Live data from Hacker News

Zed Shaw: Why I Don't Use Tor

sheddingbikes.com

11–20 of 170 posts

Re: Zed Shaw: Why I Don't Use Tor

#11
It's an interesting question. If Project Vigilant had compromised Tor, I'd expect there to be quite a few pedophiles who had used it to share cp getting busted. I'm not aware of any such incidents, let alone many. I imagine that the government wouldn't want to give away that they had it compromised, and so would simply use the information to compose a list of people to watch for slip ups, but one would expect to see a rise in the number of arrests, which would likely get at least some play in the MSM.

Conversely, if the NSA had compromised it one would expect to see no outward signs, as they a) don't care about pedophiles, b) would claim "national security" to hide the means of tracking terror suspects from the public's eye, and c) likely wouldn't tell anyone when they did apprehend someone.

I think it's probably pretty likely that the NSA is running a few nodes, but that's the risk you take wit something like Tor, just as bittorrent seeders risk riaa proxies downloading from them.

Re: Zed Shaw: Why I Don't Use Tor

#12
post #3
post #2

“@zedshaw If you don't trust Tor because of me, you clearly do not understand how Tor works. You can BadExit my nodes buddy.” Appelbaum, https://twitter.com/#!/ioerror/status/19703396818747392

I was curious about this, so I started googling for how to do this. Sure enough, it's a bitch and the only way to really do it easily is to use a GUI like Tork. Not to mention I can't seem to figure out how you find his nodes in order to BadExit them, and I very seriously doubt his nodes will get listed in anything official. Anyone got good instructions on how to actually BadExit his nodes? I want to post them so peo…

Why would you even want to BadExit his nodes? Using Tor you're vulnerable anyway. Any exit node can snoop on your traffic or even change it.

Enumerating some bad nodes does not substantially improve this. The above can only be prevented by using something like SSL plus a trusted certificate on top of Tor.

Re: Zed Shaw: Why I Don't Use Tor

#13
post #10

It's somewhat informative to compare Zed's response to personal criticisms vs those he targets with his own criticisms. Follow the chain of twitter replies and make up your own mind.

So much name calling and playground idiocy. Just looking at a sample of the tweets made my head hurt. Surely most of us don't use Tor because 1. It's slow as hell 2. We're not doing anything illegal or trying to get past censorship

I agree with 1.

I think 2. is interesting to talk about, because the intersection of legal activities with what those in power find objectionable is the battlefront of liberty.

So while Tor may not be interesting to joe public yet, I do think it's worth exacting discussion of it's strengths and flaws.

FWIW this includes Zed's criticisms up until the point he took his ball and went home.

Re: Zed Shaw: Why I Don't Use Tor

#14
post #4

> P.S. I have a long bet that SELinux is an NSA backdoor. Any takers? I don't know if it's an NSA backdoor, but there were several security alerts related to SELinux. I don't understand why all common distros use this. I don't, I compile my kernels from unpatched vanilla source.

> there were several security alerts related to SELinux.

Can you elaborate?

Re: Zed Shaw: Why I Don't Use Tor

#15
post #2

“@zedshaw If you don't trust Tor because of me, you clearly do not understand how Tor works. You can BadExit my nodes buddy.” Appelbaum, https://twitter.com/#!/ioerror/status/19703396818747392

Am I the only one who is disappointed that two supposedly professional adults can't manage to have a grown up conversation about this? Reading the back and forth is pretty disheartening.

Re: Zed Shaw: Why I Don't Use Tor

#16
post #2

“@zedshaw If you don't trust Tor because of me, you clearly do not understand how Tor works. You can BadExit my nodes buddy.” Appelbaum, https://twitter.com/#!/ioerror/status/19703396818747392

Am I the only one who is disappointed that two supposedly professional adults can't manage to have a grown up conversation about this? Reading the back and forth is pretty disheartening.

I think you are starting from a false supposition.

Re: Zed Shaw: Why I Don't Use Tor

#17
So why use OpenSSL, then? It's been written by people I don't know. Some of them may be Vigilants. Some of them may be secret members of the Wikileaks team. One of them even studied only 12km from the BND headquarters. It has had exploitable holes before.

Re: Zed Shaw: Why I Don't Use Tor

#18

It's an interesting question. If Project Vigilant had compromised Tor, I'd expect there to be quite a few pedophiles who had used it to share cp getting busted. I'm not aware of any such incidents, let alone many. I imagine that the government wouldn't want to give away that they had it compromised, and so would simply use the information to compose a list of people to watch for slip ups, but one would expect to see…

I find funny that I was re-reading a novel this morning during the commute, about a WWII cryptographer and arrived at the point were he sees that the warning in every secret document was "never take any action that could reveal the enemy that we can break their encryption".

Re: Zed Shaw: Why I Don't Use Tor

#20
post #12
post #3

Earlier quoted context omitted.

I was curious about this, so I started googling for how to do this. Sure enough, it's a bitch and the only way to really do it easily is to use a GUI like Tork. Not to mention I can't seem to figure out how you find his nodes in order to BadExit them, and I very seriously doubt his nodes will get listed in anything official. Anyone got good instructions on how to actually BadExit his nodes? I want to post them so peo…

Why would you even want to BadExit his nodes? Using Tor you're vulnerable anyway. Any exit node can snoop on your traffic or even change it. Enumerating some bad nodes does not substantially improve this. The above can only be prevented by using something like SSL plus a trusted certificate on top of Tor.

Right, and the people who are running malicious Tor exit nodes won't tell you that either. Good luck with that.
Post reply on HN