Plain Vidalia Bundles to be Discontinued (Don't Panic!)

by erinn | October 20, 2011

Over the past few years, Tor has gotten more popular and has had to grow and change to accommodate a highly varied userbase. One aspect of this is getting the software into users' hands and having it immediately do what they want it to, while also not allowing them to inadvertently deanonymize themselves because they missed a configuration step or didn't understand which applications were using Tor and which were not. As a result, we have standardized on the Tor Browser Bundle for all platforms and are currently promoting it as our only fully supported client experience.

Since the Tor Browser Bundle offers the best current protection, we are moving to a client/server model for packages, and consequently the "plain" Vidalia bundles will be discontinued by the end of the year and no longer recommended for client usage. We've started rolling out server Vidalia bundles for Windows, which you can test by going to the download page.

There are currently (and will continue to be) three types of server bundles available:

Bridge-by-default Vidalia bundle

This configures Tor to act as a bridge by default, so as soon as you install it and run it, you will be helping censored users reach the Tor network. You can read more about bridges here. This bundle still includes Torbutton and Polipo, but those will be removed in the next release (date to be determined).

Relay-by-default Vidalia bundle

This configures Tor to run as a non-exit relay by default. This means you will serve as either a guard or middle node and help grow the size of the Tor network. You can read more about Tor relay configuration here.

Exit-by-default Vidalia bundle

This configures Tor to run as an exit relay by default. Exit nodes are special, as they allow traffic to exit from the Tor network to the plain internet, and anyone who has not already looked into the risks associated with running an exit relay should read our tips for running an exit node with minimal harassment

We've started creating a Tor Browser Bundle FAQ, but we'd like to hear your concerns so we can provide answers where necessary, documentation for alternative setups, and fix the software where answers are insufficient. We have several months before Tor Browser Bundle is the only option, so please help us make it as good as possible! If you have bugs to file, please don't file them in the blog comments -- use our bug tracker for that.

applications

Comments

Please note that the comment area below has been archived.

And you plan that any end

And you plan that any end user must be don't able to change defaul configuration of the Tor?
And what about the Tor for UNIX-like systems?!
Did that mean that the Tor team intend to end supporting *nix-packages of the Tor or so?!
It seems to me that the beginning of the end of the Tor net...

I have noticed the changes

I have noticed the changes on the download page in recent time. Even considering those changes the page, in my opinion, still presents too many options for the average user.

Heck, even an experienced user is presented with too many options.

Well, as long as you still

Well, as long as you still release source code to plain-old-tor, this doesn't bother me at all.

In *nix system Tor-browser

In *nix system Tor-browser and Tor-daemon must be separated. Only system-daemon Tor (such as "debian-tor") with restricted capabilities (with shell absense) can be easy integrated with SELinux.

Instead, your current decision ruin too much possibilities: SELinux, transparent firewalling, parallel per-user X-servers sessions for isolated browsers, isolating within Virtual Machines.

Yes, average users don't bother about it. You make a great work to widespread Tor to masses. It's good to create normalising users anonymous pattern, but not good to inner security against code execution exploites. And more advanced users enforced to be in this average situation too.

If Tor Vidalia and TBB started with permissions of one user, then weakest point -- Firefox (patched Aurora) is a easiest way to deanonimizing user if code execution escalation can be done. This is ordinary and regurarly vulnerability in the browser. And this is ideally open source "backdoor" -- deanonimizing tor-users will be just a "nonmalicious third party software mistake", not close related to the Torproject itself.

This is a real scenario with the Tor-network, full of honeypot-hidden services, special bugged with deanonimizing code against "average users". Or exit nodes injectincting exploites to traffic.

I understand your concern. I

I understand your concern. I am right there with you on the desirability of least privilege for anything that faces the network. It was a tough call for me to give up my SELinux profile for Firefox in order to make the jump to TBB myself. I resisted it for a long time.

However, we made the call that more people were at risk due to misconfiguration exploits than 0day in the actual code. This seemed evident over the years with experience with services like decloak.net, as well as studies that placed the amount of properly configured Torbutton users at less than 20% of our HTTP userbase.

