
         | GentooInstaller wrote:
         | It was never "TOR", it's; Tor:
         | https://matt.traudt.xyz/posts/2021-02-22-tor-spelling.
         | 
         | The DNS checking service is rate limited and adds latency, but
         | there is a bulk exit list available here;
         | https://check.torproject.org/torbulkexitlist (please don't use
         | 3rd party blocklists, as those often contain middles and
         | guards, even though traffic cannot leave those kind of relays).
         | 
         | But, before you block Tor, please consider that doing so will
         | most likely block a number of legitimate users who you haven't
         | noticed before - just to stop one jerk. Instead, you could
         | restrict access to certain parts of your site for Tor visitors
         | for example.
         | 
         | Bot traffic from Tor is usually of the easily detectable
         | variety (as the attacker didn't have enough skill to
         | build/acquire a botnet and get "clean" IP's),
        
           | bartvk wrote:
           | Thank you for correcting the spelling.
        
       | binarymax wrote:
       | Prosus (the primary shareholder of Chinese gaming mega co/WeChat
       | developer, Tencent) acquired Stackexchange in mid 2021. It does
       | not surprise me at all that (a) they are blocking
       | private/untraceable traffic and (b) they remain silent about the
       | issue.
       | 
       | Welcome to the Chinese internet.
        
         | renewiltord wrote:
         | It's true. The Chinese block everything. The other day we had a
         | network outage and AT&T said they were working on getting
         | things back up. Then I noticed that AT&T has a joint venture
         | with China Telecom. Many of AT&T's products are actually made
         | in China. It blew my mind. The Chinese are everywhere. I
         | wouldn't be surprised if they are modifying my contact lenses
         | to replace every "Made in California" with a "Made in China" as
         | some kind of propaganda.
         | 
         | You have to be careful. Your friend could be Chinese. You never
         | know.
        
         | vachina wrote:
         | I like how anything can be blamed on China. There are many
         | plausible alternative explanation down below, but nope, HNers
         | gotta upvote to the top that one comment that appeals to anti-
         | China (or Chinese?) rhetoric.
        
           | dijit wrote:
           | Even more ironic as Prosus is Dutch. Tencent isn't involved
           | and it's still being blamed by association. XD
           | 
           | (FD: I am actually a worker of a games company owned by
           | Tencent in Europe)
        
             | bigcat123 wrote:
        
           | Trockiy wrote:
        
           | zozbot234 wrote:
           | I don't think it was mentioned as a nationalistic anti-China
           | comment per se. It's just pointing out that the Chinese are
           | often criticized for restricting the freedom of their
           | Internet users, and blocking a major privacy-enhancing
           | browser as Stack Exchange is now doing is arguably just as
           | bad. Users should never be exposed to harassment by network
           | operators or dubious AI "intrusion-spotting" bots for
           | something with such a negligible abuse potential as
           | _browsing_ a  'questions and answers' site.
        
             | bigcat123 wrote:
        
           | bigyellow wrote:
        
           | beepbooptheory wrote:
           | It is kind of a fun game to go to any arbitrary comments on
           | here and Ctl-F 'china' and more often than not there is some
           | digression about it, sometimes in the most farfetched ways.
        
         | brightball wrote:
         | I did not realize that was who purchased SO. Wow.
        
         | kazinator wrote:
         | Are you saying that the DoS attack coming from Tor exit nodes
         | didn't happen; that it was a politically-motivated, fabricated
         | pretext for blocking?
        
           | zozbot234 wrote:
           | That comment was posted prior to the official response from
           | SE.
        
         | iqanq wrote:
         | https://i.imgflip.com/64f290.jpg
        
         | chuckSu wrote:
        
         | edge17 wrote:
         | I am not familiar with Prosus but wikipedia says it's Dutch,
         | not Chinese.
        
           | eynsham wrote:
           | Prosus is owned by Naspers (RSA) which owns quite a lot of
           | Tencent, so there is a Chinese connexion, but I'm not sure
           | about Chinese control. I haven't read much of News24 (owned
           | by Naspers) but they didn't seem to be that different
           | coverage-wise from the rest of the SA media on the spy
           | scandal--after they broke the story--although, good lord,
           | Xiaomei Havard must have been the world's worst spy if the
           | story was right, as Rebecca Davis pointed out:
           | https://www.dailymaverick.co.za/article/2021-09-01-how-
           | serio....
        
             | Godel_unicode wrote:
             | Yes, but that Chinese connection is in the other direction;
             | Naspers owns them, not the other way around.
        
               | eynsham wrote:
               | Indeed. I suppose that there is a blackmail risk: their
               | stake could be made worthless unless Naspers has Prosus
               | have the Stack Exchange people ban Tor, but I rather
               | doubt this happened.
        
               | missedthecue wrote:
               | How could Tencent selectively make the shares that
               | Naspers owns worthless?
        
               | [deleted]
        
               | stickfigure wrote:
               | The proper word would be extortion - the Chinese
               | government could in theory make demands of Naspers by
               | threatening to hobble Tencent. It's pretty far-fetched,
               | especially since Naspers owns a minority (28.9%) stake in
               | Tencent.
        
               | HWR_14 wrote:
               | I mean, Tencent could just be forced by new Chinese law
               | to buy back Naspers stock for $0.001/share. What's
               | Naspers going to do, sue in a Chinese court? Go to war?
        
               | maerF0x0 wrote:
               | One could consider what's now happening with Alibaba ADRs
               | and the fear of delisting. The price on a certain
               | exchange crumbles. However, I do wonder if at the scale
               | of a big company owning big chunks it'd just be a minor
               | cost of doing business to reregister for the HK exchange?
        
               | gbasin wrote:
               | Something tells me a shareholder suit by a foreign
               | company in Chinese court, in connection with not blocking
               | internet traffic, would not go down well for Naspers :D
        
           | fxleach wrote:
           | Indeed it's Dutch and is also a subsidiary of the South
           | American company Naspers.
        
           | [deleted]
        
         | bigcat123 wrote:
        
         | [deleted]
        
       | kragen wrote:
       | Is there a good alternative site built on the Stack Exchange data
       | dumps? Open-source projects like the Stack Exchange knowledge
       | base and Wikipedia are always at risk of suffering a hostile
       | takeover by their hosting services, whatever the license may say,
       | as recently happened in the spectacular case of Freenode, and
       | happened in a less severe fashion earlier with Sourceforge
       | injecting malware into downloads.
       | 
       | Things like Deletionpedia and Wikiwand provide an essential
       | service by reducing the cost of switching and thus the power of
       | hosting services like Wikimedia, but I don't know of anything
       | comparable for Stack Exchange.
        
       | fabian2k wrote:
       | This is the official response from SE:
       | 
       | https://meta.stackexchange.com/questions/376060/update-on-th...
       | 
       | For the past month Stack Overflow has been hit by weekly DDoS
       | attacks that progressively grew in size and scope. In each
       | incident, the attacker(s) have been changing their methodology
       | and responding to our countermeasures. Initially we were able to
       | detect and mitigate the attacks before any performance
       | degradation could be noticed but the latest attacks ramped up
       | very quickly and the site was brought down before we could react.
       | 
       | While we cannot go into specifics on each attack in order to
       | maintain opsec and not tip off the attackers, we can say that
       | each individual attack has been using different IP addresses and
       | targeted different aspects of the site. During an outage, our top
       | priority is always getting the site back up and running. After
       | traffic has been stabilized, we perform a post mortem for the
       | incident where we assess and improve upon the actions we have
       | taken.
       | 
       | During the outage last Sunday, we noticed that a large amount of
       | the DDoS traffic originated from Tor exit nodes. The decision to
       | block Tor exit nodes did not come lightly, in fact Teresa, our
       | CTO was on the call when we discussed remediation methods. Due to
       | the persistent nature of the attack and our desire to bring the
       | site back up as fast as possible we made the decision to block
       | all DDoS traffic endpoints, including these Tor exit nodes.
       | 
       | We did not target, nor set out to block all traffic from Tor,
       | that's not something Stack has ever done. However, due to the
       | shared nature of Tor exit nodes, some of them were also routing
       | DDoS attacks to our sites and were blocked. We have tried
       | removing these blocks between attacks but this action has
       | resulted in further site outages as DDoS efforts continue to
       | originate from these exit nodes. Unfortunately blocking the Tor
       | exit nodes also blocks legitimate users from using them. An
       | immediate solution for users who find themselves blocked is to
       | access our site from other IP addresses, via home internet, work
       | internet, or other VPN services.
       | 
       | We are continuing to evaluate the situation and will keep our
       | community updated. Thank you for your patience and understanding.
        
