<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Happy Friday! <div class=""><br class=""></div><div class="">Obligatory Onion tip: if you are running a public/onion hybrid site, you probably want to block Tor2web.</div><div class=""><br class=""></div><div class="">This may sound weird ("zomg block!") but since you are already on both networks then there is risk and isn't much benefit to being accessible via Tor2web.</div><div class=""><br class=""></div><div class="">We actually worked with Fabio/naif from Tor2web to achieve this, to keep people safer: <a href="https://github.com/globaleaks/Tor2web/issues/162" class="">https://github.com/globaleaks/Tor2web/issues/162</a></div><div class=""><br class=""></div><div class="">The block is simple: deny (with a helpful message) Onion requests which contain a 'X-Tor2web' header; see the SecureDrop discussion at <a href="https://github.com/freedomofpress/securedrop/issues/43" class="">https://github.com/freedomofpress/securedrop/issues/43</a> for more context.</div><div class=""><br class=""></div><div class="">Whether your message issues or offers a redirect link is a matter of taste. We chose not to.</div><div class=""><br class=""></div><div class="">The block is reinforced by those sites which are able to obtain an EV Onion certificate, which hampers use from uncertificated domains.</div><div class=""><br class=""></div><div class=""> -a</div><div class=""><br class=""></div></body></html>