13 ms·

> Ultimate eventual goal: Make Tor Browser obsolete, so Tor Project can focus on research instead of maintaining a fork of Firefox.

maerF0x0 8y ago
Hopefully other browsers are encouraged to do something similar also, else Mozilla will effectively control the destiny of Tor
- jerheinze 8y ago
  Brave is already working on Tor private tabs though it won't have the same fingerprinting/first-party isolation guarantees as with a Tor Browser, https://github.com/brave/browser-laptop/labels/feature/tor https://github.com/brave/browser-laptop/labels/feature/tor Should be shipping soon https://twitter.com/BrendanEich/status/984231250104733696 https://twitter.com/BrendanEich/status/984231250104733696
sametmax 8y ago
Good, now if only we could have bitorrent baked in... EDIT: I mean baked in in the browser like tor, not baked in tor. Although interesting, it's really not my priority.
- kleiba 8y ago
  Honest question: is bittorrent even still a thing?
  - iwaffles 8y ago
    It is. For both legitimate and nefarious uses. Bigger software/game devs still use bittorrent to distribute patches and updates—World of Warcraft is an example.
  - d33 8y ago
    It definitely still is. And with the concept of private trackers, it's not really a simple thing to turn off. Companies like IP Echelon tend to automatically bully US/cloud users, but in general they're IMHO far from killing the network. The only problem is that there's fewer and fewer torrent search engines...
    - sametmax 8y ago
      tameme.fr is my new fav.
  - sametmax 8y ago
    Last month I download 2 linux ISO with it for work. This month all the seasons of the pretender for fun. Facebook used to deploy their code using bittorent. I doubt it has changed. A lot of blizzard video games update using bittorent as well. If you play Starcraft 2, you use bittorent. Streaming services like stremio are basically bittorent. After netflix, it's my main source of video content. If you want to download the internet archive, that's the saner option. Same if you are a pentester, as a lot of heavy leak or hash db are so huge only bittorent makes it practical. Too expensive to host for one small actor. It's also more resistant to take down notice. We talked a lot about RSS lately, and how to revive it, while in comments people said it actually never died. Bittorrent is a lot like that. Great tech, great standard, it works flawlessly and fill its use case perfectly. The only reason it's not more adopted is because it's not in the browser by default. Otherwise the hosting benefit and the dl speed is such that it would be an instant hit.
    - scrollaway 8y ago
      Blizzard games no longer use BitTorrent but a proprietary http-based protocol called ngdp. BitTorrent was causing a lot of issues with firewalls so users were disabling it, so they had added http mirrors to them... And then CDNs became a thing, the rest is history. I'll be happy to give more details on ngdp if you are curious.
      - sametmax 8y ago
        Please.
        scrollaway 8y ago
        Here, I pulled my docs for ya: https://gist.github.com/jleclanche/91f2f5c0f2042a81db1c61464ae6d459 https://gist.github.com/jleclanche/91f2f5c0f2042a81db1c61464... They basically created their own git protocol + virtual filesystem, optimized for asset patches inside large compressed binary files. I wish they'd open source it.
        8y ago
  - coolspot 8y ago
    If you are asking about torrents and pirate community, then yes - it is alive and well. However it is usually through VPN, not Tor.
    - mirimir 8y ago
      Torrenting through Tor overloads relays, increasing latency and throttling bandwidth for other users. Also, it's unworkably slow. Just use nested VPN chains.
  - Rjevski 8y ago
    If my movie library is of any indication, yes it’s definitely still a thing. (And before you say anything, I do pay for Netflix and have video included in my Amazon Prime membership - none of which had those movies)
  - toxican 8y ago
    Of course it is. It didn't go away because you don't use it.
- jean- 8y ago
  Firefox recently whitelisted a bunch of p2p protocols so that they can be used by browser extensions. One of them is the Dat protocol [0], which is similar to BitTorrent but has better support for mutable data and random access [1]. It's far from being "baked in", but it's a step in the right direction. [0]: https://docs.datproject.org/ https://docs.datproject.org/ [1]: https://docs.datproject.org/faq#dat-vs https://docs.datproject.org/faq#dat-vs
  - sametmax 8y ago
    We always could do that with extensions since JS is turing complete and has access to the network. Webtorrent is a thing after all. The issue is not technical. It's just a chicken and egg problem. Most won't use bittorent unless it's stupidely easy to do. Remember that the average user don't know what an URL is and doesn't open new tabs willingly. Since they are the majority, they drive cost and benefits, so we must include them.
    - Seipaho8 8y ago
      > and has access to the network It does not have access to TCP or UDP sockets.
    - jean- 8y ago
      > We always could do that with extensions You couldn't, until Firefox 59. Before that, protocol handlers were not allowed to handle links to Dat/IPFS resources [0]. And while I agree with your comment regarding the chicken and egg problem, there are still some technical issues. As the shadowbanned sibling comment says, extensions don't have access to UDP/TCP sockets, meaning that you will need to run a gateway on your machine. See e.g. what dat-fox [1] does. [0]: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/protocol_handlers https://developer.mozilla.org/en-US/Add-ons/WebExtensions/ma... [1]: https://github.com/sammacbeth/dat-fox https://github.com/sammacbeth/dat-fox
      - mook 8y ago
        > You couldn't, until Firefox 59. Before that, protocol handlers were not allowed to handle links to Dat/IPFS resources [0]. You could, kind of, before Firefox 57 (or at least, at some point). Implementing nsIProtocolHandler/nsIChannel/etc. correctly was difficult (and probably not from JavaScript), and distribution problems meant nobody did it.
