12 ms·

Introducing DNS Resolver for Tor

251 points by XzetaU8 8y ago

ancarda 8y ago
Why is the URL so long? Weren't .onion domains about 16 characters long? Compare with Facebook's hidden service: facebookcorewwwi.onion dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion Also, how does that website have SSL? Are there Certificate Authorities that can supply certificates for .onion domains now? CloudFlare did the same trick for https://1.1.1.1 https://1.1.1.1 too so perhaps they are just able to do things most people can't.
- gant 8y ago
  They have an intermediary CA. I wasn't sure too when they launched, but IP addresses as common names aren't against spec / Mozilla CA guidelines.
- benjojo12 8y ago
  Tor moved to a longer address space because the short one is 1024 bit RSA
  - kodablah 8y ago
    To be even clearer, v2 service names are just a part of the RSA key hash whereas v3 service names are a full ed25519 pub key and a couple of other bytes.
- whs 8y ago
  Facebook also have that domain over SSL. CAB allow EV certificate to be issued for onion domains. https://cabforum.org/2015/02/18/ballot-144-validation-rules-dot-onion-names/ https://cabforum.org/2015/02/18/ballot-144-validation-rules-...
- detaro 8y ago
  > Are there Certificate Authorities that can supply certificates for .onion domains now Yes, DigiCert does (maybe others too, haven't checked). Facebook was famously the first to have such a certificate. Currently needs to be an EV certificate though. Getting a certificate for an IP also isn't a "trick", it's generally available, although I believe it needs to be in your IP space, so you can't just get it for any random IP you got from your provider.
  - markovbot 8y ago
    > Currently needs to be an EV certificate though. "currently" sounds like that might change in the future. I thought the CA/B forum was pretty much opposed to non-EV certs for .onions. Is that not the case? What is the potential use case for non-EV certs on a .onion?
    - Operyl 8y ago
      There’s been a recent push to open it up to DV. The CA/B forum was against it a few years ago, but seems more open to it now.
    - tialaramex 8y ago
      The EFF's representative to CA/B (Seth Schoen) suggested that DV certs for .onion make sense in the v3 onion service world. There wasn't exactly rapturous support, but there were constructive comments from some of the usual suspects on the Browser side of the equation. So far I as know/ remember this discussion died out without anybody producing an actual ballot that could be voted on. Most notably there wasn't a fierce backlash of CA reps yelling that this was an awful idea and they wanted no part in it. So either they're OK with it, or they've decided it won't go anywhere and they don't care. Without a ballot changing the actual Baseline Requirements you'd never know for sure. Personally I'm not convinced DV .onion certificates are a great idea, but I'm not opposed to them either, and it seems some people who own .onion services that aren't legal, or need to be anonymous for whatever reason would like to have such certificates.
      - markovbot 8y ago
        hrm, what would the purpose of such certificates be?
      - deleted 8y ago
        [deleted]
gant 8y ago
>Still, the exceptionally privacy-conscious folks might not want to reveal their IP address to the resolver at all, and we respect that. Who was it again that puts ReCAPTCHA on so many popular websites when using Tor, which could be used for traffic correlation? Oh. Cloudflare. Ref: https://news.ycombinator.com/item?id=12122268 https://news.ycombinator.com/item?id=12122268
- jgrahamc 8y ago
  And who was it that worked with researchers on Privacy Pass to provide anonymous access for web users? Oh. Cloudflare. [1] And who was it that changed their algorithm for handling TorBrowser traffic so that there's no need to show those CAPTCHAs? Oh. Cloudflare. And who was it that gave our customers control over how Tor traffic is handled? Oh. Cloudflare. [2] [1] https://blog.cloudflare.com/cloudflare-supports-privacy-pass/ https://blog.cloudflare.com/cloudflare-supports-privacy-pass... [2] https://support.cloudflare.com/hc/en-us/articles/203306930-Does-Cloudflare-block-Tor- https://support.cloudflare.com/hc/en-us/articles/203306930-D...
  - stingraycharles 8y ago
    (For those of you who missed it. parent poster @jgrahamc is CTO of Cloudflare. ) Don’t get too snarky, John. Thanks for working with the Tor community, but haters gonna hate.
    - d0lph 8y ago
      I for one would like to see more snarky CTOs on HN
    - bogomipz 8y ago
      So someone expressing an opinion contrary to your own makes them a "hater"? Wow.
      - ko27 8y ago
        No, but his arguments do.
ajross 8y ago
