urn:uuid:201c3fb3-b4bd-3a4e-85ed-16327d11d7a62026-05-15T00:00:00ZThe Tor ProjectOfficial channel for news and updates from the Tor Project2026-05-15T00:00:00ZUnredacted.org urn:uuid:f6897580-0497-3a50-83c4-5cab1c98a9cf <article class="blog-post"> <picture> <source media="(min-width:415px)" srcset="https://blog.torproject.org/keeping-the-doors-open-unredacted/lead.webp" type="image/webp"> <source srcset="https://blog.torproject.org/keeping-the-doors-open-unredacted/lead_small.webp" type="image/webp"> <img class="lead" referrerpolicy="no-referrer" loading="lazy" src="https://blog.torproject.org/keeping-the-doors-open-unredacted/lead.png"> </picture> <div class="body"><p><em>This guest post is part of a spotlight series on the organizations defending the free internet.</em></p> <p>A user in China once said this about our work:</p> <blockquote><p><em>"You have helped many many people to overcome the great firewall. Without your help, I would be in the totally darkness trap and being brain-washed."</em></p> </blockquote> <p><strong>We don't hear from the people who use our services very often. Most of them can't or don't feel that they can safely send a message. When one comes through, it's a reminder of what's actually at stake.</strong></p> <p>We're <a href="https://unredacted.org/">Unredacted</a>, a US-based 501(c)(3) non-profit. We build and operate Internet infrastructure that helps people reach the open Internet and protect their right to privacy. We do this by operating a network of over 300 servers around the world. We're a way through when the front door is locked, and a place to communicate when the public square isn't safe. Most of the work is invisible: datacenter work, hardware, automation, open source software, bandwidth, abuse queues, monitoring alerts, and the late nights spent keeping all of it online.</p> <p>What we do falls into three areas. Censorship Evasion is where Unredacted Door lives, our umbrella for the services designed to route around blocking. Secure Infrastructure is where we run things like<a href="https://xmpp.is/"> XMPP.is</a> and our<a href="https://unredacted.org/services/si/matrix/"> Matrix homeserver</a>, and other free services built with security and privacy in mind. Unredacted Education is the writing and documentation side: guides and explainers for the people who want to understand the work and replicate it. Alongside those, <a href="https://unredacted.org/blog/2025/05/unredacted-labs/">Unredacted Labs</a> is where we experiment with infrastructure ideas that aren't quite production-ready. GreenWare is one of those, our effort to run real network capacity on hardware that doesn't burn a lot of power.</p> <h2>Unredacted Door</h2> <p>The name is literal. When the entrance to the open Internet gets walled off, people need another way in.</p> <p>Unredacted Door brings together several of our circumvention services: FreeSocks, messaging proxies for Signal and Telegram, Tor bridges, and Snowflake proxies. In a recent 30-day window, these services carried nearly 300 TiB of traffic for tens of thousands of people routing around censorship in their countries. That's roughly the equivalent of bandwidth to stream tens of thousands of hours of 4K video. Demand isn't slowing, and we need to continue building more. Every new filter, every new law, every "for your safety" rollout sends more people looking for a route the censors haven't found yet.</p> <p>The largest piece of Unredacted Door is <a href="https://freesocks.org/">FreeSocks</a>: free proxies for people in places where censorship is severe. If you've never run into one, a proxy is a relay point. Your app doesn't talk directly to the blocked service. It talks to a server that carries the connection past whatever filters are sitting between you and the wider Internet. FreeSocks is built to make that relay quietly unremarkable, which is exactly the trait a standard VPN tends to lack. A VPN advertises itself. There's a known endpoint, a known handshake, an obvious shape on the wire. Censors are very good at blocking things they can recognize.</p> <p>No single tool covers every situation. Tor Browser gives you strong privacy and anonymity for browsing. Snowflake helps people reach Tor when access to the network itself is blocked. FreeSocks proxies push specific traffic through a route that's harder to spot. People living under censorship usually need a few of these on hand, because no single door stays open forever.</p> <p>That's why we're putting serious work into the next version of FreeSocks (v2). It uses Xray - a powerful and versatile traffic-routing engine, which can make proxy traffic look more like ordinary web traffic bundled with our open source <a href="https://github.com/unredacted/freesocks-control-plane">control plane</a> that allows us to rotate endpoints automatically when censors find and block a server. The less a user has to fiddle with their setup while they're already under pressure, the better.</p> <h2>GreenWare: sustainable infrastructure, literally</h2> <p>Tor relays, bridges, proxies, and more. They run on hardware in datacenters, and that hardware has a real footprint: financial, operational, and environmental. If we want privacy infrastructure to last, we have to ask what's actually sustainable to operate.</p> <p><a href="https://unredacted.org/blog/2025/05/unredacted-labs/#greenware">GreenWare</a> is our attempt to shrink that footprint without shrinking what we can carry on it. The premise is straightforward: most Tor relay traffic doesn't need a server that draws power like a space heater. A relay needs a steady network, predictable CPU, and enough memory to hold its state. That's a workload a single-board computer can handle, if the chassis around it is built to take it seriously.</p> <p>We started with Raspberry Pi 5 boards powered over PoE, fed entirely through their network cables. The idea worked. A typical server in a datacenter draws as much power as a small space heater. A Pi draws less than a lightbulb. But the first generation had ceilings. Density wasn't where we wanted it, and a few of the supporting components weren't built for the hours we were putting on them.