- zdkl 8y ago
  Hey Sametmax, big fan of your site. Apart from the existing ecosystem of content, are their any reasons you want BitTorrent over ipfs? Everyone on tor AND ipfs... Now that would be something.
  - sametmax 8y ago
    Thanks :) I think IFPS needs a little more field testing before being set in stone. Indeed, if you bake in something in the browsers, then those implementation will be the boundary of what is practical to do. So any innovation will then be constraint by the browsers release and good will. IFPS is a young tech, it needs time to evolve yet. Tor and bittorrent are now quite mature.
    - Lennie 8y ago
      This works today: https://webtorrent.io/ https://webtorrent.io/ It used WebRTC which is also encrypted. So gets you some privacy.
      - sametmax 8y ago
        I know. Check my other comments. It's nice, but not nearly good enough.
    - bogomipz 8y ago
      >"IFPS is a young tech, it needs time to evolve yet." Could you share your concerns about IPFS in its current state or what you see as its limitations? Thanks.
- ungzd 8y ago
  Opera had built-in Bittorrent (this feature is now removed, probably after Opera became rebranded version of Chromium).
  - gsnedders 8y ago
    Well, removed insofar as it was never reimplemented when the browser UI was rewritten from scratch, but yes.
- tempodox 8y ago
  Nope, I wouldn't want to have to keep the browser open all the time just because I'm downloading a torrent.
  - sametmax 8y ago
    So when you download something that is not a torrent, you close your browser ?
  - crunchatized 8y ago
    Chrome extensions [1], and Firefox WebExtensions [2], can have background scripts that can continue running even when the browser window is closed. So in theory, with a p2p filesharing extension, you may not have to keep any browser window open or even minimized. [1] https://developer.chrome.com/extensions/background_pages https://developer.chrome.com/extensions/background_pages [2] https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Anatomy_of_a_WebExtension#Background_scripts https://developer.mozilla.org/en-US/Add-ons/WebExtensions/An...
ComodoHacker 8y ago
Ultimatest super-goal: make anonymity the default stance and socially accepted norm. Do with anonymous browsing what WhatsApp did with E2E encryption. Force big data suckers to invent new business models for exploiting our data without breaching our privacy.
- chipperyman573 8y ago
  I can't read this article because I'm at work, but unless they managed to solve the problem of Tor being very, very, very slow, this will never happen. End users will definitely notice a difference and likely won't care about their privacy. They'll just see Firefox being way slower than Chrome and switch.
  - astrodust 8y ago
    So long as Tor depends on volunteers to maintain exit nodes, and with that the risk of being arrested for all sorts of criminal activity by non-tech-savvy law enforcement, this is how it'll be.
    - openasocket 8y ago
      Tor is slow because every packet has to be routed through several random servers distributed all over the world with multiple layers of crypto at every pass. Even with plenty of top-of-the-line inner and exit nodes you will still see substantially more latency than just sending packets directly.
      - astrodust 8y ago
        That wouldn't be as big an issue if all the nodes were very well connected, like positioned near big peering points, but they're not.
        seandougall 8y ago
        The "distributed all over the world" part would still be just as much of an issue; the speed of light puts a substantial lower bound on the total latency.
JohnTHaller 8y ago
Is it a fork? I thought it was a heavily customized version of Firefox ESR with specific settings and defaults using the channels OEM configs. Looking at the binaries, it's definitely not the standard build anymore.
- jerheinze 8y ago
  It's a fork based on Firefox ESR, see for the details: https://www.torproject.org/projects/torbrowser/design/ https://www.torproject.org/projects/torbrowser/design/
- crunchatized 8y ago
  OEM configs have never been enough to implement everything they need in Tor Browser. They eventually started their uplift effort [1], to upstream all the patches and features they've added to it, so that they can possibly just use OEM configs. Project Fusion is a superset of that effort. [1] https://wiki.mozilla.org/Security/Tor_Uplift https://wiki.mozilla.org/Security/Tor_Uplift
  - hollerith 8y ago
    Could someone please explain what "OEM configs" means here?
    - crunchatized 8y ago
      Looking it up, I think the more accurate term is actually "partner repacks." [1] They're versions of Firefox shipped with different default settings and/or an extension included by default at install time, IIUC. Though reading this rather opaque page [2] it doesn't seem to explicitly preclude patches to the compiled code, though it seems like they would forbid that. The key config file is distribution.ini. [3] [1] https://hg.mozilla.org/build/partner-repacks/file https://hg.mozilla.org/build/partner-repacks/file [2] https://www.mozilla.org/en-US/about/partnerships/distribution/ https://www.mozilla.org/en-US/about/partnerships/distributio... [3] https://brashear.me/blog/2017/12/07/how-to-deploy-firefox-with-bookmarks-and-addons/ https://brashear.me/blog/2017/12/07/how-to-deploy-firefox-wi...
kibwen 8y ago
Ultimate goal of the Tor project, that is. Lots of people in this comment thread seem to have not clicked the link and are presuming that this is a Firefox roadmap. The Mozilla analogue of this page only mentions bringing Tor features into Firefox, without stating a goal of obviating the Tor Browser entirely.
- crunchatized 8y ago
  Well, Mozilla engineers wouldn't be the ones in charge of, or benefiting from, shutting down the Tor Browser fork, would they? So why would they need to include that kind of (incredibly distant, virtually pie in the sky) goal on their wiki page?

