4 ms·

It's shit like this Zed... Two basic claims: Tor is tainted because (1) the concepts the software is based on were developed with partial funding from the mili

by poet 16y ago

It's shit like this Zed... Two basic claims: Tor is tainted because (1) the concepts the software is based on were developed with partial funding from the military and (2) Zed thinks one of the committers is untrustworthy. Guess what? That describes a huge amount of software, including Mac OS X and Firefox. God damn Zed, this Hitler sandwich shit is pretty weak. Zed also has a problem with Tor because he thinks there is a "gigantic percentage of hackers and security experts on the volunteer payroll of a group who's job is to illegally wiretap people and circumvent the law on behalf of the government". He thinks some of these people work on Tor and thus Tor is untrustworthy. Funny though, his ISP is likely guilty of the same thing. I wonder if Zed takes that into account as a part of his paranoid fantasy. There are serious problems with using Tor and Zed fails to mention any of them. You'll want to read what Thomas has to say on the subject (http://searchyc.com/tptacek http://searchyc.com/tptacek). Specifically, Thomas mentions that a general problem with tools like Tor is that it identifies your traffic as a subset of all traffic thats probably worth monitoring. You're essentially adding bright red neon signs to your most sensitive traffic. The amount of traffic going through the Tor network is small enough that it is a tractable problem for a nation state to attempt to monitor all of it. Thomas also goes into how the incentive structure for these tools is completely broken. The defenders are academic researchers going for tenure, the attackers are nation states with millions of dollars to spend, and the users are dissidents that get killed when the tool fails. Unfortunately, arguments with this level of nuance appear to escape Zed in this case. I fear he doesn't have the domain knowledge to write something intelligent about this issue.

krainboltgreene 16y ago
> Funny though, his ISP is likely guilty of the same thing. I wonder if Zed takes that into account as a part of his paranoid fantasy. You don't need TOR. You do need an ISP.
- borism 16y ago
  you need trust in both of them as a netizen, and I have trust in Tor, but not my ISP.
pingswept 16y ago
The tptacek comments you're probably referring to: http://news.ycombinator.com/item?id=1690871 http://news.ycombinator.com/item?id=1690871 http://news.ycombinator.com/item?id=1184236 http://news.ycombinator.com/item?id=1184236
dkarl 16y ago
Thing is, you don't have to believe Firefox is trustworthy to believe it's your best bet for surfing the web. The whole point of Tor is to be trustworthy; hence, there's no point in it if you don't trust it. Plus, like you said, using Tor may be worse than nothing, so you have to have a pretty strong motivation and pretty strong trust. Using Firefox or OSX requires no such trust.
- poet 16y ago
  A comprised web browser or operating system gives the attacker your email credentials, which by proxy gives them the rest of your life. You're trying to argue that an untrustworthy browser/OS is not as significant as an untrustworthy Tor. There isn't such an argument to be made. Browsers and operating systems require trust.
  - dkarl 16y ago
    No, all they require is being just as trustworthy as the other browsers and operating systems, even if that level is zero. Tor is an extra inconvenience and calls extra attention to you and therefore requires a credible claim of providing extra security to make up for the downside.
    - poet 16y ago
      Nope. If the trustworthiness of all browsers was zero, people would do their banking in person. You're trying to get away with arguing only the relative and not absolute trust of browsers is the only thing that matters. Not gonna happen.
      - dkarl 16y ago
        Security is relative and depends on your particular goals. I may have zero confidence that the government has not subverted Firefox, but that would not stop me from using it. If there are government back doors in Firefox, they aren't being exploited on a large scale for robbery or identity theft, and that makes it good enough for online banking. It wouldn't make Firefox good enough for evading government surveillance, but depending on your purposes, using a web browser you don't trust might be better than not using a web browser at all. If someone of sufficient expertise decides to hack you and take your banking info, they will, just like if someone decides to rob you on the street, they will. We assume there are vulnerabilities in any piece of software as big as Firefox. Your security depends on not being a particularly tempting individual target for highly skilled attackers and staying up-to-date enough to avoid mass automated attacks, and those factors depend on relative risks that can't even be objectively measured. Edit/PS: I am also confident that the government would not insert back doors that are likely to be found by criminals, because those vulnerabilities would be exploited by foreign governments and would hurt U.S. commercial interests, which I imagine is the only kind of mistake that would result in Congress taking drastic punitive action (slashing budgets, reducing autonomy, increasing oversight) towards an intelligence agency.
spiritomb 16y ago
hide a stone among stones and a man among men
zedshaw 16y ago
Thomas is very right, but I was more interested in my reasons why I don't use Tor based on all the crap I see going on around it.
- poet 16y ago
  Do you avoid software like FreeBSD, Linux, Mac OS X, and all other software that fits the criteria of your post? Point is, you have shitty reasons and probably aren't consistant in your application of them. Government funding and a committer you don't like preclude the usage of a huge amount of software. curl -s http://www.kernel.org/pub/linux/kernel/CREDITS | grep gov E: becker@cesdis.gsfc.nasa.gov E: snyder@fnald0.fnal.gov curl -s http://gcc.gnu.org/viewcvs/trunk/MAINTAINERS?view=co | grep gov Asher Langton langton2@llnl.gov My general frustation with your blog post is that your arguments apply to many popular pieces of software. It feels disingenuous and it feels like it's provocative solely for the purpose of being provocative.
  - x09 16y ago
    Funniest thing of all is that we seem to completely forget who "invented the internet": Internet pioneers Vint Cerf and Bob Kahn noted that, "as far back as the 1970s, Congressman Gore promoted the idea of high speed telecommunications as an engine for both economic growth and the improvement of our educational system [and security regime]. -wikipedia [added]

