Tor version 0.4.7.16 in Whonix 17 is now considered obsolete. Any action required?

Support
1

Tor version 0.4.7.16 in Whonix 17 is now considered obsolete. Any action required?

2

Start unchanged Whonix-Gateway-17, open Nyx. Read “Tor 0.4.7.16 (obsolete)”.

I understand that this is likely to be caused by Debian, but I am not sure if it’s safe to use.

3

This is out-of-scope as per Support Request Policy.

4

Tor Project recommends using their repository for Debian/Ubuntu users. (Asked in IRC)

Debian package maintainer did not respond. (Asked via email)

Installing from backports is a thing.

The tor package being obsolete seems to affect mainly relays, as it’s barely mentioned on the web in other contexts. Hopefully it’s not unsecure for use as a client.

To reiterate: It is up to date in Debian, but directory authorities report the version as obsolete (should no longer be used). All packages must stay up-to-date for security purposes - is my cause for concern.

5

(Whonix is based on Debian.)

6

I am not sure if it is correct, but it worked for me
After checking available versions by typing in terminal:

apt list-tor -a
Listing… Done
tor/stable-backports,now 0.4.8.10-1~bpo12+1 amd64
tor/stable,stable-security 0.4.7.16-1 amd64 [installed]

then I installed the other one by typing:
sudo apt install tor=0.4.8.10-1~bpo12+1 tor-geoipdb=0.4.8.10-1~bpo12+1

reboot and we are done.

If thats wrong please correct me, but its not obsolete anymore

7

Installation from backports for users could be as simple as:

sudo apt -t bookworm-backports install tor

No need for the extra complication of specification of the most recent available version number on the command line,

which has been documented just now here:
Install Tor from Backports

It’s part of Installing Newer Tor Versions wiki page, and marked “Testers only”.

It’s not done at the distribution level because of this:

9

Due to bugs - not caused by Whonix (upstream bug reports are linked here) - the choice for Whonix development boils down to the following two options.

So far I’ve decided for A) as disabling Vanguards would be a major downgrade.

That is currently broken which is why things are as is. See:

Probably not realistic. Not sure. Look into salaries for Linux distribution developers. Maybe OpenSUSE can be used as an example. Dunno how good this data is:
https://www.glassdoor.co.uk/Salary/SUSE-Software-Engineer-Salaries-E466462_D_KO5,22.htm
(Other considerations on top of it, small vs large company, job security, etc.)

This isn’t just a one-off task. It needs constant monitoring, testing newer versions, analyzing bugs and perhaps derivative-specific bug fixes should need arise. Continuous brain cycles being spent.

At some point during Debian release cycle of a stable version.

1 Like
11

Answered here just now:

1 Like
12

4 posts were split to a new topic: general feedback

13

Another issue is some onions being unreachable due to POW (proof of work). Reference: Whonix : tor connection issue (PoW) / vpn

So it seems vanguards needs to be dropped in favor of the newer Tor version.

1 Like
14
1 Like
17

Whonix 17, Tor 0.4.8.15 (obsolete)

1 Like
18

Frozen Packages

1 Like
19

Hello Patrick,

This time it seems to be tor package’s maintainer delay to provide updates in time as there are two yet undisclosed “medium” level security issues which appear to be fixed in 0.4.8.20 (/tpo/core/team/-/wikis/NetworkTeam/TROVE):

TROVE-2025-014
TROVE-2025-015

Maybe it should be repackaged from Tor Project’s repository into Kicksecure’s repo earlier?

3 Likes
20

I see this approach is a must, as vanguard not anymore into the concern, packaging Tor from source code into whonix/KS repo or using TPO will resolve it.

1 Like
21
1 Like
22

If you ask about vanguards, I can tell these do work in Whonix when conflux feature is disabled (I do not have a Github account at the moment to post about it there). While built-in vanguards-lite provide a decent protection for client connections of most Tor users, “vanguards-full” are still useful protection from more sophisticated, long-term Guard Discovery attacks against Onion Services. For mikeperry-tor/vanguards to work, user can simply add “ConfluxEnabled 0” to torrc. Vanguards errors began when conflux was introduced, both Mike Perry and Tor Project still ignore this issue. It might be worth to note on Whonix wiki for advanced users.

2 Likes
23

It’s not entirely accurate to assume that the Tor Project is ignoring the issue. It’s just that the C implementation of Tor is gradually giving way to Arti (a Tor client written in Rust). Announcing Vanguards Support in Arti | The Tor Project

1 Like
24

Arti is still experimental and has no ETA on a stable, production-ready version. I don’t see the development of a new implementation as a logical justification for leaving most of publicly accessible Onion Services using ctor with default conflux settings at risk.

2 Likes