Re: [tor-talk] Awareness for identity correlation through circuit sharing is almost zero.

2012-03-05 Thread Nick Mathewson
On Mon, Mar 5, 2012 at 7:20 PM, wrote: > Thanks for your answer. It's immensely helpful. > [...] >> (Note >> that usernames and/or passwords can be used to separate streams, >> too.) > > Is this documented somewhere? If you're asking this question, you *really* want to check out all the isolati

Re: [tor-talk] "EVIL bug" Linux Tor Browser Bundle (2.2.35-8)

2012-03-19 Thread Nick Mathewson
On Mon, Mar 19, 2012 at 10:51 AM, wrote: > https://blog.torproject.org/blog/new-tor-browser-bundles-16 > > On March 18th, 2012 Anonymous said: > > "There is an EVIL bug in at least the Linux start-tor-browser script. See > https://trac.torproject.org/projects/tor/ticket/5417 > > A simple error wi

Re: [tor-talk] Ask for RSA key size upgrade

2012-04-06 Thread Nick Mathewson
On Fri, Apr 6, 2012 at 10:54 AM, HardKor wrote: > Thank you, > > I read the documents. Actualy I'm a hidden service operator. And I worry > about the security of my public key. > I generated a 4096 bits key manually and started a hidden service with it. > Tor gnerated a hostname file but I desn't

[tor-talk] Another openssl advisory: Tor seems not to be affected

2012-04-19 Thread Nick Mathewson
Hi, all! It looks like there is an openssl security advisory affecting some but not all of the ASN.1 parsing code. The announcement is here: http://openssl.org/news/secadv_20120419.txt And the full-disclosure posting is here: http://seclists.org/fulldisclosure/2012/Apr/210 It looks like there

[tor-talk] If you build your own OpenSSL, and you're on 1.0.1, please upgrade to 1.0.1c

2012-05-10 Thread Nick Mathewson
Hi, all! If you are using any version of openssl 1.0.1, 1.0.1a, or 1.0.1b, you should know that it's affected by a recent security advisory: https://www.openssl.org/news/secadv_20120510.txt If I am reading the diffs for this bug right, it looks like it would attacker to crash a server remotely.

Re: [tor-talk] Tor's stream isolation features defaults

2012-05-27 Thread Nick Mathewson
On Sun, May 27, 2012 at 4:56 PM, wrote: > We like to understand Tor's stream isolation features better. For those who > don't know, they will be included in Tor 0.2.3 and are already available in > the Tor Alpha 0.2.3. See > https://www.torproject.org/docs/tor-manual-dev.html.en for more infor

Re: [tor-talk] Data storage in cached-descriptors

2012-05-30 Thread Nick Mathewson
On Wed, May 30, 2012 at 2:38 AM, Fabio Pietrosanti (naif) wrote: > Hi all, > > i've been thinking some days ago that the Tor infrastructure maybe a > very valuable infrastructure also for other software that would like to > stay distributed without a "central directory". Basically, there are som

Re: [tor-talk] Tor 0.2.3 Alpha ready for redistributed projects?

2012-05-28 Thread Nick Mathewson
On Mon, May 28, 2012 at 5:24 AM, wrote: > Is it safe to use the Tor 0.2.3 Alpha in redistributed projects for regular > use? (Such as Tails or TorBOX.) Or should the alpha branch only be touched by > testers and developers? Well, the alphas encounter bugs much more frequently, since we merge l

Re: [tor-talk] What is 127.0.69.0?

2012-07-23 Thread Nick Mathewson
On Mon, Jul 23, 2012 at 3:25 PM, Hansen Jay wrote: > Hello, > > I happened to see some hidden service name resolution that torsocks was > giving as 127.0.69.0 which I never read about, so I telnetted to it and it's > like another entrance point to Tor, or at least my hidden services(?). I'm a >

Re: [tor-talk] Private Tor network on IPv6 only

2012-07-31 Thread Nick Mathewson
Tor On Jul 31, 2012 7:07 PM, "Jed Gainer" wrote: > > why does Tor still force IPv4 when TestingTorNetwork is set? > Tor doesn't currently do a good job of supporting IPv6 at all for anything beyond bridges. We hope to fix that in the next several months in the 0.2.4.x release series. I don't ha

Re: [tor-talk] Private Tor network on IPv6 only

2012-08-01 Thread Nick Mathewson
On Tue, Jul 31, 2012 at 7:42 PM, Bjoern A. Zeeb wrote: > On Tue, 31 Jul 2012, Nick Mathewson wrote: > >> Tor >> On Jul 31, 2012 7:07 PM, "Jed Gainer" wrote: >>> >>> >>> why does Tor still force IPv4 when TestingTorNetwork is set? >>&

Re: [tor-talk] Strong anonymization in a fixed group of participants

2012-08-06 Thread Nick Mathewson
The system you describe is approximately a one-hop mix, with Tor layered in front of the mix to prevent the mix (the leader in your design) from learning who submitted which message. So the security against learning group membership will reduce to the security of Tor; the security against the lead

Re: [tor-talk] Bug Remains: OpenSSL library does not load unless bridges are used

2012-08-09 Thread Nick Mathewson
On Sat, Aug 4, 2012 at 3:52 PM, wrote: > This is a followup post on this issue which persists in Linux TBB 32bit, > version 2.2.37-2. > > Any idea for the cause? > > What occurs when it doesn't list the library loading (is the library > loading?) and why it's listed > only on a TBB reload? > >

