And the more troubling aspect is that the courts have accepted the government's arguments that no warrant is required to disclose IP addresses:

> ... Tor users clearly lack a reasonable expectation of privacy in their IP addresses while using the Tor network. In other words, they are taking a significant gamble on any real expectation of privacy under those circumstances.

If both of these statements are true (that the government could easily run a majority of Tor relays, and that the government does not need a subpoena), then any particular vulnerability being patched is irrelevant to the inherent insecurity of the network.

This doesn't make it bad software; it's the best we have, and being able to monitor traffic across the entire Internet is a huge ask of an attacker.

But I'd expect that to change, a low-latency network like tor that also doesn't create cover traffic just architecturally isn't equipped to deal with something approaching a global passive adversary. Though networks for even that can be built..

AFAIK, Tor developers are willing to implement cover traffic; the main reason it hasn't happened so far is that there is no known way to do this that clearly helps against that kind of threat. Until we have this (either from academic research, the Tor Project's own efforts or something else), it would be at best a placebo.

In other words, its not gonna protect you from the NSA, ever, nor was it meant to. It might have a fightning chance against the FBI though. Actually it was surprising how in Snowden's files, the NSA was having trouble reliably deanonymizing targeted tor users.