debian | Tor Blog

Tor at the Heart: apt-transport-tor and Debian onions

During the month of December, we're highlighting other organizations and projects that rely on Tor, build on Tor, or are accomplishing their missions better because Tor exists.

44 comments

Debian and Tor Services available as Onion Services

We, the Debian project and the Tor Project are enabling Tor

58 comments

www, archive, ns, and rsync +1

Thanks to Debian for providing a fine server capable of providing redundancy for a number of services.

1 comment

Tails Live System version 0.8 released

On September 21, Tails anonymous live system version 0.8 was released.

Notable user-visible changes include:

14 comments

Security critical Tor-0.2.0.26-rc released

Tor-0.2.0.26-rc replaces several V3 directory authority keys affected by a recent Debian OpenSSL bug

3 comments

Upcoming Events

September 22, 2018

Digital Privacy Expo (Toronto Library)

September 27, 2018

Tor Meetup Ciudad de México

October 02, 2018 - October 03, 2018

Tor's Open Hack Days (Mexico City)

October 04, 2018

Tormenta: diálogos feministas para las libertades y autocuidados

October 23, 2018

Embracing the Dark Web as a Tool for Privacy and Anti-Censorship (Yale)

See All Upcoming Events

Recent Updates

New Release: Tor 0.3.5.2-alpha

There's a new alpha release available for download. If you build Tor from source, you can download the source code for 0.3.5.2-alpha from the usual place on the website. Packages should be available over the coming weeks, with a new alpha Tor Browser release very soon.

Remember, this is an alpha release: you should only run this if you'd like to find and report more bugs than usual.

Tor 0.3.5.2-alpha fixes several bugs in 0.3.5.1-alpha, including one that made Tor think it had run out of sockets. Anybody running a relay or an onion service on 0.3.5.1-alpha should upgrade.

Changes in version 0.3.5.2-alpha - 2018-09-21

Major bugfixes (relay bandwidth statistics):
- When we close relayed circuits, report the data in the circuit queues as being written in our relay bandwidth stats. This mitigates guard discovery and other attacks that close circuits for the explicit purpose of noticing this discrepancy in statistics. Fixes bug 23512; bugfix on 0.0.8pre3.
Major bugfixes (socket accounting):
- In our socket accounting code, count a socket as closed even when it is closed indirectly by the TLS layer. Previously, we would count these sockets as still in use, and incorrectly believe that we had run out of sockets. Fixes bug 27795; bugfix on 0.3.5.1-alpha.

How Has Tor Helped You? We Need Your Stories

New release: Tor 0.3.5.1-alpha

There's a new alpha release available for download. If you build Tor from source, you can download the source code for 0.3.5.1-alpha from the usual place on the website. Packages should be available over the coming weeks, with a new alpha Tor Browser release some time this week.

Remember, this is an alpha release: you should only run this if you'd like to find and report more bugs than usual.

Tor 0.3.5.1-alpha is the first release of the 0.3.5.x series. It adds client authorization for modern (v3) onion services, improves bootstrap reporting, begins reorganizing Tor's codebase, adds optional support for NSS in place of OpenSSL, and much more.

Changes in version 0.3.5.1-alpha - 2018-09-18

Major features (onion services, UI change):
- For a newly created onion service, the default version is now 3. Tor still supports existing version 2 services, but the operator now needs to set "HiddenServiceVersion 2" in order to create a new version 2 service. For existing services, Tor now learns the version by reading the key file. Closes ticket 27215.
Major features (relay, UI change):
- Relays no longer run as exits by default. If the "ExitRelay" option is auto (or unset), and no exit policy is specified with ExitPolicy or ReducedExitPolicy, we now treat ExitRelay as 0. Previously in this case, we allowed exit traffic and logged a warning message. Closes ticket 21530. Patch by Neel Chauhan.
- Tor now validates that the ContactInfo config option is valid UTF- 8 when parsing torrc. Closes ticket 27428.

New Release: Tor 0.3.4.8 (also other stable updates: 0.2.9.17, 0.3.2.12, and 0.3.3.10)

After months of work, we have a new stable release series! If you build Tor from source, you can download the source code for 0.3.4.8 on the download page of the website. Packages should be available within the next several weeks, with a new Tor Browser by some time next week.

Additionally, we're also releasing updates today for the older supported release series: 0.2.9.17, 0.3.2.12, and 0.3.3.10 . You can find them at dist.torproject.org.

Tor 0.3.4.8 is the first stable release in its series; it includes compilation and portability fixes.

The Tor 0.3.4 series includes improvements for running Tor in low-power and embedded environments, which should help performance in general. We've begun work on better modularity, and included preliminary changes on the directory authority side to accommodate a new bandwidth measurement system. We've also integrated more continuous-integration systems into our development process, and made corresponding changes to Tor's testing infrastructure. Finally, we've continued to refine our anti-denial-of-service code.

Below are the changes since 0.3.3.9. For a list of only the changes since 0.3.4.7-rc, see the ChangeLog file.

Changes in version 0.3.4.8 - 2018-09-10

New system requirements:
- Tor no longer tries to support old operating systems without mmap() or some local equivalent. Apparently, compilation on such systems has been broken for some time, without anybody noticing or complaining. Closes ticket 25398.
Major features (directory authority, modularization):
- The directory authority subsystem has been modularized. The code is now located in src/or/dirauth/, and is compiled in by default. To disable the module, the configure option --disable-module-dirauth has been added. This module may be disabled by default in some future release. Closes ticket 25610.