I... get the idea, and support it. I don't understand the implementation. What is the point of creating an onion address and then publicizing it? Why not just use Tor to get to 1.1.1.1 in the first place? Onion URLs are for services that don't want to reveal themselves. Basically, what does this enable that generic Tor does not?
- megous 8y ago
  Your circuit presumably terminates at CloudFlare infrastructure and not at a random exit node where the packets need to be routed again over the open internet to CloudFlare. I wonder if latency is better.
- superkuh 8y ago
  Just because they're called hidden services doesn't mean they have to be hidden. Tor hidden services offer a lot that the clear web and normal domain system does not. For one, you own your domain rather than lease it on the whims of some institution that can be easily pressured to kick you off (like cloudflare and registrars did against stormfront, for example). And of course going completely within Tor is a great speed-bump for preventing massive surveillance. I run all of my clear web sites as tor hidden services too and publish the domains for both publicly on both. But I wouldn't trust Cloudflare to not censor anything controversial. They're already proven themselves an enemy of free speech and an enemy of tor by their behavior. Words mean little.
  - deno 8y ago
    > But I wouldn't trust Cloudflare to not censor anything controversial. They're already proven themselves an enemy of free speech and an enemy of tor by their behavior. Words mean little. Preferably you wouldn’t have to trust any single provider at all, regardless if you deem them trustworthy. Why can’t we have Alt-Svc for DNS that points to blockchain?
    - Operyl 8y ago
      “The blockchain” is slow, clunky, and not the magical unicorn everybody tries to make it out to be.
kodablah 8y ago
In a big company blog post like this, I wish they'd call them onion services instead of hidden services, especially since they are even using a v3 onion service. Also, curious if they wrote any code to support this since OnionBalance doesn't support v3 yet. I know they use Go a lot and I wrote a Tor control client myself recently [0]. 0 - https://github.com/cretz/bine https://github.com/cretz/bine
- jgrahamc 8y ago
  I've changed the blog post as you suggest.
  - oger 8y ago
    Great work! Especially after Daniel (Stenberg) adding momentum to the DoH movement recently. Even though I wish you huge success let’s hope that many other ‚alternative‘ DNS providers jump on the bandwagon in order to make any (future) traffic correlation attacks less simple. Having just a single watering hole makes it too easy for predators to catch their prey - and I don’t assume cooperation from your side (as you already stated in other parts of this thread).
- mahrud 8y ago
  Thanks for the heads up, should be fixed now. I knew Tor Project has been shifting away from "hidden services" for a while but I missed the email where teor clarified things for blog posts and such in late April [0]. Also, I wanted to avoid using "onion resolver" as it would be a worse misnomer than "hidden resolver." Re. OnionBalance: we're working on a few ideas for this, but nothing conclusive yet. 0. https://lists.torproject.org/pipermail/tor-dev/2018-April/013104.html https://lists.torproject.org/pipermail/tor-dev/2018-April/01...
  - kodablah 8y ago
    For OnionBalance, on the mailing list they mentioned that while it is more difficult on v3, they are implementing HSFETCH/HSPOST[0]. I'm not sure of any other load balancing approaches outside of this. In the meantime I figure y'all have this all going through one hidden service endpoint or maybe share some priv keys or wrote some custom code or something. 0 - https://lists.torproject.org/pipermail/tor-dev/2018-April/013128.html https://lists.torproject.org/pipermail/tor-dev/2018-April/01...
linkmotif 8y ago
Could someone explain the rainbow theme? And why that onion URL has is a psychedelic gif?
- jgrahamc 8y ago
  We used the same theme on the underlying 1.1.1.1 resolver: https://blog.cloudflare.com/announcing-1111/ https://blog.cloudflare.com/announcing-1111/ I'll ask the designers why. EDIT: and she said: "We had this very mysterious 1.1.1.1 white on black theme when we were just sort of trying to build hype guerilla-style and then once the announcement was made we flipped it into the colorful "here it is, it's great!" Sort of thing"
  - linkmotif 8y ago
    Thank you. I am specifically wondering if there's a technical reason that URL is repeated twice. Once as a hyperlink, and once as that gif. Or if it's just for fun. Thanks for these services and your work generally at Cloudflare.
  - crapflare 8y ago
    take your army of corporate drones and jump off a cliff please. You are ruining the internet.
tgragnato 8y ago
