[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #18156 [Tor]: Add a torrc flag to disable ADD_ONION creation.

Subject: Re: [tor-bugs] #18156 [Tor]: Add a torrc flag to disable ADD_ONION creation.
From: "Tor Bug Tracker & Wiki" <blackhole@xxxxxxxxxxxxxx>
Date: Wed, 23 Mar 2016 19:25:18 -0000
Auto-submitted: auto-generated
Delivered-to: archiver@xxxxxxxx
Delivery-date: Wed, 23 Mar 2016 15:25:28 -0400
In-reply-to: <051.b47e77db51355bdb8e30548f31a21c84@xxxxxxxxxxxxxx>
List-archive: <http://lists.torproject.org/pipermail/tor-bugs/>
List-help: <mailto:tor-bugs-request@lists.torproject.org?subject=help>
List-id: "auto: Tor bug tracker status mails" <tor-bugs.lists.torproject.org>
List-post: <mailto:tor-bugs@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs>, <mailto:tor-bugs-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-bugs>, <mailto:tor-bugs-request@lists.torproject.org?subject=unsubscribe>
References: <051.b47e77db51355bdb8e30548f31a21c84@xxxxxxxxxxxxxx>
Reply-to: tor-assistants@xxxxxxxxxxxxxx
Sender: "tor-bugs" <tor-bugs-bounces@xxxxxxxxxxxxxxxxxxxx>

#18156: Add a torrc flag to disable ADD_ONION creation.
-----------------------------+------------------------------
 Reporter:  cypherpunks      |          Owner:
     Type:  defect           |         Status:  closed
 Priority:  Medium           |      Milestone:  Tor: 0.2.???
Component:  Tor              |        Version:
 Severity:  Normal           |     Resolution:  wontfix
 Keywords:  tor-hs, control  |  Actual Points:
Parent ID:                   |         Points:
 Reviewer:                   |        Sponsor:  SponsorR-can
-----------------------------+------------------------------
Changes (by dgoulet):

 * status:  new => closed
 * resolution:   => wontfix


Comment:

 After discussion on #tor-dev, with an open control port, if an attacker is
 able to give it command, you are doomed by design.

 The correct but very difficult way to fix this would be to have a control
 command filter that is a subset of commands that could be consider "safe"
 which is a `HARD` problem to solve because it depends heavily on the
 thread model of the user/app. See ticket #8369 about this.

 Closing this one as wontfix.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/18156#comment:6>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs