Hi,

I just opened a ticket.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

I have checked the whois records for the IP addresses of the outdated relays which you earlier advised and found their providers. Opened support requests and sent them a message.

Records were as follows: 93.174.90.30 support@ecatel.info noc@ecatel.info

82.165.197.129 support@1and1.com support@1and1.com

91.205.172.16 SUPPORT@CONTABO.DE

These 2 are in online.net network where they don't provide an email address, you need account registered with them to contact them. Maybe someone with account there can open a ticket and send the draft letter provided below?

IPs of Online.net relays which need contacted (to include so they will know which customers to notify): 195.154.243.53 195.154.226.66

Dear Provider,

I am a Tor supporter (www.torproject.org). I contact you with a request:

I have identified your customer with IP address <IP> runnig a Tor relay to help the network (very nice) but unfortunately running an outdated version for which we have a security CVE and there is a patch available. Latest Tor release is 0.2.4.23 and your customer needs to upgrade to this one. Patching the relay is a good practice which will make the network safer. The bug discovered IS NOT CRITICAL so there are no serious security threats (no cause to panic), but updating is always better.

The reason I am contacting you (the provider) is that your customer has not provided valid contact information in his Tor relay settings. Can you please kindly forward this notification to your customer and confirm that it was done? It is in the benefit of everyone, so it won't get anyone annoyed.

I am sending you this message as an individual Tor supporter and not on behalf of Torproject.org to which I am in no way related other than supporting the network as a volunteer.

Thank you in advance for your cooperation and sorry for the approach but I have no other way to reach your customer.

On 9/19/2014 12:00 AM, Nusenu wrote:

(if you are on the CC list of this email you are probably one of the tor relay operators running one of the 10 fastest vulnerable [CVE-2014-5117] relays on the tor network. Please upgrade your tor relay)

...

The tor network is currently at 64% of the bandwidth being served by relays running a recommended version according to torstatus.blutmagie.de. I updated a previous metrics feature request so we might see nice graphs about patching progress in the future [2].

Since we are seeing active RELAY_EARLY attacks again (or new buggy tor implemantations) I was wondering what the current update stats look like.

~85%* of the tor network's bandwidth is provided by patched relays. (~66% 0.2.4.23, ~11% 0.2.5.6-alpha, ~7% 0.2.5.7-rc)

*) according to data from torstatus.blutmagie.de

10 fastest relays still running a vulnerable version:

https://atlas.torproject.org/#details/EC98311F9EC02BEAA183651CE8402249CD036D...

https://atlas.torproject.org/#details/D1271A1E15C568DA709D3A1E68188EEAE8DDB8...

https://atlas.torproject.org/#details/12AD30E5D25AA67F519780E2111E611A455FDC...

https://atlas.torproject.org/#details/1B9FACF25E17D26E307EA7CFA7D455B144B032...

https://atlas.torproject.org/#details/2F57987F3942BA0BBD706D623F1FF86A896842...

https://atlas.torproject.org/#details/379FB450010D17078B3766C2273303C358C3A4...

https://atlas.torproject.org/#details/935BABE2564F82016C19AEF63C0C40B5753BA3...

https://atlas.torproject.org/#details/B83DC1558F0D34353BB992EF93AFEAFDB226A7...

https://atlas.torproject.org/#details/104A9453FD93BDBEAE9E2024898266AD2051A1...

https://atlas.torproject.org/#details/C11650E31F83E149C855D574B3171CC9CF9BEE...

_______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

- -- s7r PGP Fingerprint: 7C36 9232 5ABD FB0B 3021 03F1 837F A52C 8126 5B11

_______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays