SoylentNews

Luckily, the sensors that can collect the necessary data are already installed in each PC. There are thermal sensors that monitor CPU temperature, power-consumption monitors that track energy efficiency, storage health indicators that assess solid state drive (SSD) wear levels, performance counters that measure system utilization, fan-rotation-speed sensors that detect cooling efficiency, and more. The key is to collect and store all that data in a secure yet useful way.

We decided that the best way to do this is to integrate the life-cycle records into the firmware layer. By embedding telemetry capabilities directly within the firmware, we ensure that device health and usage data is captured the moment it is collected. This data is stored securely on HP SSD drives, leveraging hardware-based security measures to protect against unauthorized access or manipulation.

The secure telemetry protocol we've developed at HP works as follows. We gather the critical hardware and sensor data and store it in a designated area of the SSD. This area is write-locked, meaning only authorized firmware components can write to it, preventing accidental modification or tampering. That authorized firmware component we use is the Endpoint Security Controller, a dedicated piece of hardware embedded in business-class HP PCs. It plays a critical role in strengthening platform-level security and works independently from the main CPU to provide foundational protection.

The endpoint security controller establishes a secure session by retaining the secret key within the controller itself. This mechanism enables read data protection on the SSD—where telemetry and sensitive data are stored—by preventing unauthorized access, even if the operating system is reinstalled or the system environment is otherwise altered.

Then, the collected data is recorded in a time-stamped file, stored within a dedicated telemetry log on the SSD. Storing these records on the SSD has the benefit of ensuring the data is persistent even if the operating system is reinstalled or some other drastic change in software environment occurs.

The telemetry log employs a cyclic buffer design, automatically overwriting older entries when the log reaches full capacity. Then, the telemetry log can be accessed by authorized applications at the operating system level.

The telemetry log serves as the foundation for a comprehensive device history report. Much like a CarFax report for used cars, this report, which we call PCFax, will provide both current users and potential buyers with crucial information.

The PCFax report aggregates data from multiple sources beyond just the on-device telemetry logs. It combines the secure firmware-level usage data with information from HP's factory and supply-chain records, digital-services platforms, customer-support service records, diagnostic logs, and more. Additionally, the system can integrate data from external sources including partner sales and service records, refurbishment partner databases, third-party component manufacturers like Intel, and other original equipment manufacturers. This multisource approach creates a complete picture of the device's entire life cycle, from manufacturing through all subsequent ownership and service events.

For IT teams within organizations, we hope the PCFax will bring simplicity and give opportunities for optimization. Having access to fine-grained usage and health information for each device in their fleet can help IT managers decide which devices are sent to which users, as well as when maintenance is scheduled. This data can also help device managers decide which specific devices to replace rather than issuing new computers automatically, enhancing sustainability. And this can help with security: With real-time monitoring and firmware-level protection, IT teams can mitigate risks and respond swiftly to emerging threats. All of this can facilitate more efficient use of PC resources, cutting down on unnecessary waste.

We also hope that, much as the CarFax gives people confidence in buying used cars, the PCFax can encourage resale of used PCs. For enterprises and consumers purchasing second-life PCs, it provides detailed visibility into the complete service and support history of each system, including any repairs, upgrades, or performance issues encountered during its initial deployment. By making this comprehensive device history readily available, PCFax enables more PCs to find productive second lives rather than being prematurely discarded, directly addressing the e-waste challenge while providing economic benefits to both sellers and buyers in the secondary PC market.

While HP's solutions represent a significant step forward, challenges remain. Standardizing telemetry frameworks across diverse ecosystems is critical for broader adoption. Additionally, educating organizations about the benefits of life-cycle records will be essential to driving uptake.

We are also working on integrating AI into our dashboards. We hope to use AI models to analyze historical telemetry data and predict failures before they happen, such as detecting increasing SSD write cycles to forecast impending failure and alert IT teams for proactive replacement, or predicting battery degradation and automatically generating a service ticket to ensure a replacement battery is ready before failure, minimizing downtime.

We plan to start rolling out these features at the beginning of 2026.

Original Submission

While personalized pricing isn't unique to Delta, the airline has been particularly candid about embracing it. During that November call, Hauenstein said the AI ticketing system is "a full reengineering of how we price and how we will be pricing in the future," and described the rollout as "a multiyear, multi-step process." Hauenstein acknowledged that Delta was excited about the initial revenue results it saw in testing, but noted the shift to AI-determined pricing could "be very dangerous, if it's not controlled and it's not done correctly."

Delta's personalized AI pricing tech is provided by travel firm Fetcherr, which also partners with Virgin Atlantic, Azul, WestJet, and VivaAerobus. In Delta's case, the AI will act as a "super analyst" that operates 24/7 to determine custom ticket prices that should be offered to individual customers in real-time, per specific flights and times.

Airlines have varied their ticket prices for customers on the same routes for many years, depending on a range of factors, including how far in advance the booking is made, what website or service it's being booked with, and even the web browser the customer is using. Delta is no exception, but AI pricing looks set to supercharge the approach.

Delta has taken heat for charging customers different prices for flights, having rolled back the decision to price tickets higher for solo-travelers compared to groups in May. It's not entirely clear how invasive Delta's AI ticketing will be when it analyzes customers to figure out prices, but Fortune notes that it has privacy advocates concerned.

"They are trying to see into people's heads to see how much they're willing to pay," Justin Kloczko of Consumer Watchdog told the publication. "They are basically hacking our brains." Arizona Senator Ruben Gallego described it as "predatory pricing" that's designed to "squeeze you for every penny."

Original Submission

Those definitions emerged from the work of Juris Hartmanis, a pioneering computer scientist who had experience making do with limited resources. He was born in 1928 into a prominent Latvian family, but his childhood was disrupted by the outbreak of World War II. Occupying Soviet forces arrested and executed his father, and after the war Hartmanis finished high school in a refugee camp. He went on to university, where he excelled even though he couldn't afford textbooks.

