Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

blog.torproject.org

Post reply on HN
Print view View original

31–40 of 67 posts

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#31

Post by stoplying1 »

Uptrenda wrote: post #19

To me this just seems pointless because an implementation in Rust is going to have similar features to one in C, Java, Python, or any of the handful of languages where Tor already exists... I want to rep another project that I think would be more relevant to Tor's goals. It is unfunded yet should it exist: would have the potential to transform privacy on the web. The project is https://github.com/Ayms/node-Tor It's a…

This is a stunningly baffling idea given that any user that has half a clue is using Tor with JS disabled.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#32

Post by stoplying1 »

t6jvcereio wrote: post #13

It seems the Rust people are especially prone to re implementing things. Nothing is really created, just reimplemented.

I am not sure I can think of something that I more want reimplemented in Rust than Tor. In fact, as excited as I am about Rust inside the kernel, I'm more excited about this and the Rust-ification of Firefox. Given the distro I use, the biggest risks to me are almost guaranteedly through (some) browser.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#33

Post by MacsHeadroom »

timbit42 wrote: post #5
billconan wrote: post #3

Earlier quoted context omitted.

I have a question, can I use tor as a middleware? for example, can I build a social network with Tor embedded into the client as the network layer?

Briar does this.

Bisq also does this.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#34

Post by zxcvbn4038 »

Uptrenda wrote: post #19

To me this just seems pointless because an implementation in Rust is going to have similar features to one in C, Java, Python, or any of the handful of languages where Tor already exists... I want to rep another project that I think would be more relevant to Tor's goals. It is unfunded yet should it exist: would have the potential to transform privacy on the web. The project is https://github.com/Ayms/node-Tor It's a…

I don't think that Tor in javascript would improve anything. Tor in golang on the other hand would gain multithreading and ease of integration. It would drop in nicely with the Golang standard library.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#35

Post by Uptrenda »

stoplying1 wrote: post #31
Uptrenda wrote: post #19

To me this just seems pointless because an implementation in Rust is going to have similar features to one in C, Java, Python, or any of the handful of languages where Tor already exists... I want to rep another project that I think would be more relevant to Tor's goals. It is unfunded yet should it exist: would have the potential to transform privacy on the web. The project is https://github.com/Ayms/node-Tor It's a…

This is a stunningly baffling idea given that any user that has half a clue is using Tor with JS disabled.

I see what you're saying. But there's no reason why you couldn't do the same thing with this design. You can build a basic DOM model that is allowed and only let that portion through. While the outer layer uses Javascript freely to run. You can decide what policy you want before displaying any output.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#37

Post by ivmoreau »

sillystuff wrote: post #25
billconan wrote: post #3

Earlier quoted context omitted.

I have a question, can I use tor as a middleware? for example, can I build a social network with Tor embedded into the client as the network layer?

> Tor embedded into the client This is the most interesting part of this announcement for me: >> You can test Arti ... as an embeddable library (if you don't mind a little API instability). My first thought was adding Tor as a transport for TCP DNS resolution for an existing recursive resolver like unbound. Or, a TOR proxy for DoH public recursive resolvers. Either would result in better privacy than directly using a…

> Too bad rust doesn't really do dynamic linking.

As far as I remember, you can actually do dynamic linking. But it has its caveats.

Maybe using two different crates, lib-internal and lib-external, where lib-internal compiles to an dylib/so that exposes a C-abi compatible interface. Lib-external it’s just a idiomatic Rust wrapper to that api. It’s a little bit wonky, but I’m pretty sure that it can work.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#38

Post by e63f67dd-065b »

anthk wrote: post #28
t6jvcereio wrote: post #13

It seems the Rust people are especially prone to re implementing things. Nothing is really created, just reimplemented.

So like Unix with C being rewritten in that language instead of the original one written in PDP11 assembler for portability. Now people rewrites things in Rust for security. It's good, but I think it can be worse; it may make "lazy" programmers and if some bug it's discovered in the Rust runtime, everyone will be equally f*cked.

One of the explicit goals of rust is that it doesn’t have a runtime, so I’m not sure what you mean. If there’s a bug in rustc then we’re about as fucked as a bug in clang or gcc, so I’m not sure how that’s worse.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#39

Post by adrianN »

billconan wrote: post #3
mmastrac wrote: post #2

This project has come a long way, very fast. Great work to all involved. The biggest security holes in Tor are most likely going to be from the browser going forward. Hardening the browser is tough, but that's a win for everyone (including those not using Tor). This sentiment was one that I shared in my Rust work: > the pickiness of the compiler has been a great boon. Generally speaking, if our Rust code compiles and…

I have a question, can I use tor as a middleware? for example, can I build a social network with Tor embedded into the client as the network layer?

More interesting than a social network is imo applying Tor for IoT. IoT devices suck because they all talk to some mothership and to talk to your own device you have to connect to a third party server. With Tor you can just run a hidden service and the Tor network does all the difficult things for you.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#40

Post by adrianN »

anthk wrote: post #29
db65edfc7996 wrote: post #15

Earlier quoted context omitted.

I am happy for most software to move from C into almost anything else. Something unlikely to have memory exploits, or with standardized tooling for dependency management and compilation.

Plan9/9front uses C but... - There are no dynamic binaries. Everything it's static. But binaries and the userland are tiny and usable. - Cross compile it's dumb easy. [0-9]c, one number per arch. - Every OS comes with compilers, libraries and sources for every arch. - Security it's handled by separated modules, a password/login daemon/server and namespaces. Totally different. That will be the future in 10 years, and…

The kind of "security" that you get by using a safer language like Rust (instead of C), can't be achieved by using anything that can be described as a "module" in an unsafe language.
Post reply on HN