by poet 16y ago

krainboltgreene 16y ago

> Funny though, his ISP is likely guilty of the same thing. I wonder if Zed takes that into account as a part of his paranoid fantasy. You don't need TOR. You do need an ISP.

borism 16y ago
you need trust in both of them as a netizen, and I have trust in Tor, but not my ISP.

pingswept 16y ago

The tptacek comments you're probably referring to: http://news.ycombinator.com/item?id=1690871 http://news.ycombinator.com/item?id=1690871 http://news.ycombinator.com/item?id=1184236 http://news.ycombinator.com/item?id=1184236

dkarl 16y ago

Thing is, you don't have to believe Firefox is trustworthy to believe it's your best bet for surfing the web. The whole point of Tor is to be trustworthy; hence, there's no point in it if you don't trust it. Plus, like you said, using Tor may be worse than nothing, so you have to have a pretty strong motivation and pretty strong trust. Using Firefox or OSX requires no such trust.

poet 16y ago
A comprised web browser or operating system gives the attacker your email credentials, which by proxy gives them the rest of your life. You're trying to argue that an untrustworthy browser/OS is not as significant as an untrustworthy Tor. There isn't such an argument to be made. Browsers and operating systems require trust.
- dkarl 16y ago
  No, all they require is being just as trustworthy as the other browsers and operating systems, even if that level is zero. Tor is an extra inconvenience and calls extra attention to you and therefore requires a credible claim of providing extra security to make up for the downside.
  - poet 16y ago
    Nope. If the trustworthiness of all browsers was zero, people would do their banking in person. You're trying to get away with arguing only the relative and not absolute trust of browsers is the only thing that matters. Not gonna happen.
    - dkarl 16y ago
      Security is relative and depends on your particular goals. I may have zero confidence that the government has not subverted Firefox, but that would not stop me from using it. If there are government back doors in Firefox, they aren't being exploited on a large scale for robbery or identity theft, and that makes it good enough for online banking. It wouldn't make Firefox good enough for evading government surveillance, but depending on your purposes, using a web browser you don't trust might be better than not using a web browser at all. If someone of sufficient expertise decides to hack you and take your banking info, they will, just like if someone decides to rob you on the street, they will. We assume there are vulnerabilities in any piece of software as big as Firefox. Your security depends on not being a particularly tempting individual target for highly skilled attackers and staying up-to-date enough to avoid mass automated attacks, and those factors depend on relative risks that can't even be objectively measured. Edit/PS: I am also confident that the government would not insert back doors that are likely to be found by criminals, because those vulnerabilities would be exploited by foreign governments and would hurt U.S. commercial interests, which I imagine is the only kind of mistake that would result in Congress taking drastic punitive action (slashing budgets, reducing autonomy, increasing oversight) towards an intelligence agency.

spiritomb 16y ago

hide a stone among stones and a man among men

zedshaw 16y ago

Thomas is very right, but I was more interested in my reasons why I don't use Tor based on all the crap I see going on around it.

poet 16y ago
Do you avoid software like FreeBSD, Linux, Mac OS X, and all other software that fits the criteria of your post? Point is, you have shitty reasons and probably aren't consistant in your application of them. Government funding and a committer you don't like preclude the usage of a huge amount of software. curl -s http://www.kernel.org/pub/linux/kernel/CREDITS | grep gov E: becker@cesdis.gsfc.nasa.gov E: snyder@fnald0.fnal.gov curl -s http://gcc.gnu.org/viewcvs/trunk/MAINTAINERS?view=co | grep gov Asher Langton langton2@llnl.gov My general frustation with your blog post is that your arguments apply to many popular pieces of software. It feels disingenuous and it feels like it's provocative solely for the purpose of being provocative.
- x09 16y ago
  Funniest thing of all is that we seem to completely forget who "invented the internet": Internet pioneers Vint Cerf and Bob Kahn noted that, "as far back as the 1970s, Congressman Gore promoted the idea of high speed telecommunications as an engine for both economic growth and the improvement of our educational system [and security regime]. -wikipedia [added]