Is the log policy for this onion and 1.1.1.1 exactly the same?
- jgrahamc 8y ago
  First sentence of the second paragraph: "As it was mentioned in the original blog post, our policy is to never, ever write client IP addresses to disk and wipe all logs within 24 hours. " So, yes.
  - tgragnato 8y ago
    Thanks for confirming, suspicion is a must when it comes to onions. I'm already testing it, works like a charm. socat TCP4-LISTEN:853,bind=localhost,reuseaddr,fork SOCKS4A:localhost:dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion:853,socksport=9050 openssl s_client -showcerts -crlf -connect localhost:853 getdns_query 1dot1dot1dot1.cloudflare-dns.com 127.0.0.1@853 forward-addr: 127.0.0.1@853#tor.cloudflare-dns.com
    - crapflare 8y ago
      for the love of god. if you care about privacy...dont use this you are crippling the stream decoupling of the tor browser...how can you not get this? Its so obviously a stupid idea.
      - tgragnato 8y ago
        I'm well aware of what this does, and I have zero intentions to set it inside the tor browser. CloudFlare is only ONE OF THE MANY upstream recursive resolvers I use to protect the queries for my CLEARNET traffic.
jedisct1 8y ago
dnscrypt-proxy is compatible with Cloudflare and now has built-in support for Tor. Just add `proxy = "socks5://127.0.0.1:9050"` to the configuration file.
- timewasted 8y ago
  I just wanted to thank you for dnscrypt-proxy. I had seen it mentioned in another post so I had it saved in an open tab for later. Seeing it mentioned here again prompted me to actually install it. Very much worth the ~5 minutes it took to get it up and running!
- kim0 8y ago
  Also thanks from me, pretty awesome piece of software!
jerheinze 8y ago
As I said in the earlier duplicate post https://news.ycombinator.com/item?id=17238365 https://news.ycombinator.com/item?id=17238365 > That makes privacy worse than the default setup with Tor since there's no stream isolation. With the standard Tor Browser you get a different circuit for each first-party domain, that's not something you'd have with this.
- kodablah 8y ago
  So in the Tor browser, DNS resolution for non-onion addresses creates a new circuit each time? (not sarcasm, I really don't know) Because I consider this new onion service (aka a front for 1.1.1.1) to be a single first-party domain. How is this any worse than contacting any other onion service repeatedly? Or are you arguing they should provide a rotating list of onion addresses for this service?
  - jerheinze 8y ago
    > So in the Tor browser, DNS resolution for non-onion addresses creates a new circuit each time? You can try it for yourself, open a tab in the Tor Browser with foo1.com, look at the circuit in the Torbutton. Then open another tab with foo2.com, look at the circuit and compare it with the earlier one.
    - deleted 8y ago
      [deleted]
    - kodablah 8y ago
      The DNS resolution is done by the exit node. Once you go to foo1.com or foo2.com after the resolution you are still going to separate IPs and subject to the same benefits. There's really nothing to compare this CloudFlare service to except just like an HTTP API as an onion service (or bind or whatever). There is safety in numbers accessing the CloudFlare service. It helps reduce traffic analysis attacks that could otherwise occur on exit nodes and the exit node's possible-non-authoritative resolver. Because correlation between the circuit to CloudFlare's resolution and the exit node's site access is a bit harder. Granted once you enter the HTTP world and ask that second level domain to start the TLS handshake, they can see where you're going anyways so it might not matter. But it can prevent you from being poisoned by the exit node's DNS resolver. It just removes one layer of trust away from the exit node.
crapflare 8y ago
Who do you think is going to fall for this? Please just stop trying to play the cool internet company that cares about the privacy of the average user. These kind of actions are just cringe worthy. And its so obvious that this is just a big data collection of privacy minded people. It essentially cripples the circuit decoupling of the TOr-browser. I know your little company drone voting ring will downvote this. But anyone who takes you seriously after cloudbleed deserves no respect. And there is no way to resurrect after a failure like this. Especially because you claim to make stuff safer.
shiado 8y ago
Strange to see a company which deems a bunch of unpopular idiot white supremacist trolls to be too extreme of speech supporting a network which has allowed child pornography to flourish online at a scale never before seen. Bold move.
comboy 8y ago
Any update on some distributed names resolution for tor? At some point there seemed to be a chance for namecoin to handle this.

