Delivery-Date: Tue, 08 Mar 2016 15:20:26 -0500
Return-Path: <tor-talk-bounces@lists.torproject.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on moria.seul.org
X-Spam-Level: 
X-Spam-Status: No, score=-3.3 required=5.0 tests=BAYES_00,DKIM_ADSP_ALL,
	DKIM_SIGNED,RCVD_IN_DNSWL_MED,T_DKIM_INVALID,T_RP_MATCHES_RCVD autolearn=ham
	version=3.3.1
X-Original-To: archiver@seul.org
Delivered-To: archiver@seul.org
Received: from eugeni.torproject.org (eugeni.torproject.org [38.229.72.13])
	(using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by khazad-dum.seul.org (Postfix) with ESMTPS id 5573F1E0406;
	Tue,  8 Mar 2016 15:20:24 -0500 (EST)
Received: from eugeni.torproject.org (localhost [127.0.0.1])
	by eugeni.torproject.org (Postfix) with ESMTP id 4B0C339471;
	Tue,  8 Mar 2016 20:20:18 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
 by eugeni.torproject.org (Postfix) with ESMTP id AEBCA39473
 for <tor-talk@lists.torproject.org>; Tue,  8 Mar 2016 20:20:14 +0000 (UTC)
X-Virus-Scanned: Debian amavisd-new at 
Received: from eugeni.torproject.org ([127.0.0.1])
 by localhost (eugeni.torproject.org [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id chr_rqn4PUQH for <tor-talk@lists.torproject.org>;
 Tue,  8 Mar 2016 20:20:14 +0000 (UTC)
Received: from smtp24.openmailbox.org (smtp24.openmailbox.org [62.4.1.58])
 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
 (Client did not present a certificate)
 by eugeni.torproject.org (Postfix) with ESMTPS id 7D21C3943D
 for <tor-talk@lists.torproject.org>; Tue,  8 Mar 2016 20:20:14 +0000 (UTC)
Received: by mail2.openmailbox.org (Postfix, from userid 1002)
 id 2C02A7CEBAB; Tue,  8 Mar 2016 21:20:11 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=openmailbox.org;
 s=openmailbox; t=1457468410;
 bh=cLU49PS0xmSlmek6k8UAk3kFKrQq+wBum5tIibyMDyM=;
 h=Subject:To:References:From:Date:In-Reply-To:From;
 b=v3NotCPMTpz7O6UIBvRYdQbl+aDeIG4ZYxydQBCmCkk78w/Fsju0yBPyKfa0PWAlU
 HFy8HoDYJv8CCtWhZrUB6JfYu7VsoTSwfQbvS2cNzJfyi7TSG4iy6utcaibm2qtIw0
 AbA7LvGdA8RUQkLG/VuhswvW7JcCgqbgFFZrPA1g=
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=openmailbox.org;
 s=openmailbox; t=1457468400;
 bh=cLU49PS0xmSlmek6k8UAk3kFKrQq+wBum5tIibyMDyM=;
 h=Subject:To:References:From:Date:In-Reply-To:From;
 b=EJo3tph77xWB3EjPVlNUOcTnWqrRm/bvuadQ9M/chtyDeWuolPC9DhHjAgIW+xyDQ
 7fF1Glc3/d1E36YvMJPTRTSWLO8T959vwQrJnc1sHNazfoxrLWhmL1LYak1gkKMMHO
 VC9p1IEyUQvR9IZFLF1X0+0J43CAwQG+/Ow5YukQ=
To: "tor-talk@lists.torproject.org" <tor-talk@lists.torproject.org>
References: <87wppcdi8c.fsf@riseup.net>
From: nusenu <nusenu@openmailbox.org>
X-Enigmail-Draft-Status: N1110
Message-ID: <56DF33E9.7030208@openmailbox.org>
Date: Tue, 8 Mar 2016 20:19:53 +0000
MIME-Version: 1.0
In-Reply-To: <87wppcdi8c.fsf@riseup.net>
Subject: [tor-talk] Mailing List: OrNetRadar
X-BeenThere: tor-talk@lists.torproject.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: tor-talk@lists.torproject.org
List-Id: "all discussion about theory, design,
 and development of Onion Routing" <tor-talk.lists.torproject.org>
List-Unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
List-Archive: <http://lists.torproject.org/pipermail/tor-talk/>
List-Post: <mailto:tor-talk@lists.torproject.org>
List-Help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-Subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============6811272760126126477=="
Errors-To: tor-talk-bounces@lists.torproject.org
Sender: "tor-talk" <tor-talk-bounces@lists.torproject.org>