So we made the tradeoff to make that case better at the expense of some edge cases for power users.

Our hope was that the expert users who were aware of those edge cases would help each other fix them. Lunar^, our resident debian developer, I'm sure would love SELinux profiles for isolating the browser and the tor daemon of TBB, as he is working on equivalent debian packages for them. You can find him on #tor-dev on irc.oftc.net (6697 is ssl).

I understand your decision

I understand your decision but why don't make a source code of separate Tor Browser which can be used with *nix Tor daemon and place its tarball into torproject repos? Or at least make howto about detachment it from sources of TBB and even though such howto in FAQ or etc.?
Probably, I (and many *nix-users) am more power user than average windows user but I am not a programmer and I have no such skills in coding as you, Roger or other Tor developers.
And, I think, that the most of Tor developers operates *nix-systems by themselves.
Could you tell the community your own decisions for yourselves?

An excellent initiative!

You are spot-on in focusing on what truly matters (bridge, middle node, exit node) and removing all the rest from the decision and installation processes of the user.

To be clear, you will still

To be clear, you will still be updating and supporting "client only" versions of the Tor Bundle in addition to these "Server" configurations?

i dont want a tor browser

i dont want a tor browser bundle. i dont have the bandwidth to run a relay but i need tor from time to time. so make sure the after last tor vidalia bundle i can just overwrite any tor files (tor.exe. tor resolve.exe etc) with subsequent ones from tor updates. or u could just produce an update bundle for tor vidalia non relay installations. or maybe u could tell ppl 'if u want to run a client only tor vidalia torbutton with ur current get any relay bundle and change the setting to client only from default'. some of us like to use the latest firefox you see, despite any concerns u have with it. kthx

We use the latest Firefox in

We use the latest Firefox in TBB, too. 7.0.1. kthxby

re: previous comment about

re: previous comment about wanting to use vidalia not be forced to use torbrowser bundle for thickos:
forgot to mention i run firefox 7.0.1 with torbutton, refcontrol, adblock plus, vidalia and have set it up to use privoxy not polipo

You seem to lack some

You seem to lack some critical understanding of the issues, a perfect example of *why* you should use Tor Browser Bundle. E.g., you should not use privoxy or polipo any longer. The *only* reason they were used in the first place is due to Firefox having crappy SOCKS code, however, since v5 of Firefox that issues has been fixed. Thus, there is zero need for a http proxy such as privoxy or polipo. Furthermore, neither of those proxies should be used to 'scrub' traffic because they cannot 'scrub' HTTPS traffic, only HTTP ... a MAJOR fail.

So please, don't assume you can use Firefox as you are without a greater understating of the issues. Also, TorButton will soon not be available as a .xpi download, so you won't be able to use your current MO much longer.

absolute bullshit! you CAN

absolute bullshit! you CAN use Tor with privoxy and it WILL handle HTTPS just fine.

Well, that's obvious. I

Well, that's obvious. I never claimed otherwise. Calm down and re-read what I wrote. There is *zero* reason to use Privoxy with Tor, now that Firefox SOCKS code is patched.

In fact, using Privoxy or Polipo will most likely SLOW DOWN your surfing. And like I wrote, neither can 'scrub' HTTPS. I never wrote Privoxy can't "handle HTTPS", I wrote it can't 'scrub' HTTPS, e.g., referrer spoofing, etc. Please, learn about these issues, otherwise I hope you are happy looking like a loon. Scurbing HTTPS *has* to be done _WITHIN_ the browser, or use a MITM scheme with Privoxy (which will never happen because it's stupid and dangerous).

Now please, 'take a chill pill' and take time to reflect on what I wrote. Geeze!

looking like a loon is

looking like a loon is better that looking like a know-it-all, self important douche with superficial pretence of knowledge.

"There is *zero* reason to use Privoxy with Tor, now that Firefox SOCKS code is patched."

Firefox is not the only application ppl use with Tor. Read and learn, and stop spreading false info: https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS

In the case of the

In the case of the questioner, she/he was ONLY asking about Firefox. So, my comments stand as true, in that case, which is the only case I was commenting on. Now, take your logical fallacies elsewhere, you need not try such lame Ad Hominem attacks against me ...

