Post #1404562

https://freeradical.zone/@generalx/116428227593379864 links to cure.53 report on tor vpn beta Yay this is cool good on them... I was curious, I've never read one of these before. Now I'm... confused. TTP-04-011 — Not validating beyond your layer is abnormal In Some Cases but the point of a layer is to provide _that layer_ not some set of guarantees not in its protocol that complicate that layer and would actually constitute a different layer. TTP-04-001 — Ok whaaaat. Devices with lower versions are not worse off running tor than they are not running tor. They aren't deceived into thinking tor makes them any better than they are. And people who can't afford newer deserve an ounce of cover even if it's not perfect. TTP-04-004 — I think this is a big deal. Actually a bunch of these are pretty relevant, but especially this one. Lack of certificate pinning, etc... nice catches. I can see why cure.53 has such a good reputation. TTP-04-015 — I want to know more about this attack type... how hard is control of the ffi interface to obtain? In which directions? Lots of DNS. So much DNS. Tor did really well but it's also just a fascinating read... as a dev I'm too often ignorant of the standards I should aim for.