251 points by XzetaU8 8y ago

Why is the URL so long? Weren't .onion domains about 16 characters long? Compare with Facebook's hidden service: facebookcorewwwi.onion dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion Also, how does that website have SSL? Are there Certificate Authorities that can supply certificates for .onion domains now? CloudFlare did the same trick for https://1.1.1.1 https://1.1.1.1 too so perhaps they are just able to do things most people can't.

gant 8y ago
They have an intermediary CA. I wasn't sure too when they launched, but IP addresses as common names aren't against spec / Mozilla CA guidelines.
benjojo12 8y ago
Tor moved to a longer address space because the short one is 1024 bit RSA
- kodablah 8y ago
  To be even clearer, v2 service names are just a part of the RSA key hash whereas v3 service names are a full ed25519 pub key and a couple of other bytes.
whs 8y ago
Facebook also have that domain over SSL. CAB allow EV certificate to be issued for onion domains. https://cabforum.org/2015/02/18/ballot-144-validation-rules-dot-onion-names/ https://cabforum.org/2015/02/18/ballot-144-validation-rules-...
detaro 8y ago
> Are there Certificate Authorities that can supply certificates for .onion domains now Yes, DigiCert does (maybe others too, haven't checked). Facebook was famously the first to have such a certificate. Currently needs to be an EV certificate though. Getting a certificate for an IP also isn't a "trick", it's generally available, although I believe it needs to be in your IP space, so you can't just get it for any random IP you got from your provider.
- markovbot 8y ago
  > Currently needs to be an EV certificate though. "currently" sounds like that might change in the future. I thought the CA/B forum was pretty much opposed to non-EV certs for .onions. Is that not the case? What is the potential use case for non-EV certs on a .onion?
  - Operyl 8y ago
    There’s been a recent push to open it up to DV. The CA/B forum was against it a few years ago, but seems more open to it now.
  - tialaramex 8y ago
    The EFF's representative to CA/B (Seth Schoen) suggested that DV certs for .onion make sense in the v3 onion service world. There wasn't exactly rapturous support, but there were constructive comments from some of the usual suspects on the Browser side of the equation. So far I as know/ remember this discussion died out without anybody producing an actual ballot that could be voted on. Most notably there wasn't a fierce backlash of CA reps yelling that this was an awful idea and they wanted no part in it. So either they're OK with it, or they've decided it won't go anywhere and they don't care. Without a ballot changing the actual Baseline Requirements you'd never know for sure. Personally I'm not convinced DV .onion certificates are a great idea, but I'm not opposed to them either, and it seems some people who own .onion services that aren't legal, or need to be anonymous for whatever reason would like to have such certificates.
    - markovbot 8y ago
      hrm, what would the purpose of such certificates be?
    - deleted 8y ago
      [deleted]

gant 8y ago

>Still, the exceptionally privacy-conscious folks might not want to reveal their IP address to the resolver at all, and we respect that. Who was it again that puts ReCAPTCHA on so many popular websites when using Tor, which could be used for traffic correlation? Oh. Cloudflare. Ref: https://news.ycombinator.com/item?id=12122268 https://news.ycombinator.com/item?id=12122268

jgrahamc 8y ago
And who was it that worked with researchers on Privacy Pass to provide anonymous access for web users? Oh. Cloudflare. [1] And who was it that changed their algorithm for handling TorBrowser traffic so that there's no need to show those CAPTCHAs? Oh. Cloudflare. And who was it that gave our customers control over how Tor traffic is handled? Oh. Cloudflare. [2] [1] https://blog.cloudflare.com/cloudflare-supports-privacy-pass/ https://blog.cloudflare.com/cloudflare-supports-privacy-pass... [2] https://support.cloudflare.com/hc/en-us/articles/203306930-Does-Cloudflare-block-Tor- https://support.cloudflare.com/hc/en-us/articles/203306930-D...
- stingraycharles 8y ago
  (For those of you who missed it. parent poster @jgrahamc is CTO of Cloudflare. ) Don’t get too snarky, John. Thanks for working with the Tor community, but haters gonna hate.
  - d0lph 8y ago
    I for one would like to see more snarky CTOs on HN
  - bogomipz 8y ago
    So someone expressing an opinion contrary to your own makes them a "hater"? Wow.
    - ko27 8y ago
      No, but his arguments do.

ajross 8y ago

I... get the idea, and support it. I don't understand the implementation. What is the point of creating an onion address and then publicizing it? Why not just use Tor to get to 1.1.1.1 in the first place? Onion URLs are for services that don't want to reveal themselves. Basically, what does this enable that generic Tor does not?

megous 8y ago
Your circuit presumably terminates at CloudFlare infrastructure and not at a random exit node where the packets need to be routed again over the open internet to CloudFlare. I wonder if latency is better.
superkuh 8y ago
Just because they're called hidden services doesn't mean they have to be hidden. Tor hidden services offer a lot that the clear web and normal domain system does not. For one, you own your domain rather than lease it on the whims of some institution that can be easily pressured to kick you off (like cloudflare and registrars did against stormfront, for example). And of course going completely within Tor is a great speed-bump for preventing massive surveillance. I run all of my clear web sites as tor hidden services too and publish the domains for both publicly on both. But I wouldn't trust Cloudflare to not censor anything controversial. They're already proven themselves an enemy of free speech and an enemy of tor by their behavior. Words mean little.
- deno 8y ago
  > But I wouldn't trust Cloudflare to not censor anything controversial. They're already proven themselves an enemy of free speech and an enemy of tor by their behavior. Words mean little. Preferably you wouldn’t have to trust any single provider at all, regardless if you deem them trustworthy. Why can’t we have Alt-Svc for DNS that points to blockchain?
  - Operyl 8y ago
    “The blockchain” is slow, clunky, and not the magical unicorn everybody tries to make it out to be.

kodablah 8y ago

In a big company blog post like this, I wish they'd call them onion services instead of hidden services, especially since they are even using a v3 onion service. Also, curious if they wrote any code to support this since OnionBalance doesn't support v3 yet. I know they use Go a lot and I wrote a Tor control client myself recently [0]. 0 - https://github.com/cretz/bine https://github.com/cretz/bine

jgrahamc 8y ago
I've changed the blog post as you suggest.
- oger 8y ago
  Great work! Especially after Daniel (Stenberg) adding momentum to the DoH movement recently. Even though I wish you huge success let’s hope that many other ‚alternative‘ DNS providers jump on the bandwagon in order to make any (future) traffic correlation attacks less simple. Having just a single watering hole makes it too easy for predators to catch their prey - and I don’t assume cooperation from your side (as you already stated in other parts of this thread).
mahrud 8y ago
Thanks for the heads up, should be fixed now. I knew Tor Project has been shifting away from "hidden services" for a while but I missed the email where teor clarified things for blog posts and such in late April [0]. Also, I wanted to avoid using "onion resolver" as it would be a worse misnomer than "hidden resolver." Re. OnionBalance: we're working on a few ideas for this, but nothing conclusive yet. 0. https://lists.torproject.org/pipermail/tor-dev/2018-April/013104.html https://lists.torproject.org/pipermail/tor-dev/2018-April/01...
- kodablah 8y ago
  For OnionBalance, on the mailing list they mentioned that while it is more difficult on v3, they are implementing HSFETCH/HSPOST[0]. I'm not sure of any other load balancing approaches outside of this. In the meantime I figure y'all have this all going through one hidden service endpoint or maybe share some priv keys or wrote some custom code or something. 0 - https://lists.torproject.org/pipermail/tor-dev/2018-April/013128.html https://lists.torproject.org/pipermail/tor-dev/2018-April/01...

linkmotif 8y ago

Could someone explain the rainbow theme? And why that onion URL has is a psychedelic gif?

jgrahamc 8y ago
We used the same theme on the underlying 1.1.1.1 resolver: https://blog.cloudflare.com/announcing-1111/ https://blog.cloudflare.com/announcing-1111/ I'll ask the designers why. EDIT: and she said: "We had this very mysterious 1.1.1.1 white on black theme when we were just sort of trying to build hype guerilla-style and then once the announcement was made we flipped it into the colorful "here it is, it's great!" Sort of thing"
- linkmotif 8y ago
  Thank you. I am specifically wondering if there's a technical reason that URL is repeated twice. Once as a hyperlink, and once as that gif. Or if it's just for fun. Thanks for these services and your work generally at Cloudflare.
- crapflare 8y ago
  take your army of corporate drones and jump off a cliff please. You are ruining the internet.

tgragnato 8y ago

Is the log policy for this onion and 1.1.1.1 exactly the same?

jgrahamc 8y ago
First sentence of the second paragraph: "As it was mentioned in the original blog post, our policy is to never, ever write client IP addresses to disk and wipe all logs within 24 hours. " So, yes.
- tgragnato 8y ago
  Thanks for confirming, suspicion is a must when it comes to onions. I'm already testing it, works like a charm. socat TCP4-LISTEN:853,bind=localhost,reuseaddr,fork SOCKS4A:localhost:dns4torpnlfs2ifuz2s2yf3fc7rdmsbhm6rw75euj35pac6ap25zgqad.onion:853,socksport=9050 openssl s_client -showcerts -crlf -connect localhost:853 getdns_query 1dot1dot1dot1.cloudflare-dns.com 127.0.0.1@853 forward-addr: 127.0.0.1@853#tor.cloudflare-dns.com
  - crapflare 8y ago
    for the love of god. if you care about privacy...dont use this you are crippling the stream decoupling of the tor browser...how can you not get this? Its so obviously a stupid idea.
    - tgragnato 8y ago
      I'm well aware of what this does, and I have zero intentions to set it inside the tor browser. CloudFlare is only ONE OF THE MANY upstream recursive resolvers I use to protect the queries for my CLEARNET traffic.

jedisct1 8y ago

dnscrypt-proxy is compatible with Cloudflare and now has built-in support for Tor. Just add `proxy = "socks5://127.0.0.1:9050"` to the configuration file.

timewasted 8y ago
I just wanted to thank you for dnscrypt-proxy. I had seen it mentioned in another post so I had it saved in an open tab for later. Seeing it mentioned here again prompted me to actually install it. Very much worth the ~5 minutes it took to get it up and running!
kim0 8y ago
Also thanks from me, pretty awesome piece of software!

jerheinze 8y ago

As I said in the earlier duplicate post https://news.ycombinator.com/item?id=17238365 https://news.ycombinator.com/item?id=17238365 > That makes privacy worse than the default setup with Tor since there's no stream isolation. With the standard Tor Browser you get a different circuit for each first-party domain, that's not something you'd have with this.

kodablah 8y ago
So in the Tor browser, DNS resolution for non-onion addresses creates a new circuit each time? (not sarcasm, I really don't know) Because I consider this new onion service (aka a front for 1.1.1.1) to be a single first-party domain. How is this any worse than contacting any other onion service repeatedly? Or are you arguing they should provide a rotating list of onion addresses for this service?
- jerheinze 8y ago
  > So in the Tor browser, DNS resolution for non-onion addresses creates a new circuit each time? You can try it for yourself, open a tab in the Tor Browser with foo1.com, look at the circuit in the Torbutton. Then open another tab with foo2.com, look at the circuit and compare it with the earlier one.
  - deleted 8y ago
    [deleted]
  - kodablah 8y ago
    The DNS resolution is done by the exit node. Once you go to foo1.com or foo2.com after the resolution you are still going to separate IPs and subject to the same benefits. There's really nothing to compare this CloudFlare service to except just like an HTTP API as an onion service (or bind or whatever). There is safety in numbers accessing the CloudFlare service. It helps reduce traffic analysis attacks that could otherwise occur on exit nodes and the exit node's possible-non-authoritative resolver. Because correlation between the circuit to CloudFlare's resolution and the exit node's site access is a bit harder. Granted once you enter the HTTP world and ask that second level domain to start the TLS handshake, they can see where you're going anyways so it might not matter. But it can prevent you from being poisoned by the exit node's DNS resolver. It just removes one layer of trust away from the exit node.

crapflare 8y ago

Who do you think is going to fall for this? Please just stop trying to play the cool internet company that cares about the privacy of the average user. These kind of actions are just cringe worthy. And its so obvious that this is just a big data collection of privacy minded people. It essentially cripples the circuit decoupling of the TOr-browser. I know your little company drone voting ring will downvote this. But anyone who takes you seriously after cloudbleed deserves no respect. And there is no way to resurrect after a failure like this. Especially because you claim to make stuff safer.

shiado 8y ago

Strange to see a company which deems a bunch of unpopular idiot white supremacist trolls to be too extreme of speech supporting a network which has allowed child pornography to flourish online at a scale never before seen. Bold move.

comboy 8y ago

Any update on some distributed names resolution for tor? At some point there seemed to be a chance for namecoin to handle this.