#31990: How should we proceed with website mirrors? -----------------------------------+------------------ Reporter: phw | Owner: ggus Type: task | Status: new Priority: Medium | Milestone: Component: Community/Mirrors | Version: Severity: Normal | Keywords: Actual Points: | Parent ID: Points: | Reviewer: Sponsor: | -----------------------------------+------------------ We discussed the current status of website mirrors at [http://meetbot.debian.net/tor-meeting/2019/tor- meeting.2019-10-03-17.00.log.html our Oct 3 anti-censorship meeting]. The following questions and arguments came up:
* Should we verify mirrors' authenticity? If so, how? If we verify mirrors, we may want to do it continuously because a mirror may be authentic at time ''t'' but serve malware at time ''t+1''. We may also want to verify mirrors in a way that makes it difficult for the mirror to distinguish between a user browsing the mirror and us verifying the mirror. * People let us know when they set up new mirrors but we currently ignore volunteers because of our policy of only considering mirrors run by trusted contacts. * Let's keep in mind that people generally search for "download tor" and click on whatever shows up first in their favourite search engine. By obsessing too much over the authenticity of mirrors we may be missing the bigger issue. * Our old website [https://2019.www.torproject.org/getinvolved/mirrors.html.en has a list of mirrors]. * Some of us believe that the risk of having mirrors outweighs their value while others believe the opposite. * Website mirrors are frequently not subject to censorship, so users who are unable to browse torproject.org can still browse our mirrors and download Tor Browser from there. GetTor could therefore send users a link to mirrors – and add PGP verification instructions to its email, so the user doesn't need to trust the mirrors). -- Ticket URL: <https://trac.torproject.org/projects/tor/ticket/31990> Tor Bug Tracker & Wiki <https://trac.torproject.org/> The Tor Project: anonymity online
_______________________________________________ tor-bugs mailing list tor-bugs@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs