From AI: You are likely seeing headlines regarding a major emergency security update released by The Tor Project (version 0.4.9.13). The advisory covers high-severity vulnerabilities affecting the entire Tor network—including relays, clients, and onion services. Here is a quick breakdown of what is going on: Key Details * The Scope: The patch addresses multiple tracked vulnerabilities (using Tor's internal TROVE identifiers) spanning memory corruptions, use-after-free conditions in connection handling, and stream isolation bugs. * Anonymity & Relay Risks: Some of the flaws could theoretically allow a malicious .onion site or compromised HSDir relay to link browsing activities across separate sessions or bypass stream isolation. Other bugs involve potential denial-of-service vectors via connection flooding or memory issues in reverse DNS resolution. * The "AI Firehose" Context: The Tor Project noted that an influx of automated bug reports (often referred to as an LLM/AI vulnerability report wave) led to a massive batch of findings that maintainers had to rapidly verify, patch, and test. * Active Exploits? At the time of the release, reports indicate there are no confirmed exploits actively running in the wild, and full technical write-ups are being temporarily held back to give operators time to update safely. What You Should Do * Network/Relay Operators: The Tor Project strongly urges an immediate upgrade to 0.4.9.13. * Tor Browser Users: Keep in mind that stable Tor Browser builds (such as 15.0.23) may lag slightly behind core network releases. If you are engaging in sensitive browsing, it is best to exercise caution and wait for the upcoming Tor Browser update that fully bundles these core security fixes.

Add: allow giving a rating to those that one follows, so higher-rated-follow posts float a little higher in the feed

Hi looks like the caching server cert expired in August: $ openssl s_client -connect cache2.primal.net:443 -servername cache2.primal.net &1 | grep notAfter notAfter=Aug 27 19:51:35 2026 GMT notAfter=Aug 27 19:51:35 2026 GMT $ curl -vI https://cache2.primal.net/v1 * Uses proxy env variable all_proxy == 'socks5h://127.0.0.1:9050' * Trying 127.0.0.1:9050... * Connected to 127.0.0.1 (127.0.0.1) port 9050 * SOCKS5 connect to cache2.primal.net:443 (remotely resolved) * SOCKS5 request granted. * Connected to 127.0.0.1 (127.0.0.1) port 9050 * ALPN: curl offers h2,http/1.1 * TLSv1.3 (OUT), TLS handshake, Client hello (1): * CAfile: /etc/ssl/certs/ca-certificates.crt * CApath: /etc/ssl/certs * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (OUT), TLS alert, certificate expired (557): * SSL certificate problem: certificate has expired * Closing connection curl: (60) SSL certificate problem: certificate has expired More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above https://cache2.primal.net/v1Result: Your connection is not private Attackers might be trying to steal your information from cache2.primal.net (for example, passwords, messages, or credit cards). Learn more about this warning net::ERR_CERT_DATE_INVALID

I'm nervous links to YouTube or other Google properties, like Google Drive docs or sheets, may leak my identity inadvertently. I think same applies to any external links to other similar major infrastructure players. I don't want to carry two phones just to check nostr a couple of times a day.