And just so you're aware, here is a little fact you have ever-so-conveniently 'overlooked': it was only after the questioner claimed what I wrote was "bullshit" did I loose patience with said person.

You wrote about "referrer

You wrote about "referrer spoofing" but you exclude this function from TBB (and from newest TB) for some technical problems.
Do you intend in the future recover this features and do you plan to work with that technical problems? Sorry...

ahh well i been avoiding

ahh well i been avoiding https over tor anyway cos i felt wary about it. but surely torbutton handles that? so privoxy not doing it wouldnt be an issue? or did i get that wrong?
i have been considering dumping torbutton and privoxy anyways since firefox 5, and just having ff set up to ONLY use tor. i know i wouldnt need torbutton for this but i do like vidalia for the network map, the new id option, the message log and bandwidth map. vidalia would be irrelevant if i am using tor from ff correct?
i have read a post here that torbrowser disables all addons u try to install. i NEED adblock plus, for one site which would become unusable due to a stupidly placed advert. i am not about to start emailing the admin (on principle since this would basically be negating the point of tor by giving away my ip via my email account thus exposing me to MORE worthless adverts), so how would torbrowser deal with this kind of 'attack' by a govt on a site? will u add more code to torbrowser bundle to enable adblock style adblocking controls? wouldnt this begin the bloating process which inevitably leads to exploits needing patches needing patches for exploits from previous patches etc. like ff is getting to and IE has pioneered ? thx for previous answer and hoping for u to point me to answers!

A) Don't avoid https. It is

A) Don't avoid https. It is always better than http. (That's not to say that it's perfect, but it removes or reduces some really bad attacks and basically has no downsides -- assuming you're using Torbutton.)

B) You don't need privoxy. Feel free to use it if you like it though.

C) You need to use Torbutton when you're using Tor. It's not just there to configure your proxy settings. It does dozens of other things to keep you safe. See https://www.torproject.org/torbutton/en/design/

D) Torbrowser disables *plugins* (like flash and adobe pdf reader), but not *addons* (like adblockplus). You're free to add whatever addons you like -- be careful picking them though, since they could screw up your privacy.

Right now it's no fun to upgrade your TBB every week and also keep your own addons installed. We're working on ways to make that more bearable.

thx for the help! u have

thx for the help! u have allayed some of my concerns at least, and reminded me that torbutton does more than handle cookies. i had thought that i wouldnt need it if i just disabled all plugins and java in firefox and manually cleaned cookies with an addon, disabled history and cache etc in ff options. i have had to become competent in using regedit already because my non tor browser uses java and when java updates it installs things in ff also, with no remove option just disabe/enable (AVG also does this with linkscanner toolbar, but thats easier to find and remove with regedit), this would not be necessary if i understand the TBB correctly because it doesnt install, its stand alone. when u have gotten the addon thing sorted i will take a look at TBB which would mean i could then use firefox for my non tor browser, but i wonder if there would be any conflict issues if running TBB and a ff not using tor simultaneously? i think that to run IE while using tor in my current setup is inadvisable because IE seems to want to keep track of what sites u go to even in the tor browser! at least when i experimented long ago, a site i only visited in ff over tor appeared in IE8 history! i say this for the benefit of ppl who havent read how to use tor but may have come here reading the blog btw and tx again for ur answers!

Could using addons creat

Could using addons creat threats of de-anonymizing tor-users through making by adversary browser profile of users?
And what do you thinks about using bookmarks in TBB?

"forgot to mention i run

"forgot to mention i run firefox 7.0.1 with torbutton, refcontrol, adblock plus, vidalia and have set it up to use privoxy not polipo"

Could you please post a link to a link giving detailed instruction on achieving your set-up ?
TIA

it wast that hard to do, i

it wast that hard to do, i googled 'use privoxy with tor' and a site came up i cant remember the link. it explained what u had to edit in the privoxy config.txt and what to put in the right boxes in vidalia options to run privoxy on start up. i wont try to say myself because i tried to help someone else do it and it was an epic failure. i am not good with explaining sorry.