Re: [tor-talk] http://torbrowser.sourceforge.net/

2012-08-15 Thread Nick Mathewson
On Wed, Aug 15, 2012 at 5:35 PM, Randolph D. wrote: > As you already can see on the website, it is added (maybe done later than > you looked first): > > "TorBrowser Source code is open source and not affiliated with Tor, but > simply use Tor. "Tor" and the "Onion Logo" are registered trademarks of

Re: [tor-talk] http://torbrowser.sourceforge.net/

2012-08-15 Thread Nick Mathewson
On Wed, Aug 15, 2012 at 10:26 PM, dumbnewbie wrote: > I did a brief check but didn't determine the answer - is perrymikey > (http://sourceforge.net/users/perrymikey) the same as mikeperry > (https://blog.torproject.org/blogs/mikeperry)? Absolutely not. And unless there really is some other guy

Re: [tor-talk] http://torbrowser.sourceforge.net

2012-08-16 Thread Nick Mathewson
On Thu, Aug 16, 2012 at 2:11 PM, A. Megas wrote: > My turn. Alexis, I don't think this "antispam" guy is talking about Dooble the browser. He's talking about "Randolph"/"Perrymike"/whoever's so-called "TorBrowser." He's talking about "that package" and a "Dooble Bundle" to distinguish it from t

Re: [tor-talk] http://torbrowser.sourceforge.net

2012-08-16 Thread Nick Mathewson
On Thu, Aug 16, 2012 at 3:47 PM, Randolph D. wrote: > TBB =/ Torbrowser We release a piece of software called TorBrowser. I don't know how much more simple I can make that, Randolph. We *already* use that name for one of the components of the TBB. When you install TBB, it puts an icon on your

Re: [tor-talk] please suggest a new project name for Anonymous Operating System

2012-08-28 Thread Nick Mathewson
On Sun, Aug 26, 2012 at 4:39 PM, adrelanos wrote: > I'd be nice if you could make suggestions for a good project name. > Things like "anonym.os", "anonymous.os", "anon.os" are already taken. Personally, I think it's not so important to have a name that tells you what the product is. Tor's doing

Re: [tor-talk] Please review Tails stream isolation plans

2012-08-29 Thread Nick Mathewson
On Mon, Aug 27, 2012 at 6:33 AM, intrigeri wrote: > While I'm at it, we wanted to ask whether it is reasonable for Tails > to ship with IsolateDestAddr enabled by default (but for the web > browser) as described in our plans, or if it is doomed to put too high > a load on the Tor network. (Not tha

Re: [tor-talk] [Tails-dev] Please review Tails stream isolation plans

2012-08-30 Thread Nick Mathewson
On Wed, Aug 29, 2012 at 10:04 AM, intrigeri wrote: > Hi, > > Nick Mathewson wrote (29 Aug 2012 13:22:36 GMT) : >> I'd need an actual list of applications to think about >> IsolateDestAddr. Which ones did you have in mind? > > Thank you for having a look. You&#

Re: [tor-talk] [Tails-dev] Please review Tails stream isolation plans

2012-09-03 Thread Nick Mathewson
On Sep 3, 2012 2:21 PM, "adrelanos" wrote: > > intrigeri: > > Hi, > > > > Nick Mathewson wrote (30 Aug 2012 15:10:52 GMT) : > >> or using some kind of iptables trickery? > > > > I'm not sure how doable it is to use iptables to c

Re: [tor-talk] hidden services and stream isolation

2012-09-07 Thread Nick Mathewson
On Wed, Sep 5, 2012 at 3:27 PM, adrelanos wrote: > Hi, > > How comes stream isolation into play with hidden services, if at all? > Please provide some information. I hope it works! If somebody wants to test it, that would be much appreciated. > Is it possible to stream isolate (multiple) hidden

Re: [tor-talk] hidden services and stream isolation

2012-09-07 Thread Nick Mathewson
On Fri, Sep 7, 2012 at 11:02 AM, Fabio Pietrosanti (naif) wrote: > On 9/7/12 10:28 AM, Nick Mathewson wrote: >> Hidden services are already isolated from each other, and from non-hs >> client traffic. The only additional feature for stream isolation to >> provide would be i

Re: [tor-talk] Tor 0.2.4.2-alpha is out

2012-09-10 Thread Nick Mathewson
On Mon, Sep 10, 2012 at 10:10 PM, grarpamp wrote: >> - Log fewer lines at level "notice" about our OpenSSL and Libevent >> versions and capabilities when everything is going right. > > The version confirmation was handy when you're compiling > static and want to know what actually made i

Re: [tor-talk] SocksPort: Circuit isolation is not Exit isolation

2012-09-10 Thread Nick Mathewson
On Mon, Sep 10, 2012 at 10:28 PM, grarpamp wrote: > The typical use case is wanting to use multiple accounts on the > same site at once, with a guarantee that you're not appearing to > be from the same exit and thus are not as easily linked. > This doesn't make sense to me. If you've got two req

Re: [tor-talk] SocksPort: Circuit isolation is not Exit isolation

2012-09-10 Thread Nick Mathewson
On Tue, Sep 11, 2012 at 12:21 AM, grarpamp wrote: >>> The typical use case is wanting to use multiple accounts on the >>> same site at once, with a guarantee that you're not appearing to >>> be from the same exit and thus are not as easily linked. > >> This doesn't make sense to me. If you've got