In 1960, while working at the General Electric research laboratory in Schenectady, New York, Hartmanis met Richard Stearns, a graduate student doing a summer internship. In a pair of groundbreaking papers they established precise mathematical definitions for time and space. These definitions gave researchers the language they needed to compare the two resources and sort problems into complexity classes.

As it happened, they started at Cornell University, where Hartmanis moved in 1965 to head the newly established computer science department. Under his leadership it quickly became a center of research in complexity theory, and in the early 1970s, a pair of researchers there, John Hopcroft and Wolfgang Paul, set out to establish a precise link between time and space.

Hopcroft and Paul knew that to resolve the P versus PSPACE problem, they'd have to prove that you can't do certain computations in a limited amount of time. But it's hard to prove a negative. Instead, they decided to flip the problem on its head and explore what you can do with limited space. They hoped to prove that algorithms given a certain space budget can solve all the same problems as algorithms with a slightly larger time budget. That would indicate that space is at least slightly more powerful than time — a small but necessary step toward showing that PSPACE is larger than P.

With that goal in mind, they turned to a method that complexity theorists call simulation, which involves transforming existing algorithms into new ones that solve the same problems, but with different amounts of space and time. To understand the basic idea, imagine you're given a fast algorithm for alphabetizing your bookshelf, but it requires you to lay out your books in dozens of small piles. You might prefer an approach that takes up less space in your apartment, even if it takes longer. A simulation is a mathematical procedure you could use to get a more suitable algorithm: Feed it the original, and it'll give you a new algorithm that saves space at the expense of time.

Algorithm designers have long studied these space-time trade-offs for specific tasks like sorting. But to establish a general relationship between time and space, Hopcroft and Paul needed something more comprehensive: a space-saving simulation procedure that works for every algorithm, no matter what problem it solves. They expected this generality to come at a cost. A universal simulation can't exploit the details of any specific problem, so it probably won't save as much space as a specialized simulation. But when Hopcroft and Paul started their work, there were no known universal methods for saving space at all. Even saving a small amount would be progress.

The breakthrough came in 1975, after Hopcroft and Paul teamed up with a young researcher named Leslie Valiant. The trio devised a universal simulation procedure that always saves a bit of space. No matter what algorithm you give it, you'll get an equivalent one whose space budget is slightly smaller than the original algorithm's time budget.

"Anything you can do in so much time, you can also do in slightly less space," Valiant said. It was the first major step in the quest to connect space and time.

But then progress stalled, and complexity theorists began to suspect that they'd hit a fundamental barrier. The problem was precisely the universal character of Hopcroft, Paul and Valiant's simulation. While many problems can be solved with much less space than time, some intuitively seemed like they'd need nearly as much space as time. If so, more space-efficient universal simulations would be impossible. Paul and two other researchers soon proved that they are indeed impossible, provided you make one seemingly obvious assumption: Different chunks of data can't occupy the same space in memory at the same time.

"Everybody took it for granted that you cannot do better," Wigderson said.

Paul's result suggested that resolving the P versus PSPACE problem would require abandoning simulation altogether in favor of a different approach, but nobody had any good ideas. That was where the problem stood for 50 years — until Williams finally broke the logjam. First, he had to get through college.

In 1996, the time came for Williams to apply to colleges. He knew that pursuing complexity theory would take him far from home, but his parents made it clear that the West Coast and Canada were out of the question. Among his remaining options, Cornell stood out to him for its prominent place in the history of his favorite discipline.

"This guy Hartmanis defined the time and space complexity classes," he recalled thinking. "That was important for me."

Williams was admitted to Cornell with generous financial aid and arrived in the fall of 1997, planning to do whatever it took to become a complexity theorist himself. His single-mindedness stuck out to his fellow students.

"He was just super-duper into complexity theory," said Scott Aaronson, a computer scientist at the University of Texas, Austin, who overlapped with Williams at Cornell.

For 50 years, researchers had assumed it was impossible to improve Hopcroft, Paul and Valiant's universal simulation. Williams' idea — if it worked — wouldn't just beat their record — it would demolish it.

"I thought about it, and I was like, 'Well, that just simply can't be true,'" Williams said. He set it aside and didn't come back to it until that fateful day in July, when he tried to find the flaw in the argument and failed. After he realized that there was no flaw, he spent months writing and rewriting the proof to make it as clear as possible.

Valiant got a sneak preview of Williams' improvement on his decades-old result during his morning commute. For years, he's taught at Harvard University, just down the road from Williams' office at MIT. They'd met before, but they didn't know they lived in the same neighborhood until they bumped into each other on the bus on a snowy February day, a few weeks before the result was public. Williams described his proof to the startled Valiant and promised to send along his paper.

"I was very, very impressed," Valiant said. "If you get any mathematical result which is the best thing in 50 years, you must be doing something right."

With his new simulation, Williams had proved a positive result about the computational power of space: Algorithms that use relatively little space can solve all problems that require a somewhat larger amount of time.

The difference is a matter of scale. P and PSPACE are very broad complexity classes, while Williams' results work at a finer level. He established a quantitative gap between the power of space and the power of time, and to prove that PSPACE is larger than P, researchers will have to make that gap much, much wider.

That's a daunting challenge, akin to prying apart a sidewalk crack with a crowbar until it's as wide as the Grand Canyon. But it might be possible to get there by using a modified version of Williams' simulation procedure that repeats the key step many times, saving a bit of space each time. It's like a way to repeatedly ratchet up the length of your crowbar — make it big enough, and you can pry open anything.

"It could be an ultimate bottleneck, or it could be a 50-year bottleneck," Valiant said. "Or it could be something which maybe someone can solve next week."

"I can never prove precisely the things that I want to prove," Williams said. "But often, the thing I prove is way better than what I wanted."

Journal References:
Dr. Juris Hartmanis Interview: July 26, 2009; Cornell University in Ithaca, New York
On Time Versus Space, Journal of the ACM (JACM)
Space bounds for a game on graphs:, Journal of the ACM (JACM)
Tree Evaluation Is in Space 𝑂 (log 𝑛 · log log 𝑛), Journal of the ACM (JACM)

Original Submission

We liked this description from CHERI Project boffin David Chisnall:

The original Symbian kernel was nothing special, but EKA2 (which is the one described in the amazing Symbian Internals book) was a thing of beauty. It had a realtime nano-kernel (does not allocate memory) that could run both an RTOS and a richer application stack.

It was a victim of poor timing: the big advantage was the ability to run both the apps and the phone stack on the same core, but it came along as Arm cores became cheap enough that just sticking two in the SoC was cheap enough.

Before Nokia was assimilated and digested by Microsoft, it open sourced the OS, and despite some licensing concerns, it's still there.
It strikes this vulture as odd that while work continues on some ground-up FOSS OS projects in C++, such as the Genode OS, or

Serenity OS, which we looked at in 2022,the more complete Symbian, which shipped on millions of devices and for a while had a thriving third-party application market, languishes ignored.
(Incidentally, the Serenity OS project lead has moved on to the independent Ladybird browser, which we looked at in 2023. Work on the OS continues, now community-led.)

Symbian's progenitor, Psion EPOC32, predates much of the standardization of C++ – much as BeOS did. We've seen comments that it was not easy to program, but tools such as P.I.P.S. made it easier. Nokia wasted vast effort on multiple incompatible UIs, which have been blamed for tearing Symbian apart, but none of that matters now: adapt some existing FOSS stuff, and forget backwards compatibility. Relatively few of the apps were FOSS, and who needs touchscreen phone apps on a Raspberry Pi anyway? Qt would be ideal – it's a native C++ tool too.

Fans of all manner of 20th century proprietary OSes from AmigaOS to OS/2 bemoan that these never went open source. Some of BeOS made it into PalmOS Cobalt but that sank. Palm even mulled basing an Arm version of PalmOS on Symbian, but the deal fell through.

Some of those OSes have been rebuilt from scratch, including AmigaOS as AROS and BeOS as Haiku. But they run on Intel. Neither runs natively on Arm, and yet Symbian sits there ignored. Sometimes you can't even give the good stuff away.

by Liam Proven // Thu 17 Jul 2025 // 07:27 UTC

Original Submission

Microsoft revealed several AI features at Build 2024, but the highlight was Recall. Similar to Rewind, an app for the Mac I tried in December 2023, Recall can help Windows users find anything they've seen, heard, or opened on their PC. This includes files, documents, and apps, but also images, videos, and audio. Recall defaults to a scrollable timeline, which is broken up into discrete events detected by Recall, but users can also browse with semantic text search.

It's a simple feature to use, but its implications are vast. If Recall works as advertised, it could fundamentally change how people interact with Windows PCs. There's arguably little need to organize photos from a vacation or carefully file away notes if Recall can find anything, and everything, you've opened on your PC.

"It used to be if you interacted with your PC, you used a command line. Then we came up with the graphical user interface," said Ostrum. "Now, how do you find the things that you are looking for? Recall is a much more natural and richer way to interact with your files."

There's one unavoidable caveat: It's too early to know if Recall will do what Microsoft says. I tried the feature firsthand, and found that it could recall a fictional recipe I asked Microsoft Copilot to create. It did so immediately, and also after several hours had passed. Whether it can do the same next month, or next year, remains to be seen.

While Recall was the star, it was joined by several additional AI features. These include Cocreator, a new feature for Microsoft Paint that uses AI to convert simple sketches into more elaborate digital art, and Live Captions, which captions and translates video in real time. Like Recall, both features lean on a Copilot+ PC's neural processing unit (NPU). That means these features, again like Recall, won't be available on older PCs.

These features are intriguing, but they're shadowed by a concern: privacy. Recall could help you find lost documents, and live translation could lower language barriers, but they only work if Microsoft's AI captures what's happening on your PC. The company hopes to ease these concerns by running AI models on-device and encrypting any data that's stored.

Qualcomm partnership leaves Intel, AMD in the cold

Of course, running an AI model on-device isn't easy. CPUs can handle some AI models, but performance often isn't ideal, and many AI models aren't optimized for the hardware. GPUs are better fit for AI workloads but can draw a lot of power, which shortens battery life.

That's where Qualcomm comes into the picture. Its latest laptop chip, the Snapdragon X Elite, was designed by many of the same engineers responsible for Apple's M1 chip and includes an NPU.

Microsoft's two Copilot+ PCs, the Surface Laptop and Surface Pro, both have Snapdragon X Elite processors, and both quote AI performance of up to 45 trillion operations per second. Intel's current Intel Core Ultra processors are a step behind, with quoted AI performance up to 34 trillion operations per second.

That's apparently not enough for Microsoft: All Copilot+ PCs available at launch on 18 June will have Qualcomm chips inside. And many new AI features, including Windows' Recall, only work on Copilot+ PCs. Put simply: If you want to use Recall, you must buy Qualcomm.

Intel and AMD chips will appear in Copilot+ PCs eventually, but Ostrum said that may not happen until the end of 2024 or early 2025.

