frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Ask HN: Decent Builtwith alternative for finding leads?

1•Poomba•4m ago•0 comments

Ask HN: How important is peer programming?

1•Awesomedonut•5m ago•0 comments

Ron DiMenna, Founder of the Ron Jon Surf Shop Chain, Dies at 88

https://www.nytimes.com/2025/09/22/business/ron-dimenna-dead.html
1•bookofjoe•5m ago•1 comments

Green Lights More Often: The Secret 2018 Study of Sydney's Traffic Signals

https://jakecoppinger.com/2025/09/green-lights-more-often-the-secret-2018-study-of-sydneys-traffi...
1•CharlesW•6m ago•0 comments

Layoffs and H-1Bs: Texas Instruments' Billion-Dollar Balancing Act

https://dallasexpress.com/business-markets/layoffs-and-h-1bs-texas-instruments-billion-dollar-bal...
1•strict9•7m ago•0 comments

ReDisclosure: New technique for exploiting FTS in MySQL (myBB case study)

https://exploit.az/posts/wor/
1•mekhatai•8m ago•0 comments

Multi-Kernel Architecture Proposed for the Linux Kernel

https://www.phoronix.com/news/Linux-Multi-Kernel-Patches
2•mooreds•9m ago•0 comments

We got Claude Code to stop gaslighting our tests

https://www.nuanced.dev/blog/using-nuanced-with-claude-code
1•rewinfrey•10m ago•0 comments

Cross-Agent Privilege Escalation: When Agents Free Each Other

https://embracethered.com/blog/posts/2025/cross-agent-privilege-escalation-agents-that-free-each-...
1•simonw•12m ago•0 comments

Musical mel transform in Torch for Music AI

https://github.com/worldveil/musical_mel_transform_torch
1•muzakthings•12m ago•1 comments

Crystallabs.io

https://www.crystallabs.io/
1•casey2•13m ago•0 comments

Qualcomm's New Snapdragon X2 Elite Extreme and Elite Chips for PC

https://www.tomshardware.com/pc-components/cpus/qualcomms-new-snapdragon-x2-elite-extreme-and-eli...
2•pier25•17m ago•1 comments

Show HN: Aegis – A Self-Hosted Code Hosting Server Written in Golang

https://github.com/AegisCodeForge/aegis
1•kasumispencer2•19m ago•0 comments

Textile Encoding via Elastically Graded Embroidered Tessellations

https://advanced.onlinelibrary.wiley.com/doi/10.1002/adma.202500959
1•PaulHoule•19m ago•0 comments

Expat 2.7.3 released, includes security fixes

https://blog.hartwork.org/posts/expat-2-7-3-released/
1•spyc•20m ago•0 comments

SonyShell – an effort to "SSH into my Sony DSLR"

https://github.com/goudvuur/sonyshell
1•beligum•23m ago•1 comments

Isometric Asset Builder

https://iab.thomasburgess.dev/
1•Ninjinka•24m ago•0 comments

Best React Native UI resources for creating beautiful apps

https://wojtek.im/journal/best-react-native-ui-resources
1•gregwolanski•25m ago•0 comments

iPhone Air Review: Beauty Is Pain [video]

https://www.youtube.com/watch?v=tDARtYjUiHs
1•ZeljkoS•26m ago•0 comments

The whole bull run is because of an influx of money

https://www.ft.com/content/6f549890-c2a6-4823-a095-c8ea73f7e6bb
2•sharadov•26m ago•0 comments

Understanding AddressSanitizer: Better memory safety for your code (2024)

https://blog.trailofbits.com/2024/05/16/understanding-addresssanitizer-better-memory-safety-for-y...
1•ashvardanian•26m ago•0 comments

How I was secretly logged as a criminal by police

https://thecritic.co.uk/how-i-was-secretly-logged-as-a-criminal-by-police/
1•binning•27m ago•0 comments

Power Retention – Drop-In Replacement for Flash_attention

https://manifestai.com/articles/release-power-retention/
2•Roritharr•31m ago•0 comments

Disobey

https://untested.sonnet.io/notes/disobey
1•gregsadetsky•34m ago•0 comments

Project Rain:L1TF

https://bughunters.google.com/blog/4684191115575296/project-rain-l1tf
3•darkamaul•37m ago•0 comments

Weak Memory Model Formalisms: Introduction and Survey

https://arxiv.org/abs/2508.04115
2•matt_d•38m ago•0 comments

Intel Is Seeking an Investment from Apple as Part of Its Comeback Bid

https://www.bloomberg.com/news/articles/2025-09-24/intel-is-seeking-an-investment-from-apple-as-p...
5•mfiguiere•39m ago•0 comments

