Google funds an auto-update for Vidalia

Google is funding a project to create an auto-update feature in Vidalia. This auto-update feature will provide a better user experience for Tor users. The goal is to create a system where Vidalia can detect when a new release is available, fetch the package, verify authenticity, and assist the user in upgrading the Vidalia/Tor package. The auto-update feature preserves the user's privacy and anonymity. Over the next six months we'll develop the auto-update system for general release around November 15, 2008.

We're excited to work with Google on this project and look forward to the collaboration.

Just curious, any chance one

Just curious, any chance one could use sparkle (http://sparkle.andymatuschak.org/) for the OSX side?

From sparkle main page...
"Sparkle can install .pkg files for more complicated products."

This would be really cool.

BTW: the CAPTCHA sucks, It does not work over tor!

yes it does

the captcha works fine over tor.

sparkle is osx only? and not open source?

hey sounds good to me, many

hey sounds good to me, many Windows users can already use the Vidalia bundle to easily run Tor, but having an auto-update feature would be the icing on the cake!

btw the CAPTCHA shows up fine for me using Tor, it is currently the "What is the ___ word in the phrase ____ ?" type.

You guys are seriously

You guys are seriously starting to work with google, one of the companies, known to be collecting and storing as many information as possible of everyone ever having used their searchmachine?
Are you crazy? Have you been bribed?
To me this sounds more than ridiculous, since Google still refuses to stop their "information-collecting-behaviour", and also refuses to give any information about what exactly they are doing with all the information having been stored by them over the years!
Besides, Google resides in the US, which is one of the leading countries giving a shit on "privacy" and "anonymity".
This is like the guard inviting the thief to work with each other.

If TOR users are not able to update their clients themselves, they should not use programs as TOR, but rather stick to all the prgrams that offer everything possible to automate -and also hide- as much as possible and help make/keep the users minor and dependent.
Thank you guys, that was it for me concerning TOR.
What a pitty.

Strange Bedfellows? Hardly...

I actually initiated and helped to arrange this sponsorship, and I am about as ardent an opponent to long term tracking, profiling, and dragnet surveillance as you can get (see my Defcon 15 bio, for instance).

I initiated it because I do not believe that Google and Tor need be enemies. In fact, I believe we are in a position to be quite symbiotic, providing people with the opportunity to opt-out of censorship and surveillance that would otherwise reduce their Google usage due to chill and concerns over tracking.

Many Google users (in the USA and abroad) either cannot use Google effectively to conduct their work because certain arbitrary words are blocked by content filters put in place by their employers, schools, and governments; or they are concerned about privacy and would like to keep some queries disassociated from their Google accounts.

These users can still provide revenue for Google via adwords, but the advances in the new Torbutton extension prevent all known methods of long term correlation, tracking, profiling, and fingerprinting (see the Torbutton design document for technical details). This is the line we have drawn with code that is open and auditable: "Revenue is OK, long term tracking is not."

These users are also in a position where continual changes to censorship filters are going to necessitate a secure, automatic update process to keep their Tor clients connected and ahead of the censors. They will often be unable to access the main Tor website and many of its mirrors to perform updates themselves, and will need assistance by the software. The updates will be authenticated, anonymized, will not be tracked or logged, and likely won't even be hosted by Google (unless they decide they would like to run a mirror that fits these requirements, and that will likely require extended evaluation on our part).

Because of this balance and our shared interests, it makes perfect economic and social sense for Google to sponsor Tor, and for Tor to accept this sponsorship. Enlightened self-interest is a wonderful thing ;)

Dear anonymous person, Are

Dear anonymous person,

Are you sure you understood the post? Google is not funding us to stop working on privacy, to weaken our privacy, to endorse Google, to endorse their policies, to endorse their search engine, or to do anything anti-privacy. We would not take such funding from anybody if it were offered.

On the other hand, we will take funding to spend on developers to make Tor better, and that's what's been offered here. Google has been quite helpful to the open source world in the past. Have you heard of the Summer of Code program? This is the Tor Project's second year of participating in that, and contrary to what it seems you're suggesting, it hasn't made us stop supporting privacy.

>Besides, Google resides in the US, which is one of the leading countries giving a shit on "privacy" and "anonymity".

It sounds like you're proposing a funding model where, if we have any points of disagreement with a company or individual, or even if we do not like the policies of the country in which they reside, we do not accept help from them.

This would certainly make our project more appealing to people who believe that every incidence of funding constitutes an unconditional mutual endorsement, but it has a problem: we would be able to do almost no development at all.

>If TOR users are not able to update their clients themselves, they should not use programs as TOR, but rather stick to all the prgrams that offer everything possible to automate -and also hide- as much as possible and help make/keep the users minor and dependent.

Aside from the moral issues involved in giving up on helping people if they aren't good at computers, this suggestion would be bad for anonymity. Remember, anonymity systems like Tor hide users among other users. Dividing users into "power users" and "everybody else", and helping only the power users, would create a much smaller network population, and making the network population smaller makes it less anonymous. For more information, you might want to read Anonymity loves company: usability and the network effect.

yrs,
-Nick

umm, no

read the details fool, they took google's money, not their evil bit.

Why Google + Tor makes sense

I see at least one reason why supporting Tor makes sense for Google.

Say, Google isn't entirely evil and wants to provide some way to use its services anonymously, for those who need it. The problem is, they _have to_ record certain data under European data retention laws, whether they want it or not. (For example, German data retention law requires forum operators to track IPs of all posters, which means Google Groups _must_ keep record of all IPs. Failure to do so may result in criminal prosecution).
Tor, on the other hand, provides Google with a completely legal way to allow anonymous use: they fulfill their obligations by law (IP log is kept) but the poster remains anonymous.

I know a number of European forums and Usenet providers advising to use Tor for this exact reason: they warn users about logs they _must_ keep, and recommend to use Tor for those willing to stay anonymous.

No, two major corrections

1. Germany is not presently enforcing such a law. JonDos is a law-abiding German company, and the privacy policy of their website, which includes a forum, is very friendly. That said, there is a data retention law entering the enforcement stage in January. I am unclear on how strict it will be. In any case JonDos and the German Privacy Foundation are planning legal action against the law.

2. The European Union has actually pressured Google to improve it's privacy policies. See:
Privacy bodies back Google step
Google Privacy Policy Questions by European Union
EU: Google Privacy Changes 'Not Enough'

What a pitty too

Youtube a company of google had had censured video of some pages in sudamerica! This is weird for me too!

http://www.rebelion.org/noticia.php?id=68244&titular=usuarios-denuncian-...

http://www.rebelion.org/noticia.php?id=52114

do we need to have a google

do we need to have a google account to use the auto update feature?

No.

No.

Google

I am rather new to Tor and do not know its history and various stages of development. In any case, I am probably stating the obvious but here goes........

Based upon what I have seen forming around us though, I would read the first three words and stop.
"Google is funding"

So what has happened here? The people that maintain and update the Tor software probably did so gladly for a while. They realized they needed money, probably asked for donations and nobody participated. The people maintaining Tor were disappointed.

Meanwhile.......
Google has a "fit" when you visit it with Tor. It doesn't know what to do! Captcha this and "sorry about that" and whatever whatever.

So, Google got angry. "How dare these little pinheads? We'll make them an offer they can't refuse."

So the Tor people were approached. "But we have to maintain privacy! We cannot sacrifice that" they cried.

"Yeah, yeah take the money and shut the hell up" Google replied.
"We'll help you with the crap to post on your site so again just take the money and shut up."

And as you all know that is what happened. It gets "glossed over".

Looking forward, what will happen is that many will leave Tor. Once the "takeover" is forgotten a new generation of privacy seekers will download Tor thinking it is what it once was. Those able to tell the difference will have been pushed farther and farther to the fringes until they are eventually using smoke signals to communicate. At which point of course, smoke signals will be taken to court and sued because they damage the environment.

At this juncture, people have to realize that the average person "knows too much" This has happened because of the Internet.
It is only natural that the last bastion of freedom (aside from living on a deserted island or remote mountain) will be attacked.

You mean the ignorant paranoids might finally LEAVE?? REALLY??

Woah, you're telling me that all Tor has to do is accept money from Google and all the crazies and paranoids will go somewhere else? Holy shit. Maybe or-talk will become usable again and people will think and read before posting insane drivel.

Fuck, I know a couple of people who work for Google already. I bet I can get them to give the Tor devs $5 each right now if it meant Tor might have a reasonable mailinglist and blog forum.

Why didn't the devs think of this earlier?? Pure genius!

Oh yeah..... We can't forget

Oh yeah.....
We can't forget that very soon after the release of the new "Google-ized" software, the old software ("non-Googlized") will be steered towards a timely death.

"Download the new TOR! The best, fastest and safest version is here!"

Eventually we will all wind up on youtube for our daily spelling lessons. In reality even if you do know how to spell, you forget what you know after reading some of those posts.

