We're excited to announce that Snowflake will be shipped as one of the default bridge options with stable versions of Tor Browser later this month. Snowflake is a pluggable transport that uses a combination of domain fronting and peer-to-peer WebRTC connections between clients and volunteers to circumvent Internet censorship.
Every June, we recognize Pride month because internet freedom and the human rights of LGBTQIA+ people go hand in hand. Many LGBTQIA+ people need privacy and censorship circumvention tools like Tor to communicate with their peers, find important resources, or fight for their rights without facing violence.
After months of work, we have a new stable release series! If you build Tor from source, you can download the source code for 0.4.6.5 on the download page. Packages should be available within the next several weeks, with a new Tor Browser around the end of the week.
Because this release includes security fixes, we are also releasing updates for our other supported releases. You can find their source at https://dist.torproject.org:
- 0.3.5.15 (gpg signature) (ChangeLog)
- 0.4.4.9 (gpg signature) (ChangeLog) [Note that 0.4.4.9 hits end-of-life tomorrow; this is the last supported 0.4.4.9 release.]
- 0.4.5.9 (gpg signature) (ChangeLog)
Tor 0.4.6.5 is the first stable release in its series. The 0.4.6.x series includes numerous features and bugfixes, including a significant improvement to our circuit timeout algorithm that should improve observed client performance, and a way for relays to report when they are overloaded.
This release also includes security fixes for several security issues, including a denial-of-service attack against onion service clients, and another denial-of-service attack against relays. Everybody should upgrade to one of 0.3.5.15, 0.4.4.9, 0.4.5.9, or 0.4.6.5.
Below are the changes since 0.4.5.8. For a list of changes since 0.4.6.4-rc, see the ChangeLog file.
Changes in version 0.4.6.5 - 2021-06-14
- Major bugfixes (security):
- Don't allow relays to spoof RELAY_END or RELAY_RESOLVED cell on half-closed streams. Previously, clients failed to validate which hop sent these cells: this would allow a relay on a circuit to end a stream that wasn't actually built with it. Fixes bug 40389; bugfix on 0.3.5.1-alpha. This issue is also tracked as TROVE-2021- 003 and CVE-2021-34548.
- Major bugfixes (security, defense-in-depth):
- Detect more failure conditions from the OpenSSL RNG code. Previously, we would detect errors from a missing RNG implementation, but not failures from the RNG code itself. Fortunately, it appears those failures do not happen in practice when Tor is using OpenSSL's default RNG implementation. Fixes bug 40390; bugfix on 0.2.8.1-alpha. This issue is also tracked as TROVE-2021-004. Reported by Jann Horn at Google's Project Zero.
In mid-May, the Tor Project held a nonfungible token (NFT) auction of a generative art piece we called Dreaming at Dusk, created by artist Itzel Yard (ixshells) and derived from the private key of the first onion service, Dusk.
This action was held on Foundation and resulted in a final bid of 500 Ethereum (ETH), roughly $2M USD at the time of the auction, with the proceeds going towards the Tor Project and our work to improve and promote Tor.
There's a new release candidate available for download. If you build Tor from source, you can download the source code for 0.4.6.4-rc from the download page on the website. Packages should be available over the coming weeks, with a new alpha Tor Browser release likely next week.
Remember, this is a not a stable release yet: but we still hope that people will try it out and look for bugs before the official stable release comes out in June.
Tor 0.4.6.4-rc fixes a few bugs from previous releases. This, we hope, the final release candidate in its series: unless major new issues are found, the next release will be stable.
Changes in version 0.4.6.4-rc - 2021-05-28
- Minor features (compatibility):
- Remove an assertion function related to TLS renegotiation. It was used nowhere outside the unit tests, and it was breaking compilation with recent alpha releases of OpenSSL 3.0.0. Closes ticket 40399.
- Minor bugfixes (consensus handling):
- Avoid a set of bugs that could be caused by inconsistently preferring an out-of-date consensus stored in a stale directory cache over a more recent one stored on disk as the latest consensus. Fixes bug 40375; bugfix on 0.3.1.1-alpha.
We are excited to announce that three new members are joining the Tor Project’s Board of Directors: Alissa Cooper, Desigan (Dees) Chinniah, and Kendra Albert! Each new member comes to Tor with a different set of expertise that will help the organization and our community. At the end of this post, you can read each of their bios.
Welcome to the onion space. We've been here since 2014, and we grow every day. In a few months, some onions will rot, while others will blossom. Dusk was the first onion; now there are hundreds of thousands. In an entirely different corner of the universe, where smart contracts thrive, Dusk is being auctioned. You can bid for it by interacting with functions living in a chain of blocks.