Why Nexus runs three mirrors and not one

New readers of this directory sometimes write in to ask why we do not just publish a single Nexus onion and update it when it changes, the way a domain gets updated. It is a reasonable question and the answer says something about how the platform is put together, so it seems worth writing down in one place.

The single-address problem

A single onion address for a busy Tor marketplace has two failure modes that dwarf every other risk. The first is load. A single onion resolves to a single set of Tor descriptors, which means every incoming connection has to squeeze through the same introduction points. Under sustained pressure — an advertising push, a coordinated DDoS, a spike after a mainstream write-up — those introduction points saturate and everyone stalls at the anti-DDoS wait page, sometimes for hours.

The second failure mode is takedown pressure. A single canonical address is a single canonical target. Anything that removes that address, technically or otherwise, removes the whole storefront from view at once. Sometimes the target is symbolic: bounties get placed against known onion strings, hosting relationships get pressured, upstream providers get letters. All of that is more effective against one address than against three or four working in rotation.

The rotating set solution

Nexus publishes a small set of onion addresses that all resolve to the same back end. Three, sometimes four, occasionally two while the operator is preparing a rotation. Every one leads to the same account, balance, order history and message inbox. When one address is under pressure or being introduced or retired, the others carry the traffic without any user needing to know which one is under load at that moment.

The rotation itself is a slow-moving pattern rather than an emergency response. Addresses get added and retired on a cadence that averages every few weeks. Each new address gets a couple of days of parallel service alongside the outgoing one before the outgoing one stops being announced. Bookmarks of retired addresses fall out of the live set gradually rather than in a hard cutoff, which is deliberate — an abrupt cutoff is exactly the kind of event a phishing operation waits for.

Where this directory fits

Because the set rotates, a bookmark against a single onion goes stale by design. What you want is a bookmark against a reference that tracks the operator's current set, and that is what this directory is. Every address on the front page was verified against the last signed rotation from the operator and gets pulled the moment the operator retires it. If you land here after a bookmark of a specific onion stops working, that is the pattern working as intended rather than an outage.

What to look for in a rotation

Every rotation the operator publishes on Dread is signed with the same PGP key that has anchored the project since launch. Verifying that signature on your own copy of GnuPG takes about a minute and closes the whole class of impersonation attacks in a single step. If you have not pinned the operator fingerprint yet, do it once and you will not need to think about it again on any future rotation.