Which of the upcoming 3 Tor

Which of the upcoming 3 Tor Browser Bundles would you recommend for someone who needs Tor occasionally, runs Windows and who is on 56k dialup ( yes, there are a few of us still around )?

You should use the Tor

You should use the Tor Browser Bundle, not any of these Vidalia bundles. And be very very patient. :)

is it bad for syrian and

is it bad for syrian and iranian users?
our internet is under control and censore... how can we be bridges or relay when we have traffic limit and censore?
please belp us and sorry for bad english

Syrian and Iranian users

Syrian and Iranian users should use the Tor Browser Bundle, not any of these Vidalia bundles. No need to be a bridge or a relay.

Dear beloved TOR team Oh My

Dear beloved TOR team

Oh My God!

Why stop Vidalia bundles completely?
Why not give people both options just like you already do today ?

Many people who use your software like me use it not just for browser but also for Messengers or other programs.

So why not give that tremendously valuable option anymore ? It is extremely important.

Experienced user want to use not just for browser.

Please give both options :(

After you have started

After you have started torbrowser, you can use any progam with the bundled tor. They are also working on a way to keep tor and vidalia running after you have closed the torbrowser. From the faq:

Q) I want to leave Tor Browser Bundle running but close the browser.
A) We're working on a way to make this possible on all platforms. Please be patient.

I have a system-daemon Tor

I have a system-daemon Tor thus I don't need a Torbrowser bundle. What I need is a Torbrowser: no user-daemon Tor, no Vidalia... only the browser.

+++

I am very concerned about

I am very concerned about the TOR network. A small group of bad children are flooding the network with a childhood attack of DoS and DDoS. The attack is targeting the Hidden Wiki, the Freedom Hosting and other services and web sites.

Since these fools started their fun, I'm noticing that the network is very slow and many sites such as onion are down. This group of idiots that it is possible to overthrow nearly all the network running a few lines of code.

Those Guy Fawkes' clowns are part of the nazi-anonymous gaystapo ideology cops group. They want to dictate what is allowed and what is forbidden inside the anonymous network.

What should be a place of freedom of expression has been converted into an example of intolerance and violence of the few against the many. I fear the day when Christian or Islamic groups began to attack the sites about drugs, about atheism. I imagine also the risk that governments use this type of attack against the network.

If misconfiguration is your

If misconfiguration is your main concern: move "expert" downloads to a separate page - with appropriate warnings and instructions.

If the cost of maintaining several pieces of software is your main concern: don't be coy about it, just say so. It's understandable.
- kthxby

As a long time Vidalia

As a long time Vidalia bundle and also SeaMonkey user I wonder why this step is necessary.

I really do not wish to switch to Firefox, let alone transfer bookmarks etc. to it.

Why force SeaMonkey users into Firefox?
Please do keep those Vidalia bundles alive.

We don't have the

We don't have the skill/time/money/patience to try to audit and patch Seamonkey or other browsers out there to be safe to use with Tor. See also https://www.torproject.org/docs/faq#TBBOtherBrowser

That said, see also https://www.torproject.org/docs/faq#TBBCloseBrowser
Eventually I expect it should become easy for you to install the Tor Browser Bundle, tell it you don't want to use the browser it comes with, and then configure your other applications to use it. We just don't want that to be the default way to use it, or too many people are going to use unsafe configurations and not realize that they're unsafe.

Hi erinn, Removing the

Hi erinn,

Removing the option to runs "client only" is a serious mistake, many users of Tor are on low capacity/bandwidth connections and just not able to afford the extra cost involved.
I certainly agree with your ideals of growing the network, i vehemently disagree with your method of achieving it.

Forcing users to contribute by removing the option to "run as client only" is nothing short of blackmail .

I would seriously suggest you rethink before heading down that path.

I will not panic at this point in time as i hope you realise the mistake and continue with the option of "run as client only".

Extremely disappointed at the moment.

Ah. Sounds like you're

Ah. Sounds like you're misinterpreting Erinn's post as meaning that there will be no easy way to just be a Tor client anymore. There will be: use the Tor Browser Bundle. It's designed as exactly that "client only" approach that you describe.

