2

Subgraph provides a third party implementation of Tor called 'Orchid'. Since this is not part of the official Tor Project, how do we know that it can be trusted ?

3
  • You could always de-compile the libraries yourself to check and see if they are safe or better yet email the project Orchid people and ask for a source if isn't already available on the site. Commented Jul 5, 2014 at 0:25
  • What makes you think the official Tor Project can be trusted? What makes Subgraph seem less trustworthy?
    – ruief
    Commented Jul 22, 2014 at 3:52
  • The i2p implementation works as an add-on to i2p on some systems. I haven't check it against the Subgraph download to see the difference. Have IPTraf open and see what is going on. Commented Jun 6, 2017 at 4:04

2 Answers 2

4

The reasons for trusting (or not trusting) Orchid are the same as with Tor proper: Orchid is open source, so you (or anybody else) can audit/examine/analyze the source code.

One concern I would have with Orchid at the moment is that it doesn't seem to be a very active project. There are a bunch of bug reports/pull requests on the github site which haven't received responses, and there generally doesn't seem to be much development activity. It also has far fewer users than the main Tor implementation.

3

I would comment on Nathan's post, but I don't have enough rep. He's completely right. They offer the link to their Source Code in their download's section, along with a link to their Git Repo - https://github.com/subgraph/Orchid

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .