7 ms·

Tor in Google Summer of Code 2014

185 points by taylorbuley 13y ago

manish_gill 13y ago
Uhh...I don't think the organisations have been announced yet. This just means that they will be applying for GSoC 2014, not that they are selected. :)
- epanastasi 13y ago
  Announced here: http://google-opensource.blogspot.com/2014/02/mentoring-organizations-for-google.html http://google-opensource.blogspot.com/2014/02/mentoring-orga... Direct Link: http://www.google-melange.com/gsoc/org/list/public/google/gsoc2014 http://www.google-melange.com/gsoc/org/list/public/google/gs...
  - ScottWhigham 13y ago
    Direct link to the Tor entry: http://www.google-melange.com/gsoc/org2/google/gsoc2014/tor http://www.google-melange.com/gsoc/org2/google/gsoc2014/tor
- jlgaddis 13y ago
  > We will announce the list of accepted mentoring organizations on the Google Summer of Code 2014 site on 24 February, 2014 at 19:00 UTC. -- https://www.google-melange.com/gsoc/document/show/gsoc_program/google/gsoc2014/help_page#6._When_will_accepted_mentoring https://www.google-melange.com/gsoc/document/show/gsoc_progr...
  - manish_gill 13y ago
    Ah, sorry. My bad.
willvarfar 13y ago
I tried to actually use tor for my browsing back when snowden leaked and schneier implored us all to. But I found the browser really too restricted to be useful. I understand that plugins can go around the browser config etc, but there has to be a better way... The project I want to see is running the tor router in zerovm in docker, and running a full browser and all plugins in a child docker in such a way that it is fully fire walled and can only communicate via the tor container, with vnc screen scraping etc. And set up so the browser container can be launched in persistent mode to make changes eg browser plugins, but normally runs with aufs on a ram disk so it never touches disk and is completely lost when closed.
- 13throwaway 13y ago
  Can't you set up tor as an HTTP proxy then just use whatever browser you want?
  - willvarfar 13y ago
    And that's what the TOR browser bundle does. And that's why it is locked down and disables all plugins etc. The point of hosting in docker in docker is to firewall the browser so it can't talk to anyone else, and to add extra layers of protection - however flimsy - against any eventual targeted compromise.
  - apk17 13y ago
    That wouldn't be good for your anonymity. You get a lot of fingerprinting issues with other browsers which the tor browser tries to avoid.
  - A_COMPUTER 13y ago
    An HTTP proxy won't proxy DNS lookups. If you're using SOCKS4a/5 proxying, Firefox will use it IF you set network.proxy.socks_remote_dns=true, on Chrome it'll work if you use socks5 but the dns prefetch will bypass it and expose you. On Firefox, plugins and extensions can bypass the proxy. I don't know specifically about Chrome, but I experimented with it and when playing around with strict firewall egress filtering and restrictive apparmor profile, using the embedded Flash would just up and crash the browser. It's not a good idea. If you want to use the web on Tor, use the browser bundle.
- safeaim 13y ago
  You could try setting up TheGrugq's PortalofPi and route your computer through the Pi. https://github.com/grugq/PORTALofPi https://github.com/grugq/PORTALofPi "A dedicated hardware device which forces all internet traffic to be sent over the Tor network. This significantly increases the odds of using Tor effectively, and reduces the potential to make fatal mistakes. " https://github.com/grugq/portal https://github.com/grugq/portal
  - 13y ago
benjaminpv 13y ago
Serious question for people that are familiar with Tor: given that we've already seen people get arrested for simply running an exit node, have features like hidden services made it any safer for someone that agrees with tor's purpose (providing a less restricted end point to people that are censored by their governments) to keep an exit node running? It seems to me that arresting an exit node's maintainer for child porn serves to have a real chilling effect on the system. As much as I'd like to provide, say, a dissident with a means to voice their opinion, it's not going to help when the cops cart away the exit note and haul me off to jail. I guess what I'm thinking is that hidden tor services sort of 'close the gap' when it comes to problems like I describe above, since conceivably a political dissident could post to a hidden service (never appearing on the Internet at large) and have something of an intermediary in a country with greater freedom post it for them?
- NegativeK 13y ago
  I've talked to someone who runs an exit node. They not only have avoided hassle, but they run it via Amazon, which is supposedly against ToS. No issues so far. Also, if people would like to help Tor but are afraid of running an exit node, Noisebridge (a hackerspace) runs a fucking giant exit node. Donating time or money to them would help.
  - big_youth 13y ago
    Many non-profits or universities run exit nodes. I have a tor relay on amazon[1] and have had no problems. https://cloud.torproject.org/ https://cloud.torproject.org/
  - dublinben 13y ago
    Exit relays can be run on AWS, but it's a waste of money. You'd be better off with an inexpensive VPS from a Tor-friendly provider. Donations of any amount can also be sent to TorServers.net. https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISPs https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISP...
  - linuxguy2 13y ago
pearjuice 13y ago
So is Tox, "a free and open source replacement to the well used proprietary application Skype". https://www.google-melange.com/gsoc/org2/google/gsoc2014/tox https://www.google-melange.com/gsoc/org2/google/gsoc2014/tox
- eqyiel 13y ago
  This may be the coolest thing to ever come out of /g/!
habosa 13y ago
Oh no! Now Google is going to put a backdoor in Tor and use it to make more money on GMail ads and sell my soul to the NSA! Just kidding, turns out Google is not always evil. Good that HN gets a reminder once in a while.
- yeukhon 13y ago
  In the past Navy sponsored Tor and NSF continues to sponsor Tor. And someone is going to say, "oh no." https://www.torproject.org/about/sponsors.html.en https://www.torproject.org/about/sponsors.html.en Truth is, Google doesn't care what open source project you want to make into GSoC, as long as someone likes your proposal, the project will get the $$ it needs :) Note Mercurial didn't make it to GSoC officially this year (probably have to go under PSF's name) - so even popular OSS doesn't automatically becomes a GSoC participant.
  - yen223 13y ago
    Tor wasn't just sponsored by the Navy, it was "originally designed, implemented, and deployed as a third-generation onion routing project of the U.S. Naval Research Laboratory." https://www.torproject.org/about/overview.html.en https://www.torproject.org/about/overview.html.en
- Zigurd 13y ago
  That trivializes a difficult issue. When a company is recruited into a program like Prism, that doesn't necessarily happen through the CEO. Certainly, the company doesn't announce such a deal at an all-hands meeting, and omits it from their financial and regulatory filings. The vast majority of a company's employees might be legitimately offended at the suggestion they are collaborating in such a program. And yet, such a company can lose their customers and reputation, and may deserve that fate. It's a form of corruption. It's a hazard for customers. Those companies listed as participating in Prism have to bear the responsibility, whether or not most of the employees and even most of the company leadership can correctly claim to be victims.
blahbl4hblahtoo 13y ago
Does anybody else wish that there was a simple libTor that you could include in a project and "torify" your application?

