[tor-talk] Tor 0.2.3 Alpha ready for redistributed projects?

[Nick Mathewson]

On Mon, May 28, 2012 at 5:24 AM,  <proper at secure-mail.biz> wrote:
> Is it safe to use the Tor 0.2.3 Alpha in redistributed projects for regular use? (Such as Tails or TorBOX.) Or should the alpha branch only be touched by testers and developers?

Well, the alphas encounter bugs much more frequently, since we merge
lots more stuff.  But right now, 0.2.3.x is in a pretty good state,
and I'm starting to like it a lot.

I'll like it a lot more in a week, and a lot more in a month.

> Tor Stable is already labeled as "experimental software" and "do not rely on it for strong anonymity". How much worse does it get when using the Tor Alpha? What does Alpha with "more bugs than usual" mean? Does it mean there are just more minor annoyances or real concern for anonymity? Is the Alpha actually a Beta?

There are no regression bugs I'm aware of that make 0.2.3.x a
significantly worse choice than 0.2.2.x.  What makes 0.2.3.x a riskier
choice is that I'm merging new code into it at a much faster pace,
whereas we only put stuff into 0.2.2.x when it fixes bugs and seems
very safe to merge and (ideally) has seen a fair bit of testing in
0.2.3.x.

> Is the added security of Tor 0.2.3 Alpha, with stream isolation feature, worth the "more bugs than usual" or do you really recommend against it?

I don't think you'd be crazy to put something out with 0.2.3.x in it.

> It doesn't look like #3449 will be closed anytime soon. (No criticism. We are just asking, because we consider distributing Tor 0.2.3 Alpha with TorBOX and depend on your answer.)

I'm hoping to have a beta or a  release candidate in June.  Early
June, if possible, but with software you can never say.

(That list of tickets is a good place to look, but shouldn't be taken
as a list of "Stuff that must absolutely get fixed to put out
0.2.3.x-rc.  Many of those tickets can be fixed later, or deferred to
a later release.)

-- 
Nick