</p> <p>So we run two deployments in parallel now. The first is a 1U chassis with 20 ComputeBlade modules stacked into it. We deployed all 20 in our datacenter and moved a chunk of our Tor exit relays onto them. That chassis pulls a little over 100W under load, roughly what an old incandescent bulb burns. The second is a custom Raspberry Pi chassis we designed after the ComputeBlade work taught us what we actually wanted in the field. Both are live, and as of writing all 123 of our Tor exit relays run on this combined infrastructure, drawing roughly 400W in total. As time goes on, we'll have more to say about the chassis design and the project as it matures.</p> <p>The Tor network runs on people and organizations willing to operate infrastructure for it. Exits are the hardest part of that job. They need bandwidth, maintenance, abuse handling, legal nerve, and money. If we can drop the cost and the power required to run real exit capacity, more people can take on a piece of the work and diversify and grow the network.</p> <p>Our longer-term ambition is to keep pushing on efficient hardware, carbon tracking, and eventually renewable-powered micro points of presence. We'd be more than glad to partner with organizations and companies that want to see this grow.</p> <p>The open Internet is kept open by many people and organizations investing energy, time, and effort: The <a href="https://blog.torproject.org/Defending-the-right-to-know/">researchers measuring censorship</a>, the <a href="https://blog.torproject.org/exploring-stateless-relays/">relay operators providing bandwidth</a>, and the communities that refuse to leave one another behind. At Unredacted, our part is building and maintaining the routes people may need when the obvious ones disappear.</p> </div> <div class="categories"> <ul><li> <a href="https://blog.torproject.org/category/community"> community </a> </li><li> <a href="https://blog.torproject.org/category/partners"> partners </a> </li><li> <a href="https://blog.torproject.org/category/human-rights"> human rights </a> </li></ul> </div> </article> 2026-05-12T00:00:00Ztails urn:uuid:8954afe6-22ff-3bfd-8046-4ba62e12f48c <article class="blog-post"> <picture> <source media="(min-width:415px)" srcset="https://blog.torproject.org/new-release-tails-7_7_3/lead.webp" type="image/webp"> <source srcset="https://blog.torproject.org/new-release-tails-7_7_3/lead_small.webp" type="image/webp"> <img class="lead" referrerpolicy="no-referrer" loading="lazy" src="https://blog.torproject.org/new-release-tails-7_7_3/lead.jpg"> </picture> <div class="body"><p>This release is an emergency release to fix a critical security vulnerability in the Linux kernel, as well as security vulnerabilities in <em>Tor Browser</em> and in the <em>Tor</em> client.</p> <h2>Changes and updates</h2> <ul> <li><p>Update the <em>Linux</em> kernel to 6.12.86, which fixes <a href="https://github.com/V4bel/dirtyfrag">Dirty Frag</a>, a vulnerability that could allow an application in Tails to gain administration privileges.</p> <p>For example, if an attacker was able to exploit other unknown security vulnerabilities in an application included in Tails, they might then use Copy Fail to take full control of your Tails and deanonymize you.</p> <p>We are not aware of this vulnerability being used in practice until now.</p> </li> <li><p>Update <em>Tor Browser</em> to <a href="https://blog.torproject.org/new-release-tor-browser-15012/">15.0.12</a>.</p> </li> <li><p>Update the <em>Tor</em> client to 0.4.9.8.</p> </li> <li><p>Update <em>Thunderbird</em> to <a href="https://www.thunderbird.net/en-US/thunderbird/140.10.1esr/releasenotes/">140.10.1</a>.</p> </li> </ul> <h2>Fixed problems</h2> <p>For more details, read our <a href="https://gitlab.tails.boum.org/tails/tails/-/blob/master/debian/changelog">changelog</a>.</p> <h2>Get Tails 7.7.3</h2> <h3>To upgrade your Tails USB stick and keep your Persistent Storage</h3> <ul> <li><p>Automatic upgrades are available from Tails 7.0 or later to 7.7.3.</p> </li> <li><p>If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a <a href="https://tails.net/doc/upgrade/#manual">manual upgrade</a>.</p> </li> </ul> <h3>To install Tails 7.7.3 on a new USB stick</h3> <p>Follow our <a href="https://tails.net/install/">installation instructions</a>.</p> <p>The Persistent Storage on the USB stick will be lost if you install instead of upgrading.</p> <h3>To download only</h3> <p>If you don't need installation or upgrade instructions, you can download Tails 7.7.3 directly:</p> <ul> <li><p><a href="https://tails.net/install/download/">For USB sticks (USB image)</a></p> </li> <li><p><a href="https://tails.net/install/download-iso/">For DVDs and virtual machines (ISO image)</a></p> </li> </ul> <h2>Support and feedback</h2> <p>For support and feedback, visit the <a href="https://tails.net/support/">Support section</a> on the Tails website.</p> </div> <div class="categories"> <ul><li> <a href="https://blog.torproject.org/category/tails"> tails </a> </li><li> <a href="https://blog.torproject.org/category/releases"> releases </a> </li></ul> </div> </article> 2026-05-12T00:00:00Zpavel urn:uuid:d9f1a6f6-9d3f-3009-a511-07a94bc34da2 <article class="blog-post"> <picture> <source media="(min-width:415px)" srcset="https://blog.torproject.org/Defending-the-right-to-know/lead.webp" type="image/webp"> <source srcset="https://blog.torproject.org/Defending-the-right-to-know/lead_small.webp" type="image/webp"> <img class="lead" referrerpolicy="no-referrer" loading="lazy" src="https://blog.torproject.org/Defending-the-right-to-know/lead.png"> </picture> <div class="body"><p><em>This post is part of a spotlight series on the organizations defending the free internet.</em></p> <p>Internet freedom has declined for <a href="https://freedomhouse.org/article/new-report-persistent-authoritarian-repression-and-backsliding-democracies-drive-15th">15 consecutive years.