"We will continue to partner with [Intel and AMD] when it makes sense," said Ostrum. "There is both an element of how much performance there is, but there's also an element of how efficient that performance is [...] we don't want [AI] to be taxing multiple hours of battery life at a given time." Ostrum says activating AI features like Windows' Recall on a Copilot+ PC shaves no more than 30 to 40 minutes off a laptop's battery life, and all of Microsoft's battery-life quotes for Surface devices (which promise up to 15 hours of Web browsing and 22 hours of video playback) assume Copilot+ AI features are turned on.

It's unusual to see a major Windows product launch without Intel at the forefront of it, but that underscores Microsoft's belief that features like Recall only work on hardware that prioritizes AI performance and efficiency. If Microsoft has it their way, the Copilot key won't be a fad. It'll be the most important key on every Windows PC.

So, are you getting one or staying as far as away as you can?

Original Submission

1. Tor is compromised (and not anonymous)

That governments can de-anonymize Tor users is another well-known point that's been acknowledged for years. In 2013 the Washington Post broke an article citing reports that US government agencies had figured out how to de-anonymize Tor users on a "wide scale". From the Washington Post:

Since 2006, according to a 49-page research paper titled simply "Tor," the agency has worked on several methods that, if successful, would allow the NSA to uncloak anonymous traffic on a "wide scale" — effectively by watching communications as they enter and exit the Tor system, rather than trying to follow them inside. One type of attack, for example, would identify users by minute differences in the clock times on their computers.

There are also reports of government agencies cooperating with researchers to "break" or somehow exploit Tor to de-anonymize users:

Then in July, a much anticipated talk at the Black Hat hacking conference was abruptly canceled. Alexander Volynkin and Michael McCord, academics from Carnegie Mellon University (CMU), promised to reveal how a $3,000 piece of kit could unmask the IP addresses of Tor hidden services as well as their users.

Its description bore a startling resemblance to the attack the Tor Project had documented earlier that month. Volynkin and McCord's method would deanonymize Tor users through the use of recently disclosed vulnerabilities and a "handful of powerful servers." On top of this, the pair claimed they had tested attacks in the wild.

For $3,000 worth of hardware, this team from Carnegie Mellon could effectively "unmask" Tor users. And this was in 2015. But a 2017 court case proves FBI can de-anonymize Tor users. "The means by which the FBI is able to de-anonymize Tor users and discover their real IP address remains classified information. In a 2017 court case, the FBI refused to divulge how it was able to do this, which ultimately led to child abusers on the Tor network going free."

From the Tech Times:

In this case, the FBI managed to breach the anonymity Tor promises and the means used to collect the evidence from the dark web make up a sensitive matter. The technique is valuable to the FBI, so the government would rather compromise this case rather than release the source code it used. "The government must now choose between disclosure of classified information and dismissal of its indictment," federal prosecutor Annette Hayes said in a court filing on Friday.

The cat is out of the bag. The FBI (and presumably other government agencies) has proven to be fully capable of de-anonymizing Tor users. Most Tor promoters simply ignore these different cases and the obvious implications.

2. Tor developers are cooperating with US government agencies

Some Tor users may be surprised to know the extent to which Tor developers are working directly with US government agencies. After all, Tor is often promoted as a grass-roots privacy effort to help you stay "anonymous" against Big Brother. One journalist was able to clarify this cooperation through FOIA requests, which revealed many interesting exchanges.

Here is one email correspondence in which Roger Dingledine discusses cooperation with the DOJ (Department of Justice) and FBI (Federal Bureau of Investigation), while also referencing "backdoors" being installed.

Tor developer Steven Murdoch discovered a vulnerability with the way Tor was handling TLS encryption. This vulnerability made it easier to de-anonymize Tor users, and as such, it would be valuable to government agencies. Knowing the problems this could cause, Steven suggested keeping the document internal,

...it might be a good to delay the release of anything like 'this attack is bad; I hope nobody realizes it before we fix it'.

Eight days later, Roger Dingledine alerted two government agents about this vulnerability. While there is disagreement as to the seriousness of these issues, one thing remains clear. Tor developers are closely working with the US government. [...] Whether or not you agree with the ultimate conclusion of this researcher, the facts remain for anyone who wants to acknowledge them. The big issue is the close cooperation between Tor developers and US government agencies.

And if you really want to dive in, check out the full FOIA cache here.

3. When you use Tor, you stand out like a glow stick

Meet Eldo Kim. He was the Harvard student who assumed Tor would make him "anonymous" when sending bomb threats. Kim didn't realize that when he connected to Tor on the university network, he would stand out like a [...]glow stick. The FBI and the network admins at Harvard were able to easily pinpoint Kim because he was using Tor around the time the bomb threat email was sent through the Tor network. From the criminal complaint:

Harvard University was able to determine that, in the several hours leading up to the receipt of the e-mail messages described above, ELDO KIM accessed TOR using Harvard's wireless network.

Eldo Kim is just one of many, many examples of people who have bought into the lie that Tor provides blanket online anonymity – and later paid the price. Had Kim used a bridge or VPN before accessing the Tor network, he probably would have gotten away with it (we'll discuss this more below).

4. Anybody can operate Tor nodes and collect your data and IP address

Many proponents of Tor argue that its decentralized nature is a benefit. While there are indeed advantages to decentralization, there are also some major risks. Namely, that anybody can operate the Tor nodes through which your traffic is being routed. There have been numerous examples of people setting up Tor nodes to collect data from gullible Tor users who thought they would be safe and secure. Take for example Dan Egerstad, a 22-year-old Swedish hacker. Egerstad set up a few Tor nodes around the world and collected vast amounts of private data in just a few months:

In time, Egerstad gained access to 1000 high-value email accounts. He would later post 100 sets of sensitive email logins and passwords on the internet for criminals, spies or just curious teenagers to use to snoop on inter-governmental, NGO and high-value corporate email.