185 points by taylorbuley 13y ago

Uhh...I don't think the organisations have been announced yet. This just means that they will be applying for GSoC 2014, not that they are selected. :)

epanastasi 13y ago
Announced here: http://google-opensource.blogspot.com/2014/02/mentoring-organizations-for-google.html http://google-opensource.blogspot.com/2014/02/mentoring-orga... Direct Link: http://www.google-melange.com/gsoc/org/list/public/google/gsoc2014 http://www.google-melange.com/gsoc/org/list/public/google/gs...
- ScottWhigham 13y ago
  Direct link to the Tor entry: http://www.google-melange.com/gsoc/org2/google/gsoc2014/tor http://www.google-melange.com/gsoc/org2/google/gsoc2014/tor
jlgaddis 13y ago
> We will announce the list of accepted mentoring organizations on the Google Summer of Code 2014 site on 24 February, 2014 at 19:00 UTC. -- https://www.google-melange.com/gsoc/document/show/gsoc_program/google/gsoc2014/help_page#6._When_will_accepted_mentoring https://www.google-melange.com/gsoc/document/show/gsoc_progr...
- manish_gill 13y ago
  Ah, sorry. My bad.

willvarfar 13y ago

I tried to actually use tor for my browsing back when snowden leaked and schneier implored us all to. But I found the browser really too restricted to be useful. I understand that plugins can go around the browser config etc, but there has to be a better way... The project I want to see is running the tor router in zerovm in docker, and running a full browser and all plugins in a child docker in such a way that it is fully fire walled and can only communicate via the tor container, with vnc screen scraping etc. And set up so the browser container can be launched in persistent mode to make changes eg browser plugins, but normally runs with aufs on a ram disk so it never touches disk and is completely lost when closed.

13throwaway 13y ago
Can't you set up tor as an HTTP proxy then just use whatever browser you want?
- willvarfar 13y ago
  And that's what the TOR browser bundle does. And that's why it is locked down and disables all plugins etc. The point of hosting in docker in docker is to firewall the browser so it can't talk to anyone else, and to add extra layers of protection - however flimsy - against any eventual targeted compromise.
- apk17 13y ago
  That wouldn't be good for your anonymity. You get a lot of fingerprinting issues with other browsers which the tor browser tries to avoid.
- A_COMPUTER 13y ago
  An HTTP proxy won't proxy DNS lookups. If you're using SOCKS4a/5 proxying, Firefox will use it IF you set network.proxy.socks_remote_dns=true, on Chrome it'll work if you use socks5 but the dns prefetch will bypass it and expose you. On Firefox, plugins and extensions can bypass the proxy. I don't know specifically about Chrome, but I experimented with it and when playing around with strict firewall egress filtering and restrictive apparmor profile, using the embedded Flash would just up and crash the browser. It's not a good idea. If you want to use the web on Tor, use the browser bundle.
safeaim 13y ago
You could try setting up TheGrugq's PortalofPi and route your computer through the Pi. https://github.com/grugq/PORTALofPi https://github.com/grugq/PORTALofPi "A dedicated hardware device which forces all internet traffic to be sent over the Tor network. This significantly increases the odds of using Tor effectively, and reduces the potential to make fatal mistakes. " https://github.com/grugq/portal https://github.com/grugq/portal
- 13y ago

benjaminpv 13y ago

Serious question for people that are familiar with Tor: given that we've already seen people get arrested for simply running an exit node, have features like hidden services made it any safer for someone that agrees with tor's purpose (providing a less restricted end point to people that are censored by their governments) to keep an exit node running? It seems to me that arresting an exit node's maintainer for child porn serves to have a real chilling effect on the system. As much as I'd like to provide, say, a dissident with a means to voice their opinion, it's not going to help when the cops cart away the exit note and haul me off to jail. I guess what I'm thinking is that hidden tor services sort of 'close the gap' when it comes to problems like I describe above, since conceivably a political dissident could post to a hidden service (never appearing on the Internet at large) and have something of an intermediary in a country with greater freedom post it for them?

NegativeK 13y ago
I've talked to someone who runs an exit node. They not only have avoided hassle, but they run it via Amazon, which is supposedly against ToS. No issues so far. Also, if people would like to help Tor but are afraid of running an exit node, Noisebridge (a hackerspace) runs a fucking giant exit node. Donating time or money to them would help.
- big_youth 13y ago
  Many non-profits or universities run exit nodes. I have a tor relay on amazon[1] and have had no problems. https://cloud.torproject.org/ https://cloud.torproject.org/
- dublinben 13y ago
  Exit relays can be run on AWS, but it's a waste of money. You'd be better off with an inexpensive VPS from a Tor-friendly provider. Donations of any amount can also be sent to TorServers.net. https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISPs https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISP...
- linuxguy2 13y ago

pearjuice 13y ago

So is Tox, "a free and open source replacement to the well used proprietary application Skype". https://www.google-melange.com/gsoc/org2/google/gsoc2014/tox https://www.google-melange.com/gsoc/org2/google/gsoc2014/tox

eqyiel 13y ago
This may be the coolest thing to ever come out of /g/!

habosa 13y ago

Oh no! Now Google is going to put a backdoor in Tor and use it to make more money on GMail ads and sell my soul to the NSA! Just kidding, turns out Google is not always evil. Good that HN gets a reminder once in a while.

yeukhon 13y ago
In the past Navy sponsored Tor and NSF continues to sponsor Tor. And someone is going to say, "oh no." https://www.torproject.org/about/sponsors.html.en https://www.torproject.org/about/sponsors.html.en Truth is, Google doesn't care what open source project you want to make into GSoC, as long as someone likes your proposal, the project will get the $$ it needs :) Note Mercurial didn't make it to GSoC officially this year (probably have to go under PSF's name) - so even popular OSS doesn't automatically becomes a GSoC participant.
- yen223 13y ago
  Tor wasn't just sponsored by the Navy, it was "originally designed, implemented, and deployed as a third-generation onion routing project of the U.S. Naval Research Laboratory." https://www.torproject.org/about/overview.html.en https://www.torproject.org/about/overview.html.en
Zigurd 13y ago
That trivializes a difficult issue. When a company is recruited into a program like Prism, that doesn't necessarily happen through the CEO. Certainly, the company doesn't announce such a deal at an all-hands meeting, and omits it from their financial and regulatory filings. The vast majority of a company's employees might be legitimately offended at the suggestion they are collaborating in such a program. And yet, such a company can lose their customers and reputation, and may deserve that fate. It's a form of corruption. It's a hazard for customers. Those companies listed as participating in Prism have to bear the responsibility, whether or not most of the employees and even most of the company leadership can correctly claim to be victims.

blahbl4hblahtoo 13y ago

Does anybody else wish that there was a simple libTor that you could include in a project and "torify" your application?