</a> Beyond surveillance, the erosion of privacy and anonymity, and information manipulation, governments are targeting specific sites and services, or attacking infrastructure itself, causing shutdowns and deliberate disruptions for internet users. But how do we know when the internet is censored and how?</p> <p><a href="https://ooni.org/">OONI</a>, the Open Observatory for Network Interference, born out of the Tor Project, exists to answer that question. Through <a href="https://ooni.org/install/">free software tools</a> and <a href="https://ooni.org/data/">open data</a> OONI makes censorship measurable, verifiable, and actionable. This post is about what that looks like in practice.</p> <h2>Protecting the public record</h2> <p>OONI data is the <a href="https://explorer.ooni.org/">world's largest open dataset on internet censorship</a>: billions of measurements collected across tens of thousands of networks from 245 countries and territories since 2012. OONI's data exists because people around the world run <a href="https://ooni.org/install/">OONI Probe</a> and contribute measurements from the networks that they are connected to. Every new measurement adds to a shared public record.</p> <p>Both its scale and methodology contribute to OONI's impact. Internet censorship often works by making interference hard to see. It can make a blocked website look broken, a throttled app look unreliable, or a shutdown look like a technical failure. OONI helps expose these tactics through <a href="https://github.com/ooni/spec/tree/master/nettests">open measurement methodologies</a>, peer review, expert feedback, and comparison against control measurements, so that censorship claims can be tested, challenged, and verified.</p> <p>To make this dataset user-friendly, OONI launched <a href="https://ooni.org/post/2025-ooni-explorer-thematic-censorship-pages/">thematic pages in OONI Explorer</a> focusing on the areas most frequently targeted: social media and messaging apps, news media, and circumvention tools. Each page includes short reports, longer research reports, and charts with the latest OONI data.</p> <p>In 2025, a dedicated "<a href="https://explorer.ooni.org/news-media">Blocking of News Media</a>" page helped surface findings that would otherwise require sifting through billions or raw measurements: the <a href="https://explorer.ooni.org/findings/99431807200">blocking of the independent media outlet Zawia3</a> in Egypt, the <a href="https://explorer.ooni.org/findings/101531332700">blocking of 12 news media websites</a> in Jordan, and the <a href="https://explorer.ooni.org/findings/667455800">blocking of The Wire in India</a> during the military conflict with Pakistan.</p> <p>Think about <a href="https://ooni.org/reports/">when censorship events tend to happen</a>: elections, protests, armed conflict, national exams, and periods of political unrest. The moment when access to information matters most. OONI gives affected communities a shared factual basis at those moments to make accountability possible.</p> <h2>How journalists and media organizations use OONI</h2> <p><img src="https://blog.torproject.org/Defending-the-right-to-know/blocking-of-dw-dot-com.png" alt="Image A screenshot of the OONI explorer showing blocking of news site dw.com in Russia, China, and Iran"></p> <p>In 2025, <a href="https://meduza.io/en">Meduza</a>, one of the most prominent Russian media outlets in exile <a href="https://meduza.io/cards/tsenzury-v-runete-vse-bolshe-kak-mozhno-otslezhivat-blokirovki">published an article introducing OONI tools</a> and encouraging readers to use them. It's just one example how a newsroom can effectively use censorship measurement not just to report a story, but as an act of public education: helping audiences understand how network interference works, how it can be documented, and how they can contribute to that evidence base themselves.</p> <p>When a news website is blocked, that's not just a technical event. It's the public losing access to reporting, communities losing access to timely information, and journalists losing access to their audiences. Documentation that can be cited and analyzed is what turns that event into something actionable.</p> <p>The most concrete example of that chain in action is Kenya. OONI data served as evidence in a public-interest case challenging the unlawful disruption of internet access. <a href="https://blog.bake.co.ke/2025/05/14/bake-6-other-organizations-challenge-internet-shutdowns-in-kenya-in-landmark-public-interest-case/">The case was filed by a coalition</a> that included BAKE, ICJ Kenya, Paradigm Initiative, the Kenya Union of Journalists, Katiba Institute, the Law Society of Kenya, and CIPESA. To support the petition before the High Court of Kenya, OONI produced<a href="https://blog.bake.co.ke/wp-content/uploads/2025/05/HCCHRPET.276.2025-ICJ-v-CA-Internet-Shutdown-Case.pdf"> a detailed research report, in the form of an expert opinion</a>, documenting the blocking of Telegram during Kenya's 2023 and 2024 KCSE national exams.</p> <p>This is a case where a journalists' union, digital rights organizations, legal advocates, and technical researchers were able to work from the same datasets to elevate internet disruption to a public-interest issue. And this case also helped set an important regional precedent: lawyers in Tanzania subsequently reached out to OONI for data to support legal efforts challenging the blocking of Twitter/X there, prompting OONI to publish <a href="https://ooni.org/post/2025-tanzania-blocked-twitter/">a research report documenting the block.</a></p> <h2>Collective action for a collective internet</h2> <p>The Kenya-to-Tanzania ripple effect illustrates how internet censorship works across geographies. But also how we can fight it. A block on messaging apps isn't a standalone event. Journalists may lose access to sources. Activists may lose organizing channels. <a href="https://blog.torproject.org/fighting-censorship-with-webtunnel/">Circumvention tool developers may need to adapt.