The question on everybody's lips was: how did he do it? The answer came more than a week later and was somewhat anti-climactic. The 22-year-old Swedish security consultant had merely installed free, open-source software – called Tor – on five computers in data centres around the globe and monitored it. Ironically, Tor is designed to prevent intelligence agencies, corporations and computer hackers from determining the virtual – and physical – location of the people who use it.

People think they're protected just because they use Tor. Not only do they think it's encrypted, but they also think 'no one can find me'.

To not assume government agencies are doing this right now would be extremely naive. Commenting on this case, security consultant Sam Stover emphasized the risks of someone snooping traffic through Tor nodes:

Domestic, or international . . . if you want to do intelligence gathering, there's definitely data to be had there. (When using Tor) you have no idea if some guy in China is watching all your traffic, or some guy in Germany, or a guy in Illinois. You don't know.

In fact, that is exactly how Wikileaks got started. The founders simply setup Tor nodes to siphon off more than a million private documents. According to Wired:

WikiLeaks, the controversial whistleblowing site that exposes secrets of governments and corporations, bootstrapped itself with a cache of documents obtained through an internet eavesdropping operation by one of its activists, according to a new profile of the organization's founder.

The activist siphoned more than a million documents as they traveled across the internet through Tor, also known as "The Onion Router," a sophisticated privacy tool that lets users navigate and send documents through the internet anonymously.

Are governments running Tor nodes for bulk data collection?

Egerstad also suggests Tor nodes may be controlled by powerful agencies (governments) with vast resources:

In addition to hackers using Tor to hide their origins, it's plausible that intelligence services had set up rogue exit nodes to sniff data from the Tor network. "If you actually look in to where these Tor nodes are hosted and how big they are, some of these nodes cost thousands of dollars each month just to host because they're using lots of bandwidth, they're heavy-duty servers and so on," Egerstad says. "Who would pay for this and be anonymous?"

Back in 2014, government agencies seized a number of different Tor relays in what is known as "Operation Onymous". From the Tor Project blog:

Over the last few days, we received and read reports saying that several Tor relays were seized by government officials. We do not know why the systems were seized, nor do we know anything about the methods of investigation which were used. Specifically, there are reports that three systems of Torservers.net disappeared and there is another report by an independent relay operator.

This issue continues to gain attention. In this Gizmodo article from 2021, we find the same problems. Bad actors can and do operate Tor nodes. Additional reading: A mysterious threat actor is running hundreds of malicious Tor relays

The fundamental issue here is there is no real quality control mechanism for vetting Tor relay operators. Not only is there no authentication mechanism for setting up relays, but the operators themselves can also remain anonymous. Assuming that some Tor nodes are data collection tools, it would also be safe to assume that many different governments are involved in data collection, such as the Chinese, Russian, and US governments.

See also: Tor network exit nodes found to be sniffing passing traffic

5. Malicious Tor nodes do exist

If government-controlled Tor nodes weren't bad enough, you also have to consider malicious Tor nodes.

In 2016 a group of researchers presented a paper titled "HOnions: Towards Detection and Identification of Misbehaving Tor HSDirs" [PDF], which described how they identified 110 malicious Tor relays:

Over the last decade privacy infrastructures such as Tor proved to be very successful and widely used. However, Tor remains a practical system with a variety of limitations and open to abuse. Tor's security and anonymity is based on the assumption that the large majority of the its relays are honest and do not misbehave. Particularly the privacy of the hidden services is dependent on the honest operation of Hidden Services Directories (HSDirs). In this work we introduce, the concept of honey onions (HOnions), a framework to detect and identify misbehaving and snooping HSDirs. After the deployment of our system and based on our experimental results during the period of 72 days, we detect and identify at least 110 such snooping relays. Furthermore, we reveal that more than half of them were hosted on cloud infrastructure and delayed the use of the learned information to prevent easy traceback.

The malicious HSDirs identified by the team were mostly located in the United States, Germany, France, United Kingdom and the Netherlands. Just a few months after the HSDir issue broke, a different researcher identified a malicious Tor node injecting malware into file downloads.

Use at your own risk.

See also:

OnionDuke APT Malware Distributed Via Malicious Tor Exit Node

6. No warrant necessary to spy on Tor users

Another interesting case highlighting the flaws of Tor comes form 2016 when the FBI was able to infiltrate Tor to bust another pedophile group. According to Tech Times:

The U.S. Federal Bureau of Investigation (FBI) can still spy on users who use the Tor browser to remain anonymous on the web. Senior U.S. District Court Judge Henry Coke Morgan, Jr. has ruled that the FBI does not need a warrant to hack into a U.S. citizen's computer system. The ruling by the district judge relates to FBI sting called Operation Pacifier, which targeted a child pornography site called PlayPen on the Dark web. The accused used Tor to access these websites. The federal agency, with the help of hacking tools on computers in Greece, Denmark, Chile and the U.S., was able to catch 1,500 pedophiles during the operation.

While it's great to see these types of criminals getting shut down, this case also highlights the severe vulnerabilities of Tor as a privacy tool that can be trusted by journalists, political dissidents, whistleblowers, etc. The judge in this case officially ruled [PDF] that Tor users lack "a reasonable expectation of privacy" in hiding their IP address and identity. This essentially opens the door to any US government agency being able to spy on Tor users without obtaining a warrant or going through any legal channels.

This, of course, is a serious concern when you consider that journalists, activists, and whistleblowers are encouraged to use Tor to hide from government agencies and mass surveillance.

7. Tor was created by the US government (and not for your "right to privacy")

If you think Tor was created for "privacy rights" or some other noble-sounding cause, then you would be mistaken. The quote below, from the co-founder of Tor, speaks volumes.