Re: [tor-talk] SocksPort: Circuit isolation is not Exit isolation

2012-09-10 Thread Nick Mathewson
On Tue, Sep 11, 2012 at 1:36 AM, Jacob Appelbaum wrote: > Nick Mathewson: >> On Mon, Sep 10, 2012 at 10:28 PM, grarpamp wrote: >>> The typical use case is wanting to use multiple accounts on the >>> same site at once, with a guarantee that you're not appearing

Re: [tor-talk] tor-0.2.4.2-alpha compile errors

2012-09-14 Thread Nick Mathewson
On Fri, Sep 14, 2012 at 3:55 AM, Sebastian Hahn wrote: > > On Sep 14, 2012, at 9:34 AM, grarpamp wrote: > >> Some easy ones... > [snip] > > What compiler is that, and version? The code in main.c has been like > this for a while, I wonder why it didn't come up before. > Ah, I've seen something lik

Re: [tor-talk] tor-0.2.4.2-alpha compile errors

2012-09-14 Thread Nick Mathewson
On Fri, Sep 14, 2012 at 9:29 AM, Nick Mathewson wrote: > On Fri, Sep 14, 2012 at 3:55 AM, Sebastian Hahn > wrote: >> >> On Sep 14, 2012, at 9:34 AM, grarpamp wrote: >> >>> Some easy ones... >> [snip] >> >> What compiler is that, and version? T

[tor-talk] Tor meetup in San Francisco this Saturday

2012-09-20 Thread Nick Mathewson
Hi, friends! I'm in San Francisco this weekend for the EFF Pioneer awards, and I'm going to have an informal Tor meetup this Saturday at the Noisebridge hackerspace from noon through 6pm. The internet can tell you where Noisebridge is and how to get there. Please come, if you'd like to hang out

Re: [tor-talk] Why would authorities fall back to "1"?

2012-10-27 Thread Nick Mathewson
Whoops; my phone used the wrong from address. Let me try that again. I tried to say: > On Oct 27, 2012 11:50 AM, "Sebastian G. " < bastik@googlemail.com> wrote: > [] > > > > > Let's say more than 2/3 support "14" and one supports "13". The last one > > wouldn't use "14" becaus

Re: [tor-talk] torsocks is broken and unmaintained

2012-11-02 Thread Nick Mathewson
On Fri, Nov 2, 2012 at 1:02 PM, adrelanos wrote: > Hi, > [ [...] > What are the consequences? > Probably somebody should fork it? -- Nick ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo

Re: [tor-talk] torsocks is broken and unmaintained

2012-11-02 Thread Nick Mathewson
On Fri, Nov 2, 2012 at 1:34 PM, adrelanos wrote: > > > Could you blog it please? I'd like to see more discussion from more people here first, and see whether somebody steps up to say, "Yeah, I can maintain that" here, or whether somebody else who knows more than me about the issues has something

Re: [tor-talk] torsocks is broken and unmaintained

2012-11-03 Thread Nick Mathewson
On Fri, Nov 2, 2012 at 11:10 PM, Matthew Finkel wrote: > On 11/02/2012 07:36 PM, Jacob Appelbaum wrote: > > Nick Mathewson: > >> On Fri, Nov 2, 2012 at 1:34 PM, adrelanos wrote: > >>> > >>> > >>> Could you blog it please? > >> > &

Re: [tor-talk] torsocks is broken and unmaintained

2012-11-03 Thread Nick Mathewson
On Sat, Nov 3, 2012 at 11:23 PM, Matthew Finkel wrote: > On 11/03/2012 08:38 PM, Nick Mathewson wrote: > [...] > > Okay, sounds like we've got some enthusiasm. Let's get started. I > > volunteer to review commits and if people ask me to, and suggest that > &g

Re: [tor-talk] Confusion about Tor log messages showing relay addresses

2012-11-04 Thread Nick Mathewson
On Sun, Nov 4, 2012 at 11:17 AM, Joe Btfsplk wrote: [...] > >> Wow, absolutely no ideas about the cause, validity / non validity of > these warning messages? Grepping for the string "protocol that may leak information" in Vidalia, it looks like you're *probably* seeing this one: "One of yo

Re: [tor-talk] IsolateSOCKSUser vs IsolateSOCKSAuth bug in documentation or design?

2012-11-04 Thread Nick Mathewson
On Sat, Nov 3, 2012 at 10:20 AM, intrigeri wrote: > adrelanos wrote (03 Nov 2012 13:37:04 GMT) : > > Which one is correct? > > $ echo "SOCKSPort 1 IsolateSOCKSUser" > /tmp/intrigeri/torrc > $ tor -f /tmp/intrigeri/torrc > [...] > [warn] Unrecognized SocksPort option '"IsolateSOCKSUser"' > Ri

Re: [tor-talk] details about Tor's packaging window and delivery window

2012-11-22 Thread Nick Mathewson
On Thu, Nov 22, 2012 at 9:55 AM, esolve esolve wrote: [...] > where can I find more details about these two windows? Try the specification document, "tor-spec.txt". You can get it from the torspec git repository, or read it on the web at https://gitweb.torproject.org/torspec.git/blob/HEAD:/tor-s

Re: [tor-talk] Aggregate-type settings in torrc

2012-12-09 Thread Nick Mathewson
On Sat, Dec 8, 2012 at 8:31 PM, Maxim Kammerer wrote: > Hi, > > Are settings like ReachableAddresses guaranteed to aggregate in torrc? > E.g., is > ReachableAddresses 1.2.3.4:56 > ReachableAddresses 7.8.9.1:78 > equivalent to > ReachableAddresses 1.2.3.4:56, 7.8.9.1:78 > It is the case in my

[tor-talk] Servers might want to avoid 0.2.4.7-alpha: there's a crash bug.