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============6811272760126126477==
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature";
 boundary="MDSnLwI52wF6N019Meji6Jt456IaL1I84"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--MDSnLwI52wF6N019Meji6Jt456IaL1I84
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

Hi,

since I got a question about who is running OrNetRadar I figured I'd
answer this on list.

OrNetRadar [1] is a mailing list to publish and learn about
(automatically) detected events on the tor network (potential Sybil
attacks, undeclared families, anomalies, ...).
(There was no ML on lists.torproject.org with that topic.)

[1] https://lists.riseup.net/www/info/ornetradar


Archive of previous emails (list started in Aug 2015):

http://news.gmane.org/gmane.network.onion-routing.ornetradar


> Do you know anything about this list, like who runs it,
> how it gets its data, etc.?

It uses Karsten's great onionoo data from
https://onionoo.torproject.org/

> I do some malicious tor detection with hidden services, exit node
> manipulation and run one of the 9 directory authorities, and I just
> learned about this list recently, and so far nobody has been able to
> tell me anything about it. I'd like to determine if it is something I
> should pay more attention to.

Directory authority operators are probably the perfect audience for such
a list since they are the only one with the power to react to events
(i.e. Sybil attacks), great to see some interest.

The list is meant to be filtered/sorted client side. I.e. if you do not
care about small relay groups or the daily bunch of Windows "default"
bots joining the network you can remove such incoming emails by creating
custom filters based on the subject (the groupsize is the last part of
the subject).

As time allows it I'd like to add more alert/detection types in future.

regards,
nusenu







--MDSnLwI52wF6N019Meji6Jt456IaL1I84
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJW3zPtAAoJEFv7XvVCELh0n2QP/RFVX/GxkDO/FhB1MI+zqgzk
g1PXbKrObG2/4s4VkZWNZ52t1/1FepCIsjRtgN+vxtnfCLiYbhMwbFQ0na0K2Nlp
vFKGt3lnYNTZec+UIg71g/XU99O3WqHZ5ff13srOtCfw6HVhRx4Ft3r+6YCF1hOP
t5RuIgXjYltSEOffrenb+JL0yv1WwodNQ1J6008e/jcUIM51YmHjf9QuLRo31r1I
Nz7Ggs8gud/tKKf0L4X7BD7t1kDsXARqywcaSXZFaWVjcDlVqhYIVbesqcbbQqNu
Hc11CO/ItEGc3J80ITcMzgXxuwUp+aQBgFUabO4eHPyfAOX9c1Twc6cdw8bgp2IL
HVdd+a677FU3stEF8MJ66eYD9ujP8JKUG/SR7u/ifP6CLD/vt+0dajzAl04zm6Vz
3aPibiXouAjgOPIBI9dhJfI92SIAMdg/+Snc0trCBxCVMROJlJycLtjLoQSk2F2e
jTaeaqqehxMg0UkpJJyCcwtAlZoZfMtw5IlsYQ4q1RYNmf5hvqbPardV6+ZSe/82
UZK1sVwxmjVJEIQEn0ZR9FM25Bq/+slcaGd49tlKmPl+bmpAsizHkCZksSYZoFBs
xsoDt7nQySoTrGUlaovkasHDWKypa/05x6X0AH+diQH1Ec0xntBf/C5Te7Mx3p3G
15/WZU+9s8oLe2JtLVox
=6KvQ
-----END PGP SIGNATURE-----

--MDSnLwI52wF6N019Meji6Jt456IaL1I84--

--===============6811272760126126477==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
tor-talk mailing list - tor-talk@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

--===============6811272760126126477==--

