Arti – An implementation of Tor in Rust(blog.torproject.org) |
Arti – An implementation of Tor in Rust(blog.torproject.org) |
>Rust is more secure than C. Despite our efforts, it's all too simple to mess up when using a language that does not enforce memory safety. We estimate that at least half of our tracked security vulnerabilities would have been impossible in Rust, and many of the others would have been very unlikely.
>Arti is cleaner than our C tor implementation. Although we've tried to develop C tor well, we've learned a lot since we started it back in 2002. There are lots of places in the current C codebase where complicated "spaghetti" relationships between different pieces of code make our software needlessly hard to understand and improve.
While it's non-trivial to inspect many aspects of tor traffic, an often used study metric has been the (determinable) percentage of connections to hidden services, which are usually assumed to be disproportionately malicious.
This ranges around ~5% across most studies, the most recent one I can find shows similar results[0].
Results are limited by the inability to account for lawful use of hidden services, but also the percentage of malicious use outside of them.
> Based on data across the CloudFlare network, 94% of requests that we see across the Tor network are per se malicious.
"I could not find any reference to the toolset used to identify the websites being visited by the scanned users. I think this is important for external verification of the validity of the data. If the software is public and known, could the authors reference it? If the code is new, could the authors deposit it along the rest of the code in the OSF repository? This should not be a problem, since the authors do not have any conflict of interest."
[0] https://pubpeer.com/publications/3CE766FE19680525B332FA0004A...
Why is this assumed?
Couple of related questions:
- Does anyone know, in a Linux distro, how to pass all system traffic through a SOCKS proxy port? I'm not looking for intermediary proxy handlers but an official method to force all user and system apps to use an arbitrary port.
- If it is not possible to do so, does `NetworkManager` have a setting for this?
- Is it possible to at least change Chrome/Firefox ports via CLI to an arbitrary port?
https://www.crowdsupply.com/sutajio-kosagi/precursor/updates...
Edit: corrected typo in link
We as society basically have to undo 50 years of going into the wrong direction, without the economical incentives to fix them, rather mitigate their faults.
This would allow global access to services in case of DNS outages, superfluous takedown requests, or anything in between.
Onion service support seems to be TBD, unfortunately.
For anyone wondering what we're talking about:
https://geti2p.net (Official Java implementation)
https://github.com/PurpleI2P/i2pd (C++ implementation)
The unfortunate thing is that, as far as I'm aware, I2P doesn't have a "Tor Browser" of sorts, and most people would want to use I2P as a clearnet proxy; the audience for I2P may always be significantly less than that of Tor even if it was revealed that Tor was totally flawed.
I think that I2P could benefit from selling itself less as a means of anonymity and more as decentralized, censorship-resistant web hosting. The clearnet should then have inproxies to expose I2P sites rather than the other way around, as is the typical use case for Tor. That way you can spin up an I2P instance anywhere, instantly have a web server on a unique address, and have it be available on any number of clearnet inproxy nodes as well as to anyone connected directly to the network.
Having played a lot with I2P recently, I find it more "fun" than using Tor. It lacks in content, but its focus on hidden services (eepsites) and the relatively small number of users is reminiscent of he web back when I first started using it in the 90s. I like that it has a sort of DNS system that is only as centralized as you want it, and that it has a built in way of assigning your own domain aliases. Even if you (the reader) aren't interested in anonymous decentralized networking for any practical reason, I'd say it's worth testing out I2P just to get a kick out of how novel it is.
I guess SOCKS5 handles tcp and udp - so you might get away with redsocks (which explicitly recommends against using with TOR):
https://github.com/darkk/redsocks
See also transocks (SOCKS4 tcp only): https://transocks.sourceforge.net
And transocks (in go) https://github.com/cybozu-go/transocks
Ed: see also https://news.ycombinator.com/item?id=30684574
Combined with ssh's `-D` option, it becomes a powerful ad-hoc VPN tool.
Tor only supports TCP, so you cannot route all traffic over Tor, you will have to drop a bunch.
https://unix.stackexchange.com/questions/166692/how-does-a-t...
A part from tor I don't know if there's a generic tool packaging this.
Never would have imaged that use case.
circumventing censorship and geo-restrictions?
I'm skeptical about their metrics. If I try to access a cloudfare protected site and never manage to finish the infinite captcha look or just change my mind after seeing the captcha, do they consider it a successful block? Even if we think they have some magic way of actually knowing whether all requests are malicious or not:
> That doesn’t mean they are visiting controversial content, but instead that they are automated requests designed to harm our customers. A large percentage of the comment spam, vulnerability scanning, ad click fraud, content scraping, and login scanning comes via the Tor network.
Personally I don't think content scraping and vulnerability scanning are "malicious per se", by that metric even Google (and every other search engine) would be malicious.
FYI, complaining about downvotes violates the HN guidelines.
I never would have imagined SOCKS being used for this use case. There was no such thing as geo-restrictions or censorship at the time on the internet.
- Configure all applications to use Tor with the SOCKS proxy
- Block all non-Tor traffic with iptables