Self-hosting the Tor Project users forum

(blog.torproject.org)

62 points | by gslin 321 days ago

3 comments

  • superkuh 321 days ago
    They moved to this away from the per-article comment system they used to have for news posts, etc. In the past anyone (no account needed) could post a comment on the documents they posted and have it displayed in-line with other comments at the bottom.

    But then The Tor Project chose to move to a registration only forum where all the discussion of news is hidden away from the article. It's really impeded discussion of the tor project's decisions... which I think they consider a benefit. They didn't like having criticism of things like their early removal of tor v2 support on their main pages. Much better to hide in registration only forums requiring the latest bleeding edge browsers and JS to use, in part of the site no one visits.

    • jerheinze 321 days ago
      How was the deprecation of v2 onions in any form or shape "early"?
      • haakon 321 days ago
        It wasn't early; v2 desperately needed to be phased out. The crypto was obsolete and the protocol had known flaws. Over a year's lead time was given (see timeline: https://blog.torproject.org/v2-deprecation-timeline/).

        However, links live on in a million places, and it's hard to motivate hobbyist webmasters of niche onion sites to migrate. On /r/Tor, we regularly get people asking why some onion site doesn't work, and it's a v2 site. That's two years after they stopped working. (I wish Tor Browser would detect a v2 attempt and give a nice explanation instead of an opaque error message, though)

        The truth is that whatever schedule they could choose would cause allegations of it being too early.

        • superkuh 321 days ago
          Technically there are still plenty of tor v2 infrastructure software running out there. It's only the people using the modern Tor Project releases that cannot visit these sites. The rest of us still can.

          I still host a couple v2 onions on brute forced vanity tor domain names. Because that's what I wanted to use tor for, the name system, not to be anonymous or secure or anything. I just didn't like having to "rent" a ~.com domain that's not mine. On tor I thought I owned my domains because I held the private keys. But the tor project relieved me of that delusion when they simply dropped support for v2 name resolution and (mostly) everyone stopped being able to get to my sites.

          But that's tangential. Regardless of weather tor v2 removal was early or not, the switch to secluded, account requiring, forums instead of comments was bad. Self hosting the bad system doesn't make it better.

          • ignoramous 321 days ago
            > Because that's what I wanted to use tor for, the name system, not to be anonymous or secure or anything. I just didn't like having to "rent" a ~.com domain that's not mine.

            The Tor project doesn't exist for whatever usecase you were using it for.

            > On tor I thought I owned my domains because I held the private keys. But the tor project relieved me of that delusion when they simply dropped support for v2 name resolution

            Not routing to v2 domains isn't the same as not owning your .onion addresses? The latter is cryptographically guaranteed, is it not?

            • superkuh 321 days ago
              They've made it very clear they don't care now. But I still remember when it was part of what they advertised about tor. A lot has changed since 2010 in the tor project.
              • jerheinze 320 days ago
                You still haven't made any clear case against them. Why even stick with v2 onions in the first place?
                • predictabl3 319 days ago
                  probably something something Debian. I don't even get it, there's no reason not to just adopt v3. There was one reason, for a short while, that certain hosts might have wanted to stick with v2, but that hasn't been the case for 2+ years now. There are v3 vanity generators, v2 urls are still too long to memorize anyway. Sorry, but this just feels like another user being stubborn about change, ignoring that that change happened for a reason. See also: Wayland.
  • zaroth 321 days ago
    Interesting issue with the U2F account lockout potential - due to the anti-phishing protection and the domain name changing I assume?
    • telotortium 321 days ago
      Surely there must be a way to automatically migrate users upon login, but that still doesn't help the people who don't sign in - 2 weeks is not much time
  • AndyMcConachie 321 days ago
    I thought this article would be about them hosting their discussion forum on a .ONION address.
    • mburns 321 days ago
      Sounds like that is in the cards:

      >This will offer us more control over the forum's configuration and allow us to provide an experimental onion service for our users accessing the platform via the Tor network.