[bitfolk] Tor exit node policy updated

Hi,

If you do not operate a Tor exit node at BitFolk then this email
will be of little interest to you.

If you do, then read on…

A number of BitFolk customers operate Tor exit nodes. These generate
a constant stream of abuse reports because quite a lot of abusive
activity is conducted through Tor.

Most of the reports are automated and are informational in nature.
They expect no reply and are therefore ignored on the basis that
"it's a Tor exit node ¯\_(ツ)_/¯".

A minority are real people and in this case BitFolk points out that
the host is a Tor exit node and so neither BitFolk nor BitFolk's
customer has much control of the traffic that goes through it.

A minority of this minority of complainants are for one reason or
another not satisfied with that answer and in those rare cases we
expect the customer to correspond with the complainant.

A recent case was like this and has prompted some updates to our Tor
exit node policy. The updated policy can be found here:

    https://tools.bitfolk.com/wiki/Running_a_Tor_node

The changes:

    https://tools.bitfolk.com/w/index.php?title=Running_a_Tor_node&action=historysubmit&diff=1058&oldid=705

Briefly:

- We state clearly that you must use a dedicated IP for your Tor
node. Previously we've insisted customers use a dedicated IP from
the first time an abuse report came in, so this is just
formalising that.

- The correct Tor exit IP must appear in the Tor project list of
exit nodes, for the benefit of remote sites that are using those
lists to construct filters.

One reason why this recent abuse report escalated was because the
customer's exit node was misconfigured to list the VPS's *other*
IP address, so the complainant was seeing abusive activity
(Wordpress brute force in this case) coming from something that
wasn't listed as a Tor node.

- Clarify that when we ask for a response to an abuse report we
expect it within 72 hours.

- Warn that although we prefer correspondence with the complainant
to go through our ticket tracker, if the complainant insists then
you must give them a direct email address that reaches you.

I know that sucks, but it is unfortunately the price that must be
paid for running an abuse magnet like a Tor node: the abuse reports
*must* be answered. In 8 years of having Tor exit nodes at BitFolk
this is the first time that a complainant has insisted upon
corresponding directly with the node operator.

Cheers,
Andy

--
http://bitfolk.com/ -- No-nonsense VPS hosting