It's the "install Vidalia and Tor onto your hard drive and hope you set up everything else correctly on your own" package that we're discontinuing. I've watched too many people shoot themselves in the foot with trying to set up the rest of it.

This answers one of my

This answers one of my concerns as well. I use Tor on several different platforms in a few places — and in some places running as a relay is not an option.

I am using the osx (intel)

I am using the osx (intel) TBB latest version. I downloaded a few extra add-ons like RefControl, Ghostery etc. When I use the TBB the following day I find my add-ons have been disabled with the words "not compatible" next to its name!! This has happened three times so far. This is a concern giving the impression that one is not anonymous and is being watched. Who is doing this? Is this not allowed and is automatically disabled by Aurora?

Each addon has a list of

Each addon has a list of Firefox versions that it claims to be compatible with. If Firefox sees an addon that doesn't say it's compatible with that version of Firefox, it tells you that it's incompatible.

Sounds like the authors of the addons you have chosen have not updated their addons to declare compatibility with the most recent versions of Firefox.

You'd probably get exactly the same behavior if you downloaded vanilla Firefox 7.0.1 yourself and tried to install those addons to it.

Tor is dead if you try to

Tor is dead if you try to force people to route 3rd Party traffic. This will give the authorities the arguments to outlaw Tor.

It's time to introduce a Darwin award for Open Source projects committing suicide!

SUGGESTION I imagine it

SUGGESTION

I imagine it would be necessary a prominent warning on the download page, saying that to set up a non-exit relay, bridge or exit relay is necessary to have open doors at the web connection.

In my country all domestic connections have the inbound conections blocked by our ISP by default. I can not configure a service that depends on inbound conections because of this restriction.

If I need an inbound conection I will need to make a vpn with a proxy or pay a very expensive conections called "comercial conection".

On October 25th, 2011

On October 25th, 2011 Anonymous said:

"Tor is dead if you try to force people to route 3rd Party traffic"

It is a much greater problem than that,

My friends in Iran are not able to run 3rd party traffic as the government there are able to track them down should they do it.

They face extremely punitive punshment should they be caught to the point of being shot dead.

They run a site highlighting Iranian government atrocities and are pushing for democracy in Iran.

Thousands of people would be put in extreme risk of their lives if the functon of "run as client only" was removed.

Last time i checked, Tor was meant to assist people in preventing government serveillance and giving the oppressed the ability to get the truth out there.

You also say,

"This will give the authorities the arguments to outlaw Tor."

It already is, in Iran i have freinds that have been both detained and jailed/punished as a result of using Tor to get their message out, granted they made mistakes that gave them away.

What were the mistakes?

Using bridges and running nodes !!!

On the site they/we run it is common knowledge that visitors should only access via Tor in "run as client only" mode.
Any other method would place the visitor at great risk.

These circumstance i relate are in Iran only from my personal knowledge.

What about all the other people out their trapped in countries ruled by despotic regimes that have no compunction about putting a bullet through your head should you wish to "blog" about their opposition to government actions ?

Sorry for the long post however i am seriously worried, lives may be lost if the ability to "run as client only" in an easy to use bundle is removed.

I completely agree. We're

I completely agree. We're not going to remove the ability to run Tor as a client only.

We're just trying to make it easier to run Tor safely. There are a *lot* of people in Iran right now -- like, hundreds of thousands of people -- who have potentially really dangerous Tor configurations and don't know it. That really scares me.

To those worried about a

To those worried about a "client only" option being removed: it isn't, at least completely, Tor Browser Bundle still provides that. Unless you configure it otherwise, of course (maybe that should be prevented altogether). You may have misunderstood the blog post.

Though I'm not sure why getting rid of the client-only Vidalia Bundle is necessary or desired. After all, other applications than just the browser may benefit of using Tor, while having it as a vanilla multi-purpose local installation.

I still think providing a separate securely configured Tor Browser to be run on top of any Tor installation, whether a "portable" (as in current TBB) or a "system", would be the simplest and most versatile solution. This would eliminate the temptation to attempt to configure Firefox with Torbutton by oneself and possibly screw something up. It would also take into account users with transparent torification, those with relays etc. and on the other hand the usage of separate programs such as IMs, gpg, ssh, socksifiers... without opening the browser.