maerF0x0 8y ago

Hopefully other browsers are encouraged to do something similar also, else Mozilla will effectively control the destiny of Tor

jerheinze 8y ago
Brave is already working on Tor private tabs though it won't have the same fingerprinting/first-party isolation guarantees as with a Tor Browser, https://github.com/brave/browser-laptop/labels/feature/tor https://github.com/brave/browser-laptop/labels/feature/tor Should be shipping soon https://twitter.com/BrendanEich/status/984231250104733696 https://twitter.com/BrendanEich/status/984231250104733696

sametmax 8y ago

Good, now if only we could have bitorrent baked in... EDIT: I mean baked in in the browser like tor, not baked in tor. Although interesting, it's really not my priority.

kleiba 8y ago
Honest question: is bittorrent even still a thing?
- iwaffles 8y ago
  It is. For both legitimate and nefarious uses. Bigger software/game devs still use bittorrent to distribute patches and updates—World of Warcraft is an example.
- d33 8y ago
  It definitely still is. And with the concept of private trackers, it's not really a simple thing to turn off. Companies like IP Echelon tend to automatically bully US/cloud users, but in general they're IMHO far from killing the network. The only problem is that there's fewer and fewer torrent search engines...
  - sametmax 8y ago
    tameme.fr is my new fav.
- sametmax 8y ago
  Last month I download 2 linux ISO with it for work. This month all the seasons of the pretender for fun. Facebook used to deploy their code using bittorent. I doubt it has changed. A lot of blizzard video games update using bittorent as well. If you play Starcraft 2, you use bittorent. Streaming services like stremio are basically bittorent. After netflix, it's my main source of video content. If you want to download the internet archive, that's the saner option. Same if you are a pentester, as a lot of heavy leak or hash db are so huge only bittorent makes it practical. Too expensive to host for one small actor. It's also more resistant to take down notice. We talked a lot about RSS lately, and how to revive it, while in comments people said it actually never died. Bittorrent is a lot like that. Great tech, great standard, it works flawlessly and fill its use case perfectly. The only reason it's not more adopted is because it's not in the browser by default. Otherwise the hosting benefit and the dl speed is such that it would be an instant hit.
  - scrollaway 8y ago
    Blizzard games no longer use BitTorrent but a proprietary http-based protocol called ngdp. BitTorrent was causing a lot of issues with firewalls so users were disabling it, so they had added http mirrors to them... And then CDNs became a thing, the rest is history. I'll be happy to give more details on ngdp if you are curious.
    - sametmax 8y ago
      Please.
      - scrollaway 8y ago
        Here, I pulled my docs for ya: https://gist.github.com/jleclanche/91f2f5c0f2042a81db1c61464ae6d459 https://gist.github.com/jleclanche/91f2f5c0f2042a81db1c61464... They basically created their own git protocol + virtual filesystem, optimized for asset patches inside large compressed binary files. I wish they'd open source it.
        8y ago
- coolspot 8y ago
  If you are asking about torrents and pirate community, then yes - it is alive and well. However it is usually through VPN, not Tor.
  - mirimir 8y ago
    Torrenting through Tor overloads relays, increasing latency and throttling bandwidth for other users. Also, it's unworkably slow. Just use nested VPN chains.
- Rjevski 8y ago
  If my movie library is of any indication, yes it’s definitely still a thing. (And before you say anything, I do pay for Netflix and have video included in my Amazon Prime membership - none of which had those movies)
- toxican 8y ago
  Of course it is. It didn't go away because you don't use it.
jean- 8y ago