2012-12-28 Thread Nick Mathewson
Hi, folks! There appears to be a crash bug[1] in 0.2.4.7-alpha's IPv6 code that can get triggered on a server when a client sets the wrong set of IPv6 options. No cause for major alarm: It doesn't appear to allow remote code execution or anything -- but it *does* make servers segfault. So if you

Re: [tor-talk] Mosh safe with tor?

2013-01-18 Thread Nick Mathewson
On Fri, Jan 18, 2013 at 10:08 AM, Andrew Lewman wrote: > On Fri, 18 Jan 2013 13:40:14 +0100 > Jerzy Łogiewa wrote: > >> Hello! >> >> Does anyone know, is the Mosh shell safe for tor use? Any known >> leaking? > > It's UDP-based, so no. And it appears to be based upon one person's > mods to AES.

Re: [tor-talk] [tor-dev] Open streams on the fly

2013-01-21 Thread Nick Mathewson
On Mon, Jan 21, 2013 at 2:56 PM, wrote: I think tor lacks an isolation flag which specifies to isolate each and every stream, even those going to the same address and port. >>> >>> I see, tor already implements such a flag, ISO_STREAM. > > I attached a simple formal proposal for this id

Re: [tor-talk] Errors in logfile, tor relay stuck @ 100% CPU

2013-01-29 Thread Nick Mathewson
On Tue, Jan 29, 2013 at 10:28 AM, wrote: > Hey, > > my tor relay is suddenly experiencing issues. Even when there is no traffic > the tor process consumes 100% CPU. The logfile is getting spammed with this > message: > [warn] tor_addr_is_internal(): Bug: tor_addr_is_internal() called with a > non

[tor-talk] Watch out for openssl 1.0.1d if you're using AESNI

2013-02-07 Thread Nick Mathewson
Hi, all! There's a bug in openssl 1.0.1d that breaks Tor (and lots of other programs) if you have a CPU with aesni support. If you have aesni support on your CPU, and you're using the openssl 1.0.1 series, and you decide that you simply _must_ upgrade OpenSSL before 1.0.1e can be released (soon,

Re: [tor-talk] please re-consider Tor Trademark policy

2013-02-20 Thread Nick Mathewson
On Wed, Feb 20, 2013 at 1:21 AM, adrelanos wrote: > These pages are confusing: > http://www.torproject.org/docs/trademark-faq.html.en > https://trac.torproject.org/projects/tor/wiki/LikelyTMViolators > > Please re-consider your standpoint. > > It's not uncommon to include a part of the name of the

Re: [tor-talk] torsocks 1.3 is tagged and released

2013-02-22 Thread Nick Mathewson
On Fri, Feb 22, 2013 at 12:09 PM, intrigeri wrote: > Hi, > > Jacob Appelbaum wrote (12 Feb 2013 19:25:59 GMT) : >> intrigeri: >>> A Git tag integrates perfectly with packaging workflow... iff it's the >>> canonical form of distribution of the complete upstream release. >>> [...] > >> I'll discuss

[tor-talk] Is anybody or anything still using /etc/tor/tsocks.conf ?

2013-02-27 Thread Nick Mathewson
Hi! We have a ticket (#8290) to remove the /etc/tor/tsocks.conf file, especially now that Torsocks exists and is recommended over a stock tsocks. It seems like a decent idea to me, but before I go ahead, I want to know whether any packages or large groups of users are relying on it. Please comme

Re: [tor-talk] What would Tor v1.0 look like?

2013-03-14 Thread Nick Mathewson
On Wed, Mar 6, 2013 at 6:12 PM, georgeofthejungle wrote: > Hello, > > I've been using Tor for many years now (when Tor was hosted by EFF), and > I love how fast and far Tor is progressing, as well as other Tor Project > projects (e.g., TorBrowser and TorButton). I've always wondered what it > woul

Re: [tor-talk] NSA supercomputer

2013-04-04 Thread Nick Mathewson
On Thu, Apr 4, 2013 at 5:51 AM, Bernard Tyers wrote: > Hi, > > Is there a reason 1024 bit keys, instead of something higher is not used? Do > higher bit keys affect host performance, or network latency? Because in 2003/2004, when we were designing Tor, 1024-bit keys seemed like they would probab

Re: [tor-talk] ExcludeEntryNodes

2013-04-13 Thread Nick Mathewson
On Apr 13, 2013 2:19 PM, "hamahangi" wrote: [...] > So why is there no ExcludeEntryNodes option? It seems to have been > present at some point as there's reference to it in old mirrors of the > documentation and on the blog[0], and the helpdesk advised me that it > was still there, but I've tried

Re: [tor-talk] ExcludeEntryNodes

2013-04-13 Thread Nick Mathewson
On Sat, Apr 13, 2013 at 6:01 PM, hamahangi wrote: > #5903 and #6523. There seems to have been some fiddling with both but no > comments to speak of. Thanks for clearing up the reasoning behind your > decision. Thanks; I've marked #5903 for 0.2.5 and closed #6523 as a duplicate. That's not a commi

Re: [tor-talk] Tor project creating a replacement for TrueCrypt?