I forgot to mention earlier, probably something that will make you look at me in a new light. I contract for the United States Government to build anonymity technology for them and deploy it. They don't think of it as anonymity technology, though we use that term. They think of it as security technology. They need these technologies so that they can research people they're interested in, so that they can have anonymous tip lines, so that they can buy things from people without other countries figuring out what they are buying, how much they are buying and where it is going, that sort of thing.

— Roger Dingledine, co-founder of Tor, 2004 speech

This quote alone should convince any rational person to never use the Tor network, unless of course you want to be rubbing shoulders with government spooks on the Dark Web.

The history of Tor goes back to the 1990s when the Office of Naval Research and DARPA were working to create an online anonymity network in Washington, DC. This network was called "onion routing" and bounced traffic across different nodes before exiting to the final destination.

In 2002, the Alpha version of Tor was developed and released by Paul Syverson (Office of Naval Research), as well as Roger Dingledine and Nick Mathewson, who were both on contract with DARPA. This three-person team, working for the US government, developed Tor into what it is today.

The quote above was taken from a 2004 speech by Roger Dingledine, which you can also listen to here.

After Tor was developed and released for public use, it was eventually spun off as its own non-profit organization, with guidance coming from the Electronic Frontier Foundation (EFF):

At the very end of 2004, with Tor technology finally ready for deployment, the US Navy cut most of its Tor funding, released it under an open source license and, oddly, the project was handed over to the Electronic Frontier Foundation.

8. Tor is funded by the US government

It's no secret that Tor is funded by various US government agencies. The key question is whether US government funding negatively affects Tor's independence and trustworthiness as a privacy tool.

Some journalists have closely examined the financial relationship between Tor and the US government:

Tor had always maintained that it was funded by a "variety of sources" and was not beholden to any one interest group. But I crunched the numbers and found that the exact opposite was true: In any given year, Tor drew between 90 to 100 percent of its budget via contracts and grants coming from three military-intel branches of the federal government: the Pentagon, the State Department and an old school CIA spinoff organization called the BBG.

Put simply: the financial data showed that Tor wasn't the indie-grassroots anti-state org that it claimed to be. It was a military contractor. It even had its own official military contractor reference number from the government.

Here are some of the different government funding sources for the Tor Project over the years:

Broadcasting Board of Governors:

"Broadcasting Board of Governors (BBG) [now called U.S. Agency for Global Media], a federal agency that was spun off from the CIA and today oversees America's foreign broadcasting operations, funded Tor to the tune of $6.1 million in the years from 2007 through 2015." (source)

State Department:

"The State Department funded Tor to the tune of $3.3 million, mostly through its regime change arm — State Dept's "Democracy, Human Rights and Labor" division." (source)

The Pentagon:

"From 2011 through 2013, the Pentagon funded Tor to the tune of $2.2 million, through a U.S. Department of Defense / Navy contract — passed through a defense contractor called SRI International." (source)

The grant is called: "Basic and Applied Research and Development in Areas Relating to the Navy Command, Control, Communications, Computers, Intelligence, Surveillance, and Reconnaissance."

We can also see what the Tor project has to say about the matter. When soliciting funds in 2005, Tor claimed that donors would be able to "influence" the direction of the project:

We are now actively looking for new contracts and funding. Sponsors of Tor get personal attention, better support, publicity (if they want it), and get to influence the direction of our research and development!

There you have it. Tor claims donors influence the direction of research and development – a fact that the Tor team even admits. Do you really think the US government would invest millions of dollars into a tool that stifled its power?

9. When you use Tor, you help the US government do spooky stuff

The United States government can't simply run an anonymity system for everybody and then use it themselves only. Because then every time a connection came from it people would say, "Oh, it's another CIA agent looking at my website," if those are the only people using the network. So you need to have other people using the network so they blend together.

—Roger Dingledine, co-founder of the Tor Network, 2004 speech

The implications of this statement are quite serious. When you use Tor, you are literally helping the US government. Your traffic helps to conceal CIA agents who are also using Tor, as Dingledine and journalists are pointing out.

Just as Roger Dingledine asserted in the opening quote to this section, Paul Syverson (Tor co-founder) also emphasized the importance of getting other people to use Tor, thereby helping government agents perform their work and not stand out as the only Tor users:

If you have a system that's only a Navy system, anything popping out of it is obviously from the Navy. You need to have a network that carries traffic for other people as well.

Tor is branded by many different individuals and groups as a grassroots project to protect people from government surveillance. In reality, however, it is a tool for government agents who are literally using it for military and intelligence operations (including spying on those who think they are "anonymous" on Tor).

Tor's utility for the military-surveillance apparatus is explained well in the following quote:

Tor was created not to protect the public from government surveillance, but rather, to cloak the online identity of intelligence agents as they snooped on areas of interest. But in order to do that, Tor had to be released to the public and used by as diverse a group of people as possible: activists, dissidents, journalists, paranoiacs, kiddie porn scum, criminals and even would-be terrorists — the bigger and weirder the crowd, the easier it would be for agents to mix in and hide in plain sight.

According to these Tor developers and co-founders, when you use Tor you are helping US government agents in doing whatever they do on the Tor network. Why would anyone who advocates for privacy and human rights want to do that?

10. IP address leaks when using Tor

Another recurring problem with Tor is IP address leaks – a serious issue that will de-anonymize Tor users, even if the leak is brief.

In November 2017 a flaw was discovered that exposed the real IP address of Tor users if they clicked on a local file-based address, such as file://., rather than http:// or https://.

This issue illustrates a larger problem with Tor: it only encrypts traffic through the Tor browser, thereby leaving all other (non-Tor browser) traffic exposed.

Unlike a VPN that encrypts all traffic on your operating system, the Tor network only works through a browser configured for Tor. (See the 'what is a VPN' guide for an overview.)

