Potentially Malicious Tor Browser Update

  • 🐕 I am attempting to get the site runnning as fast as possible. If you are experiencing slow page load times, please report it.
While I take the opportunity to shit on people still using windows in the Year of Our Lord 2023
It's almost as if the only other option is an operating system that was never meant to be in competition with Windows, which has an insane amount of weird issues of it's own due to it's nature where all the elements composing the OS are made by independent developers and they don't integrate with each other since there is no top down management to make it all work, and also there is constant infighting within the developer communities whether or not project x should have a code of conduct or if distro y should have component a or component b.

You can shit on Windows users all you want, but the cold hard truth is that despite Windows being a closed source OS that is constantly being worsened by Microsoft, it has the undeniable advantage of being developed by an actually organized development team, so you're much less likely to run into some weird edge cases where something doesn't work as it should with no documentation or information on how to diagnose and fix it, since GNU/Linux is just that, GNU elements slapped onto a CLI OS.

Which in a funny way was exactly how Windows worked from Windows 1 up to Windows 98, it was the GUI OS part slapped on top of a CLI OS. And everyone knows how well that ended for Microsoft, and how they've instead created a new OS from scratch that's GUI oriented by nature.

As long as GNU/Linux is going to be a complete mess, people will still flock to Windows despite all it's flaws, because it's simply way less problematic than the GNU/ abomination.

98ed9fcaa43e8551cb7b2fd01deb74dbda6ddce0e598c2bed524d1798b1d6d36.png
 
Add another point to the linux master race.
 
No, you first tell me why is it that GNU/Linux has multiple distros with multiple components where each component has it's own issues? There are at least five package managers, at least two display servers, and multiple desktop environments with each and every one of them having their own set of the most important basic elements such as a fucking control panel.

Not to mention the constant war about whether or not include systemd into a distro, and that all of those components aren't designed to work with each other, and their developers don't see a reason to do so.

A normal person does not want to spend their precious time learning all the pros and cons of each of those elements and then deciding on which distro to pick that meets their criteria. This is the first big reason why GNU/Linux elitists are delusional about the superiority of their system over Windows.

The second is the fact that GNU/Linux overly relies on the command line, due to it's nature of being GNU/Linux. And this is the reason I agree with Stallman's definition of it, because it perfectly shows the issue of it. The Linux part is what runs buttery smooth, but it's a CLI OS. GNU/ is what aims to turn Linux into a desktop OS to replace Windows.

However even back when Windows was still just an overlay for a CLI OS which was MS-DOS, Microsoft was an actual corporation that employed people who know what they were doing and the project was being managed from the top down, so even Windows 3.1 was designed to be as user accessible as possible, so that a regular user wouldn't have to go back to MS-DOS mode to do a basic function, and with Windows NT this need completely disappeared with the command line remaining as something that's completely unneeded for the regular user.

Again, a normal person will not waste their time trying to learn the command line to do basic things like installing a web browser. If at any point in a Linux experience you basically have to use the command line as your only option, where you can accomplish the exact same thing on Windows without ever touching a command line, your OS has failed at being a desktop OS, as it's CLI roots are popping up.

And the biggest culprit of your little dreams of Windows dying off is you. The GNU/Linux community is the biggest thorn in GNU/Linux's side, as they are unhelpful to newcomers that don't know the first thing about Linux. They make their OS insanely complicated because there isn't a coherent development vision that a regular user that's not a neckbeard will run into issues, but he won't get any help, as he will be laughed at for not knowing the most basic things related to GNU/Linux, while simultaneously the same people that laughed him off will bitch and moan about people still using Windows.

I know from my experiences with Linux that I had to constantly use the command line to set it up, while I only ever touch the command line in Windows when I want to do something very specific. GNU/Linux is a mess of an operating system and it's the sole reason I prefer to deal with Windows, because it has less issues that I can deal with much easier.