2013-04-18 Thread Nick Mathewson
On Apr 18, 2013 2:01 PM, "Anthony Papillion" wrote: > > Hello Everyone, > > Someone I know said that he read that the project was creating a > replacement for TrueCrypt. Can anyone verify this as accurate or not? If > it is accurate, how far along is the work and where can I find more > informati

Re: [tor-talk] Tor 0.2.4.12-alpha is out

2013-04-18 Thread Nick Mathewson
On Thu, Apr 18, 2013 at 2:08 PM, Sebastian G. wrote: > 18.04.2013 14:05, Roger Dingledine: >> [...] >> >> o Major bugfixes (client-side privacy): >> - When we mark a circuit as unusable for new circuits, have it >> continue to be unusable for new circuits even if MaxCircuitDirtiness >

[tor-talk] PSA: watch out for trojans

2013-04-19 Thread Nick Mathewson
Hi, folks. Somebody just stopped by a couple of the Tor IRC channels and linked to something that was supposed to be the result of "redoing vadalia [sic] in java." Instead, it turned out to be (apparently[*]) an updated variant of the Java trojan described in http://community.websense.com/blogs/s

tor-talk@lists.torproject.org

2013-06-16 Thread Nick Mathewson
On Sun, Jun 16, 2013 at 11:09 AM, adrelanos wrote: > Hi! [...] > Well, I guess > having any non-ideal Q/A forum is better than forever having no Q/A forum. Hi, Adrelanos! You have hit the nail on the head with that part. So because I'm not principally involved with the decision to move away fr

Re: [tor-talk] Plans about Askbot?

2013-06-16 Thread Nick Mathewson
On Jun 16, 2013 4:38 PM, "Moritz Bartl" wrote: > > On 16.06.2013 21:33, Sebastian G. wrote: > >> It was decided that we have no resources to maintain our own Q&A, and > >> that having a third-party Q&A is better than none. I disagree, but > >> that's not the point. > > I'm not sure what you disag

Re: [tor-talk] Tor 0.2.4.13-alpha is out

2013-06-16 Thread Nick Mathewson
On Sun, Jun 16, 2013 at 6:49 PM, Roman Mamedov wrote: > On Sun, 16 Jun 2013 15:18:47 -0700 > Mike Perry wrote: > >> Roger Dingledine: >> > Tor 0.2.4.13-alpha fixes a variety of potential remote crash >> > vulnerabilities, makes socks5 username/password circuit isolation >> > actually actually wor

Re: [tor-talk] Tor 0.2.4.13-alpha is out

2013-06-16 Thread Nick Mathewson
On Sun, Jun 16, 2013 at 6:55 PM, krishna e bera wrote: > > What if relays revert to the "stable" 0.2.3.latest for now? Personally, I'd suggest that relays just stick with 0.2.4.12-alpha and wait 0.2.4.14-alpha: we should have it out pretty darn soon. -- Nick

Re: [tor-talk] "Torifier" for Windows

2013-06-17 Thread Nick Mathewson
On Mon, Jun 17, 2013 at 3:23 PM, Fabio Pietrosanti (naif) wrote: > On 6/17/13 8:21 PM, mancha wrote: >> >> Hello. >> >> Is there a Tor Project sanctioned method to "torify" >> applications on Windows? >> >> On systems such as Linux there are wrappers like torify >> and torsocks. Windows does have

Re: [tor-talk] "Torifier" for Windows

2013-06-18 Thread Nick Mathewson
On Tue, Jun 18, 2013 at 2:50 AM, Fabio Pietrosanti (naif) wrote: > > On 6/17/13 9:32 PM, Nick Mathewson wrote: >> >> >> Also, its API hooking system is based on the ubiquitous ZDisasm.c >> file written by Z0MBiE, who to the best of my knowledge never actually >&g

Re: [tor-talk] Are non-official projects welcome to Stackexchange Tor Q&A forum?

2013-06-18 Thread Nick Mathewson
On Mon, Jun 17, 2013 at 5:23 PM, adrelanos wrote: > Hi! > > Short version: > > Can I redirect Whonix users to Stackexchange Tor Q&A forum? > > Long version: > > There are many Tor related projects, which are non-official, such as > Whonix, Liberte Linux, TorChat, etc. > > Can non-official projects

[tor-talk] Tor 0.2.4.14-alpha is out

2013-06-18 Thread Nick Mathewson
Hi, everybody! Usually, Roger sends these announcements out, but he's away from the internet this week, and I thought it was a good idea to get this one out soon, given the discussion in the last thread on this list. For obvious reasons, it'll be signed with my GPG key, not Roger's. I don't do r

Re: [tor-talk] Are non-official projects welcome to Stackexchange Tor Q&A forum?

2013-06-21 Thread Nick Mathewson
On Fri, Jun 21, 2013 at 8:58 AM, Nadim Kobeissi wrote: > I disagree with the Tor Project pushing for a StackExchange that is limited > to Tor, when a StackExchange for Anonymity Technology doesn't exist as a > whole. I would prefer that a SE for Anonymity software is established that > includes

Re: [tor-talk] Fwd: [Full-disclosure] tor vulnerabilities?

2013-06-29 Thread Nick Mathewson
On Sat, Jun 29, 2013 at 4:43 PM, Cool Hand Luke wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA512 > > the below text was posted to pastebin.com (see original e-mail to the > full-disclosure list at the end of this message). > > > - - BEGIN PASTEBIN - > Tor LOL: > > directory autho

Re: [tor-talk] Fwd: [Full-disclosure] tor vulnerabilities?

2013-06-29 Thread Nick Mathewson
On Sat, Jun 29, 2013 at 5:53 PM, Nick Mathewson wrote: > On Sat, Jun 29, 2013 at 4:43 PM, Cool Hand Luke > wrote: >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA512 >> >> the below text was posted to pastebin.com (see original e-mail to the >> full-disclo

Re: [tor-talk] Fwd: [Full-disclosure] tor vulnerabilities?

2013-06-29 Thread Nick Mathewson
On Sat, Jun 29, 2013 at 5:53 PM, Nick Mathewson wrote: > On Sat, Jun 29, 2013 at 4:43 PM, Cool Hand Luke > wrote: >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA512 >> >> the below text was posted to pastebin.com (see original e-mail to the >> full-disclo

Re: [tor-talk] Binary patch downloads (for updating TBB)?

2013-06-29 Thread Nick Mathewson
On Sat, Jun 29, 2013 at 10:32 PM, Mike Perry wrote: > David Balažic: >> Hi! >> >> You don't realize how big the TBB is until you're forced to use a slow >> connection. >> >> In that light, are there patches available to update between releases? >> It might reduce load on the servers too. > > We ho

Re: [tor-talk] Tor for upcoming FirefoxOS?

2013-07-02 Thread Nick Mathewson
On Tue, Jul 2, 2013 at 5:39 PM, Nathan Freitas wrote: > On 07/02/2013 02:02 PM, Fabio Pietrosanti (naif) wrote: >> I am wondering if a Client-Only, lightweight Tor Library in Javascript >> would be feasible, maybe considering SilverTunnel porting >> https://silvertunnel.org ? > > The problem in th

Re: [tor-talk] Tor 0.2.4.15-rc is out

2013-07-05 Thread Nick Mathewson
On Wed, Jul 3, 2013 at 10:11 PM, Geoff Down wrote: > > > On Wed, Jul 3, 2013, at 07:05 PM, Roger Dingledine wrote: >> Tor 0.2.4.15-rc is the first release candidate for the Tor 0.2.4.x >> series. It fixes a few smaller bugs, but generally appears stable. >> Please test it and let us know whether i

Re: [tor-talk] Using Mixminion trough the Tor network

2011-02-21 Thread Nick Mathewson
On Sun, Jan 30, 2011 at 2:13 PM, emersonv6 wrote: > Hi, > > I was wondering if anyone has succeeded torifyng Mixminion. You'd probably want to hack up Mixminion's socket.connect stuff to use a SOCKS-compatible version instead. The functions to hack on the client side would be in lib/mixminion/MM

Re: [tor-talk] security properties of tor

2011-02-28 Thread Nick Mathewson
On Thu, Feb 24, 2011 at 7:35 PM, wrote: > Hey all, > > Security researcher here (as I assume are many of you). > Papers and a book linked to from sig. > > Anyway, if I want to come up to speed on the security properties > of tor, to the point of understanding how they're enforced and what > isn't

Re: [tor-talk] How does Tor REALLY work?

2011-03-07 Thread Nick Mathewson
On Sat, Mar 5, 2011 at 7:29 AM, wrote: > I mean _really_ work. > > (I already know how it protects your anonymity.) > > What happens from the moment you start the Tor program? What's the first > thing it does, the next thing, and so forth? I've never seen a detailed > technical illustration of ho

Re: [tor-talk] How does Tor REALLY work?

2011-03-08 Thread Nick Mathewson
On Tue, Mar 8, 2011 at 8:27 AM, casey dunham wrote: > I've got a bunch of notes from perusing the source code trying to understand > it. > > It sounds like it would be a great project for someone that is just > getting into Tor and already knows C (I hope I didn't just volunteer > myself for the

Re: [tor-talk] Why does Tor use the key lengths it does?

2011-03-10 Thread Nick Mathewson
On Thu, Mar 10, 2011 at 12:40 PM, F. Fox wrote: > Just curious as to why Tor uses RSA-1024/AES-128, and not something like > RSA-2048/AES-256. > > I suppose if keys are rotated enough, it doesn't matter much... is this > what's up with it? I wrote a mail about this a few months ago: http://archi

Re: [tor-talk] How does Tor REALLY work?