This design leaves Tor users vulnerable to leaks which will expose their identity in many different situations:

• Tor offers no protection when torrenting and will leak the user's IP address with torrent clients.
• Tor may leak IP addresses when accessing files, such as PDFs or other documents, which will likely bypass proxy settings.
• Windows users are also vulnerable to different types of leaks that will expose the user's real IP address.

It's important to note, however, that oftentimes de-anonymization is due to user error or misconfiguration. Therefore blame does not lie with Tor itself, but rather with people not using Tor correctly.

Dan Eggerstad emphasized this issue as well when he stated:

People think they're protected just because they use Tor. Not only do they think it's encrypted, but they also think 'no one can find me'. But if you've configured your computer wrong, which probably more than 50 per cent of the people using Tor have, you can still find the person (on) the other side.

Once again, non-technical users would be better off using a good VPN service that provides system-wide traffic encryption and an effective kill switch to block all traffic if the VPN connection drops.

11. Using Tor can make you a target

As we saw above with the bomb threat hoax, Eldo Kim was targeted because he was on the Tor network when the bomb threat was sent. Other security experts also warn about Tor users being targeted merely for using Tor.

In addition, most really repressive places actually look for Tor and target those people. VPNs are used to watch Netflix and Hulu, but Tor has only one use case – to evade the authorities. There is no cover. (This is assuming it is being used to evade even in a country incapable of breaking Tor anonymity.)

In many ways Tor can be riskier than a VPN:

1. VPNs are (typically) not actively malicious
2. VPNs provide good cover that Tor simply cannot – "I was using it to watch Hulu videos" is much better than – "I was just trying to buy illegal drugs online"

As we've pointed out here before, VPNs are more widely used than Tor – and for various (legitimate) reasons, such as streaming Netflix with a VPN.

So maybe you still need (or want?) to use Tor. How can you do so with more safety?

How hide your IP address when using Tor

Given that Tor is compromised and bad actors can see the real IP address of Tor users, it would be wise to take extra precautions. This includes hiding your real IP address before accessing the Tor network.

To hide your IP address when accessing Tor, simply connect to a VPN server (through a VPN client on your computer) and then access Tor as normal (such as through the Tor browser). This will add a layer of encryption between your computer and the Tor network, with the VPN server's IP address replacing your real IP address.

Note: There are different ways to combine VPNs and Tor. I am only recommending the following setup: You VPN Tor Internet (also called "Tor over VPN" or "Onion over VPN").

With this setup, even if a malicious actor was running a Tor server and logging all connecting IP addresses, your real IP address would remain hidden behind the VPN server (assuming you are using a good VPN with no leaks).

Here are the benefits of routing your traffic through a secure VPN before the Tor network:

1. Your real IP address remains hidden from the Tor network (Tor cannot see who you are)
2. Your internet provider (ISP) or network admin will not be able to see you are using Tor (because your traffic is being encrypted through a VPN server).
3. You won't stand out as much from other users because VPNs are more popular than Tor.
4. You are distributing trust between Tor and a VPN. The VPN could see your IP address and Tor could see your traffic (sites you visit), but neither would have both your IP address and browsing activities.

For anyone distrustful of VPNs, there are a handful of verified no logs VPN services that have been proven to be truly "no logs".

You can sign up for a VPN with a secure anonymous email account (not connected to your identity). For the truly paranoid, you can also pay with Bitcoin or any other anonymous payment method. Most VPNs do not require any name for registration, only a valid email address for account credentials. Using a VPN in a safe offshore jurisdiction (outside the 14 Eyes) may also be good, depending on your threat model.

For those seeking the highest levels of anonymity, you can chain multiple VPNs through Linux virtual machines (using Virtualbox, which is FOSS). You could also use VPN1 on your router, VPN2 on your computer, and then access the regular internet (or the Tor network) through two layers of encryption via two separate VPN services. This allows you to distribute trust across different VPN services and ensure neither VPN could have both your incoming IP address and traffic. This is discussed more in my guide on multi-hop VPN services.

Note: The claim that "VPN is fully, 100%, a single point/entity that you must trust" is false. This claim comes from this Tor promoter who coincidentlyworks for the US government's Naval Research Lab.

When you chain VPNs, you can distribute trust across different VPN services and different jurisdictions around the world, all paid for anonymously and not linked to your identity. With Tor alone, you put all your trust in The Onion Router...

Tor vulnerabilities and VPNs

There are other attacks that the Tor Project admits will de-anonymize Tor users (archived):

As mentioned above, it is possible for an observer who can view both you and either the destination website or your Tor exit node to correlate timings of your traffic as it enters the Tor network and also as it exits. Tor does not defend against such a threat model.

Once again, a VPN can help to mitigate the risk of de-anonymization by hiding your source IP address before accessing the guard node in the Tor circuit.

Can exit nodes eavesdrop on communications? From the Tor Project:

Yes, the guy running the exit node can read the bytes that come in and out there. Tor anonymizes the origin of your traffic, and it makes sure to encrypt everything inside the Tor network, but it does not magically encrypt all traffic throughout the Internet.

However, a VPN can not do anything about a bad Tor exit node eavesdropping on your traffic, although it will help hide who you are (but your traffic can also give you away).

Conclusion

No privacy tool is above criticism.

Just like with Tor, I have also pointed out numerous problems with VPNs, including VPNs that were caught lying about logs, VPN scams, and dangerous free VPN services. All privacy tools come with pros and cons. Selecting the best tool for the job all boils down to your threat model and unique needs.

Unfortunately, for many in the privacy community, Tor is now considered to be an infallible tool for blanket anonymity, and to question this dogma means you are "spreading FUD". This is pathetic.

In closing, for regular users seeking more security and online anonymity, I'd simply avoid Tor altogether. A VPN will offer system-wide encryption, much faster speeds, and user-friendly clients for various devices and operating systems. This will also prevent your ISP from seeing what you're up to online.