         | arwineap wrote:
         | Thank you for posting this, there is some tin foil hat stuff
         | going on deeper on the thread, so I hope this stays up top.
        
           | zozbot234 wrote:
           | Yes, it's a useful response. What happens if they use traffic
           | shaping to limit Tor traffic to a manageable share of their
           | resources? This might ultimately deter the attacker since the
           | end outcome would simply be a variable amount of
           | inconvenience for legitimate Tor users.
        
         | AiX2ohja wrote:
         | For anyone who is using Tor and needs Stack Overflow knowledge
         | while they're doing such mitigation, Kiwix [1], best known for
         | allowing to read wikipedia offline, also provides dumps of
         | Stack Overflow that you can download and browse locally [2].
         | It's massive, though (134gb).
         | 
         | [1] https://www.kiwix.org/en/
         | 
         | [2] https://wiki.kiwix.org/wiki/Content_in_all_languages
        
           | mrobot wrote:
           | What is up with the privacy policy and data usage? The app
           | store information says this:
           | 
           | --- App Privacy
           | 
           | The developer, Wikimedia CH, has not provided details about
           | its privacy practices and handling of data to Apple. For more
           | information, see the developer's privacy policy.
           | 
           | ----
           | 
           | ... then you click the link for "developer's privacy policy"
           | and it goes to a 404 at http://www.kiwix.org/impressum/
           | 
           | ... then you go find the privacy policy on the website at
           | https://www.kiwix.org/en/legal/privacy-policy/ and it says:
           | 
           | "This privacy policy applies to the website www.kiwix.org
           | only. It does not cover our subsites like wiki.kiwix.org or
           | download.kiwix.org."
        
             | unethical_ban wrote:
             | You use Kiwix offline. You download a Kiwix database of the
             | content you wish for.
             | 
             | If you can get the app and the database on tor, then you're
             | golden.
        
         | Trockiy wrote:
        
         | soheil wrote:
         | The # of tor exit nodes relative to IP addresses available to
         | people doing the DDoS is miniscule. I'm so tired of company
         | blocking tor users and always claiming this as the reason. Any
         | IOT device, routers with admin/pass as login, smart cameras,
         | grandma's old PC and a million other types of devices are fully
         | susceptible to being hijacked as a proxy giving the attacker an
         | unimaginable number of IP addresses.
        
           | kayodelycaon wrote:
           | Yet, geo-ip and service provider (AWS) blocks are extremely
           | effective at blocking these kinds of attacks. The issue is
           | there is no list of IPs that can be identified and blocked
           | with any reliability. It is impossible to separate valid
           | connections from invalid. When the vast majority of traffic
           | (99+%) is malicious, slamming the door is the most viable
           | solution.
           | 
           | If there was a good way, Cloudflare would have solved it.
           | Cloudflare hasn't been enough for my company. We had to add
           | temporary Geo-IP blocks just to get the site up.
        
             | soheil wrote:
             | Seems to me tor needs to implement a way to blend in better
             | with the rest of internet traffic instead of it being
             | detectable as an exit node so easily.
        
