5 ms·

A host on v2 can serve a redirect to v3. Search indexes can be updated, as well as links (there was about 1.5 years?). It is a nuisance, but I don't see what th

by labawi 5y ago

A host on v2 can serve a redirect to v3. Search indexes can be updated, as well as links (there was about 1.5 years?). It is a nuisance, but I don't see what the big issue is. If v2 addresses are not disabled, people will keep using them, yet they are (seemingly quite) insecure. People would get false security/privacy impressions so they need to be disabled. Migrations need definite timelines - look at python v2/3, IPv4/6. RSA1024 really is long past overdue.

im3w1l 5y ago
> there was about 1.5 years You are kind of assuming that every Tor site is someone's primary occupation. But for some people it just be a hobby, and not their primary one either. Imagine someone spending an hour or so per year. They may not even know this is coming.
- tinus_hn 5y ago
  So they never install security updates, sounds like a good idea to no longer support them. Note it is pretty bad publicity for Tor if they get hacked.
  - im3w1l 5y ago
    Automatic updates are a thing.
    - superkuh 5y ago
      The tor browser enforces this but that doesn't happen for the actual tor client (used for hosting onion services) if it comes from your system repositories. But even if you go back to the tor client released in 2013 there are no serious vulnerabilities. Just a mild DoS.
      - tinus_hn 5y ago
        This is about servers. The Tor browser and its automatic updates don’t include a webserver for tor sites, do they?
        superkuh 5y ago
        Yes. That's exactly what I said. Except my main point was that even tor clients from 2013 only have a minor DoS vulnerability. It's not so dire if you don't update. I actually put off reading about or implementing a v3 domain because of the new DoS problems it introduced. For most of the v2->v3 transitional period an old out of date tor client running a v2 onion service was no more vulnerable than a brand new up to date v3 tor client with it's new vulnerabilities not worked out yet.

by labawi 5y ago

im3w1l 5y ago

> there was about 1.5 years You are kind of assuming that every Tor site is someone's primary occupation. But for some people it just be a hobby, and not their primary one either. Imagine someone spending an hour or so per year. They may not even know this is coming.

tinus_hn 5y ago
So they never install security updates, sounds like a good idea to no longer support them. Note it is pretty bad publicity for Tor if they get hacked.
- im3w1l 5y ago
  Automatic updates are a thing.
  - superkuh 5y ago
    The tor browser enforces this but that doesn't happen for the actual tor client (used for hosting onion services) if it comes from your system repositories. But even if you go back to the tor client released in 2013 there are no serious vulnerabilities. Just a mild DoS.
    - tinus_hn 5y ago
      This is about servers. The Tor browser and its automatic updates don’t include a webserver for tor sites, do they?
      - superkuh 5y ago
        Yes. That's exactly what I said. Except my main point was that even tor clients from 2013 only have a minor DoS vulnerability. It's not so dire if you don't update. I actually put off reading about or implementing a v3 domain because of the new DoS problems it introduced. For most of the v2->v3 transitional period an old out of date tor client running a v2 onion service was no more vulnerable than a brand new up to date v3 tor client with it's new vulnerabilities not worked out yet.