Isis mostly works on Python stuff like bridgebd: https://gitweb.torproject.org/bridgedb.git/
On the Tor daemon itself, she's got a pretty good patch series on https://trac.torproject.org/projects/tor/ticket/7144 that I hope she'll have time to refactor soon. Maybe accusing her of being a total phony is not the best way to help her there?
(omg slashdot still exists)
Please help us improve our documentation.
on
Spying On Tor
·
· Score: 5, Informative
Hi all. I'm one of the Tor authors.
We're trying very hard to get out the message that you should always use encrypted protocols over Tor, if you're doing anything even slightly sensitive.
Right now, we do this in our documentation, and in a list of warnings on our download page. But obviously, this isn't good enough, since some of the commenters here seem to be surprised at finding it out.
Does anybody have good ideas about how to get the word out better?
(As for the SSL MITM thing: we've run into situations like this one before. Usually, it turns out that the exit node isn't doing the MITM itself, but is getting MITMd itself by its upstream. This happens depressingly often in some countries, and in some dormitories. I've dropped a line to the directory authority operators Mike Perry (the guy who maintains the Torbutton firefox plugin) has been working on an automated detection tool for this stuff. It would be great if somebody with programming chops would step up and give him a hand.)
4. Logic of BitFast
BitFast works with numbers in the bit level. It applies masks to cut the numbers so it uses only the desired ( based on the
programmer/problem specifications ) number of bits every run. It always start with the LSB ( Less Significant Bits ) ignoring
the any other bits and every run it moves to the higher block of bits until the whole list is sorted. So is we want to sort 8 bit
every run , the first timer it will sort 0-7 bits ( Least significant ), then the 8-15 bits , then the 16-23 bits and for last the
24-32 bits ( Most significant ) , having now sorted the entire list of 32bit numbers
Basically, Tor goes through some effort in order to be easy to block, by making sure that you can easily get a list of exactly the Tor nodes that allow connections to your servers. If you don't think people who want privacy belong on your service, you don't need to support them; it's your service after all. (Some people have already written RBL-like tools, but I haven't seen any that I like so far; all the ones I've seen list all Tor servers, even the ones that do not permit outgoing connections and so cannot deliver unwanted connections.)
On the other hand, if you do think that privacy is a useful thing, there are ways to allow anonymous users without allowing unlimited abuse. See the first link above.
I agree, the default positions for the control and alt keys are idiotically. IMO, the programable version is a must so you can remap them. The way my thumb works, I like to switch control with delete and alt with end; this puts all the meta keys in easy reach of my left hand. With this change, you're home free.
With this proviso, I'd recommend the Kinesis to anybody who needs to type more than a few hours a day, and who can afford a day or two of accomodation time.
(I've never the tried the foot switch and my work seldom requires the numeric keypad. YMMV.)
If you have an alternative policy that is even slightly practical for a class with 800-odd students, I'd sure like to hear it!
Well, here's what I did when I had to write test drivers for an 150-person class: In addition to automated tests for the TA's, I also wrote
sanity tests that the students could run themselves. In other words, when you thought you had finished problem set 5, you typed:
verify ps5
. This would remove any object files, try to recompile, make sure that your code provided the right interfaces (it's amazing how many people forget to capitalize function names), and so on.
Later on, your TA would do:
test ps5 <username>
. This would run the same sanity checks, and then perform the tests.
After a few iterations, it actually started to work. Students realized that they could avoid pissing off their TA's by running a command line program.
In any case, it's not going to hurt you to be exposed to a different programming environment. At worst, you'll know *why* Windows programming is as horrible as Slashdotters often regard it:)
Slashdot Mirror
Isis mostly works on Python stuff like bridgebd: https://gitweb.torproject.org/bridgedb.git/
On the Tor daemon itself, she's got a pretty good patch series on https://trac.torproject.org/projects/tor/ticket/7144 that I hope she'll have time to refactor soon. Maybe accusing her of being a total phony is not the best way to help her there?
(omg slashdot still exists)
Hi all. I'm one of the Tor authors.
We're trying very hard to get out the message that you should always use encrypted protocols over Tor, if you're doing anything even slightly sensitive.
Right now, we do this in our documentation, and in a list of warnings on our download page. But obviously, this isn't good enough, since some of the commenters here seem to be surprised at finding it out.
Does anybody have good ideas about how to get the word out better?
(As for the SSL MITM thing: we've run into situations like this one before. Usually, it turns out that the exit node isn't doing the MITM itself, but is getting MITMd itself by its upstream. This happens depressingly often in some countries, and in some dormitories. I've dropped a line to the directory authority operators Mike Perry (the guy who maintains the Torbutton firefox plugin) has been working on an automated detection tool for this stuff. It would be great if somebody with programming chops would step up and give him a hand.)
Whoever told you to do this is wrong, and you should not take any more advice from them about copyright.
To learn why, do a google search on "poor man's copyright".
The Tor project has a FAQ about abuse, from the perspective of Tor server operators and other folks on the internet. Of particular interest are:
Also of interest on the main Tor FAQ is:
Basically, Tor goes through some effort in order to be easy to block, by making sure that you can easily get a list of exactly the Tor nodes that allow connections to your servers. If you don't think people who want privacy belong on your service, you don't need to support them; it's your service after all. (Some people have already written RBL-like tools, but I haven't seen any that I like so far; all the ones I've seen list all Tor servers, even the ones that do not permit outgoing connections and so cannot deliver unwanted connections.)
On the other hand, if you do think that privacy is a useful thing, there are ways to allow anonymous users without allowing unlimited abuse. See the first link above.
I agree, the default positions for the control and alt keys are idiotically. IMO, the programable version is a must so you can remap them. The way my thumb works, I like to switch control with delete and alt with end; this puts all the meta keys in easy reach of my left hand. With this change, you're home free.
With this proviso, I'd recommend the Kinesis to anybody who needs to type more than a few hours a day, and who can afford a day or two of accomodation time.
(I've never the tried the foot switch and my work seldom requires the numeric keypad. YMMV.)
If you have an alternative policy that is even slightly practical for a class with 800-odd students, I'd sure like to hear it!
Well, here's what I did when I had to write test drivers for an 150-person class: In addition to automated tests for the TA's, I also wrote
. This would remove any object files, try to recompile, make sure that your code provided the right interfaces (it's amazing how many people forget to capitalize function names), and so on.sanity tests that the students could run themselves. In other words, when you thought you had finished problem set 5, you typed:
Later on, your TA would do:
. This would run the same sanity checks, and then perform the tests.After a few iterations, it actually started to work. Students realized that they could avoid pissing off their TA's by running a command line program.
In any case, it's not going to hurt you to be exposed to a different programming environment. At worst, you'll know *why* Windows programming is as horrible as Slashdotters often regard it :)
Agreed.