rowan

I think unconditionally blocking tor, open proxies etc is a bad idea, unless you're under attack and urgently need to tighten up things.

I prefer the once bitten, twice shy model: if an IP (or cookie'd device) misbehaves and ends up banned for a day, their reputation goes down, so the trigger level for a future ban is set much lower.

I send a bit of skimmed TGP traffic to a semi-adult site and see plenty of VPNs and TOR IPs. They mostly behave themselves just fine.