2011-03-10 Thread Nick Mathewson
On Thu, Mar 10, 2011 at 8:38 PM, casey dunham wrote: > It seems that the tor Doxygen isn't published anywhere? From this > http://www.bitchx.com/log/tor-o/tor-o-25-May-2010/tor-o-25-May-2010-00.php > > it looks like it hasn't been kept up to date. Maybe that would be a > good first step? Getting t

Re: [tor-talk] Iran cracks down on web dissident technology

2011-03-21 Thread Nick Mathewson
On Mon, Mar 21, 2011 at 11:40 AM, katmagic wrote: > On Mon, 21 Mar 2011 11:07:49 -0400 > Paul Syverson wrote: > >> universities are in on it, and the supposedly independent researchers >> who found code flaws were also in on it (or sock puppets created by >> Roger to create credibility). But at s

Re: [tor-talk] Ticket #2594 (new enhancement) ["Excito needs a web interface to easily install and configure Tor"

2011-04-04 Thread Nick Mathewson
On Mon, Apr 4, 2011 at 8:55 AM, Håken Hveem wrote: > Hello, does anyone know when the enhancement will be released to the > public ? (In reference to https://trac.torproject.org/projects/tor/ticket/2594 .) To the best of my knowledge, we haven't started work on it, and there isn't a scheduled du

[tor-talk] Tor 0.2.2.25-alpha is out!

2011-04-29 Thread Nick Mathewson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Tor 0.2.2.25-alpha fixes many bugs: hidden service clients are more robust, routers no longer overreport their bandwidth, Win7 should crash a little less, and NEWNYM (as used by Vidalia's "new identity" button) now prevents hidden service-rela

Re: [tor-talk] Tor 0.2.3.1-alpha is out!

2011-05-05 Thread Nick Mathewson
On Thu, May 5, 2011 at 8:30 PM, Jim wrote: > > > Nick Mathewson wrote: >> Changes in version 0.2.3.1-alpha - 2011-05-05 >> >>   Tor 0.2.3.1-alpha adds some new experimental features, including ... >>   automatic home router configuration. > > Are you saying

[tor-talk] Tor 0.2.3.1-alpha is out!

2011-05-05 Thread Nick Mathewson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Changes in version 0.2.3.1-alpha - 2011-05-05 Tor 0.2.3.1-alpha adds some new experimental features, including support for an improved network IO backend, IOCP networking on Windows, microdescriptor caching, "fast-start" support for streams, and

Re: [tor-talk] Tor 0.2.3.1-alpha is out!

2011-05-06 Thread Nick Mathewson
On Fri, May 6, 2011 at 5:19 AM, Olaf Selke wrote: > Hi there, > > just upgraded the blutmagie routers to v0.2.3.1-alpha using > libevent-2.0.so.5. > Thanks, Olaf! Be sure to keep a closer-than-usual eye out for crashes. :) yrs, -- Nick ___ tor-talk m

[tor-talk] Tor 0.2.2.x will be stable soon; please try it out

2011-06-27 Thread Nick Mathewson
Hi, all! If you have a chance, please try out Tor 0.2.2.29-beta release some time soon! It's going to be stable pretty soon, and if we're going to find any more bugs in it, the best time to do so is now. The next release will probably be an -rc (release candidate) release, unless there are signi

Re: [tor-talk] embedding tor into apps?

2011-06-29 Thread Nick Mathewson
On Wed, Jun 29, 2011 at 9:56 AM, Manuel wrote: > On Wed, Jun 29, 2011 at 03:40:30PM +0200, MacLemon wrote: >> On 29.06.2011, at 13:46, Manuel wrote: >> > The real question is: Why would you want to embed Tor? >> I???d be interested in building a Tor browser for iOS which would require me >> to pa

Re: [tor-talk] TOR-Client bug?/wrong package size?

2011-06-29 Thread Nick Mathewson
On Wed, Jun 29, 2011 at 4:51 AM, wrote: > Hello, > > Does anybody know how TOR deals with TCP-Pakets? > > For example, while logging my outgoing traffic via iptables or > wireshark, i saw a large amount of TLS-encrypted packages - but > they all had a differend size, sometimes 60bytes, sometimes

Re: [tor-talk] specify exit for only one website?

2011-07-24 Thread Nick Mathewson
On Sun, Jul 24, 2011 at 12:29 PM, cmeclax-sazri wrote: > Is it possible to specify in Privoxy or Polipo that a particular website will > be accessed through an exit in a particular country, while all other websites > will be accessed through a randomly chosen exit anywhere? > In Tor, this would b

Re: [tor-talk] tor-0.2.2.32 compilation failure

2011-08-30 Thread Nick Mathewson
On Tue, Aug 30, 2011 at 6:10 PM, grarpamp wrote: >> try this patch: > > Give me a few minutes, will do it now. > > In the meantime, here's another issue... Wow. Your compiler doesn't like 'double d; printf("%lf", d);' . That's pretty... special. :) Attached are two more patches. Let us know

Re: [tor-talk] tor-0.2.2.32 compilation failure

2011-08-30 Thread Nick Mathewson
On Tue, Aug 30, 2011 at 9:10 PM, grarpamp wrote: >> circuitbuild.c:4134: warning: preprocessing directive not recognized >> within macro arg >> circuitbuild.c: In function `choose_random_entry': >> circuitbuild.c:4108: undefined or invalid # directive >> circuitbuild.c:4122: undefined or invalid #

Re: [tor-talk] RSA identity keys

2011-09-01 Thread Nick Mathewson
On Wed, Aug 31, 2011 at 6:03 AM, grarpamp wrote: > Tor routers and hidden services use these. > > Various other tools can utilize them for sign > and encrypt. A number of useful scenarious > can be envisioned. Hm. I'm not too fond of the idea of using Tor keys for other stuff too: there are hist

Re: [tor-talk] Hardware accel by default

2011-09-12 Thread Nick Mathewson
On Thu, Sep 8, 2011 at 1:18 PM, coderman wrote: [...] >> My question is... Why wasn't AES-NI taken advantage of by default? Why >> did I have to come across it by accident? > > some engines are actually slower than host optimized code. > > hw accel is experimental, and by default all providers in

Re: [tor-talk] GNU make required?

