I used Tor for surveillance. But an appropriate kind, IMHO.

I used Tor as a small part of one of the capabilities of a supply chain integrity startup. I built a fancy scraper/crawler to discreetly monitor a major international marketplace (mainstream, not darknet), including selecting appropriate Tor exit nodes for each regional site, to try to ensure that we were seeing the same site content that people from those regions were seeing.

Tor somehow worked perfectly for those needs. So my only big concern was making sure everyone in the startup knew not to go bragging about this unusually good data we had. Since we were one C&D letter away from not being able to get the data at all.

(Unfortunately, this had to be a little adversarial with the marketplace, not done as a data-sharing partnership, since the marketplace benefited from a cut of all the counterfeit and graymarket sales that we were trying to fight. But I made sure the scraper was gentle yet effective, both to not be a jerk, and also to not attract attention.)

(I can talk about it now, since the startup ran out of runway during Covid investor skittishness.)

For anyone interested in this author’s book on Tor, it’s available for free download! https://direct.mit.edu/books/oa-monograph/5761/TorFrom-the-D... (full disclosure: i work for MIT Press)

I think they publicized it so they could obscurely use it for military purposes. The users are easy to spot if they are all military users. Get tons and tons of regular users to use it and you obscure who is trying to hide.

Btw, a Tor relay can be relatively lightweight. I run one on a $5/mo VPS (which does many other things). You need 1 GiB of RAM, but a single basic CPU core largely suffices. My relay sends/receives ~150 GiB of traffic per day (~15 Mbits/s). It’s not an exit node, so no legal worries.

Here’s my torrc:

  SocksPort  0
  ExitRelay  0

  ORPort     NNNN
  DirPort    NNNN

  Nickname     X
  ContactInfo  X@X.com

  RelayBandwidthRate    80 megabits
  RelayBandwidthBurst  120 megabits

  MaxMemInQueues  384 megabytes

  AvoidDiskWrites  1
  HardwareAccel    1
  NoExec           1
  NumCPUs          1

Here’s my override config for systemd (Ubuntu 24.04):

  $ sudo systemctl edit tor@default
  [Service]
  Nice=15
  CPUAffinity=0
  CPUWeight=60
  StartupCPUWeight=6
  IOWeight=60
  TimerSlackNSec=100us

  MemoryMax=896M
  MemoryHigh=800M
  OOMScoreAdjust=1000

  LimitAS=2G
  LimitNPROC=512
  LimitNOFILE=10240

  PrivateDevices=true
  ProtectSystem=true
  ProtectHome=true

I'd never used Tor, though had to scrape a bunch of things that required different IPs. I figured their endpoints were already tarred.

With the porn block in the UK though, the "New Private Window with Tor" in Brave is very convenient.

Maybe not for long, or maybe not. I guess websites don't need to comply beyond a certain point.

There are tons of "residential proxy" and whatnot type services available, IP being a source of truth doesn't seem to matter much in 2025. The Perplexity 'bot' recent topic being an example of that.

Basically if you want to access any resource on the web for a dollar a GB or so you can use millions of IPs.

I ran a bridge until recently, but the server died a heat death after I moved to another apartment :(

I have not yet had time to find a suitable replacement machine. But running a bridge is a cheap, safe low network volume method people can help out from home. I had it going to help people in 'bad' countries to get out to the rest of the world.

https://community.torproject.org/relay/setup/bridge/

If you already have an understanding of how Tor works and want to know how attacks on it work, read these!

- https://github.com/mikeperry-tor/vanguards/blob/master/READM...

- https://github.com/mikeperry-tor/vanguards/blob/master/READM...

- https://spec.torproject.org/proposals/344-protocol-info-leak...

I assume when I’m using Tor that every packet is the under the highest level of collection/analysis priority. I think maybe sometimes it’s better to blend into in the crowd