Wikipedia talk:Blocking policy/Tor nodes

message: I keep a list of a.o. TOR exit nodes in a database containing also date info, such as date acquired, date lastconfirmed. That db is updated daily (if I'm not on holidays).
Analysis of the entries has learned me the following:
There are long living TOR exit nodes, short(er) and very short living ones. Apparently people are trying, so the IP appears for a while in the reporting and others run consistently an exit node.
Since I learned that, I apply the following blocking policy on nl:w (and on invitation the same on he:w):
* Hard block if the IP appears for more than 2 days in the list. That allows people to experiment with TOR without being blocked immediately
* Unblock if the blocked IP does not appear as exit node anymore for a period of two months.
* If an IP that has been unblocked earlier and appears again as exit node, then it is blocked again (btw SQL recently fixed).
Due to the statistical nature of TOR that seems adequate as can be seen from this.
The automated batch process is run 1-2 times per week. The result is that at any moment in time approximately 3000 IP's are blocked. See the current list of blocked TOR exit nodes and view the history to get a feel for the dynamics.
Btw: I'm observing that the TOR network is rapidly growing. It has more than doubled in size in a year, from some 1200 to more than 2500 nodes (all, i.e. onion and exit nodes together).
A similar blocking policy is applied for so called exit nodes, i.e. the end-node of a cascade of ordinary open proxies. Those exit-nodes are generally used by multiple open proxies as can be found on the internet and hence behave more or less similar as TOR. These can only be found by scanning, i.e finding confirmation whether a published IP is indeed an open proxy or not. That's what I'm doing 7/24.
A third category that is pre-emptively blocked are the IP's used by anonymizers. Although proxy.org publishes some IP's, my scanner finds more IP's. For the time being IP's found this way are indefinitely blocked, as they appear to be predominantly IP's used by hosting providers.
Rgds RonaldB-nl (talk) 14:33, 8 January 2008 (UTC)
replies: text: That seems utterly sensible.  I don't run bots myself but hopefully one of the concerned admins who posted above will bring your system online here. Thatcher 16:24, 8 January 2008 (UTC)

text: As a member of WP:BAG I request that you file a WP:BRFA but dont file a WP:RFA. Since I know that this will bring every wacko that uses tor out against you, I am going to see if I can just get a B-crat to do this. βcommand 16:57, 8 January 2008 (UTC)
replies: text: See here for an earlier approved bot-status. Is currently taking care of Wikipedia:Open proxy detection. - RonaldB-nl (talk) 17:48, 8 January 2008 (UTC)
replies: text: Id like another BRFA for automatic blocking/unblocking. βcommand 18:05, 8 January 2008 (UTC)
replies: text: Why bother? The community is going to stomp on it just like every other adminbot. east.718 at 22:57, January 8, 2008
I suppose I should make a comment here but I find it all very depressing. There are some pages on wikipedia I can only load using Tor, and I'm not in mainland China or anything. I suspect the Tor fighters all have very nice, expensive internet connections. I'm not expecting the group think to move, but you would have thought from reading WP that Tor had no benefits whatsoever. I presume from one of the comments above that if I connect via Tor I'll be accused of being some loser's sockpuppet. Sometimes I really wish a lousy internet connection on some of you people.. Secretlondon (talk) 01:21, 9 January 2008 (UTC)

text: Also please note that we are not preventing TOR users from reading wikipedia. All that we are doing is preventing them from editing not reading. βcommand 02:24, 9 January 2008 (UTC)

text: As a bureaucrat, the blocks on the nodes will not affect you whatsoever, but I understand the issue that you raise.—Ryūlóng (竜龍) 02:09, 9 January 2008 (UTC)
replies: text: I don't: what pages exist that can only be edited using Tor for some users? Why? Kusma (talk) 09:43, 9 January 2008 (UTC)
replies: text: I would assume in Secretlondon's case, some of the pages that take longer times to load would be an issue for users with poor internet connections. However, I understood that the blocks may harm people who require Tor to access Wikipedia (it is the primary reason that they all haven't been blocked in the past).—Ryūlóng (竜龍) 11:06, 9 January 2008 (UTC)
replies: text: How is the issue of editing pages through Tor connected to poor internet connections? Kusma (talk) 13:11, 10 January 2008 (UTC)
replies: text: Tor can help with DNS issues, because the hostname is resolved by the Tor server (via SOCKS 4a) instead of the user's normal ISP. It's not a very effective solution, but it can help a lot with flaky ISP DNS servers. -- zzuuzz (talk) 13:54, 10 January 2008 (UTC)
thread_title: Blocking policy applied at nl:w

