Re: [tor-dev] yes hello, internet supervillain here

2014-11-09 Thread Paul Syverson
On Sun, Nov 09, 2014 at 07:25:39PM +, Fears No One wrote: > I have some news to report, along with more data. > > The August DoS attempt appears to have been a crawler bot after all. An > old friend came forward after reading tor-dev and we laughed about his > dumb crawler bot vs my dumb "must

Re: [tor-dev] yes hello, internet supervillain here

2014-11-09 Thread Matthew Finkel
On Sun, Nov 09, 2014 at 07:25:39PM +, Fears No One wrote: > In other news, the same guy runs a bot that records uptimes for various > onions, and he gave me output related to up/down times for doxbin, > Cloud9, and Silk Road 2.0. > > NOTE: Time zone is GMT+9:30 on all of these. He used sed to

Re: [tor-dev] yes hello, internet supervillain here

2014-11-09 Thread Fears No One
I have some news to report, along with more data. The August DoS attempt appears to have been a crawler bot after all. An old friend came forward after reading tor-dev and we laughed about his dumb crawler bot vs my dumb "must-serve-200-codes-at-everything" nginx config. His user agent string only

Re: [tor-dev] yes hello, internet supervillain here

2014-11-08 Thread Fears No One
To address a question from Mansour Moufid first: There aren't any preserved access logs, unfortunately. I copied some of the access logs from the August DoS to another directory but never bothered to scp them to my box. Another regret is that pcaps weren't taken, but we both made the mistake of ass

Re: [tor-dev] yes hello, internet supervillain here

2014-11-08 Thread Roger Dingledine
On Sat, Nov 08, 2014 at 10:10:23PM +, Fears No One wrote: > If you have any questions/clarifications, just ask. [...] > All of these files are in the hands of the > cops anyway (And I have no plans of bringing doxbin back), so there are > 0 real-time opsec concerns. Hello Mr. Supervillain, C

Re: [tor-dev] yes hello, internet supervillain here

2014-11-08 Thread Mansour Moufid
On Sat, 08 Nov 2014 22:10:23 + Fears No One wrote: > BEGIN TINFOIL > > Upon scrolling through the .xz files (I personally use xzless), you'll > find a bunch of stuff like: > > 1 > /%5C%22http://www.hackforums.net/code/fail/code/code/code/code/code/ > ... > > All of the requests were