The feds pay for 60 percent of Tor’s development. Can users trust it?

Re:The feds pay for 60 percent of Tor’s development. Can use... by bdcravens on Friday September 06, 2013 @10:29PM (#6343689)

I originally had a snarky comment about not trusting nodes, then reread what you said as well as the article, and realized that's a different issue... the article is questioning trusting the Tor Project due to DoD funding; your response is you can trust the code they generate as it's open for review. So now I have completely different snarky response :-)

How many users are downloading and compiling source? If you're running a binary you didn't compile, it's really no different than being closed source. (Unless you get the MD5 sig from an independent, trusted third party, and verify yourself)

[ Parent | on HN ]

Re:The feds pay for 60 percent of Tor’s development. Can use... by thex86 on Friday September 06, 2013 @10:38PM (#6343708)

I am sorry, but this is just wrong.

a). For all the bundles, they are signed by the Tor developer who packages them. The signatures are clearly visible with the downloads.

b). Most importantly:

Tor is moving towards deterministic builds: https://blog.torproject.org/blog/deterministic-builds-part-o...

Different people build the Tor Browser Bundles on Gitian (look it up), and they will have the same hashes. So unless ALL of these people are lying, if their hashes match, you can be convinced that it is the same binary as you would get by compiling it.

[ Parent | on HN ]

Re:The feds pay for 60 percent of Tor’s development. Can use... by pshc on Friday September 06, 2013 @11:17PM (#6343814)

Re: Tor deterministic builds link

That writeup is really fucking cool. You should submit it as its own story!

[ Parent | on HN ]

Re:The feds pay for 60 percent of Tor’s development. Can use... by thex86 on Friday September 06, 2013 @11:33PM (#6343850)

Thanks, just did!

[ Parent | on HN ]