message: We recently had a rollback debate that over 500 users participated in. Afterward, one of the sysadmin's comments was: how is possible that you can find 500 people to comment on rollback and not a single person to code a compromise solution?
That's the crux of the issue here as well. We're focusing on blocking policy and how to stop all Tor uses. Instead, why can't we focus on possible solutions to the greater issue?
WS: As a follow-up, Raul654 asks, Roger Dingledine, inventor of TOR, has said that if Wikipedia implemented a trust metric, this would effectively solve the problem of proxies. Have you considered adding such a feature?
JW: It is not up to me, but that avenue of approach seems viable. I think we should only soft-block Tor anyway.
Jimmy also made a comment on his blog, vague but simple: here.
I can't write code, but I know that there are tens of developers who are able to. I also know that there are other developers outside of Wikipedia who could help. If we spent half the energy toward a solution that we put toward this blocking policy, we would have an answer.
I'm not trying to say that we should defer to Jimbo, and going even further, I'm making no comment on what blocking policy should be with regards to Tor nodes. Personally, I don't use Tor, so I simply don't care. What I am saying this is: why can't we find a better way, a way that's more in line with our values and the community's values? --MZMcBride (talk) 21:40, 13 January 2008 (UTC)
replies: text: I'd code something but it would be a system that soft-blocks any IP that appears on a Tor list and only unblocks once the IP is off the Tor list. Fnagaton 22:27, 13 January 2008 (UTC)
replies: text: Unfortunately softblocks are useless because vandals create accounts. Bugzilla:9862 has been proposed as a solution. -- zzuuzz (talk) 22:30, 13 January 2008 (UTC)
replies: text: What about the trust metric? What is that and how could it be implemented? Or, if the trust metric system isn't the right direction, what about a bot to softblock IPs? (These blocks should be impersonal if done.) --MZMcBride (talk) 00:01, 14 January 2008 (UTC)

text: FWIW, I've got a list up, updated hourly, of non-blocked tor nodes. User:SQL/Unblocked TOR. SQLQuery me! 03:58, 14 January 2008 (UTC)
replies: text: Btw, those tor nodes don't necessarily *need* blocking. They're all exit nodes (to the best of my ability to figure that out), but, not all allow wiki editing. I meant the list for statistical use only, not as a block-checklist... SQLQuery me! 04:11, 14 January 2008 (UTC)
thread_title:  Stop the madness! / Technical solutions? 

message: I have been semi-following the discussion here, and while I understand the tor issue, I also understand the problem with hard-blocking the tor exit nodes (the Chinese, registered users ip addresses being not too private, etc.). User:MZMcBride suggested above a trust system as a possible solution. I thought about it, and concluded that it might be a good idea. Here is a possible trust meter system that I thought of:
:A user's (anons included) trust is measured as a real number between 0 and infinity. Anons in the same subnet share the same trust meter. Newly registered users start with the trust level of the ip address they register with. Anons start with a trust level of 1. Administrators have a trust level of infinity (or NaN).
:A user's trust level changes as follows: for every day of constructive editing a user's trust level increases by 1. A constructive day is a day in which the user edited wikipedia, and did not receive a warning from a more trusted user (possible problem: null edits. possible solution: null edit warnings). If a user is blocked (for any duration), his trust level is cut in half. If the blocked user is a registered user, his ip address trust level is also cut in half (in a similar style as auto-blocks). 
:In this system, an article being semi-protected would mean that users are required to have trust level of more than 3 (or some other number) in order to edit the article. This (partially) solves the sleeper accounts problem as an account is required to not only be registered for 3 or more days before it can edit semi-protected articles, the account also needs to be used in these days in a positive manner. Another, optional, page-protection method can be "auto-protection", in which articles which are actively edited are auto-protected, requiring users to have a trust level of more than 1 before they can edit the article. Actively edited articles can be defined as articles having more than 4 editors working on them during the past 2 days. Auto-protection makes sense as active articles are more likely to be targeted by sock-puppets and random vandalism. Also collateral damage would be kept to a minimum as an article having 5 or more editors actively edit it is unlikely to need edits from a not-so-trusted editor.
From a technical perspective (as far as I can tell, as I don't know how wikipedia is implemented, and I don't have any real experience developing large scale websites) this system can be implemented by scanning the editors of the past 24 hours every 12 hours, and adding 0.5 trust points to the user if he has edited sometime between [currenttime-24h] and [currenttime-12h] and has not been warned in the past 24 hours (again, only AFAIK).
This system should be most effective when the trust level is mostly hidden from the users (access granted only to administrators, or bureaucrats, or checkusers). 
Any comments? Thoughts? Suggestions? Rami R 19:42, 15 January 2008 (UTC)
replies: text: I don't know that a trust system would work with TOR users, as, nearly every edit (even from the same IP) has the potential to be by a different user. SQLQuery me! 20:46, 15 January 2008 (UTC)

text: Trivial to game. Just edit nicely for a while. Since the metric is so simple you could even have a bot do the work. And if the user's proxy is blocked, then how will they build trust?  Use their non-proxy IP? Okay, but it defeats any anonymity purpose of using the proxy. --Gmaxwell (talk) 21:09, 15 January 2008 (UTC)
replies: text: Also, a "warning" is near impossible to determine technically unless we were to totally redo the warning system by building it into the software. Most template warnings have hidden text which indicates what they are, but a handwritten warning would not and there is no technical difference between a warning edit and any other edit. And like Gmaxwell said, all you would have to do is fix a typo a day for 4 days and you could edit a semi protected article, this would basically be like the current autoconfirm system, but with an edit count restriction of 4 instead of 0. Also, the auto-protection thing is backward IMO. The articles that should be auto-protected, if any, are the obscure articles where vandalism might stick around for days or weeks. Active articles have people watching for vandalism and other abuse and attract more new users to editing Mr.Z-man 02:45, 16 January 2008 (UTC)
thread_title:  A possible trust system 

message: First, make sure you see my comments at Wikipedia_talk:Blocking_exemption_policy#Evidence_that_the_world_won.27t_end.2C_and_a_counter_argument.  There I point out that TOR is (mostly) not currently blocked. Any proposal to exempt or allow Tor, if coupled with systematic software driven soft-blocking would almost certantly reduce vandalism from Tor. That Tor is not effectively blocked and yet we live is an important perspective.
 
I'm seeing all these ideas for allowing proxies.. Trust metrics, approval systems, etc... But there is already a good (and cryptographically strong) solution which should meet our goals (block bad guys, avoid one person having a zillion accounts but only one IP) without excessively compromising the pseudonomity of proxy using editors: See User:Lunkwill/nym. --Gmaxwell (talk) 21:09, 15 January 2008 (UTC)
replies: text: Soft-blocking is useless for TOR nodes, as has been shown time and again. I'm astonished to see people still suggesting soft-blocking proxies. Policy is to hard block, period. Jayjg (talk) 03:40, 17 January 2008 (UTC)
replies: text: I'm not very familiar with the topic, so I'd be glad to see evidence of soft-blocking being useless for most TOR nodes.  Everyone here knows the policy, and it's why they want to change it (if it had clear consensus we wouldn't be discussing it here). This is Wikipedia, you don't just say "This is policy. Period". You evaluate the policy, and see if it makes sense, and if it helps the ultimate goal (build a free encyclopedia). If it doesn't you change it or ignore it-depending on the situation. Puchiko (Talk-email) 21:30, 1 March 2008 (UTC)
thread_title: Please do not reinvent the wheel

message: Why don't reduce the life of blocks and create a Special:Recentchanges/TOR page for patrolling that edits? --Emijrp (talk) 22:08, 1 February 2008 (UTC)
replies: text: We aim to limit the block length to the length of time the proxy is open, and there's a reason the blocks are not shorter. We can monitor the Tor recent changes at Wikipedia:Open proxy detection. People using Tor will usually change IP address every few minutes (or faster), which means by the time they have been blocked (or unblocked) they have a new IP address. Blocking a single IP address used for vandalism or sockpuppetry simply doesn't work - it's completely punitive and not preventative. The prevention happens by limiting the number of IP addresses the vandals can use, whether that be through blocking them all with a bot, or just blocking the ones we happen to notice. To reduce the vandalism for Tor you don't need to block them faster after they have vandalised by watching the recent changes, instead you need to block more of them from editing in the first place. Unfortunately, the more you block, the more legitimate editors are affected. -- zzuuzz (talk) 22:39, 1 February 2008 (UTC)
thread_title:  A solution 

message: By proposing a total TOR block you are potentially aiding countries in denying their citizens uncensored internet access, this seems like a backwards step. Perhaps rather than auto blocking the node any TOR proxy requires them to register and then monitors their edits, perhaps flagging them up if they start editing lots of documents quickly or re-editing a lot with a similar checksum Silent52 (talk) 03:22, 27 February 2008 (UTC)
replies: text: I think we should not do anything indiscriminately when we have chosen our admins for their discretion. (1 == 2)Until 13:46, 3 April 2008 (UTC)
thread_title:  Blocking indiscriminately 

message: This can be done using MediaWiki's support for DNS blacklists. It is silly to block all of them at once when we can just use a DNS blacklist for the purpose, which will automatically update. This is a two-line shell request. — Werdna talk 03:49, 22 April 2008 (UTC)
thread_title:  Can be done with a simple shell request 