Firefox recently whitelisted a bunch of p2p protocols so that they can be used by browser extensions. One of them is the Dat protocol [0], which is similar to BitTorrent but has better support for mutable data and random access [1]. It's far from being "baked in", but it's a step in the right direction. [0]: https://docs.datproject.org/ https://docs.datproject.org/ [1]: https://docs.datproject.org/faq#dat-vs https://docs.datproject.org/faq#dat-vs
- sametmax 8y ago
  We always could do that with extensions since JS is turing complete and has access to the network. Webtorrent is a thing after all. The issue is not technical. It's just a chicken and egg problem. Most won't use bittorent unless it's stupidely easy to do. Remember that the average user don't know what an URL is and doesn't open new tabs willingly. Since they are the majority, they drive cost and benefits, so we must include them.
  - Seipaho8 8y ago
    > and has access to the network It does not have access to TCP or UDP sockets.
  - jean- 8y ago
    > We always could do that with extensions You couldn't, until Firefox 59. Before that, protocol handlers were not allowed to handle links to Dat/IPFS resources [0]. And while I agree with your comment regarding the chicken and egg problem, there are still some technical issues. As the shadowbanned sibling comment says, extensions don't have access to UDP/TCP sockets, meaning that you will need to run a gateway on your machine. See e.g. what dat-fox [1] does. [0]: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/protocol_handlers https://developer.mozilla.org/en-US/Add-ons/WebExtensions/ma... [1]: https://github.com/sammacbeth/dat-fox https://github.com/sammacbeth/dat-fox
    - mook 8y ago
      > You couldn't, until Firefox 59. Before that, protocol handlers were not allowed to handle links to Dat/IPFS resources [0]. You could, kind of, before Firefox 57 (or at least, at some point). Implementing nsIProtocolHandler/nsIChannel/etc. correctly was difficult (and probably not from JavaScript), and distribution problems meant nobody did it.
zdkl 8y ago
Hey Sametmax, big fan of your site. Apart from the existing ecosystem of content, are their any reasons you want BitTorrent over ipfs? Everyone on tor AND ipfs... Now that would be something.
- sametmax 8y ago
  Thanks :) I think IFPS needs a little more field testing before being set in stone. Indeed, if you bake in something in the browsers, then those implementation will be the boundary of what is practical to do. So any innovation will then be constraint by the browsers release and good will. IFPS is a young tech, it needs time to evolve yet. Tor and bittorrent are now quite mature.
  - Lennie 8y ago
    This works today: https://webtorrent.io/ https://webtorrent.io/ It used WebRTC which is also encrypted. So gets you some privacy.
    - sametmax 8y ago
      I know. Check my other comments. It's nice, but not nearly good enough.
  - bogomipz 8y ago
    >"IFPS is a young tech, it needs time to evolve yet." Could you share your concerns about IPFS in its current state or what you see as its limitations? Thanks.
ungzd 8y ago
Opera had built-in Bittorrent (this feature is now removed, probably after Opera became rebranded version of Chromium).
- gsnedders 8y ago
  Well, removed insofar as it was never reimplemented when the browser UI was rewritten from scratch, but yes.
tempodox 8y ago
Nope, I wouldn't want to have to keep the browser open all the time just because I'm downloading a torrent.
- sametmax 8y ago
  So when you download something that is not a torrent, you close your browser ?
- crunchatized 8y ago
  Chrome extensions [1], and Firefox WebExtensions [2], can have background scripts that can continue running even when the browser window is closed. So in theory, with a p2p filesharing extension, you may not have to keep any browser window open or even minimized. [1] https://developer.chrome.com/extensions/background_pages https://developer.chrome.com/extensions/background_pages [2] https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Anatomy_of_a_WebExtension#Background_scripts https://developer.mozilla.org/en-US/Add-ons/WebExtensions/An...

