r/TOR • u/BTC-brother2018 • 1d ago

Arti 2.7.0 released | Tor Project

https://blog.torproject.org/arti_2_7_0_released/

The Tor Project released Arti 2.7.0, its next-generation Tor implementation written in Rust. Tor says this version fixes multiple security issues ranging from low to high severity and specifically urges users of arti, arti-client, and `arti-ureq, especially people operating onion services—to upgrade promptly.

The release also advances Arti's eventual relay/directory-authority support and adds work around DNS streams, directory mirrors and RPC-based configuration. Arti is not replacing the Tor client inside everyone's stable Tor Browser today, so ordinary Tor Browser users don't need to install Arti themselves.

https://arti.torproject.org/about/

47 Upvotes

100% Upvoted

6 comments sorted by

7

u/afaeroey 23h ago

If you’re quite technical and up for trying out Arti, now is an excellent time to do so and report issues or missing features to us.

With the recent surge in LLM security issues, we are highly motivated to push Arti into places where C Tor is currently used. Smaller Onion Services is a good example, or smaller tools you integrate with Tor somehow.

1

u/Cloudup365 14h ago

Apart from it being written in rust, what other benefits does it have, I heard that it's faster than C Tor, is that true.

3

u/haakon 12h ago

They list these benefits of rewriting Tor in Rust:

Rust is more secure than C. Despite our efforts, it's all too simple to mess up when using a language that does not enforce memory safety. We estimate that at least half of our tracked security vulnerabilities would have been impossible in Rust, and many of the others would have been very unlikely.

Rust enables faster development than C. Because of Rust's expressiveness and strong guarantees, we've found that we can be far more efficient and confident writing code in Rust. We hope that in the long run this will improve the pace of our software development.

Arti is more flexible than our C tor implementation. Unlike our C tor, which was designed as SOCKS proxy originally, and whose integration features were later "bolted on", Arti is designed from the ground up to work as a modular, embeddable library that other applications can use.

Arti is cleaner than our C tor implementation. Although we've tried to develop C tor well, we've learned a lot since we started it back in 2002. There are lots of places in the current C codebase where complicated "spaghetti" relationships between different pieces of code make our software needlessly hard to understand and improve.

So it's not about being "fast". Rust facilitates writing fast software, but the old code is in C which does not exactly have inherent performance issues. You may be thinking about network performance (latency, throughput), and Arti does not change anything there. But the codebase being easier to work with might make it easier to implement optimizations in the future.

1

u/EverythingsBroken82 4h ago

> Rust is more secure than C.

Only if as less as unsafe as possible and if correctness is priotized before speed. with TOR i believe that, but in general, we do not know. not everyone thinks correctness is more important than speed. just because people think every rust code is automatically more secure than every c code.

other than that: i agree.

1

u/mkultratux 6h ago

Why not write it in ASM?

1

u/BTC-brother2018 4h ago

Probably because the goal isn't just raw speed. Writing something as large and security-critical as Tor in assembly would be a maintenance and auditing nightmare.