For future reference you should use the forum search engine at the top right of your screen before you create a new post. If you had entered “tor unrecommended” or "unrecommended " you would have found this duplicate post which still applies to your questions.
boring, now is the whonix update with 0.2.9.10 and the new one with many security fixes is 0.2.9.12.
Why goes Whonix the unsafe way and dont update directly to the newest stable? and then asks for a donation ^^ for his permernent out-of-date product pfff
It’s not “his” product. It’s ours. And you’re welcome to support its continued existence by making suggestions like you did at any time. You may also submit pull requests, suggest new tickets, or donate so others can work on development. How to contribute.
Tor 0.3.0.x introduced an updated directory authentication mechanism as well as new guard selection algorithms. Tor 0.3.1.x introduced compact directory formats and network padding (which requires both clients and relays to be updated to be functional).
Since these are major new features, these clients should be tested before being uploaded to Whonix stable. My guess is that Whonix will stay on 0.2.9.x until Whonix 14. (FYI, 0.2.9.x is an LTS release and will remain officially supported until Jan 2020). If you’d like to help test, simply clone your whonix-gw template and follow the instructions above to upgrade to 0.3.1.x.
This was the case in earlier versions of Whonix but then things happened creating a strong urge to use the version from deb.torproject.org. I was wondering if it was best to move Whonix back to that method if possible.
You probably know but in case anyone is wondering: an automatic 0.2.9 -> 0.3 upgrade of Tor could break connectivity for Whonix users. (Happened in past. AppArmor, configs and whatnot.) That’s why it’s not as easy as enabling torproject’s repository by default for everyone.
Because then we could stay with the version from Debian.
Connections between clients and relays now send a padding cell in each direction every 1.5 to 9.5 seconds (tunable via consensus parameters). This padding will not resist specialized eavesdroppers, but it should be enough to make many ISPs’ routine network flow logging less useful in traffic analysis against Tor users.
Padding is negotiated using Tor’s link protocol, so both relays and clients must upgrade for this to take effect. Clients may still send padding despite the relay’s version by setting ConnectionPadding 1 in torrc, and may disable padding by setting ConnectionPadding 0 in torrc.
If you agree, I’ll edit the wiki here (they can add an additional line under the Sandbox 1 entry):