A New Era at the Tor Project | Hacker News Reader

A New Era at the Tor Project

blog.torproject.org

157 pointsehPReth44 comments

"Although we are sad to see Andrew leave, Tor is entering an exciting period of growth. "

Why not stop at Andrew is leaving? The whole "exciting period of growth" thing feels tacked on and forced. Reminds me of the type of stuff managers say after a layoff.

Just wait until "it's been an incredible journey".

Is he going to spend more time with his family?

He feels that there are so many great opportunities out there, but his is going to take some time to decide which one to focus on. The timing just felt right.

This seems more to me like a small announcement about a tor staff member leaving.

Clickbait title = front page of HN.

I guess it would have been nice if they at least hinted at what these new directions may be?

As it was, it came off identically to a Fortune 500 press release about the CEO moving on.

EFF-related announcements often have that "Fortune 500 press release" feel to them.

I wonder if that's a natural result of EFF being a lawyer-heavy organization.

This is Tor, not EFF.

EFF is a major sponsor of Tor, and writes a lot of legal documents related to Tor.

Perhaps this is a hint. Something is amiss in the Tor project?

Infiltrated perhaps? Backdoored? Even worse? All they can do is throw this CEO moving on shit.

If you assume that there actually is no issue at Tor, how would the message be different? This could just be that the top guy is leaving, and this is their way of reassuring that it's still business as usual, and everything _isn't_ falling apart.

Of course that's the sort of message that you write if it is falling apart as well, so I guess this is basically a contentless press release on that part.

This, ladies and gentlemen, is what paranoia looks like.

It's not paranoia if it's true.

But it's not, is it? Unless there can be some proof of the said backdoor.

I don't get how a person - even though he is the Executive Director - moving on can co-relate to a "backdoor" in a project that puts all its code online and does deterministic builds.

I don't know. Is it?

I didn't know Tor had an Executive Director. Looking now at their staff list [0], I'm now unsure about how they have the money to support all these employees. All I see is a donate button.

[0] https://www.torproject.org/about/corepeople.html.en

Tor is funded at least partly by the U.S. government.

https://www.torproject.org/about/sponsors.html.en

See:

* Radio Free Asia

* US Department of State Bureau of Democracy, Human Rights, and Labor

* Naval Research Laboratory

A fact that in light of all the stuff in the last few years is doubly hilarious.

I've read that the primary motivation is to allow intelligence assets in other countries to communicate with the agencies they work for.

https://www.evernote.com/shard/s1/sh/96791ee9-98d5-44a0-b0a9...

It's well known that Tor is vulnerable to traffic analysis by an adversary that can basically monitor the entire internet. In the past, this was considered impractical, but now we know the NSA does something like this. Since this is inherent in its design, that means it doesn't really matter if it's funded by the US government, because they don't even need to weaken it in the first place.

Not to say that funding diversity wouldn't be a good thing, but there's no particular reason to think Tor is broken any more than is already known because of where the money currently comes from.

What about I2P?

I2P claims to try to defend against large scale traffic analysis, but they are a underfunded project with few contributors. There was some mention of implementing cover traffic which would solve the issue (at the cost of massively increasing traffic), but I don't think that's happened yet.

I2P, being fully decentralised, is also very vulnerable to a sybil attack. Join thousands of nodes to the network, wait until you are strategically placed, then follow the traffic streams routed through your nodes.

Of course, sybil attacks are a concern in any open network. In theory the tor directory authorities are able to deny new nodes so they have some recourse, but in practice if you stagger your new nodes you can still infiltrate the network. :/

The fact is, anonymity systems are a hard and unsolved problem. That's not due to the source of the funding. We take what we get.

If you find this fact concerning, please donate to the Tor project.

"The organization consists of many volunteers and a few employees."

It's a 501(c)(3) organisation so you should be able to see for yourself. I'm not a USian so don't know how to pull them out, would be very interested to know.

They have publicly posted financial reports: https://www.torproject.org/about/financials.html.en

IRS form 990 will tell you a 501c3's finances, they are required to release it annually.

Also Tor Project is available on http://smile.amazon.com and almost every purchase you make they will receive 0.5% of the total as long as you make it through the smile subdomain.

http://pando.com/2014/07/16/tor-spooks/

Please, if you have to paste something, at least don't paste the absolutely ludicrous Pando article, which has been debunked many many times. It does nothing but say that Tor is compromised just because it was funded by the government.

Please paste the link which debunks Pando's thesis. I'd like to read.

http://blog.erratasec.com/2014/11/the-pando-tor-conspiracy-t...

https://micahflee.com/2014/12/fact-checking-pandos-smears-ag...

> Andrew Lewman, our current Executive Director, is leaving The Tor Project to take a position at an Internet services company.

Anyone know the name/type of the company? I'm really curious. Hoping it's an ISP or MVNO or some other space that needs good people like him

Networking Services of America

Sadly, tor is Not Secure Anymore.

Citation needed.

TOR has never been "secure". Everyone running an exit-node can intercept all communications going through that node, and since everyone can run an exit-node... So, you always had to take care that you use encryption when using TOR. In Terms of anonymity though TOR seems still to bug NSA and the likes.

Apples and oranges. All I want is anonymity, I am fine with the exit seeing things as it does not know who I am.

Tor, not TOR.

SSL. Also, all ISPs can do this.

I find it really surprising and frustrating how many paranoid/cynical posts are in this thread.

* Is this a hint that Tor has been infiltrated?"

* "So sad to see the organization become so self-centered"

None of these comments have any basis in the story!

Such a sad announcement.

Organizations like this and the Bitcoin Foundation eventually become so self-centered they start to undermine the work of all past contributors.

Hope the community works around these issues.

I rather like the idea that someone from Tor is going to be working at an ISP. If everyone who worked at ISPs shared ideals with the Tor project, perhaps the Internet would be a better place.

Reply on news.ycombinator.com