The "http-equiv" in that meta tag means "equivalent HTTP header", FYI.

can you recommend some gopher server that is actively maintained? I always wanted to host gopher site but could not find a strong solution that I will not be afraid to be easily compromised.

Proton also uses HTTPS for their onion site, and they used the same certificate provider as Facebook did for theirs, Digicert, per this page:

https://proton.me/blog/tor-encrypted-email

In the above blog post, they seem to imply that they made HTTPS mandatory for Proton Mail over Tor for security reasons.

Without https can't the last relay snoop the traffic?

edit: oh, is the last relay the onion service? So the entire chain is encrypted?

> have https but that was more of a vanity from what I remember

It has a functional difference as well, lots of new client-side features (like webcrypto) only work on "Secure Origins" which .onion isn't, but websites behind TLS are. So if you wanna deploy say something that encrypts/decrypts something client-side on .onion, you unfortunately need TLS today otherwise the APIs aren't available.

Of course browsers could fix this, but I don't think they have any incentives to do so. I guess Tor Browser could in fact fix this, and maybe they already do, but it'd be a patch on top of Firefox I think, something they probably want to do less off, not more.

Back when EV certificates were widely supported by browsers, HTTPS was a great way of cryptographically associating a .onion service with a real legal entity, for sites like Facebook which didn't care about being anonymous.

Very unlikely if you just hosting an onion service with legal content, where all traffic is encrypted.

Having to deal with law enforcement is unlikely even if you run a normal, encrypted, TOR relay.

Exit nodes, on the other hand, will most likely get letters or even visits by law enforcement. But those are not involved at all when just running an onion service.

Which is funny when anecdotal evidence says that over 50% of existing tor relays are controlled by US TLAs :)

I was already able to host onion services last year by using the crate directly. A few footguns related to flushing but it generally works as expected. I will however say that the code quality could be improved though. When trying to contribute, I found a lot of somewhat bad practices such as having direct file read/writes littered around without abstraction which made refactoring difficult (trying to add different storage/cache options such as in-memory only or encrypted)

Letscage [0] is also using Arti to implement its privacy features.

[0]: https://github.com/letscage

As long as they have the private key they can move it to new hosting infrastructure without issue, and the same onion address will still be operational.

"Mirroring" is a term also used when a single source publishes data in different mediums (technically in this case we're talking only about the internet but the internet is full of different protocols so I'll call them mediums). For example there are websites that mirror their content to Geminispace or in this case make it available as an onion service.

You are correct that this solution does not prevent problems if the server goes down. This particular approach aims to reach a larger audience, while your idea of mirroring enables resiliency.

Both approaches have their use cases and can even be combined too!

Without having a trustable certificate, the connection can be MITM'ed anyways. Anyone can produce a self-signed cert on demand.

The onion address is the certificate, albeit not one that expires or can be revoked. As long as you get it from a trusted source, you should be good.

I would like to know more, can you give me some insight?

No part of hosting or visiting onion services involves exit nodes. Onion service traffic stays within the Tor network instead of exiting to the clearnet.

Run more exit nodes then, and more onion services so they don't need to involve exit nodes.

It's also not such a big deal, provided they aren't messing with your exit traffic which you did encrypt, right? There are few exit nodes, but a great many non-exit nodes which still help anonymize your traffic. If you think it's a problem though, run an exit node.

Anywhere and on just about anything. The only time a location would be of concern would be on Tor Exit nodes which is not what they are discussing.