On Thu, Sep 03, 2026 at 09:11:01AM -0400, David Goulet via tor-dev wrote:
Greetings everyone!
Next Tuesday, September 8th, we will do a C-tor release (0.4.9.12) containing fixes for a set of high severity issues.
And then, as a heads up, C-tor will likely enter a release cadence every 2-3 weeks for the foreseeable coming month(s) as we continue to fix more and more security issues we received from this new reality that we happen to all be in where LLMs are in an echo chamber stuck in a tight loop over our C code ;).
Hey David, Is the 2-3 week cadence a permanent change? If so, that might pose a problem for operating system vendors with slow package building servers. For example, it usually takes 2-4 weeks to build the HardenedBSD package repositories. (4 weeks if starting the build from scratch, 2-ish weeks for the average incremental build.) And then there's the matter of deploying the updated versions in our infrastructure. A lot of work between building packages and deploying them in our own infrastructure. As a resource-constrained downstream, I'm not entirely sure if we can keep up with that kind of cadence. I'm hoping it's just temporary while security issues get triaged and worked through. Thanks, -- Shawn Webb Cofounder / Security Engineer HardenedBSD Signal Username: shawn_webb.74 Tor-ified Signal: +1 (719) 756-1197 / activist_opsec.27 https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A4...