To not scatter development, the TBB distribution could then just be said "Tor Browser" and the "portable" Vidalia+Tor part glued together.

Not being too involved with the development of Tor, though, I don't know how easily the above could be implemented or current designs changed. Features that rely on the integration of TBB come to mind as possible challenges, such as the recent "New Identity" of Torbutton. Does it need its own Vidalia in between to work? Or ControlPort privileges? Does it matter if it does? (I know, it's probably explained in the bug tracker, can't bother to check right now, just giving an example...)

I am totally confused. I

I am totally confused. I have read the post several times and cannot even understand what the change is. Please rewrite the blog post in a coherent manner. Here is a template:

Right now, we offer the following options:

For Linux: A table by distribution, listing the separate tor, privoxy, and even Vidalia options available.

For Mac: Same as above.

For Windows: Same as above

We have found that this is causing problems (list problems). Therefore, we are discontinuing the items marked in red above.

The new options will be:

New table as above, but probably smaller since some options are being taken away.
The ramifications are that:

Linux servers: For each distribution, discuss how the package changes will occur and which configurations will no longer be possible.

Linux clients: Same thing as above.

Mac servers: Same thing as above.

Mac clients: Same as above

Windows servers and clients: same.

I look forward to a coherent discussion and being able to actually understand what is being done. Saying that Tor is taking away "plain" vidalia packages is totally incomprehensible to someone running a server on Gentoo, for example.

Regards.

I do not understand why Tor

I do not understand why Tor needs to install a different copy of Firefox in order to work. I am very nervous about letting Tor copy over my Firefox installation which is customized with a number of plug-ins. I do not browse in Tor very often - most of my browsing is done outside of it. Yet I keep my relay running whenever my computer is on. Now I can't do this?

I am concerned about the compromises, although I think Anonymous was right to do what they did. I agree that it does not sound like a "Tor flaw." Servers addressed on the onion are still physically out there and can be pinged and vulnerability scanned at random. All Tor says it will do is prevent them from being ID'd to their traffic, from their traffic.

Yet, when Vidalia started up this morning and popped me up a window, the only new version I was offered was the browser bundle. Sorry, but if I had to replace my browser to run Tor, I would never have become part of the Tor network to begin with. I will continue to run my relay until you shut me down, to help people under censored regimes. But no more versions.

The Tor Browser Bundle

The Tor Browser Bundle doesn't install anything. It's a self-contained set of applications. It won't overwrite or mess with anything from your other Firefox install.

That said, if you're running a relay, great! Keep up the good work and thanks for helping the world. The Vidalia relay bundle is for you.

https://www.torproject.org/download/download has lots of options including the Vidalia bundles. https://www.torproject.org/download/download-easy has fewer options.

There's a couple points that

There's a couple points that aren't clear to me. Can the configurations of these new bundles be changed or are the relay, bridge, and exit node settings locked?

Not everyone wants to use FireFox. Myself, I'm a SeaMonkey user and will not be installing FireFox. Please keep an option available for non FireFox users. I rarely need Tor for my own use but I do run an exit node because others need them. Like a few others have voiced, if this becomes a "no choice" scenario, I'll run the present relay/exit node until it no longer works.

It would also be appreciated if you do not discontinue Vidalia. I realize that it isn't necessary for Tor to work, but it's convenient to have the bandwidth graph, network map and message log all available from a single interface.

Bump my post from two days

Bump my post from two days ago. I am the one who said I am totally confused. There is no coherent explanation of the changes. Is there anyone here who thinks it is a good explanation of the changes to say "Plain Vidalia Bundles to be discontinued, don't panic."

Roger's (arma) post above this one is hardly a complete explanation of what is available for the various distributions and user groups. Yeah, it is hard to write complete documentation and explain your work to users. Sorry, but that's part of the job.

Killing Vidalia is the end

Killing Vidalia is the end of Torproject :(

Vidalia is a core piece of

Vidalia is a core piece of Tor Browser Bundle, which is the bundle everybody should be using instead of the old Vidalia bundle. Nobody's killing it.