               | zozbot234 wrote:
               | Tor incoming traffic is easy to detect and block on
               | purpose. It's not trying to hide or 'blend in' via
               | technical means, it's seeking social legitimacy for
               | privacy-enhanced traffic.
        
         | agilob wrote:
         | This adds up, metrics for Tor show increased bandwidth in
         | recent days
         | https://metrics.torproject.org/bandwidth.html?start=2022-01-...
        
           | armchairhacker wrote:
           | Also SE has been down a lot yesterday.
        
         | rafale wrote:
         | I wonder what's the motive to target StackOverflow? A
         | disgruntled ex-employee?
        
           | HWR_14 wrote:
           | Well, they just got rid of their job board.
        
             | pc86 wrote:
             | Is a coordinated DDoS attack a reasonable response to
             | someone getting rid of a free feature you like?
        
               | itoro7g wrote:
        
               | joconde wrote:
               | Might be. Depends on your personality.
        
           | colinmhayes wrote:
           | Probably trying to ransom if I had to guess.
        
           | Godel_unicode wrote:
           | Presumably advertising for the ddos service; "pay us and
           | we'll knock your target offline! Remember, we're the ones who
           | killed stackoverflow, we can help you"
        
           | StevePerkins wrote:
           | What an interesting question. When I first got into computing
           | back in the 80's and 90's, people wrote viruses just for the
           | challenge and fun of it. Some people just want to watch the
           | world burn. This was seen as obvious motivation, it was
           | unquestioned. It was only after crypto mining and ransonware
           | became big things in the 2010's, that people started assuming
           | a financial motive behind attacks.
           | 
           | Up through the mid-2010's, people posted amateur porn largely
           | for personal fun and ego boost. Occasionally, regular people
           | would try to make a buck. But it was mostly people posting
           | selfies to /r/gonewild because they enjoyed the attention.
           | Then OnlyFans came out, and now virtually anyone posting
           | amateur adult material can be assumed to be driving traffic
           | to a monetization channel.
           | 
           | Sorry for the tangents. It just strikes me how normalized
           | "side hustle" culture has become. It was not very long ago at
           | all that it wouldn't even occur to most of us to question a
           | DDOS attacker's "motive".
        
           | marcos100 wrote:
           | Someone is behind schedule and _really_ needed to focus on
           | his work.
        
             | joconde wrote:
             | If I were behind schedule I would try to scrape
             | StackOverflow so I don't get cut off from it.
             | 
             | Edit: maybe someone's scraper was too efficient.
        
           | soheil wrote:
           | Probably the owner of one of those stackoverflow clones would
           | see a bump in traffic => more ad revenue if SO is
           | experiencing slower response times/downtime.
        
             | jandrese wrote:
             | Should we be investigating those Expert Sex Change people?
        
         | DoctorOW wrote:
         | > An immediate solution for users who find themselves blocked
         | is to access our site from other IP addresses, via home
         | internet, work internet, or other VPN services.
         | 
         | Anyone for whom this is a solution has already tried it.
        
         | snthd wrote:
         | They could run their own stackoverflow .onion service and
         | advertise it in the site headers [0] (including on the block
         | page).
         | 
         | Then the onion traffic can be handled differently (maybe
         | DDoSing the .onion will only affect Tor users, or the resulting
         | .onion resource usage is throttled). Worst case a readonly
         | version of the site would be better than nothing.
         | 
         | Something similar could be done with the existing tor exit node
         | blocklist, but maybe this is easier to separate from existing
         | infrastructure.
         | 
         | [0] https://community.torproject.org/onion-
         | services/advanced/oni...
        
           | admax88qqq wrote:
           | Yes they _could_ do a bunch of engineering and infra work to
           | support a niche use case.
        
             | YesThatTom2 wrote:
             | (Your sarcasm may have been too subtle for the average
             | reader.)
        
             | z3t4 wrote:
             | At stack overflow scale a "niche" use case could mean more
             | users then your average web site.
        