</a> Researchers may need to verify what happened. Lawyers may need evidence. But everyone needs documentation.</p> <p>OONI's <a href="https://ooni.org/data/">open data</a> model is built for exactly these moments. Protecting the free internet requires documenting censorship, sharing evidence, and building the collective capacity to respond.</p> </div> <div class="categories"> <ul><li> <a href="https://blog.torproject.org/category/community"> community </a> </li><li> <a href="https://blog.torproject.org/category/partners"> partners </a> </li><li> <a href="https://blog.torproject.org/category/human-rights"> human rights </a> </li></ul> </div> </article> 2026-05-08T00:00:00Zma1 urn:uuid:70e330f6-cd91-39d5-9a75-8b121ad82143 <article class="blog-post"> <picture> <source media="(min-width:415px)" srcset="https://blog.torproject.org/new-release-tor-browser-15013/lead.webp" type="image/webp"> <source srcset="https://blog.torproject.org/new-release-tor-browser-15013/lead_small.webp" type="image/webp"> <img class="lead" referrerpolicy="no-referrer" loading="lazy" src="https://blog.torproject.org/new-release-tor-browser-15013/lead.png"> </picture> <div class="body"><p>Tor Browser 15.0.13 is now available from the <a href="https://www.torproject.org/download/">Tor Browser download page</a> and also from our <a href="https://www.torproject.org/dist/torbrowser/15.0.13/">distribution directory</a>.</p> <h2>Send us your feedback</h2> <p>If you find a bug or have a suggestion for how we could improve this release, <a href="https://support.torproject.org/misc/bug-or-feedback/">please let us know</a>.</p> <h2>Full changelog</h2> <p>The <a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/maint-15.0/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt">full changelog</a> since Tor Browser 15.0.12 is:</p> <ul> <li>All Platforms<ul> <li>Updated tor to 0.4.9.8</li> <li>Updated NoScript to 13.6.19.1984</li> </ul> </li> </ul> </div> <div class="categories"> <ul><li> <a href="https://blog.torproject.org/category/applications"> applications </a> </li><li> <a href="https://blog.torproject.org/category/releases"> releases </a> </li></ul> </div> </article> 2026-05-07T00:00:00Zwesleyac urn:uuid:79cb11dd-4153-3014-b3f4-4df876b74f45 <article class="blog-post"> <picture> <source media="(min-width:415px)" srcset="https://blog.torproject.org/static/images/lead.webp" type="image/webp"> <source srcset="https://blog.torproject.org/static/images/lead_small.webp" type="image/webp"> <img class="lead" referrerpolicy="no-referrer" loading="lazy" src="https://blog.torproject.org/static/images/lead.png"> </picture> <div class="body"><p>Arti is our ongoing project to create a next-generation Tor implementation in Rust. We're happy to announce the latest release, Arti 2.3.0.</p> <p>This release bumps the minimum MacOS version supported by Arti to 10.14, up from 10.12. Despite being supported on a technical level, we do not recommend the use of MacOS versions that old, as they are no longer receiving updates from Apple and may have unpatched security issues.</p> <p>This release continues our ongoing development towards using Arti as a relay and as a directory authority. It also continues development on RPC, including adding a new RPC API for inspecting tunnel paths.</p> <p>Additionally, there are a couple new logging related features. Arti now supports logging to syslog when the <code>syslog</code> feature is enabled and the <code>logging.syslog</code> config option is enabled. We've also added a new <code>logging.protocol_warnings</code> option to log protocol violations as warnings.</p> <p>Developers who use the <code>arti-client</code> crate should note that in the release after this one, we plan to change <code>TorClient</code> to be wrapped in an <code>Arc</code> explicitly, rather than implicitly having <code>Arc</code>-like semantics. Be prepared for this breaking change, and if you have any thoughts about it, please speak up in <a href="https://gitlab.torproject.org/tpo/core/arti/-/work_items/2469">#2469</a>.</p> <p>As usual, there is also a signigicant amount of cleanup, improvements to testing, infrastructure, and documentation, and many small bugfixes.</p> <p>For full details on what we've done, including API changes, and for information about many more minor and less-visible changes, please see the <a href="https://gitlab.torproject.org/tpo/core/arti/-/blob/main/CHANGELOG.md#arti-230--7-may-2026">CHANGELOG</a>.</p> <p>For more information on using Arti, see our top-level <a href="https://gitlab.torproject.org/tpo/core/arti/-/blob/main/README.md">README</a>, and the documentation for the <a href="https://gitlab.torproject.org/tpo/core/arti/-/blob/main/crates/arti/README.md"><code>arti</code> binary</a>.</p> <p>Thanks to everybody who's contributed to this release, including Andrew Kloet, hjrgrn, and moumenalaoui.</p> <p>Also, our deep thanks to our <a href="https://www.torproject.org/about/sponsors/">sponsors</a> for funding the development of Arti!</p> </div> <div class="categories"> <ul><li> <a href="https://blog.torproject.org/category/announcements"> announcements </a> </li><li> <a href="https://blog.torproject.org/category/releases"> releases </a> </li></ul> </div> </article> 2026-05-07T00:00:00Zma1 urn:uuid:ff9d7f3f-5126-3b25-b2b4-882d7e5b7e81 <article class="blog-post"> <picture> <source media="(min-width:415px)" srcset="https://blog.torproject.org/new-alpha-release-tor-browser-160a6/lead.webp" type="image/webp"> <source srcset="https://blog.torproject.org/new-alpha-release-tor-browser-160a6/lead_small.webp" type="image/webp"> <img class="lead" referrerpolicy="no-referrer" loading="lazy" src="https://blog.torproject.org/new-alpha-release-tor-browser-160a6/lead.png"> </picture> <div class="body"><p>Tor Browser 16.0a6 is now available from the <a href="https://www.torproject.org/download/alpha/">Tor Browser download page</a> and also from our <a href="https://www.torproject.org/dist/torbrowser/16.0a6/">distribution directory</a>.