16:00:03 <meskio[mds]> #startmeeting tor anti-censorship meeting
16:00:03 <MeetBot> Meeting started Thu Nov  5 16:00:03 2026 UTC.  The chair is meskio[mds]. Information about MeetBot at https://wiki.debian.org/MeetBot.
16:00:03 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic.
16:00:09 <meskio[mds]> hello everybody!!!
16:00:13 <meskio[mds]> here is our meeting pad: https://pad.riseup.net/p/r.9574e996bb9c0266213d38b91b56c469
16:00:13 <meskio[mds]> ask me in private to give you the link of the pad to be able to edit it if you don't have it
16:00:13 <meskio[mds]> I'll wait few minutes for everybody to add you've been working on and put items on the agenda
16:01:42 <cohosh> hi
16:04:28 <meskio[mds]> I don't see any agenda items
16:04:36 <meskio[mds]> so I guess we don't have much to discuss this week
16:05:42 <cohosh> we had some big spikes in client polls
16:05:45 <cohosh> for snowflake
16:06:19 <cohosh> one smaller one late yesterday and a big one just a few minutes ago
16:06:59 * meskio[mds] goes to see
16:07:21 <cohosh> looks like from no country in particular
16:08:50 <meskio[mds]> looks like there was also one in October 19 bigger
16:08:52 <cohosh> there is a bit of a compound effect that happens though, clients have to keep re-polling if there are no available proxies
16:09:55 <meskio[mds]> that makes it hard to locate the original country, if there is one
16:10:02 <cohosh> so if there's some kind of censorship that causes one region to have to frequenly rendezvous, it won't be immediate apparent in client poll numbers where that is
16:10:05 <meskio[mds]> weird that the spikes are so isolated
16:10:05 <cohosh> yeah
16:10:17 <cohosh> i'll open an issue about it or comment on one of the existing ones
16:10:21 <dcf1> I haven't done usage graphs for October yet.
16:10:53 <cohosh> it is weird they are isolated but it could be a test rollout of a censorship system
16:11:13 <cohosh> it could also be a DoS attack
16:11:23 <meskio[mds]> or attempts to list proxies
16:11:29 <cohosh> yeah
16:11:48 <meskio[mds]> but looks like they are more effective DoSing than listing them
16:11:55 <dcf1> GeKo thinks that the increases in user counts (tor metrics, not client polls) is not related to the recent BEGIN_DIR attacks https://lists.torproject.org/mailman3/hyperkitty/list/tor-relays@lists.torproject.org/message/IWVAOZBUSJWJ5QCXDTJRMYBSAXSSTOLP/
16:13:45 <cohosh> interesting
16:15:38 <GeKo> let me know if i can help with analyzing anything or just ping me if you have any questions.
16:15:57 <GeKo> the dos we have seen changed shape over a couple of months
16:16:04 <GeKo> since the end of june 2026
16:16:40 <meskio[mds]> GeKo (IRC): thanks
16:16:59 <meskio[mds]> the snowflake spikes are very short lived
16:17:01 <meskio[mds]> the current one was ~10min
16:17:10 <meskio[mds]> looks like a test of something
16:18:04 <meskio[mds]> anyway, I guess we'll not find much more about it here
16:18:11 <cohosh> yeah, i can look into it a bit more and document it in an issue
16:18:11 <meskio[mds]> thanks cohosh for putting it in an issue
16:18:32 <cohosh> thanks!
16:18:36 <meskio[mds]> great
16:18:44 <meskio[mds]> any more discussion topics?
16:20:23 <onyinyang[mds]> nothing from me
16:20:26 <cohosh> not from me
16:22:36 <meskio[mds]> then I guess we are done for today
16:22:37 <meskio[mds]> #endmeeting