How to Raise a Reader in an Age of Digital Distraction

https://lithub.com/how-to-raise-a-reader-in-an-age-of-digital-distraction/
2•gmays•39m ago•0 comments

Amiga40 Germany – 40 years of Amiga, a celebration for everyone

https://amigaevent.de/
2•doener•40m ago•0 comments

Judge finds Amazon acted in bad faith during discovery in FTC litigation

https://www.courtlistener.com/docket/67515622/404/federal-trade-commission-v-amazoncom-inc/#text
7•1vuio0pswjnm7•40m ago•2 comments
Open in hackernews

How Secure is Tor? Not secure at all

https://csam-bib.github.io/security/
17•emeryberger•1h ago

Comments

emeryberger•1h ago

  The Tor Project web site makes a bold claim to its users:

  "Tor Browser prevents someone watching your connection from knowing what websites you visit. All anyone monitoring your browsing habits can see is that you're using Tor."

  Don't misinterpret this claim. It's not true that Tor protects you against "anyone monitoring your browsing".

  On this web page, I provide you with the critical information missing from the Tor Project's website: if you estimate your adversary's resources in dollars, I'll estimated the probability that Tor will fail to protect you.
(web site by Brian Levine, Professor at UMass Amherst <https://www.cics.umass.edu/about/directory/brian-levine> and director of Rescue Lab <https://www.rescue-lab.org/>)
ranger_danger•1h ago
> Why has the Tor Project created a network used extensively for child sexual abuse

Hottest take of the week right there.

Why do they seem to imply that Tor was somehow created explicitly with this purpose in mind? That's like saying only criminals use the Internet, just because it can be used to commit crimes.

I think they are taking Tor's words and applying it to a much broader scope than they originally intended.

> Tor Browser prevents someone watching your connection from knowing what websites you visit.

If someone is watching only your connection as it exits your local ISP and nothing else, then yes, this is in fact true. It's just not articulated that plainly.

But if the author actually went as far as they are trying to, they might as well tell people to just give up because there's a chance your attacker already controls the destination server you're talking to in the first place.

If you're going to the trouble of trying to calculate the chances that nodes in the middle are compromised, why not include the destination itself too?

> The small set of people that centrally control Tor software and centrally manage the Tor network have the power to act to stop this abuse without lessening their (weak) protections.

Source: trust me bro

> The world's standards for encrypting data are so secure that no one has enough money or time to brute force their way into properly encrypted data, not even governments. They are better off waiting for a scientific breakthrough that may never come.

This completely disregards the possibility that any one of a number of root CAs aren't already compromised or cannot be coerced by your attacker.

If you're going to claim tor is insecure, you might as well go all the way and say it's pointless to use anything at all, ever.

nickdurfe•1h ago
> Why has the US created a highway system used extensively for causing death?
ranger_danger•1h ago
Reminds me of https://0x0.st/XJZT.jpg
bnl_umass•1h ago
My apologies. I don’t believe that was their intent to create a network for csam. But after decades of it being used extensively for csam, why would they take no corrective action?
ranger_danger•1h ago
Maybe because there isn't a known solution?

CSAM is still distributed on the clearnet too... why isn't there a "solution" for that too?

So far the only solutions people seem to have come up with is mass surveillance, and that's not an option.

bnl_umass•1h ago
There is a known solution.

Did you know that the Tor Project allows exit nodes to filter based on the clear internet IP. So filtering is ok.

However, if a relay refuses to service an onion site directory look up, it will be banned by the Directory Authority. They could allow this today. But they don’t. That’s the simple solution. No surveillance. Not back door. No less privacy for everyone else.

edit: This is easy to confirm. I’m not asking anyone to trust me.

ranger_danger•1h ago
Exit nodes are not used for onion services. From https://onionservices.torproject.org/technology/properties/:

> For the Tor network, Onion Services can alleviate the load on exit nodes, since it's connections don't need to reach the exits.

Also:

> Directory Authority.

"These authorities are operated by trusted organizations or individuals with a strong commitment to the principles of privacy, security, and network neutrality."

Emphasis on neutrality... it's not the job of network operators to police the sites people can and can't access, this is exactly why many people use Tor in the first place.

> They could allow this today. But they don’t.

Speaking for onion services... no, they cannot, because the entire design of the tor network prevents this in the first place. No relay in the circuit knows the final destination because it is encrypted multiple times (like an onion) and each hop can only see where it needs to go next, not what the destination is.

neutered_knot•57m ago
I think the point is that exit node operators can filter traffic they don’t want to support. Guard and middle nodes are not given the same choice; they apparently must support all traffic or get booted. Why can’t other nodes have freedom to decide how they want to participate?
ranger_danger•47m ago
> Why can’t other nodes have freedom to decide how they want to participate?

Because the network was explicitly designed to not allow this... otherwise it becomes subject to censorship, which is one of the main goals they try to prevent.

