Because there are currently no vendor-provided patches or viable workarounds, these are still zero-day exploits. However, there are no official patches, no deployed solutions, nothing currently in beta testing, and no estimated release dates for these critical issues. The Tor developers assured me that they are working on resolutions. I want to emphasize that none of the findings in this blog entry are new to the Tor Project - most have been known for years. This blog entry includes feedback from the Tor Project. They also received the list of specific findings that are covered in this blog entry, before it went public.

The Tor developers who respond to media requests never saw the list they have now received my list of topics. Although the Tor Project had received advanced notice of these blog topics (by more than a month), I learned that the list had not been passed down their management chain. I certainly hope that they felt the same.

I'm not going to detail the topics discussed, but I will say that it was friendly, informative, and felt productive. (I told a few to make an appointment I don't do impromptu.) Among other things, I had my first direct chat with a few developers from the Tor Project. I've also had a couple of interview requests. I've have a lot of contacts from companies and people who wanted more information about Tor exploits.

Configure how often tor switches relays