3 ms·

Automatic updates are a thing.

• superkuh 6y ago
  The tor browser enforces this but that doesn't happen for the actual tor client (used for hosting onion services) if it comes from your system repositories. But even if you go back to the tor client released in 2013 there are no serious vulnerabilities. Just a mild DoS.
  • tinus_hn 6y ago
    This is about servers. The Tor browser and its automatic updates don’t include a webserver for tor sites, do they?
    • superkuh 6y ago
      Yes. That's exactly what I said. Except my main point was that even tor clients from 2013 only have a minor DoS vulnerability. It's not so dire if you don't update. I actually put off reading about or implementing a v3 domain because of the new DoS problems it introduced. For most of the v2->v3 transitional period an old out of date tor client running a v2 onion service was no more vulnerable than a brand new up to date v3 tor client with it's new vulnerabilities not worked out yet.