Additionally, VPNs are more mainstream and there are many legitimate (and legal!) reasons for using them. Compared to Tor, you definitely won't stand out as much with a VPN.

For those who still want to access the Tor network, doing so through a reliable VPN service will add an extra layer of protection while hiding your real IP address.

Further Reading:

Tor and its Discontents: Problems with Tor Usage as Panacea

Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries

Tor network exit nodes found to be sniffing passing traffic

On the Effectiveness of Traffic Analysis Against Anonymity Networks Using Flow Records

Judge confirms what many suspected: Feds hired CMU to break Tor

Original Submission

[...] But what is happening in the body and mind of a person who does not seem to feel the pain they "should" be feeling. Do we all have the capacity to be one of these heroic freaks?

And how did John Sattler play those 77 minutes?

Questions like these rattled around the mind of Lorimer Moseley when he showed up at Sydney's Royal North Shore hospital years ago as an undergraduate physiotherapy student. He wanted to interrogate a quip made by a neurology professor as he left the lecture theatre one day, that the worst injuries are often the least painful. So Moseley sat in the emergency room and watched people come in, recording their injuries and asking them how much they hurt.

"And this guy came in with a hammer stuck in his neck – the curly bit had got in the back and was coming out the front and blood was pouring all down," Moseley recalls. "But he was relaxed. He just walked in holding the hammer, relaxed. Totally fine."

Then the man turned around, hit his knee on a low table and began jumping up and down at the pain of the small knock.

"And I think, 'Whoa, what is happening there?'"

The curious student ruled out drugs, alcohol, shock. He realised that the reason the man did not feel pain from his hammer injury was due to the very point of pain itself.

"Pain is a feeling that motivates us to protect ourselves," says Moseley, now the chair in physiotherapy and a professor of clinical neurosciences at the University of South Australia.

"One of the beautiful things about pain is that it will motivate us to protect the body part that's in danger, really anatomically specific – it can narrow it right down to a tiny little spot."

[...] Prof Michael Nicholas is used to stories like these. "You can see it in probably every hospital ward. If you stay around long enough you'll hear comments like 'this person has more pain than they should have' or 'you might be surprised that they're not in pain'," he says. "What that highlights to me is the general tendency for all of us to think there should be a close relationship between a stimulus like an injury or a noxious event and the degree of pain the person feels.

"In fact, that's generally wrong. But it doesn't stop us believing it."

The reason we get it wrong, Nicholas says, "is that we have a sort of mind-body problem".

Eastern medicine and philosophy has long recognised the interconnectedness of body and mind, and so too did the west in early civilisations. In ancient Greece the Algea, the gods of physical pain, were also gods associated with psychic pain – with grief and distress. But in the 1600s the French philosopher René Descartes set western thinking on a different course, asserting that the mind and body were separate entities.

"When people come to see me, they're often worried they're being told it's all in their head," Nicholas says.

"Of course pain is in your head. It's in your brain. You know, it's the brain that is where you get that experience ... It's never all physical."

This is true of people who tolerate acute pain. It's never all physical. And it has little to do with heroism or freakishness.

[...] And so the experience of acute pain is caught in the realm of mystery and mythology; where we can understand much of what is happening in a body and part of what is happening in a brain but never actually know what another person feels.

The legend of John Sattler goes that after that fateful right hook from Bucknall, the bloodied captain turned to his teammate Matthew Cleary. That no one knew, perhaps not even himself, the damage that had been done to him became his mythological power.

"Hold me up," he said. "So they don't know I'm hurt."

Original Submission

So Marchant and Cox looked at whether the decline in cloud brightness corresponded with areas with falling levels of SO2 pollution, and found that it did. The pair presented their preliminary results at the Exeter Climate Forum earlier this month.

The results are encouraging because the rapid warming in recent years has led some researchers to suggest that Earth’s climate sensitivity – how much it warms in response to a given increase in atmospheric CO2 – is on the high side of estimates. As it turns out, extra warming due to falling pollution will be short-lived, whereas if the cloud darkening was a feedback caused by rising CO2, it would mean ever more warming due to this as CO2 levels keep rising.

“If this darkening is a change in cloud properties due to the recent decrease in SO2 emissions, rather than a change in cloud feedbacks that indicate a higher-than-anticipated climate sensitivity, then this is great news,” says Laura Wilcox at the University of Reading in the UK, who wasn’t involved in the study.

There are some limitations with the datasets Marchant and Cox used, says Wilcox. For instance, the data on SO2 pollution has been updated since the team did their analysis.

And two recent studies have suggested the darkening is mainly due to a reduction in cloud cover, rather than darker clouds, she says. “The drivers of the recent darkening trends are a hotly debated topic at the moment.”

Overall, though, Wilcox says her own work also supports the conclusion that the recent acceleration in global warming has been primarily driven by the decrease in air pollution, and that it is likely to be a temporary effect.

Original Submission

[...] Comcast seems to have noticed, Herman said. "They've been calling our clients nonstop to try to come back to their service, offer them discounted rates for a five-year contract and so on," he said.

A Comcast spokesperson told Ars that "we have upgraded our network in this area and offer multi-gig speeds there, and across Michigan, as part of our national upgrade that has been rolling out."

Meanwhile, Comcast's controversial data caps are being phased out. With Comcast increasingly concerned about customer losses, it recently overhauled its offerings with four plans that come with unlimited data. The Comcast data caps aren't quite dead yet because customers with caps have to switch to a new plan to get unlimited data.

Comcast told us that customers in Saline "have access to our latest plans with simple and predictable all-in pricing that includes unlimited data, Wi-Fi equipment, a line of Xfinity Mobile, and the option for a one or five-year price guarantee."

Original Submission