7 ms·

Going to Work for the Tor Project

49 points by edward 5y ago

diogenesjunior 5y ago
Interesting read, but is the author someone I should know? Are they popular in the community?
- Computeiful 5y ago
  He's well known in certain areas (Debian, Hypervisors)[0] I worked with the author a few times while he was at Citrix. Always struck me as extremely clever and pragmatic, I think Tor has gained a real asset. [0] https://www.theregister.com/2015/11/01/no_were_not_sorry_for_xen_security_snafus_says_ian_jackson/ https://www.theregister.com/2015/11/01/no_were_not_sorry_for...
  - diogenesjunior 5y ago
    Thank you.
- transpute 5y ago
  In addition to working on Xen, which enabled EC2/cloud, they were a Debian contributor, https://ma.ttias.be/devuan-debian-fork/ https://ma.ttias.be/devuan-debian-fork/
  - diogenesjunior 5y ago
    Thank you
hyproxia 5y ago
I wonder how the author will live with himself knowing that he's directly facilitating all the horrible things that go on Tor. I know that I can't do that, so kudos to him.
- neilalexander 5y ago
  For all of the bad people using tools like Tor, there are also plenty of good (and more importantly, innocent) people. Researchers, journalists, minorities, residents of oppressive regimes. Like most things, anonymity can be abused. However, as the saying goes, "don't throw the baby out with the bathwater".
- gostsamo 5y ago
  They will think about all the good it does as well.
- orangepanda 5y ago
  Same way power plant workers live with themselves, knowing that criminals use electricity too.
  - hyproxia 5y ago
    Not a good analogy. Most usage of Tor is either unnecessarily paranoid people, criminal enterprises, and state agencies. In fact, so far the leaks (Snowden, Wikileaks, etc) are the only cases I've heard of where Tor usage legitimately helped. Can you say the same thing about electricity? Again, I'm not saying that Tor should be shut down, it's just unsettling to work on something that the majority of its usage is "bad".
    - linschn 5y ago
      Union workers , journalists, security researchers, IT managers, lawyers, and judges and prosecutors are the professions of people I teach the usage and inner working of TOR to. They all have legitimate use cases for it. And nobody has any idea what "most" (according to which metric anyway? Bandwidth, number of connections?) of TOR usage is for.
      - lazybreather 5y ago
        I don't think TOR has to be justified by giving such use cases. Why can't I be a normal person and still use TOR for my browsing?
omgmajk 5y ago
"That Tor is mostly written in C is quite terrifying, and I'm very happy that I'm going to help fix that!" I don't get why so many people are so terrified by C. It's been working well for almost 50 years.
- est31 5y ago
  Using C for this purpose (application processing untrusted data) is absolutely terrifying. Already when it was invented, C was a step backwards in terms of language design. C has been very successful, and there are definitely advantages like the ubiquitous support, but its lack of memory safety is causative for three quarters of all security bugs in software that is built in it. This share has been found by multiple independent projects so it's kind of a constant. And Tor is not just a random networked application, it manages data highly interesting for state level actors.
  - Craighead 5y ago
    do you have a statistic for three quarters?
- mhh__ 5y ago
  Because C makes it really really easy to write test-free unsafe crap. The list of bugs caused by use if C is genuinely ridiculous. Now, I think there are ways to write robust C - I don't get many bugs now that I usually use AddressSanitizer and a static analyzer (the GCC one is really nice) but that simply isn't good enough any more for high-reliability code.
  - calvinmorrison 5y ago
    Let's not mention all the undefined or compiler specific behavior. I love C but come on - let's be realistic
    - mhh__ 5y ago
      I absolutely hate C. Just that I have to use it sometimes.
smitop 5y ago
Here's the mentioned implementation of Tor in Rust: https://gitlab.torproject.org/tpo/core/arti https://gitlab.torproject.org/tpo/core/arti
verytrivial 5y ago
I very much prefer "Product X is written in C so I am re-writing it in Rust" over "Product X is written in C, so someone else should re-write it in Rust." Great to see!
superkuh 5y ago
You know what tor needs far more than a rewrite in some corporate meme language? Someone to work on the onion services side. There's plenty of people working on the pseudoanonymous proxy to the clear web features but .onion is left to decay and rot (https://blog.torproject.org/v2-deprecation-timeline https://blog.torproject.org/v2-deprecation-timeline). Because of the lack of developer resources or anyone at the tor project giving a damn they have removed support for all tor v2 as of october 15th (a week ago). And this is extremely silly since >90% of HSDirs are tor v2 (https://www.encryptionin.space/tracking-hsdirs-and-the-version-of-tor-they-run https://www.encryptionin.space/tracking-hsdirs-and-the-versi...). But they don't have the resources to maintain the (slightly less secure) v2 stuff alongside v3, so they're just throwing the entire 15 years of all of tor's domains, linking, search indices, and writing in the trash and starting anew from very few users and little infrastructure. And apparently no one cares that Tor has deleted itself. No news. No blog posts. Nothing but the well hidden post and upset comments from a year ago. I've talked to various people on their IRC and they say even if people continue to run tor v2 supporting clients The Tor Project will eventually push out their centralized consensus flag to ban them from the network.
- Zababa 5y ago
  v2 are deprecated of safety. The "rewrite in some corporate meme language" would address this issue.
  - hyproxia 5y ago
    >The "rewrite in some corporate meme language" would address this issue. No it won't, the issues with v2 are with its design, not its implementation.
    - hyproxia 5y ago
      Off-topic, but can someone tell me if this comment is phrased properly? I suspect that using "with" twice in the sentence is a little bit wrong, but I don't know how to correct it.

49 points by edward 5y ago

diogenesjunior 5y ago

Interesting read, but is the author someone I should know? Are they popular in the community?

Computeiful 5y ago
He's well known in certain areas (Debian, Hypervisors)[0] I worked with the author a few times while he was at Citrix. Always struck me as extremely clever and pragmatic, I think Tor has gained a real asset. [0] https://www.theregister.com/2015/11/01/no_were_not_sorry_for_xen_security_snafus_says_ian_jackson/ https://www.theregister.com/2015/11/01/no_were_not_sorry_for...
- diogenesjunior 5y ago
  Thank you.
transpute 5y ago
In addition to working on Xen, which enabled EC2/cloud, they were a Debian contributor, https://ma.ttias.be/devuan-debian-fork/ https://ma.ttias.be/devuan-debian-fork/
- diogenesjunior 5y ago
  Thank you

hyproxia 5y ago

I wonder how the author will live with himself knowing that he's directly facilitating all the horrible things that go on Tor. I know that I can't do that, so kudos to him.

neilalexander 5y ago
For all of the bad people using tools like Tor, there are also plenty of good (and more importantly, innocent) people. Researchers, journalists, minorities, residents of oppressive regimes. Like most things, anonymity can be abused. However, as the saying goes, "don't throw the baby out with the bathwater".
gostsamo 5y ago
They will think about all the good it does as well.
orangepanda 5y ago
Same way power plant workers live with themselves, knowing that criminals use electricity too.
- hyproxia 5y ago
  Not a good analogy. Most usage of Tor is either unnecessarily paranoid people, criminal enterprises, and state agencies. In fact, so far the leaks (Snowden, Wikileaks, etc) are the only cases I've heard of where Tor usage legitimately helped. Can you say the same thing about electricity? Again, I'm not saying that Tor should be shut down, it's just unsettling to work on something that the majority of its usage is "bad".
  - linschn 5y ago
    Union workers , journalists, security researchers, IT managers, lawyers, and judges and prosecutors are the professions of people I teach the usage and inner working of TOR to. They all have legitimate use cases for it. And nobody has any idea what "most" (according to which metric anyway? Bandwidth, number of connections?) of TOR usage is for.
    - lazybreather 5y ago
      I don't think TOR has to be justified by giving such use cases. Why can't I be a normal person and still use TOR for my browsing?

omgmajk 5y ago

"That Tor is mostly written in C is quite terrifying, and I'm very happy that I'm going to help fix that!" I don't get why so many people are so terrified by C. It's been working well for almost 50 years.

est31 5y ago
Using C for this purpose (application processing untrusted data) is absolutely terrifying. Already when it was invented, C was a step backwards in terms of language design. C has been very successful, and there are definitely advantages like the ubiquitous support, but its lack of memory safety is causative for three quarters of all security bugs in software that is built in it. This share has been found by multiple independent projects so it's kind of a constant. And Tor is not just a random networked application, it manages data highly interesting for state level actors.
- Craighead 5y ago
  do you have a statistic for three quarters?
mhh__ 5y ago
Because C makes it really really easy to write test-free unsafe crap. The list of bugs caused by use if C is genuinely ridiculous. Now, I think there are ways to write robust C - I don't get many bugs now that I usually use AddressSanitizer and a static analyzer (the GCC one is really nice) but that simply isn't good enough any more for high-reliability code.
- calvinmorrison 5y ago
  Let's not mention all the undefined or compiler specific behavior. I love C but come on - let's be realistic
  - mhh__ 5y ago
    I absolutely hate C. Just that I have to use it sometimes.

smitop 5y ago

Here's the mentioned implementation of Tor in Rust: https://gitlab.torproject.org/tpo/core/arti https://gitlab.torproject.org/tpo/core/arti

verytrivial 5y ago

I very much prefer "Product X is written in C so I am re-writing it in Rust" over "Product X is written in C, so someone else should re-write it in Rust." Great to see!

superkuh 5y ago

You know what tor needs far more than a rewrite in some corporate meme language? Someone to work on the onion services side. There's plenty of people working on the pseudoanonymous proxy to the clear web features but .onion is left to decay and rot (https://blog.torproject.org/v2-deprecation-timeline https://blog.torproject.org/v2-deprecation-timeline). Because of the lack of developer resources or anyone at the tor project giving a damn they have removed support for all tor v2 as of october 15th (a week ago). And this is extremely silly since >90% of HSDirs are tor v2 (https://www.encryptionin.space/tracking-hsdirs-and-the-version-of-tor-they-run https://www.encryptionin.space/tracking-hsdirs-and-the-versi...). But they don't have the resources to maintain the (slightly less secure) v2 stuff alongside v3, so they're just throwing the entire 15 years of all of tor's domains, linking, search indices, and writing in the trash and starting anew from very few users and little infrastructure. And apparently no one cares that Tor has deleted itself. No news. No blog posts. Nothing but the well hidden post and upset comments from a year ago. I've talked to various people on their IRC and they say even if people continue to run tor v2 supporting clients The Tor Project will eventually push out their centralized consensus flag to ban them from the network.

Zababa 5y ago
v2 are deprecated of safety. The "rewrite in some corporate meme language" would address this issue.
- hyproxia 5y ago
  >The "rewrite in some corporate meme language" would address this issue. No it won't, the issues with v2 are with its design, not its implementation.
  - hyproxia 5y ago
    Off-topic, but can someone tell me if this comment is phrased properly? I suspect that using "with" twice in the sentence is a little bit wrong, but I don't know how to correct it.