{"thread":{"id":"51045","subject":"Cannot access git-scm.com with Tor","startedAt":"2019-05-07T07:10:58Z","lastAt":"2019-05-08T23:22:20Z","messageCount":4,"participants":["opal hart","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"374990","messageId":"20190507070028.54c291af@clamav.local","threadId":"51045","inReplyTo":null,"subject":"Cannot access git-scm.com with Tor","fromName":"opal hart","fromEmail":"opal@wowana.me","sentAt":"2019-05-07T07:00:28Z","receivedAt":"2019-05-07T07:10:58Z","isPatch":false,"sender":{"key":"opal@wowana.me","avatar":null},"body":"Hi,\n\nI assume this community is at least slightly familiar with Tor and its\nusefulness, so I'll cut to the chase. The Git website git-scm.com is\nbehind Cloudflare, which is currently configured to block suspicious\nrequests which unfortunately include Tor users. It would be greatly\nappreciated to lower Cloudflare security settings to allow Tor users.\nIf the additional traffic really becomes an issue (I see the website\nuses RoR backend [1]) then consider caching pages if that isn't already\ndone.\n\nIdeally the use of Cloudflare would be avoided entirely, but\nI will not get into the politics of that here. Being able to access the\nstatic portions of the site behind Tor is enough for me currently.\n\n[1]\n\nThanks,\n-- \nwowaname \n"},{"id":"374993","messageId":"20190507073322.GD28060@sigill.intra.peff.net","threadId":"51045","inReplyTo":"20190507070028.54c291af@clamav.local","subject":"Re: Cannot access git-scm.com with Tor","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2019-05-07T07:33:22Z","receivedAt":"2019-05-07T07:33:25Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Tue, May 07, 2019 at 07:00:28AM +0000, opal hart wrote:\n\n> I assume this community is at least slightly familiar with Tor and its\n> usefulness, so I'll cut to the chase. The Git website git-scm.com is\n> behind Cloudflare, which is currently configured to block suspicious\n> requests which unfortunately include Tor users. It would be greatly\n> appreciated to lower Cloudflare security settings to allow Tor users.\n> If the additional traffic really becomes an issue (I see the website\n> uses RoR backend [1]) then consider caching pages if that isn't already\n> done.\n\nThe \"security settings\" toggle for the site on Cloudflare is already set\nto \"low\", and there are no other restrictions. Is it actually blocking?\nOr is it asking for a CAPTCHA?\n\nI can drop it to \"essentially off\". I don't think the site is very high\nrisk. The site is _basically_[1] serving up static content (which isn't\nto say there couldn't be some attack against the rails infrastructure,\nbut it's not like people are logging in, or that there's any non-public\ndata on the site).\n\nUsing Cloudflare or some other caching layer is a necessity. We serve\nabout 50-60GB of traffic daily, over 98% of which is cached. The load\nwas quite high when the caching was all done at the Rails layer (though\nI wouldn't rule out that there are ways to configure Rails to make this\nmore optimal; none of the people active in maintaining the site is\nparticularly knowledgeable there).\n\n-Peff\n\n[1] It actually could be a static site entirely; there was some push in\n that direction a while ago, but there's a lot of tedious work that\n never got finished. Of course, we'd still need a caching layer.\n"},{"id":"375100","messageId":"20190508083917.50f2cf59@clamav.local","threadId":"51045","inReplyTo":"20190507073322.GD28060@sigill.intra.peff.net","subject":"Re: Cannot access git-scm.com with Tor","fromName":"opal hart","fromEmail":"opal@wowana.me","sentAt":"2019-05-08T08:39:17Z","receivedAt":"2019-05-08T08:39:30Z","isPatch":false,"sender":{"key":"opal@wowana.me","avatar":null},"body":"On Tue, 7 May 2019 03:33:22 -0400\nJeff King wrote:\n\n> The \"security settings\" toggle for the site on Cloudflare is already set\n> to \"low\", and there are no other restrictions. Is it actually blocking?\n> Or is it asking for a CAPTCHA?\n\nSorry, it is indeed asking for a CAPTCHA. Google reCAPTCHA does not do\na great job at accomodating Tor users; it effectively blocks us with an\nendless barrage of puzzles unless we log in to a Google account.