ComodoHacker 8y ago

Ultimatest super-goal: make anonymity the default stance and socially accepted norm. Do with anonymous browsing what WhatsApp did with E2E encryption. Force big data suckers to invent new business models for exploiting our data without breaching our privacy.

chipperyman573 8y ago
I can't read this article because I'm at work, but unless they managed to solve the problem of Tor being very, very, very slow, this will never happen. End users will definitely notice a difference and likely won't care about their privacy. They'll just see Firefox being way slower than Chrome and switch.
- astrodust 8y ago
  So long as Tor depends on volunteers to maintain exit nodes, and with that the risk of being arrested for all sorts of criminal activity by non-tech-savvy law enforcement, this is how it'll be.
  - openasocket 8y ago
    Tor is slow because every packet has to be routed through several random servers distributed all over the world with multiple layers of crypto at every pass. Even with plenty of top-of-the-line inner and exit nodes you will still see substantially more latency than just sending packets directly.
    - astrodust 8y ago
      That wouldn't be as big an issue if all the nodes were very well connected, like positioned near big peering points, but they're not.
      - seandougall 8y ago
        The "distributed all over the world" part would still be just as much of an issue; the speed of light puts a substantial lower bound on the total latency.

JohnTHaller 8y ago

Is it a fork? I thought it was a heavily customized version of Firefox ESR with specific settings and defaults using the channels OEM configs. Looking at the binaries, it's definitely not the standard build anymore.

jerheinze 8y ago
It's a fork based on Firefox ESR, see for the details: https://www.torproject.org/projects/torbrowser/design/ https://www.torproject.org/projects/torbrowser/design/
crunchatized 8y ago
OEM configs have never been enough to implement everything they need in Tor Browser. They eventually started their uplift effort [1], to upstream all the patches and features they've added to it, so that they can possibly just use OEM configs. Project Fusion is a superset of that effort. [1] https://wiki.mozilla.org/Security/Tor_Uplift https://wiki.mozilla.org/Security/Tor_Uplift
- hollerith 8y ago
  Could someone please explain what "OEM configs" means here?
  - crunchatized 8y ago
    Looking it up, I think the more accurate term is actually "partner repacks." [1] They're versions of Firefox shipped with different default settings and/or an extension included by default at install time, IIUC. Though reading this rather opaque page [2] it doesn't seem to explicitly preclude patches to the compiled code, though it seems like they would forbid that. The key config file is distribution.ini. [3] [1] https://hg.mozilla.org/build/partner-repacks/file https://hg.mozilla.org/build/partner-repacks/file [2] https://www.mozilla.org/en-US/about/partnerships/distribution/ https://www.mozilla.org/en-US/about/partnerships/distributio... [3] https://brashear.me/blog/2017/12/07/how-to-deploy-firefox-with-bookmarks-and-addons/ https://brashear.me/blog/2017/12/07/how-to-deploy-firefox-wi...

kibwen 8y ago

Ultimate goal of the Tor project, that is. Lots of people in this comment thread seem to have not clicked the link and are presuming that this is a Firefox roadmap. The Mozilla analogue of this page only mentions bringing Tor features into Firefox, without stating a goal of obviating the Tor Browser entirely.

crunchatized 8y ago
Well, Mozilla engineers wouldn't be the ones in charge of, or benefiting from, shutting down the Tor Browser fork, would they? So why would they need to include that kind of (incredibly distant, virtually pie in the sky) goal on their wiki page?