"we are moving to a

"we are moving to a client/server model for packages, and consequently the "plain" Vidalia bundles will be discontinued"

God only knows what this means. Maybe it would be clearer if translated into Greek.

the matter for me the most

the matter for me the most is can the new arrangement made portable or not? If it can be made portable then it's great since I prefer the portable software rather the installed one in order to make my computer cleans.

The 'new arrangement', aka

The 'new arrangement', aka Tor Browser Bundle, is already portable. You're in luck!

Please confirm, does the Tor

Please confirm, does the Tor Bundle allow for other applications in OSx to use TOR? Such as Apple Mail?

Are there any privacy risks in downloading email over IMAP into Apple Mail, over Tor, from a mail server such as Hushmail?

Thanks,

Jenny

Yes, OS X TBB does allow

Yes, OS X TBB does allow other applications to use Tor. But see
https://www.torproject.org/docs/faq#TBBSocksPort
and
https://www.torproject.org/docs/faq#TBBPolipo

I don't know that anybody's ever audited Apple Mail to see if it leaks sensitive info.

This is truly a sad

This is truly a sad developing of TOR project. If you are so concerned about newbies having misconfigured bundles then make a bundle for them and don't shut down the power users and relay providers that has been around since start!! Besides I choose what the heck I want to run through TOR! Not you! : ( I am a SeaMonkey user and sometimes I torrent through TOR and all IM is run trough TOR. What is the great solution for US??! /NiGH from Sweden

Do NOT use "torrent" through

Do NOT use "torrent" through Tor! Even using Tor just for tracker is questionable in terms of anonymity. But, to use Tor to download torrents is rude and you should stop. You are hogging bandwidth from other Tor users, slowing down the whole network. Soon, Tor folks will implement a fix for jerks that download torrent through Tor ... oh, how that will be a sweet day!

Guys hope someone could

Guys hope someone could PLEASE help me.

I read this blog so I decided to stop using Vidalia Bundle and only use Tor-Browser from now on (through Aurora or other Socks prgs)

Moving from Vidalia bundle to using Tor-Browser, I no longer have Polipo, since Tor-Browser doesn't need it.

However I still need a legacy program that can only use HTTP proxy to still be able to use TOR (Using sockifying prg not possible)

So far the only solution I found was to :
Run Vidalia bundle.
Kill within Windows taskmanager Vidalia.exe and Tor.exe but leave polipo.exe process running.

So now for secure browsing I only use Tor-Browser Aurora and other programs which use Socks. And that way polipo.exe process is still running I can still run an old program I have which insists on only route traffic through HTTP proxy.

My question is now that Tor-Browser doesn't include polipo. Is there any simpler way to run polipo in the background as a process (without command prompt) just like Vidalia itself used to run it ? I mean without nagging command prompt window etc.

That's actually not a bad

That's actually not a bad way for now, if it works for you.

Eventually we need to figure out if we're going to do some easier version of the polipo installer for Windows. But in the mean time, this seems like a perfectly reasonable workaround.

Thanks. Hope there would be

Thanks. Hope there would be an easier way for this :)

Will the Tor only expert

Will the Tor only expert bundles continue to be available?

From what one understands,

From what one understands, distributing a modified version of the Firefox browser with the Firefox trademark requires permission from Mozilla. For the Tor Browser Bundles, this issue was raised at the PortableApps.com site:

http://portableapps.com/node/15206

If this is actually a non-issue or if this issue has been resolved, it might be useful to confirm this.

On a somewhat different issue, it appears that the Ubuntu Linux platform can be set up so that Vidalia (along with the Tor software) can be added via the package manager from deb.torproject.org. If users are going to be directed to use the Tor Browser Bundles instead of the Vidalia Bundles, it would be useful if the Tor Browser Bundle could be obtained on the Ubuntu Linux platform in a similar manner. (Note: Not all Ubuntu Linux platforms have the same version of the Firefox browser. For instance, Ubuntu 10.04 has Firefox 3.6.23 as of now.)