\n\n> I can drop it to \"essentially off\". I don't think the site is very high\n> risk. The site is _basically_[1] serving up static content (which isn't\n> to say there couldn't be some attack against the rails infrastructure,\n> but it's not like people are logging in, or that there's any non-public\n> data on the site).\n\n> Using Cloudflare or some other caching layer is a necessity. We serve\n> about 50-60GB of traffic daily, over 98% of which is cached.\n\nThat's fine to use it as a CDN/cache; setting the site protection to\n\"essentially off\" should indeed help. For whatever reason, Cloudflare\nstill isn't smart enough to allow greylisted IP addresses during times\nof low/no abuse -- either that or a lot of people use CF with the\nmisconception that it's for anti-spam on blogs and forums, so it's\neasier to just block Tor. CF representatives have been involved in\npublic discussions elsewhere, claiming they are working to improve the\nexperience for Tor Browser users, but these discussions have been going\non for years now, so I wouldn't hold my breath. That's why I have to\nmake webmasters aware of this, because not everyone realises how\ninaccessible the web becomes for people who use Tor. Personally I use\nit although I'm in a relatively free country, but there are others who\nuse it to escape censorship. And when services like Cloudflare\ninadvertently act as censors, it defeats the purpose of Tor for this\ngroup of people.\n\n> The load\n> was quite high when the caching was all done at the Rails layer (though\n> I wouldn't rule out that there are ways to configure Rails to make this\n> more optimal; none of the people active in maintaining the site is\n> particularly knowledgeable there).\n\nYeah, if caching *is* handled directly on git-scm's side, I would\nrecommend something more suited for caching such as Varnish or\nmemcached (depending on the type of caching you're doing). Personally I\nuse memcached on a Tor hidden service I host and it seems to cut down\non server pressure from bot requests. This is why I even suggest to\nwebmasters to reconsider their use of CF; I'm not naïve and I do have\nsome experience with handling webserver abuse. But again, I won't argue\nif the site genuinely benefits from using CF as a CDN.\n\n> [1] It actually could be a static site entirely; there was some push in\n> that direction a while ago, but there's a lot of tedious work that\n> never got finished. Of course, we'd still need a caching layer.\n\nIt is indeed a lot of effort to change a site's inner workings. I'm\nglad that this possibility is at least considered and I hope it's an\naccomplishable goal in the future. It'd be nice to see the web revert\nto its more static, sustainable days.\n\n-- \nwowaname \n"},{"id":"375196","messageId":"20190508232216.GD19990@sigill.intra.peff.net","threadId":"51045","inReplyTo":"20190508083917.50f2cf59@clamav.local","subject":"Re: Cannot access git-scm.com with Tor","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2019-05-08T23:22:17Z","receivedAt":"2019-05-08T23:22:20Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Wed, May 08, 2019 at 08:39:17AM +0000, opal hart wrote:\n\n> On Tue, 7 May 2019 03:33:22 -0400\n> Jeff King wrote:\n> \n> > The \"security settings\" toggle for the site on Cloudflare is already set\n> > to \"low\", and there are no other restrictions. Is it actually blocking?\n> > Or is it asking for a CAPTCHA?\n> \n> Sorry, it is indeed asking for a CAPTCHA. Google reCAPTCHA does not do\n> a great job at accomodating Tor users; it effectively blocks us with an\n> endless barrage of puzzles unless we log in to a Google account.\n\nYeah, even though it at least provides _a_ way to get to the content,\nI'd just as soon not inconvenience people for no reason (and in fact,\navoiding CAPTCHAs is why I had initially lowered it from the default).\n\nI dropped the setting in Cloudflare to \"essentially off\". Using\ntorbrowser I didn't get a CAPTCHA either before or after the setting, so\nI have no idea if it actually changed anything. But hopefully it is\nbetter for you now.\n\nI also checked the settings for git-scm.org (same content, different\ndomain), which had accidentally been left at \"medium\". Those are now at\noff, too.\n\n-Peff\n"}]}