
Number of Tor users recently halved - frabcus
https://metrics.torproject.org/userstats-relay-country.html
======
Tornado666
Tor moved the metrics to new servers and there was a temporary glitch in the
metrics counting the relays. It's a metrics issue, not an actual change in the
number of relays.
[https://twitter.com/torproject/status/664168624467386368](https://twitter.com/torproject/status/664168624467386368)

------
Caer
According to the metrics-team mailing list[1] it's likely due to an aborted
cronjob and should be sorted out soon.

[1] [https://lists.torproject.org/pipermail/metrics-
team/2015-Nov...](https://lists.torproject.org/pipermail/metrics-
team/2015-November/000013.html)

------
abdullahkhalids
If you break it down by country, you can see the same halving for every
country. It is unlikely that a social reason behind this, or a botnet going
down as someone has suggested. It is more likely an intentional or
unintentional change in how the number of users are counted.

~~~
3pt14159
Or an institutional Tor user like say the NSA realized a flaw in it and
executed a predetermined strategy of ceasing use uniformly in order to shroud
that there is a previously undetermined weakness that they just discovered.

I'm not saying that the above situation is likely, just that it is possible.

~~~
sp332
An institutional Tor user with proportionally the same number of endpoints as
all other Tor users in each country? Probably not even the NSA would qualify.

~~~
3pt14159
If they had this strategy ahead of time, what would stop them from rooting a
proportional number of Wordpress servers in order to give this illusion? I
think the better counter argument is this:

Why would they even take actions which disclose the change? Why not just
change the nature of their queries?

------
nyargh
I wonder if it was a botnet going offline?

~~~
mirimir
In August 2013, about five million Sefnit slaves joined the Tor network,
increasing client count from about 800 thousand to almost six million. About
two thirds of them have dropped off over the past two years. Maybe this is
just the rest going away.

[https://metrics.torproject.org/userstats-relay-
country.html?...](https://metrics.torproject.org/userstats-relay-
country.html?graph=userstats-relay-
country&start=2012-1-1&end=2015-11-19&country=all&events=off)

------
pizza
Q: Why do the graphs end 2 days in the past and not today?

A: Relays and bridges report some of the data in 24-hour intervals which may
end at any time of the day. And after such an interval is over relays and
bridges might take another 18 hours to report the data. We cut off the last
two days from the graphs, because we want to avoid that the last data point in
a graph indicates a recent trend change which is in fact just an artifact of
the algorithm.

Q: But I noticed that the last data point went up/down a bit since I last
looked a few hours ago. Why is that?

A: The reason is that we publish user numbers once we're confident enough that
they won't change significantly anymore. But it's always possible that a
directory reports data a few hours after we were confident enough, but which
then slightly changed the graph.

from the Q&A [https://gitweb.torproject.org/metrics-
web.git/tree/doc/users...](https://gitweb.torproject.org/metrics-
web.git/tree/doc/users-q-and-a.txt)

~~~
pfg
Edit: nvm, thanks to Caer for figuring this one out.

The drop appears to happen on Nov 13th[1], I think that period should've been
fully reported.

The only event I could find in the tor repo on that day was a version bump for
0.2.7[2], but node lists don't report any usage for that version yet, so I
doubt it's related.

It's all quite weird, because there seems to be no drop in consumed bandwidth
in the same period[3].

[1]: [https://metrics.torproject.org/userstats-relay-
country.png?s...](https://metrics.torproject.org/userstats-relay-
country.png?start=2015-11-12&events=off&end=2015-11-14&country=all)

[2]:
[https://gitweb.torproject.org/tor.git/commit/?id=741d2dc685a...](https://gitweb.torproject.org/tor.git/commit/?id=741d2dc685a0e380bc4d8fbcda5a33b70272b3f7)

[3]:
[https://metrics.torproject.org/bandwidth.png?start=2015-11-1...](https://metrics.torproject.org/bandwidth.png?start=2015-11-12&end=2015-11-14)

------
wspeirs
Is there something wrong with the counting, or is this an actual drop in
users?

~~~
krazydad
Its interesting, although perhaps coincidental, that the drop occurs on the
day of the Paris attacks.

------
Paul_S
Can't know if this is indeed the case but quite a few tor alternatives are out
there so this drop needn't be sinister.

This is seemingly tangential but when untargeted surveillance is used
steganography beats encryption.

~~~
mirimir
What alternatives? I2P is _much_ smaller, and has only _ad hoc_ clearnet
gateways. JonDo is too small. VPNs provide _much_ weaker anonymity than Tor
does.

------
tacojuan
[https://twitter.com/torproject/status/664168624467386368](https://twitter.com/torproject/status/664168624467386368)

