Tor’s history of D/DoS attacks and future strategies for mitigation • Hacker News Board

Re: Tor’s history of D/DoS attacks and future strategies for mitigation

#101

Post by cf141q5325 » Sun, Jul 09, 2023, 5:25 AM UTC

Lk7Of3vfJS2n wrote: post #35

cf141q5325 wrote: post #8

Earlier quoted context omitted.

The problem is, that it still requires an address (be it tor or IP). Even if you run the script locally, there is still a need to communicate input and output. So people can just ddos that page. Works great for combating human spam though. You tend to behave better if your login took half a day to get and expires quickly when not used. Plus build in cool down time after getting banned.

Behaving better isn't the only outcome. Another outcome is leaving the service permanently.

Impact from moderation always goes both ways. The more you insert yourself, the higher the chances that your own stupidity warps the entire communication channel for the worse leading to shrinkage and echo chambers. And people dont vanish, chances are they are already attempting the next tower in babel a few ips over and get up to who knows what.

The merits of proof of work should be discussed for the specific scenario. If it allows for reputationless discussions and throwaway accounts, how high is the cost really? In comparison to banevasion problems, moderation overhead and the resulting attack surface requiring more resources while deteriorating the channel? Otherwise impact less emergency breaks for idiots might be reasonable solution. Its not much different from timed bans.

Re: Tor’s history of D/DoS attacks and future strategies for mitigation

#102

Post by Lk7Of3vfJS2n » Sat, Jul 15, 2023, 2:51 PM UTC

cf141q5325 wrote: post #101

Lk7Of3vfJS2n wrote: post #35

Earlier quoted context omitted.

Behaving better isn't the only outcome. Another outcome is leaving the service permanently.

Impact from moderation always goes both ways. The more you insert yourself, the higher the chances that your own stupidity warps the entire communication channel for the worse leading to shrinkage and echo chambers. And people dont vanish, chances are they are already attempting the next tower in babel a few ips over and get up to who knows what. The merits of proof of work should be discussed for the specific scenar…

I'm not sure I understood everything you said.

How do you determine a user is an idiot or not when good ideas look like bad ideas initially? Experts can have blind spots.

The option for reputationless discussion should always remain open in my opinion.

> how high is the cost really?

The cost can be proportional to the proof of work.

Everything has a cost. How about determining the cost and providing means to pay for it? Paying works for many things in the world. It works for ads, for example.

Why must the cost be annoying a human by requiring reputation instead of a monetary cost? How is annoying a human a better solution than letting people pay? Do you really think pissing people off will stop them from expressing what they want? It might be more likely that people will express what they want, nobody will hear them, and they'll leave, taking good ideas with them.

Just as there is a cost to moderation, there is a cost to losing good ideas. How about letting a free market decide?

Re: Tor’s history of D/DoS attacks and future strategies for mitigation

#103

Post by cf141q5325 » Fri, Jul 21, 2023, 12:18 AM UTC

Lk7Of3vfJS2n wrote: post #102

cf141q5325 wrote: post #101

Earlier quoted context omitted.

Impact from moderation always goes both ways. The more you insert yourself, the higher the chances that your own stupidity warps the entire communication channel for the worse leading to shrinkage and echo chambers. And people dont vanish, chances are they are already attempting the next tower in babel a few ips over and get up to who knows what. The merits of proof of work should be discussed for the specific scenar…

I'm not sure I understood everything you said. How do you determine a user is an idiot or not when good ideas look like bad ideas initially? Experts can have blind spots. The option for reputationless discussion should always remain open in my opinion. > how high is the cost really? The cost can be proportional to the proof of work. Everything has a cost. How about determining the cost and providing means to pay for…

My post was indeed rather convoluted. I dont think we are disagreeing.

With idiot breaks i am talking about timeouts to artificially lengthen the reaction time and with it reduce emotional bias and excitement. Its the same idea as with "count till 10 before you start screaming at someone". I share your concern with reality models and the confidence in them, trying to determine and dictate TRUTH is a dangerous fools errand. I would also go further, that its not just a matter of annoyance, communication channels dictate our reality models. With no error correction for identity based errors (group think, tribalism, ego, fear of loosing credibility/ social capital ...) we are majorly screwed.

With proof of work i am talking purely practical necessity to operate a reputation less communication channel. Going zero moderation with one just hasnt worked so far. And its arguably less bad then the old system of IP bans. And i dont see many alternatives, there will always be a stupid person with a short fuse jamming the channel. Who has likely some interesting points but is ruining the efficiency and with it the appeal of the channel.