[XMR] Monero - A secure, private, untraceable cryptocurrency

[Hueristic]

Are you guys not using the Tor repository to keep your Tor install up to date?

Instructions are here: https://support.torproject.org/little-t-tor/getting-started/installing/

A few other suggestions:

• Consider a path towards integrating Arti.
• Just thinking aloud...  If I wanted to embed the C tor daemon in a project, I’d probably use git submodule with the Tor repository then pull, switch, commit to each release.  (I run a Tor daemon with my own local patches; their repo and their build/test processes are relatively easy to work with, even just for personal use.  Rewriting my patches for Arti will be a PITA, wtf all of the code is rusting.)

Hey, welcome back!

Do me a favor an give me your thoughts on that PR.

[nullius]

Moving this to the top:  How do you want to keep up-to-date with new tor daemon releases?

• The Tor Project forum’s News board announces releases for various projects, and includes the daemon release announcements in the News: Tor Release Announcement subforum.  (Posting on these forums requires JS (fucking discourse), but they can be read with no-js.)
• The Tor Project’s blog (onion) announces Tor Browser, but not tor daemon releases.  So...
• Whenever you get a Tor Browser update, check its release notes to see if it distributes an updated tor daemon!  (I assume that everyone involved here actually uses Tor Browser every day, and keeps it updated.)
• I need to check and see if the Tor release announcement mailing list still works at all.  The hyperkitty archive page requires JS, so fuckit—someone else please tell me?
• Use the power of git.  Keep a local clone up-to-date, and watch for new release tags.  This can be automated, and automation prevents fuckups.  I use the official git onion ← (link will work with git clone, but redirects browsers to the core tor gitlab app page); to “trust but verify” that I’m not phishing you with a trojaned tor, verify from onion.torproject.org that that’s the onion for gitlab.torproject.org.

Hey, welcome back!

Do me a favor an give me your thoughts on that PR.

Ah, php2shell—and now this...   By way of thanks for the warm welcome:

Code:

-$(package)_version=0.4.9.11
+$(package)_version=0.4.9.15

This is a problem.  Tor has had a stack of security advisories since 0.4.9.11.  Never mind 0.4.8.x in the PR itself?  (I didn’t dig into Feather deeply enough to understand this discrepancy; I myself have only ever used monero-wallet-cli for Monero, IIRC since before that was the filename.)

The past few months have been a security shitstorm in the Tor Project, just like everywhere else.  Merely by reviewing the git log, I think it looks like David Goulet and Mike Perry have been using both GPT Codex and Claude to hunt for security bugs before attackers do the same thing.  Not sure where reports come from, I heard somewhere that TPO has also been getting many other reports from bughunters using LLMs; I don’t know if I am giving appropriate credit or not.  Anyway, altogether, the past few months have seen public disclosures of tor daemon security bugs, which have been fixed ASAP in unscheduled releases.

If I were a state-level threat actor, I’d hope that lots of people never update their tor daemons. #justsaying

With my attention elsewhere, I haven’t dug too much into the impact for AP clients; AFAIK, some of the security bugs affect only relays, but some may affect AP also.  Off the top of my head, I don’t know the potential impact on Feather users—if any.  I just keep my own tor daemon up-to-date!

Also due to LLMs, OpenSSL has had several important point releases for security.  I’d suggest double-checking what OpenSSL (system or not) Feather’s redistribution of the tor package uses.  Tor Browser does NOT use system OpenSSL, and the Tor Project has been consistently updating the OpenSSL binaries that they package with Tor Browser’s tor daemon.

Code:

+    if (output.contains(QByteArray("protocol listed as required in the consensus is not supported"))) {

Parsing log output this way is brittle.  A quick grep of my tor tree suggests starting here to look for a better way to detect this condition...

Code:

  if (!protover_all_supported(required, &missing)) {
    tor_asprintf(warning_out, "At least one protocol listed as required in "
                 "the consensus is not supported by this version of Tor. "
                 "You should upgrade. This version of Tor will not work as a "
                 "%s on the Tor network. The missing protocols are: %s",
                 func, missing);
    tor_free(missing);
    return 1;
  }

...but at this particular moment, it seems the effort would be better spent on more reliably keeping Tor up-to-date.

[DireWolfM14]

Consider a path towards integrating Arti.

