analysis | Tor Blog

Some thoughts on Hidden Services

Hi! Nick here.

52 comments

New OpenSSL vulnerability; Tor not affected

There's a new buffer overflow vulnerability in versions of OpenSSL from 0.9.8f through 0.9.8o, and 1.0.0 through 1.0.0a.

Upcoming Events

May 26, 2021

PrivChat #4 - 25th Anniversary of Onion Routing

To celebrate the 25th anniversary of the academic publication of onion routing, we're holding PrivChat #4 on May 26 at 18:00 UTC with host Gabriella Coleman and panelists Roger Dingledine and Nick Mathewson. Stay tuned for more details!

June 07, 2021 - June 11, 2021

Rightscon (with Tor panel!)

July 12, 2021 - July 16, 2021

Privacy Enhancing Technologies Symposium (PETS)

August 27, 2021

Free and Open Communications on the Internet (FOCI) workshop

See All Upcoming Events

Recent Updates

Dreaming At Dusk

New release: Tor 0.4.5.8

We have a new stable release today. If you build Tor from source, you can download the source code for Tor 0.4.5.8 on the download page. Packages should be available within the next several weeks, with a new Tor Browser likely next week.

Tor 0.4.5.8 fixes several bugs in earlier version, backporting fixes from the 0.4.6.x series.

Changes in version 0.4.5.8 - 2021-05-10

Minor features (compatibility, Linux seccomp sandbox, backport from 0.4.6.3-rc):
- Add a workaround to enable the Linux sandbox to work correctly with Glibc 2.33. This version of Glibc has started using the fstatat() system call, which previously our sandbox did not allow. Closes ticket 40382; see the ticket for a discussion of trade-offs.
Minor features (compilation, backport from 0.4.6.3-rc):
- Make the autoconf script build correctly with autoconf versions 2.70 and later. Closes part of ticket 40335.

New release candidate: Tor 0.4.6.3-rc

There's a new release candidate available for download. If you build Tor from source, you can download the source code for Tor 0.4.6.3-rc from the download page on the website. Packages should be available over the coming weeks, with a new Tor Browser release likely next week.

Tor 0.4.6.3-rc is the first release candidate in its series. It fixes a few small bugs from previous versions, and adds a better error message when trying to use (no longer supported) v2 onion services.

Though we anticipate that we'll be doing a bit more clean-up between now and the stable release, we expect that our remaining changes will be fairly simple. There will likely be at least one more release candidate before 0.4.6.x is stable.

Changes in version 0.4.6.3-rc - 2021-05-10

Major bugfixes (onion service, control port):
- Make the ADD_ONION command properly configure client authorization. Before this fix, the created onion failed to add the client(s). Fixes bug 40378; bugfix on 0.4.6.1-alpha.
Minor features (compatibility, Linux seccomp sandbox):
- Add a workaround to enable the Linux sandbox to work correctly with Glibc 2.33. This version of Glibc has started using the fstatat() system call, which previously our sandbox did not allow. Closes ticket 40382; see the ticket for a discussion of trade-offs.

Check the status of Tor services with status.torproject.org

The Tor Project now has a status page which shows the state of our major services.