</p> <p>This version includes important <a href="https://www.mozilla.org/en-US/security/advisories/">security updates</a> to Firefox.</p> <p>⚠️ <strong>Reminder</strong>: The Tor Browser Alpha release-channel is for <a href="https://community.torproject.org/user-research/become-tester/">testing only</a>. As such, Tor Browser Alpha is not intended for general use because it is more likely to include bugs affecting usability, security, and privacy.</p> <p>Moreover, Tor Browser Alphas are now based on Firefox's betas. Please read more about this important change in the <a href="https://blog.torproject.org/future-of-tor-browser-alpha/">Future of Tor Browser Alpha</a> blog post.</p> <p>If you are an at-risk user, require strong anonymity, or just want a reliably-working browser, please stick with the <a href="https://www.torproject.org/download/">stable release channel</a>.</p> <h2>Send us your feedback</h2> <p>If you find a bug or have a suggestion for how we could improve this release, <a href="https://support.torproject.org/misc/bug-or-feedback/">please let us know</a>.</p> <h2>Full changelog</h2> <p>The <a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/main/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt">full changelog</a> since Tor Browser 16.0a5 is:</p> <ul> <li>All Platforms<ul> <li>Updated tor to 0.4.9.7</li> <li>Updated NoScript to 13.6.18.90101984</li> <li>Updated OpenSSL to 3.5.6</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43857">Bug tor-browser#43857</a>: Review in-source TODOs</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44402">Bug tor-browser#44402</a>: Re-enable ESLint rule mozilla/no-browser-refs-in-toolkit as an error</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44749">Bug tor-browser#44749</a>: Check search engines parameter replacements</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44792">Bug tor-browser#44792</a>: Rebase alpha onto 150.0a1</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44796">Bug tor-browser#44796</a>: Adjust TorProviderBuilder to report the provider state to consumers</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44828">Bug tor-browser#44828</a>: Remove browser module references from toolkit/modules/ActorManagerParent.sys.mjs</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44841">Bug tor-browser#44841</a>: TorDomainIsolator proxy filter returns null on exception instead of preserving SOCKS proxy</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44865">Bug tor-browser#44865</a>: Block chrome://<em>/locale/</em> to content</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44868">Bug tor-browser#44868</a>: Backport 138c33ea964b2e0a4875aadc39d8a948e0c2aace to 150 to fix Windows builds</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44870">Bug tor-browser#44870</a>: Remove legacy branch from gitlab templates</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44895">Bug tor-browser#44895</a>: Undo the patch for #44772</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41775">Bug tor-browser-build#41775</a>: Update list of Snowflake STUN servers in default bridge line, 2026 edition</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41778">Bug tor-browser-build#41778</a>: Remove base-browser from protected-branches.py</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41780">Bug tor-browser-build#41780</a>: Create sha256sums-unsigned-build.txt in artifacts/$platform directories</li> </ul> </li> <li>Windows + macOS + Linux<ul> <li>Updated Firefox to 150.0a1</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43824">Bug tor-browser#43824</a>: Switch resource:// modules to use moz-src:</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44288">Bug tor-browser#44288</a>: New identity fails to block loading a custom home page</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44458">Bug tor-browser#44458</a>: Fix the "Connect" and ".onion available" button height</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44560">Bug tor-browser#44560</a>: Customize the flags for alternate 'Application Data' directories</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44630">Bug tor-browser#44630</a>: Use settings config to hide settings, rather than data-hidden-from-search or commenting out</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44648">Bug tor-browser#44648</a>: Unexpected changes to SearchService.sys.mjs</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44685">Bug tor-browser#44685</a>: Use border radius for letterboxing</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44798">Bug tor-browser#44798</a>: Don't load <code>about:torconnect</code> into iframes</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44829">Bug tor-browser#44829</a>: Hide the settings privacy card</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44832">Bug tor-browser#44832</a>: Hide the Firefox mascot in about:neterror</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44846">Bug tor-browser#44846</a>: about:torconnect redirect doesn't work with the new neterror page</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44847">Bug tor-browser#44847</a>: Drop letterboxing sidebar rounded corner logic</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44902">Bug tor-browser#44902</a>: Error in privacy preference initialisation due to missing <code>dataCollectionViewProfilesMultiProfileBackupWarning</code></li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/31860">Bug tor-browser-build#31860</a>: Start using LTO for firefox project</li> </ul> </li> <li>Windows<ul> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44862">Bug tor-browser#44862</a>: Fontvis is missing Segoe MDL2 Assets</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44868">Bug tor-browser#44868</a>: Backport 138c33ea964b2e0a4875aadc39d8a948e0c2aace to 150 to fix Windows builds</li> </ul> </li> <li>macOS<ul> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44850">Bug