不過每次編 Rust 的東西都會發現 Rust 版本不夠新，這次也不例外，就不知道是 Rust community 的特性還是真的太少用 Rust...
Updating crates.io index
Downloaded arti v1.0.0
error: failed to parse manifest at `/home/gslin/.cargo/registry/src/github.com-1ecc6299db9ec823/arti-1.0.0/Cargo.toml`
Caused by:
feature `edition2021` is required
this Cargo does not support nightly features, but if you
switch to nightly channel you can add
`cargo-features = ["edition2021"]` to enable this feature
用 rustup update 更新後就能編了，然後跑起來看起來沒什麼問題：
$ arti proxy -p 9150
2022-09-03T17:13:30.234032Z INFO arti: Starting Arti 1.0.0 in SOCKS proxy mode on port 9150...
2022-09-03T17:13:30.238606Z INFO tor_circmgr: We now own the lock on our state files.
2022-09-03T17:13:30.238652Z INFO tor_dirmgr: Didn't get usable directory from cache.
2022-09-03T17:13:30.238674Z INFO arti::socks: Listening on 127.0.0.1:9150.
2022-09-03T17:13:30.238686Z INFO arti::socks: Listening on [::1]:9150.
2022-09-03T17:13:30.238713Z INFO tor_dirmgr::bootstrap: 1: Looking for a consensus.
2022-09-03T17:13:33.833304Z INFO tor_dirmgr::bootstrap: 1: Downloading certificates for consensus (we are missing 9/9).
2022-09-03T17:13:34.335754Z INFO tor_dirmgr::bootstrap: 1: Downloading microdescriptors (we are missing 6629).
2022-09-03T17:13:41.041683Z INFO tor_dirmgr::state: The current consensus is fresh until 2022-09-03 17:00:00.0 +00:00:00, and valid until 2022-09-03 19:00:00.0 +00:00:00. I've picked 2022-09-03 18:35:38.290798754 +00:00:00 as the earliest time to replace it.
2022-09-03T17:13:41.061978Z INFO tor_dirmgr: Marked consensus usable.
2022-09-03T17:13:41.065536Z INFO tor_dirmgr: Directory is complete.
2022-09-03T17:13:41.065557Z INFO tor_dirmgr: We have enough information to build circuits.
2022-09-03T17:13:41.065564Z INFO arti: Sufficiently bootstrapped; system SOCKS now functional.
Tor has released 0.4.7.7, the first stable Tor release with support for congestion control. Congestion control will eliminate the speed limit of current Tor, as well as reduce latency by minimizing queue lengths at relays. It will result in significant performance improvements in Tor, as well as increased utilization of our network capacity.
之所以沒有辦法直接利用 packet loss 的方式讓 TCP network stack 直接判斷 congestion control，是因為這樣會產生 side channel：
The astute reader will note that we rejected datagram transports. However, this does not mean that Tor will never carry UDP traffic. On the contrary, congestion control deployment means that queue delay and latency will be much more stable and predictable. This will enable us to carry UDP without packet drops in the network, and only drop UDP at the edges, when the congestion window becomes full. We are hopeful that this new behavior will match what existing UDP protocols expect, allowing their use over Tor.
The BBC says its shortwave broadcasts will be available on frequencies of 15735 kHz from 4PM to 6PM and 5875 kHz from 10PM to midnight, Ukraine time. News will be read in English, which the BBC says will be available in Kyiv as well as “parts of Russia.”
主要還是用到短波廣播可以傳很遠，以及難以封鎖的特性，相較於 internet 容易被牆掉所以被拿來用...
primary motivation: financial profit (by replacing bitcoin addresses in tor exit traffic)
KAX17 這組看起來就比較像是政府單位在後面掛：
motivation: unknown; plausible: Sybil attack; collection of tor client and/or onion service IP addresses; deanonymization of tor users and/or onion services
其中可以看到同時掌握了不少 hop，這樣就很有機會一路串起來：
To provide a worst-case snapshot, on 2020–09–08 KAX17's overall tor network visibility would allow them to de-anonymize tor users with the following probabilities:
first hop probability (guard) : 10.34%
second hop probability (middle): 24.33%
last hop probability (exit): 4.6%
由於 Tor 是匿名網路，目前最好的防禦方式還是讓更多人參與加入節點，降低單一團體可以取得足夠組出的資料... 之後找機會整理一下跑了一年多 exit node 的想法好了。
The scheme flooding vulnerability allows an attacker to determine which applications you have installed. In order to generate a 32-bit cross-browser device identifier, a website can test a list of 32 popular applications and check if each is installed or not. On average, the identification process takes a few seconds and works across desktop Windows, Mac and Linux operating systems.
被擋下後再打都會失敗，所以需要一個方式重設 flag，而內建的 Chrome PDF Viewer 剛好可以重設 flag：
The built-in Chrome PDF Viewer is an extension, so every time your browser opens a PDF file it resets the scheme flood protection flag. Opening a PDF file before opening a custom URL makes the exploit functional.
Every time you navigate to an unknown URL scheme, Firefox will show you an internal page with an error. This internal page has a different origin than any other website, so it is impossible to access it because of the Same-origin policy limitation. On the other hand, a known custom URL scheme will be opened as about:blank, whose origin will be accessible from the current website.
You are not authorized to access bug #225769. To see this bug, you must first log in to an account with the appropriate permissions.
另外，雖然 Tor Browser 底層是 Firefox，但因為有改變預設值，所以攻擊者也得換方法：
Tor Browser is based on the Firefox source code, so the Same-origin policy trick was used here as well. But because Tor Browser does not show pop-ups, we used the same-origin policy trick with iframe elements instead.
