N0TH1NG T0 H1D3

Transparency Report March 2023

March was a noteworthy month because most of the attacks on our infrastructure either decreased in severity considerably or even even stopped completely. There are still attacks, but the current situation is rather manageable.

The lack of the usual attacks had the added benefit of getting valuable data about the baseline load of Tor on our servers. We always had to more or less guess the impact of the attacks on the server’s performance since we started hosting Tor exit relays when the attacks were happening already. But now we can safely conclude that the previous attacks were responsible for at least 70% and at the most 90% of the load on our CPUs, depending on the severity of the attacks. This means that before the major change in attack pattern and severity in March, only between 10% and 30% of our total computational and bandwidth resources were spent on legitimate Tor traffic.

Without the attacks the servers were mostly idling so with the available headroom we added more relays. As a result the exit probability share of Nothing to hide exit relays stayed the same (~15%) despite losing share in the first half of March. Our bandwidth contribution to the Tor network grew from 22.5 Gb/s to 27 Gb/s.

The metrics used in this report are rounded extrapolated snapshots of the final day of the month, to not give away too much specific information.

1 Requests & orders

We received 0 official LEA requests this month.

1.1 Law enforcement agencies (LEA)

1.2 Legal entities

1.3 Natural persons

2 Service report

2.1 Tor relays

Because of the increase in exit relays we were able to keep our exit probability share the same. The CPUs are saturated for about 50% so growing further would be easy, but centralization might become a problem. Also Tor would need to increase the amount of relays per IP address to 8 before we could contribute more bandwidth to the Tor network.

Note that for these statistics both incoming and outgoing traffic are combined (just like Tor network’s metrics).

2.2 Tor DNS requests

DNS requests on the Tor network are resolved by the Tor exit relays. This means that high capacity Tor exit relays can generate a lot of DNS queries. These queries are being resolved by multiple high capacity DNS resolvers.

In March the amount of queries-per-second decreased a bit, despite the total Tor traffic increasing. Our best guess is that one or more of the attacks also generated DNS queries because when the attacks stopped the amount of DNS queries also decreased considerably.

Do note that we don’t log the contents of DNS queries.

2.3 Tor diversity

One of our major goals is to break the GNU/Linux monoculture currently present on the Tor network. Monocultures in nature are dangerous, as vulnerabilities are held in common across a broad spectrum. In a globally used anonymity network, monocultures can be disastrous.

We make the Tor network stronger and more resilient by running all our relays on FreeBSD. Here we report on our ongoing effort to increase operating system diversity on the Tor network.

The overall BSD exit share decreased in March, probably due to the decrease in total amount of other (excluding our relays) BSD relays on the network. This is somewhat worrisome because despite Nothing to hide only runs 172 out of 444 (39%) relays on BSD, we’re contributing ~97% of BSD exit relay bandwidth. Linux has a exit share of 84% and this shows how big the monoculture problem for exit relays really is.

If any Tor operator reading this is interested in running Tor relays on BSD, please contact us and we will gladly help out.

2.4 DDoS attacks

As mentioned March was a great month because there were less attacks while the attacks that remained were less severe as well. Using the Tor browser also feels faster and smoother on average since the change in attack pattern and severity. The question is how long the current situation will remain, and we should still be prepared for a change of heart with the adversaries.