Live data from Hacker News

Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

blog.torproject.org

41–50 of 67 posts

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#41

Earlier quoted context omitted.

> Tor embedded into the client This is the most interesting part of this announcement for me: >> You can test Arti ... as an embeddable library (if you don't mind a little API instability). My first thought was adding Tor as a transport for TCP DNS resolution for an existing recursive resolver like unbound. Or, a TOR proxy for DoH public recursive resolvers. Either would result in better privacy than directly using a…

> Too bad rust doesn't really do dynamic linking. As far as I remember, you can actually do dynamic linking. But it has its caveats. Maybe using two different crates, lib-internal and lib-external, where lib-internal compiles to an dylib/so that exposes a C-abi compatible interface. Lib-external it’s just a idiomatic Rust wrapper to that api. It’s a little bit wonky, but I’m pretty sure that it can work.

Apparently there is a dynamic linking ABI for Rust too, but it is not stable enough to use yet for distros like Debian.

https://wiki.debian.org/StaticLinking#Rust https://lwn.net/Articles/797616/ https://github.com/rust-lang/rfcs/pull/2603

I note that the PR for Rust symbol mangling got merged, but it looks like it isn't the default yet, they are waiting on external tools supporting it.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#42
post #28

Earlier quoted context omitted.

So like Unix with C being rewritten in that language instead of the original one written in PDP11 assembler for portability. Now people rewrites things in Rust for security. It's good, but I think it can be worse; it may make "lazy" programmers and if some bug it's discovered in the Rust runtime, everyone will be equally f*cked.

One of the explicit goals of rust is that it doesn’t have a runtime, so I’m not sure what you mean. If there’s a bug in rustc then we’re about as fucked as a bug in clang or gcc, so I’m not sure how that’s worse.

and it's worth noting that this isn't hypothetical. the c standard is somewhat unclear and contradictory, and as such no two c compilers fully agree with each other on what the standard actually means.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#43

Earlier quoted context omitted.

> Tor embedded into the client This is the most interesting part of this announcement for me: >> You can test Arti ... as an embeddable library (if you don't mind a little API instability). My first thought was adding Tor as a transport for TCP DNS resolution for an existing recursive resolver like unbound. Or, a TOR proxy for DoH public recursive resolvers. Either would result in better privacy than directly using a…

> Too bad rust doesn't really do dynamic linking. As far as I remember, you can actually do dynamic linking. But it has its caveats. Maybe using two different crates, lib-internal and lib-external, where lib-internal compiles to an dylib/so that exposes a C-abi compatible interface. Lib-external it’s just a idiomatic Rust wrapper to that api. It’s a little bit wonky, but I’m pretty sure that it can work.

> It’s a little bit wonky, but I’m pretty sure that it can work.

Not that wonky, it's really a natural consequence of the fact that Rust's stable ABI is the C ABI. Plus you can then use lib-internal from any language that supports FFI to C, not just from Rust.

(Of course, some things just cannot be supported across a dylib boundary, such as arbitrary monomorphized code. But this limitation applies to all such languages; it's why you have "header-only" libraries in C/C++ for example.)

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#45
post #21

To me this just seems pointless because an implementation in Rust is going to have similar features to one in C, Java, Python, or any of the handful of languages where Tor already exists... I want to rep another project that I think would be more relevant to Tor's goals. It is unfunded yet should it exist: would have the potential to transform privacy on the web. The project is https://github.com/Ayms/node-Tor It's a…

You could compile the rust version to WASM and run it in browser.

The issues preventing this from happening are actually tracked in the Arti repository.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#46
post #16

It's interesting that the funding for this came from the Zcash Community Grants. There's a lot of money involved with cryptocurrency and a lot of it gets invested into the software involved. It's interesting that in this case, serious money got invested into some software that isn't strictly cryptocurrency-related and is useful outside of cryptocurrency. It makes me wonder if there are other software projects that ar…

That is probably because Zcash is a privacy tool that just happens to be a cryptocurrency. Snowden was one of the co-founders of the project.

The users are people that rely on the security to stay out of prison, not crypto-bros trying to get rich quick.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#47
post #2

This project has come a long way, very fast. Great work to all involved. The biggest security holes in Tor are most likely going to be from the browser going forward. Hardening the browser is tough, but that's a win for everyone (including those not using Tor). This sentiment was one that I shared in my Rust work: > the pickiness of the compiler has been a great boon. Generally speaking, if our Rust code compiles and…

I have a question, can I use tor as a middleware? for example, can I build a social network with Tor embedded into the client as the network layer?

Absolutely, in the past I was using the proxy that Tor opens and just set up IRC to connect through it. The browser is just one application using it.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#48
post #16

It's interesting that the funding for this came from the Zcash Community Grants. There's a lot of money involved with cryptocurrency and a lot of it gets invested into the software involved. It's interesting that in this case, serious money got invested into some software that isn't strictly cryptocurrency-related and is useful outside of cryptocurrency. It makes me wonder if there are other software projects that ar…

That is probably because Zcash is a privacy tool that just happens to be a cryptocurrency. Snowden was one of the co-founders of the project. The users are people that rely on the security to stay out of prison, not crypto-bros trying to get rich quick.

Snowden was part of the initial ceremony, along with some other crypto experts. Not sure that qualifies him as co-founder

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#49

It seems the Rust people are especially prone to re implementing things. Nothing is really created, just reimplemented.

I'd be fascinated to hear examples of what you think of as "new" and not a reimplmentation. Because the entirety of human history is learning from others, improving it and releasing that as a new invention. All of us stand on the shoulders of giants whenever we do anything.

Databases, text editors, network protocol implementations, GUI frameworks, command line argument parsers, game engines, search engines, build tools - no matter what program is written in any language, there is a program written elsewhere in another language that inspired and informed it.

That's not a knock on the new language, it's just stating a simple fact about human beings.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#50
post #20
post #16

It's interesting that the funding for this came from the Zcash Community Grants. There's a lot of money involved with cryptocurrency and a lot of it gets invested into the software involved. It's interesting that in this case, serious money got invested into some software that isn't strictly cryptocurrency-related and is useful outside of cryptocurrency. It makes me wonder if there are other software projects that ar…

I think .attic has benefited from such an event as well: https://matrix.org/blog/2018/01/29/status-partners-up-with-n...

*matrix
Post reply on HN