Slashdot Mirror
Tor Project Installs New Board of Directors After Jacob Appelbaum Controversy (theverge.com)
An anonymous reader writes: The Tor Project announced today that is has elected an entirely new board of directors as part of a larger shake-up after accusations of misconduct by former employee Jacob Appelbaum. Appelbaum left the company in June after the nonprofit organization said it had received multiple accusations against him. The seven board members that are leaving the organization said in a statement today that it is their "duty to ensure that the Tor Project has the best possible leadership." The New York Times reports that the board agreed to step down following the controversy surrounding Appelbaum. Some of the board members who will be leaving include Tor Project co-founders Roger Dingledine and Nick Mathewson, who will continue to work on the organization's technical research and development team, according to the statement. They will be replaced with several prominent cryptographers and scholars, including University of Pennsylvania professor Matt Blaze, Electronic Frontier Foundation Executive Director Cindy Cohn, and security technologist Bruce Schneier. Meanwhile, researchers at MIT have been working on a new anonymity network that they say is more secure than Tor.
You'll find out in the press. That's what the press is there for. And the more transparent a project is, the easier it is to find out whether it does something else than it claims it does. TOR, being a true open source project, is a very transparent project.
Why does every single project meant to keep us secure have someone accused of sex crimes under fishy circumstances? Even Linus gets some of this now. I hope he avoids going anywhere without reliable witnesses present.
Why is there no mention of the fact that one of the alleged anonymous "victims" said that the people who came forward did not speak for her and that the accusations were completely false? I seem to remember that Slashdot never bothered to post that story and yes, I did, in fact, submit it.
Make of this what you will. Do we only cover the parts of the story we want people to hear?
From the Wikipedia article on Applebaum:
The Tor Project and several other organizations ended their association with Appelbaum in June 2016 following several allegations of sexual abuse; Appelbaum denied the accusations.
Okay, so he's being thrown under the bus due to an accusation.
Reading further:
One woman, who has been held-up as an example of one of his victims, hotly contested allegations that Appelbaum abused her and questioned the validity of other allegations against him.
Women are generally sensitive about sexual abuse, so having a woman deny the allegations, and with insight into the situation question the other allegations, shouldn't we at least wait for charges being filed?
Various activists and others have publicly supported Appelbaum, citing that extrajudicial social reactions to the allegations were overly extreme, and had violated Appelbaum's fundamental rights, resulting in a witch-hunt.
Are we a society rules by law?
Or do we simply try things in the court of public opinion, where the loudest voice is the strongest evidence?
We have an entire board being replaced due to an accusation.
The potential for abuse is enormous.
The board stepped down.
Voluntarily.
@" FBI Tor "exploits" are people running with JS or Flash enabled in the Tor browser"
No, FBI attacked *servers* first.
1) Tor browser bundle COMES with Javascript enabled and Noscript installed instead to selectively disable it. Why would it permit javascript to be enabled at all for a dark site if the intention was to make it secure? Pasting a warning is not a fix.
2) The bad nodes and problems with the directory servers are known, disclosed by Snowden et al. and have received zero action from the Tor Project board.
"There's no such thing as perfect security. "
Known attacks have received excuses from the Tor project, not fixes.
Jacob needs to fork the project and fix it, not make excuses.
They may as well have bought it. Tor is a government trojan. Stay away from it! This "controversy" is a bullshit distraction. Don't use Tor. If freenet is somewhat secure, use it instead. Or just send encrypted archives over email, Usenet, IRC, whatever, but don't use Tor.
Many on the former and current boards have been too cozy with questionable entities to merit blind placement of trust.
Will you see backdoors in the code? Unlikely.
Will they be funded, or not funded, to do certain types of development directions and propaganda? Definitely. Always have been.
As always, Tor and every other tool, is only as good as, and as good for, what you see in the code,
NOT what's on the tin.
Are we seeing an actual change of the guard, and if so, is it actually to benefit privacy, security, and anonymity, or are we going to find out all these new board members have been compromised/were already working for the government to compromise our security?
I don't really believe that, but it is worth asking and scrutinizing periodically, just like the tor code and processes itself.
Very good question. Schneier has an excellent reputation and has fought considerably to free up encryption etc. On the other hand at least one of the accusations is provably false.
Probably the new board is chosen by the old board to provide a safe set of hands who are unlikely to collapse under pressure. Probably also this was an attack by a group which has a tendency to use false accusations to force people out of positions of power that they want to take over. That is a very serious situation and it's' really important to know who was behind each of the accusations.
Moral within an organisation is always important, and stakeholders should have confidence in the board to manage things, but;
This is an organisation that lots of powerful people and government would like to see destroyed, it maintains a product that is controversial, and is used in some extreme circumstances.
Do they really need to manage the perception of their work so aggressively. People will have very strong views for/against TOR independent of perceived employee behaviour.
Can Tor as an organisation be trusted if public perception is more important to them than proven facts.
Is TOR just about money now ?
> Jacob needs to fork the project and fix it, not make excuses. Agree. But do= these actions not set TOR on the path for that course of action? His links were identified and segregated out of the system and now he is out of the management. Yeah... he is still involved but likely will be watched now. It would be best to throw him out completely.
Accusation.
Basically the ACLU crowd took over. Is this a good thing? Depends if you're into whitepapers, policies and ideas, or if you want to protect your privacy.
lucm, indeed.
Just about anyone who is to be 'taken down' in western societies seems to be done by sexual impropriety. JFK, MLK both had allegations of misconduct.
That's a convenient way to brush things off.
For MLK the FBI has sex tapes (including video) recorded in his hotel room. Those tapes were not a fabrication but rather a surprise, as the FBI was instead hoping to get evidence of MLK being in cahoots with commies (of which there's no evidence).
Back then the FBI tried to leak those but the media refused to play ball (that was a long time before Gawker). So they sent a ridiculous letter to his house, with a copy of those tapes. Here's an actual quote from that letter which was allegedly read by his wife first:
The American public will know you for what you are, an evil, abnormal beast, and Satan could not do more
Years later a bunch of right-wingers tried to get those tapes released but a judge sealed them until 2027.
So take off your tinfoil hat. It's healthy to ask questions, but when you raise doubts about sexual allegations simply on the basis that the alleged perpetrator is famous and therefore some nefarious organization must be trying to frame him, you're making it more difficult for real victims to come out.
lucm, indeed.
[1] isn't he former DoD or something?
A very interestig and apparently false accusation to make. He's worked for British Telecomms when a company he co-founded got bought out, but it's not quite the same thing. He's also had a book (Applied Cryptography) used in lawsuits against the defence establishment, but again, that's not quite the same as working for them.
Do you have some citation or are you just randomly spreading shit?
The issue is not with unfounded accusations. The people that worked with Applebaum over the years found the accusations very plausible, because of the conduct he has shown to the rest of the board members. They know why they finally got rid of him.
This story isn't about some accusations that came out of the blue, but about an organization finally pulling the plug on a really mean character that has used his social skills and status for over a decade to abuse countless people.
My problem is: Why haven't they done so sooner. If you read the accounts, you really have to wonder how toxic the organizations (TOR, CCC, cDc, et al) were that hosted this gigantic psychopath for so long. And if you look at his bio (Wikipedia), his psychological problems aren't a big surprise.
So why has this been going on for so long, and how many other (smarter) abusers still hide in these communities? There is a lot of abuse that can't be adequately addressed by criminal law, but still warrants dealing with and the TOR project has not shown any interest in finding out how to deal with these issues in the future. Neither have cDc or the CCC.
A few things:
1. There are only a few employees actually working for Tor. Most of the research surrounding it is done by academics at other institutions. I also personally know that Tor was doing similar research into "attack nodes" as what was done at NEU, albeit not as sophisticated.
2. These attack nodes were explicitly targeting hidden services, not Tor clients. This research has no impact on the security of the most common use case of Tor, which is to anonymize access to public websites.
Tor seems to have 2 fundamental problems they can't fix:
1. Tor hidden servers seem to have a new "oops, totally not anonymous" exploit every few months since the dawb of the project.
2. No one one can seem to write a secure web browser. Even with js etc disabled, FF (and everyone else) has had flaws simply in the code that renders a page. Not common at all, but all it takes is 1, and nations can afford to buy such exploits (and we know they do).
There no actual evidence of a successful attack on the onion routing element of TOR, and the team seems do an OK job of fixing theoretical issues, but if servers are flawed and the browser is flawed, so what?
I think TOR is doing a great job, however, of protecting privacy from the likes of Google and Facebook. If that's your goal, TOR is a great tool.
Socialism: a lie told by totalitarians and believed by fools.
I, for one, believe everything I read in the news. Professional journalists never lie and they certainly don't have an obvious class bias.
I think you've really hit upon the crux of the "why do I care?" question.
For me, Tor is about securing my privacy from those who would exploit it; it's about securing my day-to-day rather pedestrian concerns which mainly revolve around not giving personal information to advertisers that I haven't consented to. Those do NOT include kiddie pr0n or anything that a nation-state would give a flying fuck about. I'm not trading in state secrets.
Therefore, for me, Tor is just fine. For people involved in kiddie pr0n or trading state secrets, well, fuck those guys. Not my problem.
This comment is my opinion and does not represent an official position of Donald Trump or others I do not work for