<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
The latest stable (1.0.6) operates without causing any screen messages
when tor is set to 'notice' loglevel. Programs known not to do DNS in a
safe manner do result in such notifications. When did you last review
the source? I'll do a local ethernet sniff w/ Etherial if you would
like further verification (it's late right now otherwise I would just
do it immediately).<br>
<br>
Roger Dingledine wrote:
<blockquote cite="mid20050829060409.GK4630@localhost.localdomain"
type="cite">
<pre wrap="">On Sun, Aug 28, 2005 at 10:40:53PM -0700, ADB wrote:
</pre>
<blockquote type="cite">
<pre wrap="">FF does SOCKS 5 securely, so I don't see why you couldn't. The only
</pre>
<blockquote type="cite">
<pre wrap="">Other than not having cookies blocked, Is there anything to lose by
not having privoxy installed, and using firefox as its own sock5
proxy? Does this compromise security by dns headers?
</pre>
</blockquote>
</blockquote>
<pre wrap=""><!---->
Last I read the code, the way Firefox does socks5 is *not* secure from
Tor's perspective. It does the DNS resolve itself, then passes the IP
address to Tor via socks5.
Firefox 1.1 (not yet released, as far as I know) has an option to "do
dns remotely", which makes it safe. Adam Langley has a howto on this:
<a class="moz-txt-link-freetext" href="http://www.imperialviolet.org/deerpark.html">http://www.imperialviolet.org/deerpark.html</a>
--Roger
.
</pre>
</blockquote>
<br>
</body>
</html>