           | soheil wrote:
           | Whatever is deciding if the traffic is tor or not can get
           | ddos'd too.
        
             | junon wrote:
             | Eh? That's not how hidden services work.
        
               | soheil wrote:
               | It's pretty trivial to find the list of running tor exit
               | nodes.
        
               | boring_twenties wrote:
               | Exit nodes are not used to connect to hidden services.
        
               | [deleted]
        
           | [deleted]
        
       | PaulHoule wrote:
       | It's a general anti-abuse measure.
       | 
       | It was more than ten years ago but I was seriously spamming one
       | of those reddit-like sites for software developers. I made about
       | 1000 fake accounts with what looked like real names and
       | photographs but if somebody looked close they might have noticed
       | I made no effort to match the gender of the name to the gender of
       | the photograph.
       | 
       | The accounts generated a good amount of "cover traffic" voting
       | for articles that weren't mine but I would give one of my
       | articles somewhere between 20 to 80 votes that would usually
       | recruit an even larger number of real votes. Once in a while
       | somebody would say something like "That's a pretty good blog but
       | not that good, I can't see how he's possibly getting so many
       | votes for every single post"
       | 
       | My take was that what I was doing was pretty safe because my fake
       | users were actually pretty well behaved and there wasn't going to
       | be any real perception that there was a problem. Even so I was
       | using Tor to make sure that my requests were not coming from the
       | same IP address and it wouldn't be so obvious what I was up to.
       | 
       | I lost the database with the fake accounts in a hard drive crash
       | and I wasn't about to push the issue because I had also attracted
       | some attention from the F.B.I. which knew I (or at least my alter
       | ego) was making trouble with Tor so they tried to entrap me into
       | distributing child porn over Tor. I told them no of course ("the
       | FBI in my country sees that as an important enforcement
       | priority") but that did make me lose interest in Tor.
       | 
       | Back then Wikipedia would require you to log in to make any edits
       | over Tor because they didn't want to deal with that kind of BS
       | either. It's not unusual for many kinds of sites to have
       | restrictions on Tor users for the same reason.
       | 
       | My last covert web crawling project involved making a machine
       | image that could be deployed in any AWS zone to do about 200
       | requests and then pop up in some other place. On one level it
       | looks like you are getting hit from Japan and Singapore and
       | Germany, and... But on another level it is all AWS.
       | 
       | At some point they looked at their logs and freaked out and made
       | changes to make it fundamentally harder to crawl out their site.
       | We've got the running gag today that it's not safe for me to go
       | to Delaware now. But practically a lot of sites block AWS
       | addresses for the same reason they block Tor. It's just way too
       | easy for a third rate hacker wannabee to seem to be coming from
       | too many IP address that way.
        
       | zozbot234 wrote:
       | This is regrettable. I'm not going to even browse, much less plan
       | to answer questions on Stack Exchange sites if this requires
       | broadcasting privacy-sensitive personal information to them such
       | as an IP address. (I'm ofc. OK with answering from my household
       | or job IP address as a basic matter of accountability and anti-
       | abuse, but surely not with _browsing_ from there!) It 's fine for
       | Stack Exchange to want to manage Tor Browser use of their
       | network, but then they should at least publish an .onion
       | alternative in the HTTP response headers, so that Tor Browser
       | users have a tolerable alternative to hitting their clearnet
       | sites.
        
         | throwaway2037 wrote:
         | Would a VPN be sufficient for your needs? I assume you will say
         | that VPN is too insecure. Zero shill here: I heard the VPN
         | offered by Mozilla recently received a security audit.
        
       | gerikson wrote:
       | There's probably been an issue with spam originating from that
       | IP.
        
         | iqanq wrote:
         | I've tried to create new circuits, changing IP addresses, and
         | they are all blocked.
        
         | yanmaani wrote:
         | That makes sense for posting, where Tor users often get a
         | CAPTCHA etc, but I can't even read it. If I go to any site on
         | SE, I'm hard blocked, I can't even fill in a captcha to bypass
         | it.
        
