neerdowell

Yes there is. There are currently 857 exit nodes. The Tor Project only has to personally know who runs 86 of them to ensure that 90% of the exits are not run by the NSA.

In fact, since ~90% of traffic exits through the top ~260 relays, they'd only need to know 27 of the people who run those.

No, it doesn't. TB sends all kinds of misinformation, from the user agent string (always reports itself as being its base version of Firefox running on 32-bit Windows 7) to rounding javascript timing functions to reduce the precision.

> A solution would probably be a browser where every version, on every platform reports the exact same things, always the same way.

That's exactly what Tor Browser does.

Their court filing[0] says the license fee was "unspecified" and the $2 million figure was based on "information and belief" which is legal terminology used to dodge perjury[1]. If they had really been told that, they wouldn't be using terms that mean "I heard that from somewhere second-hand and think it might be true".

[0] https://www.scribd.com/doc/311974670/Wire-Swiss-GmbH-v-Quiet...

[1] https://www.law.cornell.edu/wex/information_and_belief

Not because it was pushed via bundlware or a Google-owned property?

[0] https://i.imgur.com/LNFjqzd.png

[1] https://i.imgur.com/B3b5iCZ.png

The checkbox is pre-selected.

Response from actual FDroid dev:

> It's connected to the network, yes

What metadata does Google get from Signal messages? The time/date you received a message, the size of the message... Is there anything else?

Moxie says Signal works fine in China: https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

He doesn't like how F-Droid uses centralized signing keys which are stored online: https://github.com/WhisperSystems/Signal-Android/issues/127#...

This scheme has various weaknesses, eg. a rogue key could be associated with someone's account without their knowledge, and anyone who sends this person messages will therefore be sending a copy encrypted with the rogue key.

At least, that's the way I see it.

Now, are you saying that because it's possible to bypass the mitigations in some other cases, preventing that vulnerability (and others) doesn't matter?

Or, are you saying that it would be possible to craft an exploit that bypassed the stack protection for that particular vulnerability? In which case I would love to see your PoC.

Or something else?

[0] https://www.qualys.com/2015/10/02/opensmtpd-audit-report.txt

Are these "shoddy applications" not more secure on OpenBSD due to the various mitigations applied to userland software?

The easy way to remember this distinction is to know that one of the most famous libel cases in history, nicknamed the "McLibel" case, concerned printed pamphlets.

uBlock hasn't been updated in almost a year. uBlock Origin is actively developed. uBlock has effectively had no significant changes or improvements since the uBlock Origin fork happened.

I mean, other than that time just a few years ago[0] where Google broke the law and then breached the contract they signed with the UK Government.

[0] http://www.bbc.com/news/technology-19014206

We're talking about a corporation that had employees access personal data to show off to teenagers[0].

No one can be trusted with data, therefore it needs to be restricted to only those who need access. The NHS probably needs data about patients, Google does not and the unspecified third-party contractor Google has employed to store the data definitely does not.

[0] http://techcrunch.com/2010/09/14/google-engineer-spying-fire...

Maybe they want people to be able to easily distribute binaries of the software via BitTorrent. Apache allows this, the Vim License allows this, GPLv2 does not[0].

[0] https://www.gnu.org/licenses/gpl-faq.html#BitTorrent

Check out the bottom of page 7, and the diagrams on page 8.

[0] http://pubs.opengroup.org/onlinepubs/9699919799/utilities/rm...