2011-09-12 Thread Nick Mathewson
On Wed, Sep 7, 2011 at 8:21 AM, Greg Troxel wrote: > > Greg Troxel writes: > >> Someone updated the pkgsrc entry for tor to 0.2.2.32, and on NetBSD/i386 >> 5.1ish it failed to build.  The complaint was about not knowing how to >> build libtor.a.  Switching to GNU make (from BSD make, which is 'ma

Re: [tor-talk] Tor as a sort of "library/dependancy" for third party software

2011-09-28 Thread Nick Mathewson
On Wed, Sep 28, 2011 at 3:41 PM, Jacob Appelbaum wrote: >> p.s. The alternative to provide the same degree of security/usability is >> to use a Java Applet with file upload+file encryption+silvertunnel as a >> Tor Client layer. > > I don't think silvertunnel is a good idea - the code is based on >

Re: [tor-talk] Tor 0.2.3.5-alpha is out

2011-09-28 Thread Nick Mathewson
On Wed, Sep 28, 2011 at 8:12 PM, Roger Dingledine wrote: > On Wed, Sep 28, 2011 at 08:06:14PM -0400, Roger Dingledine wrote: >>   o Major features (networking): >>     - Add a new TokenBucketRefillInterval option to refill token buckets >>       more frequently than once per second. This should im

Re: [tor-talk] Tor as a sort of "library/dependancy" for third party software

2011-10-03 Thread Nick Mathewson
On Sun, Oct 2, 2011 at 8:29 AM, Fabio Pietrosanti (naif) wrote: > On 9/28/11 11:53 PM, Nick Mathewson wrote: >> On the original question: we do not currently support having the Tor >> client run in the same address space as another application, nor do we >> plan to.  If you

Re: [tor-talk] Revoking your secret_id_key

2011-10-03 Thread Nick Mathewson
On Wed, Sep 28, 2011 at 6:09 AM, Anthony G. Basile wrote: > Hi everyone, > > Is there a way of revoking your tor relay's secret_id_key?  For > instance, suppose your server is compromised and you want to tell the > world, don't trust this node anymore as a relay and/or exit, how would > you do tha

Re: [tor-talk] Best Tool to connect to my Private TOR Network

2011-10-07 Thread Nick Mathewson
On Fri, Oct 7, 2011 at 1:51 PM, Ted Smith wrote: > On Fri, 2011-10-07 at 10:58 -0400, Andrew Lewman wrote: >> On Friday, October 07, 2011 10:35:31 Faisal Rehman wrote: >> > Okay I will run some more directory authorities but how these will be tied >> > with each other via relays, sorry for asking

Re: [tor-talk] Legal or not on monitoring traffic at a Tor exit?

2011-10-23 Thread Nick Mathewson
On Sun, Oct 23, 2011 at 10:18 PM, Xinwen Fu wrote: > I'm just asking the legal liability of running Tor exits and making it > clear. I don't bother with modifying somebody's traffic. The FAQ in question from that link says: "Tor relay operators in the United States can possibly create civil and

Re: [tor-talk] bug found on the Tor v0.2.3.6-alpha (git-47dff61061f4bfc2).

2011-10-29 Thread Nick Mathewson
On Fri, Oct 28, 2011 at 4:23 PM, Roger Dingledine wrote: > On Fri, Oct 28, 2011 at 03:09:38PM -0500, Jon wrote: >> Oct 28 07:51:21.106 [Notice] Tor v0.2.3.6-alpha >> (git-47dff61061f4bfc2). This is experimental software. Do not rely on >> it for strong anonymity. (Running on Windows 7 Service Pack

Re: [tor-talk] bug found on the Tor v0.2.3.6-alpha (git-47dff61061f4bfc2).

2011-10-29 Thread Nick Mathewson
Thanks, Tim! If you aren't on windows, and you're comfortable building from source, I'd ask if you can try out the latest version of either the master branch or the maint-0.2.2 branch. I *think* we've got the known non-windows issues pretty well squashed there, so more testing to try to discover

Re: [tor-talk] Freedom Hosting admin revealed by Anonymous - Tor finally cracked?

2011-10-30 Thread Nick Mathewson
On Oct 30, 2011 1:16 PM, wrote: > There also seems to be lots of data missing for them to go from 10.0.1.2 > to claiming it's Mike Perry's server. Ah, sounds like the "underpants gnomes" method of character assassination. Step 1: There's a crime! Step 2: Step 3: Profit^WAccusations! (If

Re: [tor-talk] The Stop Online Piracy Act

2011-11-02 Thread Nick Mathewson
On Wed, Nov 2, 2011 at 9:13 PM, Andrew Lewman wrote: > On Tuesday, November 01, 2011 00:11:49 Jim wrote: >> I haven't seen this brought up on this list yet, so I thought I would >> mention it.  Tech Dirt (among others) are reporting on yet another round >> of misguided (U.S.) legislation supposedl

  1   2   3   >