I don't like it to get

I don't like it to get forced using a specific browser. Especially the newer versions of firefox are a bit too user-friendly for me. Options are missing and things are automated.

For instance, firefox can update itself even though it was switched off. Firefox also looks for plugins like java and flash on C-Drive and activates them automatically, causing trouble with anonymity. Noscript is known as a malicious plugin and installed search-engines look (anonymously or not?) on their websites for updates. With firefox I bet there are even more unknown issues like this.

Please continue providing the traditional vidalia-bundle.

I know you guys are trying

I know you guys are trying to make a point.....but why is Tor through Aurora very slow ?

i hope ppl are still reading

i hope ppl are still reading this and can help me. i use tor vidalia with my own firefox, torbutton but i also have a download manager set up to use tor. i cant run a relay bcos i get charged per gb of data used (its a bit complicated my internet connect) so if all vidalia plain bundles are discontinued how do i use tor with my dl manager under a browser bundle? it seems from what i have read that wont be possible, because the tor browser bundle will only be set up to work with the browser it comes with (and please dont suggest an addon download manager; i dont want any more addons for firefox)

1. I use TenFourFox, nice

1. I use TenFourFox, nice and speedy on a 1Ghz G4 PPC TiBook, now updated to 9.0.1 (current version of FF).

2. Torproject is then *discontinuing* PowerPC versions for the Mac OS?

...could not find a notice of this from a Google search on the site, as PPC is only in Vidalia bundles (w/old FF 3.x), correct?

3. Must now use older versions of Tor on a PPC computer, with any browser that isn't old? Newer browsers such as Safari 5.x for PPC (last version supported by Apple, which still works well for most websites) cannot be configured to use newer versions of Tor then(anyway to turn off the annoying error message saying I'm using an older, insecure version of Tor that needs to be updated)???

Vidalia Bundle 0.2.17 -

Vidalia Bundle 0.2.17 - Editing the torrc file??? Where has the flexibility gone?

Hi. Just updated to the above version. Whereas before, I could edit the torrc file to specify exitnodes, now this is only allowed temporarily ie edit the torrc file from
within Vidalia/Advanced tab but it isn't saved. The older version saved the file so the
edit was done once and then every time after, it all worked as planned. The exitnodes I want to specify are for the UK. I need to update this on both Mac
OS X and Windows. I'm working with Foxyproxy. Any advice gratefully received. Thanks

With respect to having to

With respect to having to edit your torrc file every time, a batch file that copies a version of your torrc file from elsewhere then launches TBB would probably work perfectly. TBB does not allow changes so that the masses will not accidentally break the security in Tor.

With respect to using another browser with the new TBB, this can easily be done. Just launch TBB, minimize the Tor browser, then launch one's preferred browser. One needs to be cautious though, that one's preferred browser is secure since the Tor button will no longer be maintained. I doubt there is any issue with TBB Aurora getting confused with another Firefox version since TBB Aurora is running in portable mode.

One option that I have tried that works as an alternative browser, is the JonDoFox flavour of Firefox. It is specifically configured to allow the JonDo anonymizer, but has a switch in the Addon bar to connect to Tor, to configure your own proxy, or to run with no anonymity. It is also kept current with Firefox updates. I like this browser a bit better than the Tor Aurora browser because like most browsers for Windows, one can drag the current URL link from the address bar onto the Desktop, which is not allowed with TBB Aurora. Also Addon's added by user to JonDoFox do not get deleted upon next startup of the browser. Again, be careful because many Addons will break Tor's, or any other anonymizer's security.

One caution I will make is if one clicks on a URL link saved on one's computer, it may launch another browser that is not configured for Tor; so be careful. One can however safely drag the link into the TBB Aurora browser.

Is there a reason why the Tor Project does not allow Aurora to allow users to drag the current URL address onto the desktop as a link? I wish this feature was re-enabled in TBB Aurora.

Also try out the new Tor Tails project, found elsewhere on the Tor website - a portable OS with portable Tor that launches automatically on startup, encryption, mail, etc. that will work from almost any fairly modern computer that allows booting from CD or USB, with no need to touch the computer's hard disk.