diff options
author | Roger Dingledine <arma@torproject.org> | 2003-11-11 07:50:12 +0000 |
---|---|---|
committer | Roger Dingledine <arma@torproject.org> | 2003-11-11 07:50:12 +0000 |
commit | d0acbe86d1e4ee8abd1cba983d932a70ab6c7693 (patch) | |
tree | 3cd21808741cd3bb612e5ae9b0dc2942d0325381 /doc/tor-design.tex | |
parent | 5a6bb0333e7a08055063e5ba43e14096f7ef4b64 (diff) | |
download | tor-d0acbe86d1e4ee8abd1cba983d932a70ab6c7693.tar.gz tor-d0acbe86d1e4ee8abd1cba983d932a70ab6c7693.zip |
prioritize and rearrange the TODO
svn:r789
Diffstat (limited to 'doc/tor-design.tex')
-rw-r--r-- | doc/tor-design.tex | 23 |
1 files changed, 11 insertions, 12 deletions
diff --git a/doc/tor-design.tex b/doc/tor-design.tex index bd2ef4af9f..38175d613c 100644 --- a/doc/tor-design.tex +++ b/doc/tor-design.tex @@ -991,18 +991,17 @@ to slow down other users when they build new circuits. % What about link-to-link rate limiting? -Attackers also have an opportunity to attack the Tor network by mounting -attacks on its hosts and network links. Disrupting a single circuit or -link breaks all currently open streams passing along that part of the -circuit. Indeed, this same loss of service occurs when a router crashes -or its operator restarts it. The current Tor design treats such attacks -as intermittent network failures, and depends on users and applications -to respond or recover as appropriate. A future design could use an -end-to-end TCP-like acknowledgment protocol, so that no streams are -lost unless the entry or exit point itself is disrupted. This solution -would require more buffering at the network edges, however, and the -performance and anonymity implications from this extra complexity still -require investigation. +Adversaries can also attack the Tor network's hosts and network +links. Disrupting a single circuit or link breaks all streams passing +along that part of the circuit. Indeed, this same loss of service +occurs when a router crashes or its operator restarts it. The current +Tor design treats such attacks as intermittent network failures, and +depends on users and applications to respond or recover as appropriate. A +future design could use an end-to-end TCP-like acknowledgment protocol, +so that no streams are lost unless the entry or exit point itself is +disrupted. This solution would require more buffering at the network +edges, however, and the performance and anonymity implications from this +extra complexity still require investigation. \SubSection{Exit policies and abuse} \label{subsec:exitpolicies} |