Besides, the people maintaining Tor were/are more than capable of creating their own auto-update feature and didn't need Google funding to do so.

We all need money to live and we all have dreams of being prosperous, successful and happy. This, however, is not accomplished by selling your soul to the devil. We never appreciate what we have until we lose it.

Google and Tor

If google is so beneficent, why are there so many addons for firefox to eliminate its tracking features? We don't have to be fully paid up members of the tinfoil hat brigade to be suspicious of this proposal.

Once Tor joins up with google, it will have lost its edge. Who will google try to buy out next? FoxyProxy? Or why not join up with Special Branch and the CIA to log every single use of Tor?

Good luck!

Perhaps you misread the

Perhaps you misread the post, here's a fine, sane comment on the situation:
https://blog.torproject.org/blog/google-funds-auto-update-vidalia#commen...

@#$@!#$@!~# TOR

People abusing websites using TOR to keep getting in.

And now you want money to help enable this - screw that. I wonder how long this will stay up since TOR seems to think helping this sort of crap happening to other sites is no big deal.

Here is an idea - give us website owners a way to BLOCK TOR users that are causing problems. Otherwise get bent.

Re: @#$@!#$@!~# TOR

How about just allow us to

How about just allow us to come to you and get exempted from your customers. I've only got one guy coming from TOR out of nearly 20,000. So a place that says "keep TOR off my server" and keep us from having to deal with the headaches you cause.

Seems like a reasonable request to me.

Sort of like the "no call"

Sort of like the "no call" list for marketers. I like that idea.

Me toooo!!

Yeah, I third the nomination. Where can I inform the millions of open proxy operators while I'm at it? Will the Tor project please volunteer to contact them for me as well? It would be really nice if they would. One less thing for me to deal with.

And this whole Internet thing. I hate it when it sends packets to me. If only someone would provide me with a list of all the IP addresses so I could ask ARIN to contact them all for me. That sure would make my life easier.

Or better still, can't we just shut 'er down?

I support Tor

I support Tor for the same reason you are against it. Web site abuse goes both ways. I use it to gain access to the DemocraticUnderground site that will ban you by IP address the instant that you question ANYONE's stupid liberal (lack of) logic.

Or how about TOR quit acting

Or how about TOR quit acting like they don't help people create issues when they know they do. And quit hiding behind their product by being so sanctimonious. How long until backlash starts? I saw that Wikapedia is getting fed up with them - how long until Youtube, Vbulletin, and others start trying to come up with ways to totally shut out TOR because TOR thinks they are not creating an issue at all?

Sure - act like you are just providing a nice service while you are really making it easy for some no-tallent hack to continue to bypass security on sites run by the other average joe that doesn't want to try to get a Phd in Computer Science to shut out some of the worst idiots on our sites that have downloaded TOR

Thanks for the sarcasm there fucktard

Are you really still posting?

Your position wasn't being ignored. Maybe you just have trouble reading?

Didn't someone already give you this information:

https://www.torproject.org/faq-abuse.html.en#Bans
https://www.torproject.org/tordnsel/

I think the sarcasm was directed at you because you're not paying any attention and seem to just want to complain about technology. Tor is not your problem, your system is.

As soon as you ban Tor, your troll(s) will just download FoxyProxy and use it with one of those lists the other poster gave. Heck, it even has its own lists! What will you do then? Tell the FoxyProxy author he's destroying the Internet? Or maybe you'll blame Firefox next for supporting proxies.

So how about you devote your energy to a real solution for dealing with trolls. Maybe require each user to have an email account and go through a waiting period before contributing content. The best way to stop trolls is to make it boring and slow for them to get reaction. Or even better, some CMS's have "Troll" modules that allow you to make a Troll's posts only visible to them. Do this with a few accounts your troll has created and they will quickly get bored without the reaction and move on.

Or just use the provided tools to ban Tor users from posting. That's what they're there for. But good luck if your troll finds an open proxy list..

Freespeech is definitely

Freespeech is definitely more important than the bottom line.
I would rather lose all my clients from hacking attempts, than lose my freedom.

Why Not More Profile for ToR on Privacy Sites?

I stumbled upon TOR by accident and wonder, if it offers as much protection as it sounds, why is it not profiled on more sites like http://www.cogipas.com/ or http://www.privacyresources.org/ ? Cheers!

Post new comment

The content of this field is kept private and will not be shown publicly.
CAPTCHA
This question is for testing whether you are a human visitor and to prevent automated spam submissions.
Copy the characters (respecting upper/lower case) from the image.