I read up on Arti when I saw you had mentioned it before.  Definitely a neat project.  As much as I am a fan of Rust, I just don't see much demand for it to supplant C where it's already been entrenched.  For new software, or re-writes of other languages that aren't as practical as C it makes lots of sense.

I run a Tor daemon with my own local patches; their repo and their build/test processes are relatively easy to work with, even just for personal use.

Just curious; what exactly are you patching, why, and how?

[LoyceV]

Are you guys not using the Tor repository to keep your Tor install up to date?

I'm using my Linux distro's default packages.

[nullius]

I read up on Arti when I saw you had mentioned it before.  Definitely a neat project.  As much as I am a fan of Rust, I just don't see much demand for it supplant C where it's already been entrenched.  For new software, or re-writes of other languages that aren't as practical as C it makes lots of sense.

This will make me as popular as a whore in church to mention here, but credit where due:  The big project to rewrite Tor as Arti was funded by Zcash grants for multiple years.  I have mixed feelings about this; I’m not such a fan of rusting all the world’s code, and I kinda dislike Rust, and I know the C daemon like an old friend... sigh.

Besides the whole “memory-safe language” thing, some aspects of Arti’s design are far superior to the C daemon.  That’s a design issue, not a language issue; while rewriting from scratch, the Tor lead devs did their wishlist of “how we should’ve done it”.  (Imagine what Bitcoin Core would do, if they could throw the whole thing out instead of slooooowly refactoring out libbitcoinkernel (a good explanation), etc.)  In particular, Arti is designed from the ground up to work with other programs—either via an RPC protocol much better than the old control socket, or embedding as a crate/library.

Embedding and bundling in other programs has been a major pain point.  Tor always should have been deployable a library—and also, the Tor control port protocol has always been awful.  So...

Switching to Arti would not require Feather to rewrite their own project in Rust!  On the integration page I linked, both FFI and RPC are noted.

The C daemon will someday be phased out.  I haven’t yet tried Arti, but I know I need to dig into it sooner rather than later.

I run a Tor daemon with my own local patches; their repo and their build/test processes are relatively easy to work with, even just for personal use.

Just curious; what exactly are you patching, why, and how?

Occasionally, I’ve fixed bugs.  For instance, I discovered and locally fixed #40739 (clearnet) a few years before the Tor Project’s patch broke my branch with a merge conflict, and I had to revert my patch.  And now, I didn’t help the community, and I didn’t get credit for it, and no one will ever even believe me.  (No, I’ve never found a 0day in Tor!)

Other stuff I do is sensitive; I would prefer not to discuss it publicly.

But most importantly:  I am heavily dependent on Tor.  Some people toss around the terms “free software” and “open source” as buzzwords.  I actually use the source.  If my life is so deeply entwined with a piece of software as it is with Tor, I want to know that code intimately.  The best way to keep in touch with the code is to build from git, spend some time poking around in the code, and customize little things to my satisfaction.

P.S., DireWolfM14, this thread was actually spawned by my alt’s needs, which delayed reply to you until OP’s aneurysm/thread lock cut it off—for now.  XMR got a plug in my artfully slipped-in fungibility manifesto, though the manner thereof probably won’t make XMR people much happier than BTC/AMLed-NFT maximalists.

Are you guys not using the Tor repository to keep your Tor install up to date?

I'm using my Linux distro's default packages.

If that’s Debian or Debian-based, the Tor Project recommends their own .deb instead.  That’s why they make it.  I don’t know how it is now, but in past years the Debian tor package was poorly-maintained.

[DireWolfM14]

No, I’ve never found a 0day in Tor!

Well, that's good news for those of us who are code-illiterate. 

Other stuff I do is sensitive; I would prefer not to discuss it publicly.

Roger that.  Thanks for entertaining the question nonetheless.

Are you guys not using the Tor repository to keep your Tor install up to date?

I'm using my Linux distro's default packages.

If that’s Debian or Debian-based, the Tor Project recommends their own .deb instead.  That’s why they make it.  I don’t know how it is now, but in past years the Debian tor package was poorly-maintained.

I don't recall when or why I started using the Tor repository, but years back I do recall running into an issue on Windows that's similar to what's going on with Feather.  I was in the habit of running a Tor daemon as an NTService so I didn't have to start Tor Browser whenever using Electrum wallet, but I was really lazy about keeping Tor up to date.  Tor's Debian repository makes keeping it up to date super easy.