Re: [tor-talk] wget - secure?

2012-04-19 Thread Martin Hubbard
I just checked wget in Tails 0.10.2 and see no UDP from the machine. Could someone please verify that? ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

Re: [tor-talk] wget - secure?

2012-04-19 Thread Maxim Kammerer
On Thu, Apr 19, 2012 at 02:55, Ondrej Mikle wrote: > I've just checked wget, it does leak DNS even with http_proxy environment > variable set. Do you see wget actually connecting to the proxy? Wget terminal output shows that. -- Maxim Kammerer Liberté Linux (discussion / support: http://dee.su/

Re: [tor-talk] wget - secure?

2012-04-19 Thread Geoff Down
On Thu, Apr 19, 2012, at 02:47 AM, Martin Hubbard wrote: > I just checked wget in Tails 0.10.2 and see no UDP from the machine. > Could someone please verify that? > ___ > tor-talk mailing list > tor-talk@lists.torproject.org > https://lists.torproject.

[tor-talk] Another openssl advisory: Tor seems not to be affected

2012-04-19 Thread Nick Mathewson
Hi, all! It looks like there is an openssl security advisory affecting some but not all of the ASN.1 parsing code. The announcement is here: http://openssl.org/news/secadv_20120419.txt And the full-disclosure posting is here: http://seclists.org/fulldisclosure/2012/Apr/210 It looks like there

Re: [tor-talk] Another openssl advisory: Tor seems not to be affected (Chroot?)

2012-04-19 Thread Fabio Pietrosanti (naif)
Should we move all the "listening part" of Tor to an empty Chroot? That way, even in case of a software exploit against OpenSSL, there would be no serious risks of compromise due to OpenSSL code (a big, fat library) running in it's own chroot. Apache does it with Mod_Security: http://www.modsecur

Re: [tor-talk] Another openssl advisory: Tor seems not to be affected (Chroot?)

2012-04-19 Thread Tom Ritter
On 19 April 2012 11:50, Fabio Pietrosanti (naif) wrote: > Apache does it with Mod_Security: > http://www.modsecurity.org/documentation/apache-internal-chroot.html > > ProFTPD does it with DefaultRoot: > http://www.proftpd.org/docs/directives/linked/config_ref_DefaultRoot.html To add another data

Re: [tor-talk] wget - secure?

2012-04-19 Thread torsiris
Hi, I cannot confirm that wget (v1.12) is sending any DNS resolve when using it this way: wget --proxy --execute=http_proxy=http://127.0.0.1:8118/ -c http://download.test Wireshark does not show any UDP traffic. I will check out curl. I like the idea of not using a http proxy in between. Thank

Re: [tor-talk] wget - secure?

2012-04-19 Thread Ondrej Mikle
Hm, you're right, wget 1.12 does not leak DNS if you use http protocol. I just realized I tested it also with https when the leak happened (wget requires explicit 'https_proxy' to use CONNECT for https even if you use the same http proxy). Ondrej On 04/19/2012 10:54 PM, torsi...@tormail.net wrote

[tor-talk] Vidalia no longer portable / --datadir option not working

2012-04-19 Thread virak toli
A while back vidalia.exe had an option called --datadir where it would take everything from that directory. It doesn't seem to work with the latest vidalia.exe Its a pity and I think should be fixed asap. -- Virak ___ tor-talk mailing list tor-talk@lis

Re: [tor-talk] Vidalia no longer portable / --datadir option not working

2012-04-19 Thread AK
I'm not sure about Windows, But this seems to work for me in Linux: vidalia --datadir Before you run this, put the files torrc, vidalia.conf, geoip into torrc: AvoidDiskWrites 1 Log notice stdout SocksPort 9050 SocksListenAddress 127.0.0.1 ControlPort 9051 DataDirectory GeoIPFile /geoip vi

[tor-talk] We're looking for another dedicated core Tor developer

2012-04-19 Thread Roger Dingledine
Your job would be to work on all aspects of the main Tor network daemon and other open-source software. This would be a contractor position for 2012 (starting as soon as you're ready and with plenty of work to keep you busy), with the possibility of 2013 and beyond. Being a core Tor developer incl