Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oniux: Kernel-level Tor isolation for any Linux app

blog.torproject.org

Post reply on HN
Print view View original

41–50 of 54 posts

Re: Oniux: Kernel-level Tor isolation for any Linux app

#41

Post by mike-cardwell »

Hmm. I assumed this worked like torsocks in that it would direct traffic through the locally running tor daemon. However, I've noticed that if I stop the locally running tor daemon, oniux still works whilst torify and torsocks do not. [edit] The documentation does actually say this. Pretty neat.

It works inside docker as well, but I needed to use --privileged. Just copied the binary into a debian:12 container and it works there:

  docker run -it --rm --privileged -v "$PWD/oniux:/usr/bin/oniux" debian:12

Re: Oniux: Kernel-level Tor isolation for any Linux app

#42

Post by jeroenhd »

kyguy23 wrote: post #19
ahmedfromtunis wrote: post #11

Does this mean one can now access tor websites using chrome?

You can, but please don’t do this, you’ll stick out even more! Tor browser has a series of anti fingerprinting strategies that chrome doesn’t

I don't think anonimity is a concern for people who still use Chrome at this point.

It does allow accessing onion sites, though, even though anyone running an onion site will probably tell you that it's a terrible idea to use plain Chrome to access them.

Re: Oniux: Kernel-level Tor isolation for any Linux app

#43

Post by 47282847 »

charcircuit wrote: post #3
ericfrederich wrote: post #2

They use hexchat as an example but do these processes run with the users configuration? Wouldn't this leak IRC usernames if you forget to change it. ... Or leak cookies if you launch a browser?

What do you mean by leak usernames? It would leaks that a username uses tor. It would still leak that all of the usernames connecting to the same IRC host would be the same person. IRC seems pretty dangerous if you want to remaining anonymous considering how many people are logging disconnection times allowing them to be correlated with other network disruption events.

Tor is anonymizing you primarily from the network. There are many use cases where you do want to be authenticated/known to whoever you are talking to. You just want observers to not know.

In your example of correlation of connection times, it may not be your goal to remain anonymous from the network and its participants, you may be interested in the location-hiding properties, and/or adversarial networks (like local government or corporate networks) and firewalls.

Re: Oniux: Kernel-level Tor isolation for any Linux app

#45

Post by yencabulator »

natmaka wrote: post #13

Isn't all this reserved to TCP, in other words in which way may it protect non-TCP activity?

I don't know the details, but https://gitlab.torproject.org/tpo/core/onionmasq says

> This project is an attempt to implement a simple user-space network stack that can handle TCP *and UDP* state such that it is possible to forward the traffic into the Tor network.

Re: Oniux: Kernel-level Tor isolation for any Linux app

#46

Post by yencabulator »

mike-cardwell wrote: post #41

Hmm. I assumed this worked like torsocks in that it would direct traffic through the locally running tor daemon. However, I've noticed that if I stop the locally running tor daemon, oniux still works whilst torify and torsocks do not. [edit] The documentation does actually say this. Pretty neat. It works inside docker as well, but I needed to use --privileged. Just copied the binary into a debian:12 container and it…

I would assume this uses the Rust rewrite as a library, not the older C daemon.

https://tpo.pages.torproject.net/core/arti/

Re: Oniux: Kernel-level Tor isolation for any Linux app

#47

Post by Aissen »

Fun fact, this has been broken with curl for 5 years (and so are the blog examples), because Tor developers previously insisted that apps shouldn't attempt to resolve .onion domain names: https://daniel.haxx.se/blog/2025/05/16/leeks-and-leaks/

I hope they can find a resolution.

Re: Oniux: Kernel-level Tor isolation for any Linux app

#49

Post by FrostKiwi »

mmooss wrote: post #44
natmaka wrote: post #13

Isn't all this reserved to TCP, in other words in which way may it protect non-TCP activity?

What do Tor Browser users do for YouTube or DNS? Also, what about HTTP/3?

DNS is already done by Tor. In fact, if you feed it a raw IP, it will warn in tor's output that it received an IP, which may indicate that the user has accidentally setup browsing via Tor, but DNS resolution via a normal, unsecured way.

YouTube mainly throttles TOR hard and it's a bit of a fight uphill against a never ending avalanche of Captchas or a straight up service refusal. Bridges solve this, by going through exit nodes that are not publicly listed to be TOR exist nodes. Even with bridges it's still a high chance to trip Google's bot detection.

HTTP/3 is unsupported.

Re: Oniux: Kernel-level Tor isolation for any Linux app

#50

Post by ericfrederich »

01HNNWZ0MV43FF wrote: post #4
charcircuit wrote: post #3

Earlier quoted context omitted.

What do you mean by leak usernames? It would leaks that a username uses tor. It would still leak that all of the usernames connecting to the same IRC host would be the same person. IRC seems pretty dangerous if you want to remaining anonymous considering how many people are logging disconnection times allowing them to be correlated with other network disruption events.

Irssi iirc used to default your username to your system username, so noobs would leak their given name by accident. After seeing that I changed my username in Linux to always be the most common username

I was talking more about you using HexChat with your preferred username "FooBar", but then when on Tor you want to be "SpamEggs". If you launch HexChat through oniux and it reads your config file, you might hit the login button before changing your name from FooBar to SpamEggs.
Post reply on HN