tor-browser#44850</a>: Wrong path for bootstrapped tor daemon on macOS</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41476">Bug tor-browser-build#41476</a>: Since 13.5-legacy is not longer supported, remove tools/signing/wrappers/sign-rcodesign</li> </ul> </li> <li>Linux<ul> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44361">Bug tor-browser#44361</a>: Notify Linux i686 users that they won't receive updates anymore</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44521">Bug tor-browser#44521</a>: Disable widget.wayland.fractional-scale.enabled</li> </ul> </li> <li>Android<ul> <li>Updated GeckoView to 150.0a1</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44615">Bug tor-browser#44615</a>: Remove ability to "Rate/Review in Google Play" in app</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44827">Bug tor-browser#44827</a>: Always enable noscript for android</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44842">Bug tor-browser#44842</a>: Replace instances of SwitchPreference with SwitchPreferenceCompat</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44848">Bug tor-browser#44848</a>: Do not overwrite Android toolchains on default mozconfigs</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44880">Bug tor-browser#44880</a>: Fix edgeToEdge display issue presented in 150 android rebase</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44925">Bug tor-browser#44925</a>: Fix bootstrap screen color styling for light mode presented in one of the rebases between 140 and 150</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44935">Bug tor-browser#44935</a>: Remove incorrectly shown "open in app" notification dot on settings button</li> </ul> </li> <li>Build System<ul> <li>All Platforms<ul> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41591">Bug tor-browser-build#41591</a>: Remove support for old mar filenames when 13.5 legacy branch is EOL</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41764">Bug tor-browser-build#41764</a>: Update toolchains for Firefox 150</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41767">Bug tor-browser-build#41767</a>: Add jwilde to allowed signer for browser projects</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41778">Bug tor-browser-build#41778</a>: Remove base-browser from protected-branches.py</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41780">Bug tor-browser-build#41780</a>: Create sha256sums-unsigned-build.txt in artifacts/$platform directories</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41786">Bug tor-browser-build#41786</a>: Add comment to rbm.local.conf.example warning about potential recursive loops in tmp_dir definition</li> <li><a href="https://gitlab.torproject.org/tpo/applications/rbm/-/issues/40106">Bug rbm#40106</a>: Improve error message in case of recursive definition</li> </ul> </li> <li>Windows + macOS + Linux<ul> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41759">Bug tor-browser-build#41759</a>: Remove references to legacy release in tor-browser-build</li> </ul> </li> <li>Windows + Linux + Android<ul> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41770">Bug tor-browser-build#41770</a>: Update Go to 1.26.x</li> <li>Updated Go to 1.26.2</li> </ul> </li> <li>Windows<ul> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44853">Bug tor-browser#44853</a>: Update target in mozconfig-windows-x86_64 and mozconfig-windows-i686</li> </ul> </li> <li>macOS<ul> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41773">Bug tor-browser-build#41773</a>: Change the position of -mindepth when creating the dmg</li> </ul> </li> <li>Linux<ul> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44555">Bug tor-browser#44555</a>: Remove mozconfig-linux-i686</li> </ul> </li> <li>Android<ul> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44848">Bug tor-browser#44848</a>: Do not overwrite Android toolchains on default mozconfigs</li> </ul> </li> </ul> </li> </ul> </div> <div class="categories"> <ul><li> <a href="https://blog.torproject.org/category/applications"> applications </a> </li><li> <a href="https://blog.torproject.org/category/releases"> releases </a> </li></ul> </div> </article> 2026-05-07T00:00:00Zma1 urn:uuid:3da2dd6a-b895-37f8-aa5a-5ec11e7d9192 <article class="blog-post"> <picture> <source media="(min-width:415px)" srcset="https://blog.torproject.org/new-release-tor-browser-15012/lead.webp" type="image/webp"> <source srcset="https://blog.torproject.org/new-release-tor-browser-15012/lead_small.webp" type="image/webp"> <img class="lead" referrerpolicy="no-referrer" loading="lazy" src="https://blog.torproject.org/new-release-tor-browser-15012/lead.png"> </picture> <div class="body"><p>Tor Browser 15.0.12 is now available from the <a href="https://www.torproject.org/download/">Tor Browser download page</a> and also from our <a href="https://www.torproject.org/dist/torbrowser/15.0.12/">distribution directory</a>.</p> <p>This version includes important <a href="https://www.mozilla.org/en-US/security/advisories/">security updates</a> to Firefox.</p> <h2>Send us your feedback</h2> <p>If you find a bug or have a suggestion for how we could improve this release, <a href="https://support.torproject.org/misc/bug-or-feedback/">please let us know</a>.