message: I completely disagree with everything. I have run a Tor node a few times, once for a week and the other times for a few days. I would dare to step out on a limb and suggest this to be perhaps typical of casual users or those simply wanting to give it a test run. I was surprised to find myself blocked from Wikipedia because of this. After reading the rationale, I am almost disgusted. I understand the need to protect WP against vandalism, but this is practically a witch hunt against everyone who is running Tor.
With terminology used in this discussion such as "plan of attack", you are clearly taking an offensive that yields considerable collateral damage by blocking all Tor exit nodes. Let me introduce a new aspect here. I wasn't even allowing HTTP to leave my node! Since your inferior technology cannot even determine what the exit policies of the various nodes are, your indiscriminate blocking of them all is a violation of free speech, protection of individuals suffering from oppression and basic human rights.
Furthermore, I find the very fact that you are doing obtrusive scanning (or subscribing others who do) flat out appalling. All of this is playing into the hands of oppressive governments, whose bidding you are doing. I detest Wikipedia supporting totalitarian regimes. Where is Wikipedia going with this outright hatred, the on-going censorship practice and questionable editing policy? You are shooting yourself in the leg. My distrust has certainly skyrocketed. --84.249.164.59 (talk) 03:42, 17 March 2009 (UTC)
thread_title:  This is '''not''' over. 

message: I think that TOR nodes that are not exits should be blocked as well.
By running a TOR node, even a non-exit one, you are actually helping vandals by providing them a anonymous encrypted path to a TOR exit node.
By blocking ALL TOR-nodes, even non-exit ones, we discourage usage of TOR. A block time of 1 week is suitable, and then a recheck. If its still a TOR node, extend the block by 1 week and recheck.
So the block time of 1 week the gets as a punishment for node operators for running a TOR node and helping vandals. Its like selling weapons to criminals.
Sebastiannielsen (talk) 02:07, 28 November 2010 (UTC)
replies: text: We are not bothered at all if someone operates a Tor node to help people with their anonymity elsewhere on the Internet. We are not interested in discouraging Tor, only preventing abusive edits to Wikipedia. If we're only concerned about preventing vandalism, all we need to do is block the exit nodes which can exit to Wikipedia -- zzuuzz (talk) 08:44, 28 November 2010 (UTC)
thread_title:  Suggestion 

message: After reading through this years-long blog it seems to me as an IT-consultant, that it may be summarized like this:
* WP faces problems with vandalism and sockpuppetry, but so far there seem to be no quantitative informations about the frequency and size of these problems
* some of these problems are caused by bots, some by humans, but also here, we lack quantitative information
* some of the problems are produced through WP-access via TOR or other anonymous access methods (like the several free WiFi initiatives) hiding the originators IP-address (again, no absolute numbers nor percentage are presented)
* the only or main counter-measure used so far seems to be the blocking of IP addresses of open proxies and TOR nodes for editing, regardless of the authors being anonymous or logged in
While anonymity belongs to the range of basic human rights (at least in Germany), vandalism and sockpuppetry, though certainly a nuisance, possibly a crime, are not of comparable account. Blocking IP addresses is technically easy, but a very big gun and not at all a specific solution for the problems. Its collateral damage is not only the inhibition of all legitimate anonymous authors as well as logged-in WP authors, but also the implicit discrimination of all anonymous access projects of the civil society and the suspicion of vandalism or sockpuppetry for all of their users, while what we want is fighting actual vandals and sockpuppets, regardless of how they access WP.
So, why don't we concentrate on a more thorough analysis of the problem and, as far as adequate, the development or use of more specific counter-measures? 
* To prevent vandalism using bots, why don't we use something like captcha?
* To prevent vandalism by humans, we may think about intelligent content-evaluation.
* Having the same or different IP-addresses is not decisive for the recognition of sockpuppets. Several providers change IP-addresses daily, some use proxies with NAPT and use one IP-address for thousands of users. Here, other characteristics have to be found. In the end, I believe, even without technical means, honest human authors will by their vast majority win any fight against human sockpuppets wherever relevant.
--G-u-t (talk) 18:37, 11 May 2014 (UTC)
thread_title:  Another suggestion 

message: at 2014-10-19
* I guess that allow user to edit wikipedia anonymous is agreed within the group.
* But since some police states such as China are have 100% IP to actual person record, even you are at public spot such as net cafe, or WIFI "you need to put down your ID first".
* please recommended ways to prevent such things happen.
* We all agree that no one should got arrest when editing wikipedia, right ?
183.178.222.177 (talk) 13:18, 19 October 2014 (UTC)
thread_title:  How to honor allow anonymous editing policy when IP tracking is 100%