Going to Work for the Tor Project

https://diziet.dreamwidth.org/10255.html

by edward • 5 years ago

49 53 5 years ago

diziet.dreamwidth.org

Interesting read, but is the author someone I should know? Are they popular in the community?

transpute• 5 years ago

In addition to working on Xen, which enabled EC2/cloud, they were a Debian contributor, https://ma.ttias.be/devuan-debian-fork/

diogenesjunior3• 5 years ago

Thank you

Computeiful• 5 years ago

He's well known in certain areas (Debian, Hypervisors)[0]

I worked with the author a few times while he was at Citrix. Always struck me as extremely clever and pragmatic, I think Tor has gained a real asset.

[0] https://www.theregister.com/2015/11/01/no_were_not_sorry_for...

diogenesjunior3• 5 years ago

Thank you.

hyproxia7• 5 years ago

I wonder how the author will live with himself knowing that he's directly facilitating all the horrible things that go on Tor. I know that I can't do that, so kudos to him.

gostsamo• 5 years ago

They will think about all the good it does as well.

orangepanda• 5 years ago

Same way power plant workers live with themselves, knowing that criminals use electricity too.

hyproxia7• 5 years ago

Not a good analogy. Most usage of Tor is either unnecessarily paranoid people, criminal enterprises, and state agencies. In fact, so far the leaks (Snowden, Wikileaks, etc) are the only cases I've heard of where Tor usage legitimately helped.

Can you say the same thing about electricity?

Again, I'm not saying that Tor should be shut down, it's just unsettling to work on something that the majority of its usage is "bad".

breakingcups• 5 years ago

A more apt comparison might be crowbar manufacturers, since that is something people often associate with criminals even though it is a very legitimate tool in many other uses.

DeathArrow• 5 years ago

I wonder how heads of states will live with themselves knowing that they are directly facilitating all the horrible things that go on the World.

On the other hand, I consider fighting against mass surveillance and for maintaining privacy a good thing.

roody15• 5 years ago

Interesting, curious what your occupation is?

sydbarret• 5 years ago

I wonder how the creators of the internet can live with themselves knowing that they facilitated all the horrible things that go on the internet. I know that I can't do that, so kudos to them.

neilalexander• 5 years ago

For all of the bad people using tools like Tor, there are also plenty of good (and more importantly, innocent) people. Researchers, journalists, minorities, residents of oppressive regimes.

Like most things, anonymity can be abused. However, as the saying goes, "don't throw the baby out with the bathwater".

mhh__3• 5 years ago

As in buying weed? Does anyone have a hard data? I would guess jazz cabbage alone makes up a lot of traffic

okprod• 5 years ago

If you pay government taxes in any capacity anywhere, I wonder how you will live with yourself knowing that you're directly facilitating all the horrible things that governments do, like drop bombs on humans for oil and bulldoze homes.

xvector3• 5 years ago

I love Tor, but this analogy doesn't work. We don't have a choice when it comes to taxes. Working for the Tor Project is clearly a choice.

omgmajk• 5 years ago

"That Tor is mostly written in C is quite terrifying, and I'm very happy that I'm going to help fix that!"

I don't get why so many people are so terrified by C. It's been working well for almost 50 years.

est31• 5 years ago

Using C for this purpose (application processing untrusted data) is absolutely terrifying. Already when it was invented, C was a step backwards in terms of language design.

C has been very successful, and there are definitely advantages like the ubiquitous support, but its lack of memory safety is causative for three quarters of all security bugs in software that is built in it. This share has been found by multiple independent projects so it's kind of a constant.

And Tor is not just a random networked application, it manages data highly interesting for state level actors.

mhh__3• 5 years ago

Because C makes it really really easy to write test-free unsafe crap.

The list of bugs caused by use if C is genuinely ridiculous.

Now, I think there are ways to write robust C - I don't get many bugs now that I usually use AddressSanitizer and a static analyzer (the GCC one is really nice) but that simply isn't good enough any more for high-reliability code.

calvinmorrison• 5 years ago

Let's not mention all the undefined or compiler specific behavior. I love C but come on - let's be realistic

xvector3• 5 years ago

It's been working well for almost 50 years.

If you count being the source of countless security vulnerabilities "working well."

It's pretty senseless to use C in security-sensitive contexts. Let alone Tor.

adrianN• 5 years ago

For some definitions of "working well", but not many definitions that include robustness against hackers.

pjmlp• 5 years ago

While security researchers keep taking advantage of memory corruption bugs during those 50 years.

agumonkey• 5 years ago

an interesting codependency curve

smitop• 5 years ago

Here's the mentioned implementation of Tor in Rust: https://gitlab.torproject.org/tpo/core/arti

verytrivial• 5 years ago

I very much prefer

    "Product X is written in C so I am re-writing it in Rust"

over

     "Product X is written in C, so someone else should re-write it in Rust."

Great to see!

superkuh2• 5 years ago

You know what tor needs far more than a rewrite in some corporate meme language? Someone to work on the onion services side. There's plenty of people working on the pseudoanonymous proxy to the clear web features but .onion is left to decay and rot (https://blog.torproject.org/v2-deprecation-timeline).

Because of the lack of developer resources or anyone at the tor project giving a damn they have removed support for all tor v2 as of october 15th (a week ago). And this is extremely silly since >90% of HSDirs are tor v2 (https://www.encryptionin.space/tracking-hsdirs-and-the-versi...). But they don't have the resources to maintain the (slightly less secure) v2 stuff alongside v3, so they're just throwing the entire 15 years of all of tor's domains, linking, search indices, and writing in the trash and starting anew from very few users and little infrastructure.

And apparently no one cares that Tor has deleted itself. No news. No blog posts. Nothing but the well hidden post and upset comments from a year ago. I've talked to various people on their IRC and they say even if people continue to run tor v2 supporting clients The Tor Project will eventually push out their centralized consensus flag to ban them from the network.

Zababa4• 5 years ago

v2 are deprecated of safety. The "rewrite in some corporate meme language" would address this issue.

hyproxia7• 5 years ago

The "rewrite in some corporate meme language" would address this issue.

No it won't, the issues with v2 are with its design, not its implementation.

superkuh2• 5 years ago

The way users of v2 effect the safety of v3 and the tor project is in terms of directory and resources, etc, and potential exhaustion attacks native to v2. But with porting and some work most of this could be mitigated. The safety of the hash and the length used couldn't but there still isn't a real world example of a collision in use. It's pretty drastic to entirely throw away 15 years of inter-linking, indices, etc when <5% of users (probably less) of onion services have switched to v3.

Going to Work for the Tor Project

Related Stories