</p> <h2>Full changelog</h2> <p>The <a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/maint-15.0/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt">full changelog</a> since Tor Browser 15.0.11 is:</p> <ul> <li>All Platforms<ul> <li>Updated tor to 0.4.9.7</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44940">Bug tor-browser#44940</a>: Rebase Tor Browser stable onto 140.10.2esr</li> </ul> </li> <li>Windows + macOS + Linux<ul> <li>Updated Firefox to 140.10.2esr</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44746">Bug tor-browser#44746</a>: Funding the Commons Implementation (Desktop)</li> </ul> </li> <li>Android<ul> <li>Updated GeckoView to 140.10.2esr</li> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44747">Bug tor-browser#44747</a>: Funding the Commons Implementation (Android)</li> </ul> </li> <li>Build System<ul> <li>All Platforms<ul> <li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41781">Bug tor-browser-build#41781</a>: Fix clean section in rbm.local.conf.example</li> </ul> </li> </ul> </li> </ul> </div> <div class="categories"> <ul><li> <a href="https://blog.torproject.org/category/applications"> applications </a> </li><li> <a href="https://blog.torproject.org/category/releases"> releases </a> </li></ul> </div> </article> 2026-05-06T00:00:00ZGeKo, ahf, ln5 urn:uuid:3a841fec-415e-32af-a681-d521494f94fa <article class="blog-post"> <picture> <source media="(min-width:415px)" srcset="https://blog.torproject.org/tor-community-gathering-2026/lead.webp" type="image/webp"> <source srcset="https://blog.torproject.org/tor-community-gathering-2026/lead_small.webp" type="image/webp"> <img class="lead" referrerpolicy="no-referrer" loading="lazy" src="https://blog.torproject.org/tor-community-gathering-2026/lead.png"> </picture> <div class="body"><p>After organizing a successful <a href="https://blog.torproject.org/bringing-tor-community-together/">first community gathering last year in Denmark</a>, we were eager to find out: Could we get another productive, community-organized meeting off the ground taking into account what we've learned so far?</p> <h2>Preparations</h2> <p>We decided to do the next community gathering organized by us at the same location we used last year: Hylkedam, in Denmark. We knew it worked well, was sufficiently cheap, and we could likely cut down the overall planning overhead given our past experience there. And, indeed, planning was minimal, reusing much of the "playbook" we developed for our first meeting last year. We spent most of our preparation time on revamping our meeting website. We have <a href="https://onionize.space/">a shiny new onionized space</a> now, including <a href="https://lists.onionize.space/mailman3/postorius/lists/tcg.lists.onionize.space/">a public mailing list</a>!</p> <h2>3 days of fun with Tor</h2> <p>We gathered on the weekend of March 13 - 15 at Hylkedam. Overall we were a little less people this time (around 12) but had, on the plus side, participants with backgrounds not being present at our first Tor community gathering: we got the research angle covered this time (with focus on anti-censorship) and had people from <a href="https://reproducible-builds.org/">the Reproducible Builds project</a> attending. The latter allowed us to think about potentially doing community gatherings together, which would make collaboration and sharing of ideas easier between our projects. Talking about research on the other hand has been very inspiring as we could see what is currently happening in the research world and help shaping particular project plans by explaining related tools and already existing projects and needs within the Tor eco system.</p> <p>Apart from the new contributions we were happy as well to see that various work started at the previous gathering got picked up and pushed forward again, showing the overall commitment of our volunteers in the community. Notably, we saw further improvements to the network social graph proof of concept project and the relay operator Grafana dashboard. We also continued <a href="https://gitlab.torproject.org/linus/tor-consensus-transparency">the discussion around consensus-transparency</a>.</p> <p>We had the usual structure during our meeting days, following the established cycle of: opening session -&gt; structured sessions -&gt; unstructured sessions -&gt; closing circle, which, again, worked pretty well. Unstructured sessions included general free hacking time and room for getting ad hoc together, thinking through or working on a topic that might have come up during the more structured sessions previously or is just not ready for "prime time" yet. We think that this time without a moderator and a clear session time limit is an essential part of making the whole meeting productive, as it gives the participants the freedom to work on random things they are interested in and might get excited about.</p> <p>For the structured sessions we made sure we had note takers again, so someone not being able to attend can get up to speed afterwards. We had a set of different topics again, ranging from anti-censorship related sessions to an update on upcoming changes for relay operators and a session dedicated to how the community can get organized itself, so we would have similar gatherings or an 'onion festival' in the future. Check out <a href="https://onionize.space/2026/sessions/">the session notes on our website</a>, in case you are interested!</p> <h2>What's next?</h2> <p>We plan to have more Tor community meetings in the future. As already said: they don't have to be at Hylkedam (we'd like to see other venues as well!), nor does it have to be the same group of people sharing the organization workload. So, if you are excited about what you read in this blog post and are experiencing a serious case of FOMO or want to help organize future community gatherings, get in touch! Our mailing list[3] is a good starting point for that.</p> <p>The same goes for providing feedback about this format and how we can make such events more inviting and inclusive in the future. Want to be invited, too? Let us know as well!</p> </div> <div class="categories"> <ul><li> <a href="https://blog.torproject.org/category/community"> community </a> </li></ul> </div> </article> 2026-05-04T00:00:00Ztails urn:uuid:35ad341c-58e4-3f9b-87b2-5e2f2c2cc27c <article class="blog-post"> <picture> <source media="(min-width:415px)" srcset="https://blog.torproject.org/new-release-tails-7_7_2/lead.webp" type="image/webp"> <source srcset="https://blog.torproject.org/new-release-tails-7_7_2/lead_small.webp" type="image/webp"> <img class="lead" referrerpolicy="no-referrer" loading="lazy" src="https://blog.torproject.org/new-release-tails-7_7_2/lead.jpg"> </picture> <div class="body"><p>This release is an emergency release to fix a critical security vulnerability in the Linux kernel.