So you can stay in your little GNU/Linux circlejerk group and keep sabotaging the only alternative to Microsoft's hegemony by huffing your own farts over how great FOSS project are. I'd rather stay on a shittier OS that's actually being tardwrangled into being a cohesive mess.

Also next time thumbnail your images, if you're using GNU/Linux you have no excuse to act like a phoneposter.
 
Necroing thread to bring up that tor browser might be compromised, by its own dev team.
The latest video by Sam Bent reveals that they outright lie about OS spoofing, and leave a bogus switch in options to provide false sense of privacy, while the entire logic behind it had been excised some time ago.
It's an ongoing issue that the tech negro hasn't mentioned, since he's shilling FOSS without looking at people behind it and is genetically unable to seek and recognize patterns.
 
Necroing thread to bring up that tor browser might be compromised, by its own dev team.
Usecase for anonymity on Tor?

I read about the decision to do away with spoofing a while back. I don't necessarily wanna call the Tor devs retarded or evil, but I don't really see a technical reason that makes sense. If the point of the Tor Browser is to get everyone on the same config so that they blend in, then not spoofing the OS hurts this goal. I simply do not see the reasoning.
 
Necroing thread to bring up that tor browser might be compromised, by its own dev team.
The latest video by Sam Bent reveals that they outright lie about OS spoofing, and leave a bogus switch in options to provide false sense of privacy, while the entire logic behind it had been excised some time ago.
It's an ongoing issue that the tech negro hasn't mentioned, since he's shilling FOSS without looking at people behind it and is genetically unable to seek and recognize patterns.

Yeah let's get some OPSEC advices from the darknet vendor that got caught.:smug:
(I'm kidding, some of his videos are good, but I wouldn't blindly trust anything he says)

Usecase for anonymity on Tor?

I read about the decision to do away with spoofing a while back. I don't necessarily wanna call the Tor devs retarded or evil, but I don't really see a technical reason that makes sense. If the point of the Tor Browser is to get everyone on the same config so that they blend in, then not spoofing the OS hurts this goal. I simply do not see the reasoning.


Quoting the Tor browser devs :

Historically, Tor Browser has spoofed the browser user agent found in HTTP headers, while not spoofing the user agent returned by the Navigator.userAgent property in JavaScript. The logic behind the HTTP header spoofing was to prevent passive tracking of users' operating system by websites (when using the 'Safest' security level) and by malicious exit nodes (or their upstream routers) passively listening in on unencrypted HTTP traffic. We left the JavaScript query intact for the purposes of website compatibility and usability. We also left it enabled because there are already many ways of detecting a user's real operating system when JavaScript is enabled (e.g. via font enumeration).
With Tor Browser 14.0a4, we have introduced the boolean preference privacy.resistFingerprinting.spoofOsInUserAgentHeader. When this pref is set to true (which is currently the default), Tor Browser will follow the previously described legacy behaviour. However, if you set this preference (accessible in about:config) to false, Tor Browser will never spoof the user agent and will report your operating system family (i.e. Windows, macOS, Linux, or Android) when requested. We are considering changing Tor Browser to make this the new default behaviour.
So, why are we considering making this change? Basically, asymmetrically spoofing the user agent causes website breakage seemingly due to bot-detection scripts. And (in our analysis) it also provides only a negligible amount of benefit to the user in terms of additional linkability (i.e. cross-site tracking, fingerprinting) protections, and only then when JavaScript is disabled. Tor Browser's default HTTPS-Only mode (and much of the web having moved to HTTPS) has also significantly reduced the utility of passively sniffing HTTP traffic for user agents as well.

--

To be honest, If OS spoofing or detection is a threat, I would just use Whonix or TAILS.
 
Yeah let's get some OPSEC advices from the darknet vendor that got caught.:smug:
(I'm kidding, some of his videos are good, but I wouldn't blindly trust anything he says)
Obviously you haven't watched the video. He both shows the relevant git conversations, devs being called out and their responses. It's not just some old guy talking to a camera for 20 minutes, he posts evidence.
 
Back