On Thu, Sep 03, 2026 at 09:11:01AM -0400, David Goulet via tor-dev wrote: > Greetings everyone! > > Next Tuesday, September 8th, we will do a C-tor release (0.4.9.12) containing > fixes for a set of high severity issues. > > And then, as a heads up, C-tor will likely enter a release cadence every 2-3 > weeks for the foreseeable coming month(s) as we continue to fix more and more > security issues we received from this new reality that we happen to all be in > where LLMs are in an echo chamber stuck in a tight loop over our C code ;). Hey David, Is the 2-3 week cadence a permanent change? If so, that might pose a problem for operating system vendors with slow package building servers. For example, it usually takes 2-4 weeks to build the HardenedBSD package repositories. (4 weeks if starting the build from scratch, 2-ish weeks for the average incremental build.) And then there's the matter of deploying the updated versions in our infrastructure. A lot of work between building packages and deploying them in our own infrastructure. As a resource-constrained downstream, I'm not entirely sure if we can keep up with that kind of cadence. I'm hoping it's just temporary while security issues get triaged and worked through. Thanks, -- Shawn Webb Cofounder / Security Engineer HardenedBSD Signal Username: shawn_webb.74 Tor-ified Signal: +1 (719) 756-1197 / activist_opsec.27 https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc
Attachment:
signature.asc
Description: PGP signature
_______________________________________________ tor-dev mailing list -- tor-dev@xxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to tor-dev-leave@xxxxxxxxxxxxxxxxxxxx