</p> <h2>Changes and updates</h2> <p>Update the <em>Linux</em> kernel to 6.12.85, which fixes <a href="https://copy.fail/">Copy Fail</a>, a vulnerability that could allow an application in Tails to gain administration privileges.</p> <p>For example, if an attacker was able to exploit other unknown security vulnerabilities in an application included in Tails, they might then use Copy Fail to take full control of your Tails and deanonymize you.</p> <p>We are not aware of this vulnerability being used in practice until now.</p> <h2>Fixed problems</h2> <p>For more details, read our <a href="https://gitlab.tails.boum.org/tails/tails/-/blob/master/debian/changelog">changelog</a>.</p> <h2>Get Tails 7.7.2</h2> <h3>To upgrade your Tails USB stick and keep your Persistent Storage</h3> <ul> <li><p>Automatic upgrades are available from Tails 7.0 or later to 7.7.2.</p> </li> <li><p>If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a <a href="https://tails.net/doc/upgrade/#manual">manual upgrade</a>.</p> </li> </ul> <h3>To install Tails 7.7.2 on a new USB stick</h3> <p>Follow our <a href="https://tails.net/install/">installation instructions</a>.</p> <p>The Persistent Storage on the USB stick will be lost if you install instead of upgrading.</p> <h3>To download only</h3> <p>If you don't need installation or upgrade instructions, you can download Tails 7.7.2 directly:</p> <ul> <li><p><a href="https://tails.net/install/download/">For USB sticks (USB image)</a></p> </li> <li><p><a href="https://tails.net/install/download-iso/">For DVDs and virtual machines (ISO image)</a></p> </li> </ul> <h2>Support and feedback</h2> <p>For support and feedback, visit the <a href="https://tails.net/support/">Support section</a> on the Tails website.</p> </div> <div class="categories"> <ul><li> <a href="https://blog.torproject.org/category/tails"> tails </a> </li><li> <a href="https://blog.torproject.org/category/releases"> releases </a> </li></ul> </div> </article> 2026-04-30T00:00:00Zisabela urn:uuid:9f7c80be-39ad-31a3-a4f6-dc72325f1be5 <article class="blog-post"> <picture> <source media="(min-width:415px)" srcset="https://blog.torproject.org/static/images/lead.webp" type="image/webp"> <source srcset="https://blog.torproject.org/static/images/lead_small.webp" type="image/webp"> <img class="lead" referrerpolicy="no-referrer" loading="lazy" src="https://blog.torproject.org/static/images/lead.png"> </picture> <div class="body"><p>The Tor Project is deeply saddened by the last-minute cancellation of <a href="https://www.rightscon.org/">RightsCon 2026</a> in Lusaka, Zambia, and online. The right to assemble, associate, and speak freely must not be conditioned on political approval. Convenings like RightsCon are essential precisely because they create space for difficult, urgent, and necessary conversation about power, technology, rights, and accountability.</p> <p>Tor's work is rooted in the belief that everyone should be able to speak freely, safely, and privately. We build tools that help people connect, communicate, organize, and seek information; especially those facing censorship, surveillance, repression, discrimination, and other forms of vulnerability. The disruption of a space dedicated to advancing these shared goals represents a serious gutpunch to the global human rights community.</p> <p>While the cancellation may have been the only responsible path to prevent further harm to the community, the circumstances that made it necessary are unacceptable. This moment underscores why the fight against censorship, surveillance, and restrictions on civic participation remains urgent.</p> <p>We share the deep concerns expressed by those directly affected: participants who were already traveling or preparing to travel, speakers and organizers who invested significant labor into this gathering, communities who were counting on these conversations, and local partners and small businesses who now face the consequences of a cancellation <a href="https://www.techpolicy.press/rightscon-canceled-after-zambia-requires-full-alignment-with-national-values/">imposed over night.</a></p> <p>We stand in solidarity with the <a href="https://www.rightscon.org/">RightsCon</a> and <a href="https://www.accessnow.org/">Access Now</a> teams, who have worked to protect the safety and integrity of the community under extremely difficult circumstances. We also stand firmly with local organizers, digital rights defenders, and civil society actors in Zambia and across the region, who are left to absorb the backlash of a broader and longstanding pattern of repression against civil society.</p> <p>For Tor, RightsCon has been especially important because it allows us to connect directly with the people and organizations who use, teach, and share our tools with their communities. Our organization has <a href="https://blog.torproject.org/event/tor-silicon-valley-human-rights-conference/">participated in RightsCon since its first edition in 2011</a>. Over the years, it has become a central gathering place for our broader community: a space where small open source hacker nonprofits could collaborate with more established, mainstream human rights organizations.</p> <p>Tor remains committed to advancing human rights online AND offline, supporting vulnerable internet users globally, and building technologies that help people break through censorship and reclaim their right to communicate freely. We will continue to work alongside the digital rights community in solidarity.</p> </div> <div class="categories"> <ul><li> <a href="https://blog.torproject.org/category/human-rights"> human rights </a> </li><li> <a href="https://blog.torproject.org/category/global-south"> global south </a> </li><li> <a href="https://blog.torproject.org/category/partners"> partners </a> </li><li> <a href="https://blog.torproject.org/category/community"> community </a> </li></ul> </div> </article>