[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: Out-of-date Tors (was Re: 25 tbreg relays in directory)
-----BEGIN PGP SIGNED MESSAGE-----
On May 26, 2009, at 8:35 AM, Nils Vogels wrote:
On Tue, May 26, 2009 at 4:04 AM, <scream@xxxxxxxxxxxxxxxxxx> wrote:
On Mon, 25 May 2009 16:59:33 -0400, Roger Dingledine <arma@xxxxxxx>
But you're right, this is a real problem. Some of our users use
packaging systems that keep them mostly up to date. But some are on
(...insert expletives here). And some are on BSD, which either
no easy upgrades, or the users don't use them.
Has this been discussed with the Ubuntu packagers? Is there a link
discussion I can read... I'm a user of Ubuntu and would be very
in being able to update via apt (repository).
I am using Ubuntu from apt (but only as a client), and if needed I
could also provide updates. I used to be a package maintainer for
FreeBSD, but have moved completely off to Linux these days.
If the packagers need some help or are in time constraints, feel free
to drop me a line.
The problem with Ubuntu can be followed by reading https://bugs.launchpad.net/ubuntu/intrepid/+source/tor/+bug/328442
In short: Tor provides working Ubuntu packages in the noreply
repositories, so users can simply use those to get working, up-to-
date, secure versions. Because Tor is in Ubuntu Universe, no security
updates are provided by Ubuntu itself, meaning that Ubuntu used to
ship remote-root vulnerable versions of Tor for a long time, even
though they were informed about the problem and could simply have
adopted the packages from noreply. As it stands, I personally deem any
package in Ubuntu universe as a great risk to anyones computer
security, since updates are not provided in a timely manner. That
being said, I'm very happy with the current situation (Tor being
removed from Ubuntu, while users can install packages from noreply
without any trouble to get the latest version of Tor).
Please see https://wiki.torproject.org/noreply/TheOnionRouter/TorOnDebian
if you want to learn more.
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----