           | paxys wrote:
           | Loading CAPTCHAs is still very expensive, and is not an
           | answer to large-scale DDoS attacks. Those have to be handled
           | higher up the stack, usually at the proxy/load balancer
           | level.
        
         | stjohnswarts wrote:
         | I tried a new tor a few times, they all got blocked.
        
         | dmitrygr wrote:
         | That's a very convenient excuse, if your goal is to collect
         | more data sell to advertisers and anonymous users annoy you.
         | What next? There has been a lot of spam from people wearing
         | clothes, so everybody needs to be strip searched?
        
           | hirako2000 wrote:
           | that's pretty much how safety regulations at airports work.
           | Stackoverflow perhaps hired a prior airport consultant for
           | security.
        
       | tiffanyh wrote:
       | Off topic: does anyone understand why SO is shutting down their
       | Jobs Board?
       | 
       | I get they were acquired, but why would you want to shutdown a
       | revenue generating business has been able to uniquely capture the
       | attention of a highly skilled worker who's difficult to hire.
        
       | thomassmith65 wrote:
       | @dang? Can someone please fix the title? Something like "I have
       | been unable to connect to Stack Overflow using Tor today" would
       | be appropriate. The title at the moment is rash speculation. One
       | doesn't expect HN to be perfect, but one expects more
       | conscientiousness than this.
        
         | jandrese wrote:
         | I ran into this yesterday when testing a Tor middlebox. I
         | didn't think much of it at the time because you slam into a lot
         | of these "no" pages when browsing via Tor. I did think it was a
         | shame that they didn't even give you the "10 CAPCHAs in a row"
         | option that Google will hit you with if you really really need
         | to use the service.
        
         | float4 wrote:
         | I disagree. I just opened Tor myself to check, and indeed every
         | circuit (I've refreshed ~10 times using cmd+shift+L) results in
         | an error page that literally states: "Reason: Blocked."
        
           | thomassmith65 wrote:
           | It's beside the point.
           | 
           | What if you _had_ connected? What if an endpoint with a
           | different IP can connect?
           | 
           | The standard here ought to be that the title accurately
           | reflect the content. This post does not.
           | 
           | I don't take HN as the kind of place where people want to
           | read speculation masquerading as fact.
        
             | float4 wrote:
             | The core of your argument is that you don't think many
             | reloads, by different users, from different Tor IP's, is
             | convincing evidence, and I think that makes you part of a
             | very tiny minority.
        
               | thomassmith65 wrote:
               | It probably does, sadly.
        
               | stjohnswarts wrote:
               | I had the same result, 8 connects from "new identity"
               | feature, all ips blocked. It may be temporary though, but
               | today, for sure they are blocking tor.
        
               | thomassmith65 wrote:
               | I don't know StackOverflow's Tor practices. Given the
               | post's title, I was disappointed to finish reading the
               | post and still not know. If I had read the same post with
               | a title like "Ask HN: is Stack Exchange (Stack Overflow)
               | now blocking Tor?" I would have no complaint.
        
       | [deleted]
        
       | waiwai933 wrote:
       | > I tried to contact them by e-mail and they didn't bother to
       | respond, as is par for the course these days.
       | 
       | Given you only contacted them today presumably, I'd allow them at
       | least a few days to respond...
        
         | yanmaani wrote:
         | In my experience, when it comes to big players, responses are
         | either bimodal - either they respond within a few hours, or not
         | at all.
         | 
         | That said, if they respond, I'll edit the post.
        
           | MisterSandman wrote:
           | Stack Overflow is far from """huge"""
           | 
           | Also, dude, it was the end of the work done or close to
           | midnight in most of the western world when you made this
           | post.
        
           | Jcowell wrote:
           | As someone who works close to the SO office. No. I'd expect
           | everyone to be home asleep at that time.
        
         | [deleted]
        
       ___________________________________________________________________
       (page generated 2022-02-08 23:02 UTC)