Roger Dingledine: > On Thu, Aug 18, 2016 at 08:49:04PM -0400, myzeus@xxxxxxxxxxxxxxx wrote: >> I feel like Tor has become increasingly user-friendly >> and the Tor Browser Bundle is by far less 'intimidating' to perform >> first time configuration than it was a few years ago. > > Yay! Sign me up. There are many millions of people around the world > who can benefit from the things that Tor Browser can do for them, > but there's still a lot of work to be done. > > In fact, wait a minute, I already wrote this text before. :) Here is the > middle chunk of my blog post from last December 1st -- I still believe > it all now, and I think it gives us some good ideas for a future roadmap > of Tor's priorities. > > "We have much more work ahead of us in the coming years. First and > foremost, we care about our users and the usability of our tools. We > want to accelerate user growth: The Tor network sees millions of users > each day, but there are tens of millions more who are waiting for it to > be just a little bit faster, more accessible, or easier to install. We > want to get the word out that Tor is for everyone on the planet. > > We also need to focus on outreach and education, and on helping our > allies who focus on public policy to succeed. Tor is still the best > system in the world against large adversaries like governments, but > these days the attackers are vastly outspending the defenders across the > board. So in addition to keeping Tor both strong and usable, we need to > provide technical advice and support to groups like EFF and ACLU while > they work to rein in the parts of our governments that have gone beyond > the permissions and limits that our laws meant to give them. > > From an organization and community angle, we need to improve our stability > by continued work on transparency and communication, strengthening our > leadership, choosing our priorities well, and becoming more agile and > adapting to the most important issues as they arise. > > Taller mountains await after these: We need to tackle the big open > anonymity problems like correlation attacks, we need to help websites > learn how to engage with users who care about privacy, and we need to > demonstrate to governments around the world that we don't have to choose > between security and privacy." > > --Roger Hey Roger, First off, I fully agree with everything you've said here, especially the part about how having a technically sound anonymity system isn't the only battle that needs to be fought here. I also fully agree with what Griffin said -- my confidence in Tor (although already very solid beforehand) has increased substantially based on how this issue has been handled. If I might give some hopefully constructive feedback on this, though: while it is very important for more usable solutions to be available and widely advertised on the website (since these solutions are the ones that increase the anonymity set the most), I feel like a neglected minority is the set of users who were sufficiently technically skilled to run Tor Browser Bundle back when it was difficult to use, and whose technical skill makes them now able to run more complex (though more secure) systems like Qubes-Whonix. I feel like this is a legitimate point made by the Reddit poster -- it would be great for the Tor website to provide links to more complex systems like Qubes-Whonix, perhaps near the bottom of the download, and with a note that such systems are are intended for technically savvy users and will be harder to use, but aim to provide more security against sophisticated attackers than TBB can. People like myself, who are more than capable of using Whonix, learned about it from other sources (e.g. this mailing list), and I'm sure there are plenty of people with my level of technical sophistication who don't have the time nor interest to read a mailing list for that info. Now, I realize that it's easy for me to say this, and that writing such additions to the website in an accessible way is more difficult. So, hopefully no one takes this as grumpiness in any way -- I love the focus on usable solutions getting the spotlight -- but maybe some kind website maintainer could give some love to the minority of users who are totally okay with going through some extra usability issues in order to get better anonymity? Even some blogposts would be great -- perhaps some of the projects like Tails, Qubes, Whonix, and Subgraph might be willing to collaborate with Tor on some blogposts explaining how the threat models, usability, and intended audiences differ? (I imagine quite a lot of the material could be condensed from the Logan CIJ panel "Future of OS".) Cheers, -Jeremy Rand
Attachment:
signature.asc
Description: OpenPGP digital signature
-- tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk