Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.
Sign up to join this community
I want to know how Tor code is actually updated. Who does it? In light of the NSA scandal and the NSA desire to bring down Tor, is there a possibility that the NSA infiltrates Tor code and adds code to suit their needs?
I do appreciate all the work by the Vidalia and Tor folks, my concern is infiltration by NSA or other institution and getting code in it to destroy the Tor network.
Tor is an open-source project. It is worked on my a mixture of volunteers and people who are paid via donations.
It is possible that the NSA ``infiltrates'' Tor's code, but due to the open-source nature of the project that kind of back door would likely be found and fixed before long. When it comes to NSA backdoors closed-source projects are far more of a worry, since no neutral third party is able to audit the code.
Tor does a variety of things to make sure that the source code is safe. First of all Tor is Free Software. That means anyone can review the code and contribute to it. While anyone can contribute it doesn't mean that anyones contribution find their way into the code. All contributions are reviewed (link goes to all trac tickets which need review), the contributor gets feedback and only when the reviewer thinks it is worthwhile the code is added. Furthermore the Tor Project uses Coverity scan. This project scans the source code and warns if it finds bugs or mistakes in the source code.
If someone don't trust the binary there are deterministic builds. This way one can check out the code, build it for themselves and check if their build has the same hash value than the official Tor binary.
There are more things like software tests, university projects which also deal with the security of Tor's source code. So all in all Tor tries all possible to have a secure source code.
