Hacker News Reader

> We actually noticed these relays when they joined the network, since the DocTor scanner reported them. We considered the set of new relays at the time, and made a decision that it wasn't that large a fraction of the network. It's clear there's room for improvement in terms of how to let the Tor network grow while also ensuring we maintain social connections with the operators of all large groups of relays.

Sounds like they did know?

View on HN

No, it sounds like they knew new nodes joined the network.

Not that they knew what they were doing - they seemed to have suspected something, but made the decision that it was a small enough fraction of the network to not worry about, but obviously in hindsight they were wrong about that.

Yes, they saw a bunch of new relays, starting in February 2014. And they weren't doing anything obviously alarming. But once Tor devs had seen the Black Hat abstract, they figured out what to look for. Once they were monitoring relevant parameters, the attack was obvious.

In retrospect, more monitoring seems an obvious approach. But that would probably hurt performance. And threaten security and anonymity. Maybe there's a middle ground.

Reply on news.ycombinator.com