The (onion) address itself is never transmitted in plaintext through the Tor network... when you access an onion site, your Tor client encrypts the traffic multiple times, literally like an onion. No relay in the circuit knows the final destination.

neutered_knot•27m ago
It is absolutely a design decision. I don’t understand though how allowing exit nodes to filter (by port and IP) doesn’t permit censorship but allowing internal nodes to not complete connections to onion sites does. I do understand that early nodes on the path are unaware of what the traffic but it seems pretty straightforward to allow nodes to not become rendezvous points for onion sites.
basedrum•16m ago
Your assumptions are based on faulty understanding of how tor works.
leakycap•1h ago
I'm not here to defend Tor

But the calculator states that if the investigating party has $150,000 a month budget for all targets they have a 100% certainty of getting your IP address... obviously this is false, so what else has the author claimed that is also not true?

saithound•1h ago
Pretty much everything claimed on this site is false or grossly misleading.
bnl_umass•1h ago
Really? Tell me why.
bnl_umass•1h ago
The math and the code is all there. I’d love to have a discussion about what the real value is. Further, why hasn’t the Tor Project provided this calculation? Why hasn’t anyone? I think it’s necessary.
janci•1h ago
The assumption is the adversary controls x of N nodes. When x=N the probability of discovering the onion service IP is 1. But the adversary can not achieve this situation as he only controls the additional nodes. The existing nodes still stay in the network, they do not disappear. The ratio is not x/N but x/(x+N).

The formula is wrong and it all falls apart.

emeryberger•47m ago
You can adjust the code on the page easily (it’s open source javascript) to determine the question you are after, which is a valid one: if an adversary starts today and adds x nodes to the existing network, what is their success rate?

BUT the author asked a different (but valid) question: assuming the adversary controls x out of N existing nodes, what is the success rate? I am unclear: is the assertion that everyone’s relay is honest today? From a privacy standpoint, that’s not a great assumption.

janci•10m ago
No, the author is presenting an idea that $25 a month can buy you a node. That fits adding a new node to the network, not taking over an existing node.
giantg2•1h ago
"As C3P will tell you: CSAM distribution on Tor onion services is not inevitable."

Lol, are we using the regular internet as an example of preventing all CSAM?

We've known for years that owning enough nodes results in the compromise of privacy and that it's likely the NSA has achieved this. Although there is some question around how that plays out if adversaries like China are also competing for similar node share percentage.

bnl_umass•1h ago
There is no question about that. The site makes use of current statistics from the Tor Project.
datadrivenangel•55m ago
As a percent of onion services, what does it work out to, a few percent? And how much of that is dedicated abuse sites versus general adult sites?
neutered_knot•40m ago
Your question made me curious so I tried to see what information about onion sites is available. It’s hard to measure onions sites by design, but

https://99firms.com/research/tor-stats

Says there seem to be about 65k onion sites.

This site:

https://protectchildren.ca/en/press-and-media/blog/2025/tor-...

Has some varying numbers depending on the observation time, but in final month listed saw 30k sites that had they identified as having CSAM.

I’m not sure how accurate either number is or if they are directly comparable but that would be a 50% of all onion sites ballpark.

Not sure how to measure general sites vs dedicated abuse sites.

datadrivenangel•1h ago
If an adversary is spending tens or hundreds of thousands of dollars to find you, that's a lift that most threat actors won't be able to do. Especially if they have to host a significant number of exit nodes for a lengthy period, which often means serving unlawful content which is very awkward for law enforcement.

It's definitely better than regular browsing for security, but it's not perfect.

_alternator_•1h ago
Unfortunately, the money isn't just to find "you". You rent arbitrary exit nodes, and if you spend ~$30k / month, you'll be able to deanonimize >50% of users using Tor each month.
neutered_knot•1h ago
It’s a drop in the bucket for state actors who might want to find TORs target user base of dissidents, whistleblowers, and journalists.
superfishy•1h ago
"The small set of people that centrally control Tor software and centrally manage the Tor network have the power to act to stop this abuse without lessening their (weak) protections."

That the author has received funding from the DOJ makes me wonder what their proposed solution is.

basedrum•1h ago
Clickbait title is usually a good indicator of clickbait content.

I see in the comments that the author is an academic, my cursory look of the site makes me disappointed to see such weak rigor applied here. This looks like a hit piece dressed up to sound scary. Not going to waste my time further on its claims when on the surface its given me this impression. Strikes me as yelling and not listening type of personality.

roncesvalles•10m ago
I wouldn't use Tor or any other anonymous services like SecureDrop without a VPN (preferably multi-hop). Otherwise you're advertising to the world that your IP address uses Tor, and that alone can be a huge reduction in the solution space for your adversary to deanoymize you.