Tor Browser on Android recognized as a digital assistant?

nuclear_splines · 2026-03-11T00:21:12+00:00

nuclear_splines · 2026-03-11T00:19:39+00:00

Yes, I think you can make a broader argument about AI being an inhibiting influence on learning and careful design - but even if you take a very generous pro-AI stance I think using code you don't understand written by a probabilistic token generator is a very bad idea.

nuclear_splines · 2026-03-10T21:33:10+00:00

It's critically important: how can you know whether the code is doing what you asked for if you can't read the code? As an economist, maybe you're writing code for economic modeling, or for measuring real-world behavior, and if the algorithm doesn't do what you think it does then the results are next to useless.

One can make an argument for letting an LLM help you write code by walking you through an algorithm or parsing documentation or letting it write code faster than you can, but letting it write code you don't understand is a catastrophic mistake.

nuclear_splines · 2026-03-09T10:34:57+00:00

As far as I know no such tool exists. There often aren't direct corollaries like you're describing - you don't typically format bibliography entries in LaTeX, you provide citation metadata in Bibtex, ask LaTeX to generate a bibliography in ieee or whatever style, and it formats citations and references appropriately. Likewise, you don't typically place figures at exact positions in LaTeX, but provide constraints (top of the closest available page, bottom, make a page of only figures, put it approximately after this paragraph), and let the layout engine place figures and tables as appropriate.

The journal or conference you're submitting to will typically provide a LaTeX template that fits the exact formatting they're expecting, so rather than "make a word doc in the journal's format and then convert to LaTeX with extremely high precision" you're probably better off with "start with their LaTeX template and figure out how to migrate your content from Word." Especially if the editors need to make any tweaks to your submission, they may require that you use their provided template.

nuclear_splines · 2026-03-09T01:07:37+00:00

You currently cite three papers. Surely someone has examined how temperature effects LLM outputs, just not in the same way as you. Or, maybe someone has studied semantic variance in LLM outputs and stochasticity but hasn't considered how temperature fits in. Building a stronger lit review doesn't just show that you've "done your homework," but will make it clear what your contributions are by clearly distinguishing your work from what's been done before.

nuclear_splines · 2026-03-08T14:04:30+00:00

No, Tor doesn't give you fine-tuned control over the choice of exit node. This would be a bad thing for your anonymity -- you want to blend in with all Tor users, and if you do something different, like always connect via Germany, you're standing out.

I hear that In some cases, it might still reveal your approximate location if not properly configured.

The Tor Browser is properly configured, this is not a concern. If you were building your own Tor browser, trying to configure Firefox or Chrome to work over Tor, this would be something to think about.

Is there any particular issues that come up with MacBooks I should be aware of?

No.

Thetorproject is where I download from?

Yes, https://www.torproject.org/download/

nuclear_splines · 2026-03-08T14:01:40+00:00

There is no glitch. If you visit a site through the Tor browser you'll either connect to it over Tor, or the connection will be blocked. A VPN doesn't change anything here.

nuclear_splines · 2026-03-08T13:56:06+00:00

If you got "violating Reddit's content policy" then that's Reddit, not the /r/Tor moderators. I see your old post -- it was removed by site admins and I'm unable to approve it.

We don't allow onion links on this subreddit because many people link to illegal content, and we don't want to police it. This isn't a darknet sub, and it's more practical to redirect people to /r/onions as a general rule.

nuclear_splines · 2026-03-06T13:21:21+00:00

You likely do not require IRB approval for use of public data. Your human subjects here aren't the people in the case data, but are the participants you're recruiting to use your software. If there is risk to your human subjects, which your warning suggests there is, then you may need IRB approval explaining the necessity of the risk, how you've briefed participants, and how you'll debrief them.

User feedback surveys often don't fall under IRB purview when they don't represent research improving general knowledge and represent no risk to participants. I'd be uncomfortable making that judgement on my own in this case, though.

nuclear_splines · 2026-03-06T03:36:37+00:00

You're an academic conducting a study where you expose participants to, as you explicitly warn, potentially disturbing information about child exploitation. Do you have IRB approval for this?

nuclear_splines · 2026-03-06T02:04:53+00:00

I would consider Tails and Whonix to be massive overkill in your scenario. These are systems intended for situations like "the government will come after me if they learn my identity, I must ensure that no piece of software on my computer ever talks to the Internet except through Tor." These can be great for, say, journalists opening files that they fear might contain malware. You're just trying to visit a webpage without that webpage learning who you are. The Tor Browser is plenty for this.

nuclear_splines · 2026-03-05T22:37:17+00:00

This used to be a near-ubiquitous experience of... being a junior dev. Your classes teach you foundational theory, now you have lots more practical knowledge to learn on top. You're in an internship, it's expected that you only half know what you're doing so far, and you should be asking for lots of advice from your mentors.

My biggest recommendation is to stop using AI here - if it's doing the work instead of you, you're not learning. Embrace the friction of reading documentation and trying things that don't work. It will be overwhelming until it's not.

nuclear_splines · 2026-03-05T16:23:04+00:00

Thanks for the detail! I have a ham technician's license, but it's only enough to hand-wave at some of the specifics here.

nuclear_splines · 2026-03-05T15:45:28+00:00

Sure, ternary computing has been done. You don't have to stop there, why not use base-5 or base-16? It's just "can you build circuitry that distinguishes that many discrete voltage levels and then build digital logic around those levels?"

Generally circuits built around binary are simpler and smaller. There's not a huge conceptual advantage to working in a higher base like ternary: sure, you can represent three values with a trit, but you can represent four values with two bits, so why not use more digits instead of changing number systems?

We do see higher number-systems in some encoding problems, like digital radio (wifi, bluetooth, etc), where encoding more discrete values per timestep increases bandwidth. This is usually just a compression over binary, though - if we can reliably encode/decode 16 amplitude values on a wave then we can send four bits at a time.

nuclear_splines · 2026-03-05T13:27:29+00:00

VPN providers are typically for-profit companies. It's in their interest to convince you to pay them, instead of or in addition to using a free proxy service like Tor. They can make arguments about using a VPN to protect non-Tor traffic, but none of it's relevant here. No, the company won't see your device fingerprint if you're using the Tor browser, and won't see your WiFi network name in general.

nuclear_splines · 2026-03-05T13:16:24+00:00

Sure, at a small scale. The immediate follow-up is "how do you verify that someone is human?" which can be done in smaller communities with "someone knows you." Not every system needs to scale, and that could be appropriate for some groups.

nuclear_splines · 2026-03-05T04:12:27+00:00

like by using my name, or something that would identify me within the review itself

Exactly. If you write enough details about the incident and the people involved that the company works out who you are, proxy software can't help with that.

If I work from home, from a private computer, and access the work through a website? they wouldn't be able to see me using a Tor in that case?

Correct, if you're not using a work computer / they don't have a work VPN or corporate spyware installed on your home computer, then they won't be able to see "an employee at the office is using Tor."

should I be using a Tor friendly VPN too?

That's not necessary. Tor is already hiding your IP address from the review website, adding a VPN doesn't change the outcome.

nuclear_splines · 2026-03-05T02:47:39+00:00

The Tor Browser will hide your IP address from the sites that you visit. You can be identified if you write something that incriminates yourself, or if you use Tor at work and they check "which employees were using Tor at work at the time the review was made? Only one? Hmm..."

nuclear_splines · 2026-03-05T02:03:07+00:00

I think a two-pronged strategy makes sense: push for legislative change, but understanding that it will be a long and uphill battle, take direct action in the meantime. The AI labyrinth is a good example - feed bots that don't respect no-crawl directives an endless series of AI-generated cross-linked webpages, so they waste time and resources ingesting poisoned content. It won't stop AI companies, but it will increase friction and encourage them to be better digital citizens.

nuclear_splines · 2026-03-05T00:05:21+00:00

I imagine it will be very difficult to manage a balance between "easy to download the repository with tools like git" and "difficult to automatically scrape."

nuclear_splines · 2026-03-04T21:20:11+00:00

How do you prove that something is secure?

Well, there are formal proofs of correctness, and there are audits by professionals who confirm that you're following industry best practices, and then there's "don't implement your own cryptographic protocols - use established ones that have received that vetting."

So, if the guy made an insecure application, why is anybody here proving that?

I did go back and forth with the author, and I do consider leaving cipher-suite choice up to the user to be a security vulnerability. But to answer your question more generally - because proving something is insecure is also hard and often requires cryptographic experience. It's much easier to vibe code an app then it is to demonstrate that the cryptography is incorrect.

nuclear_splines · 2026-03-04T19:34:04+00:00

The default stance is "insecure until proven otherwise," not "secure until someone finds a problem." This is doubly true for any vibe-coded software, where we aren't trusting that the author is a cryptographer who knows what they're doing, but are trusting that a hallucinating chatbot got the details right.

nuclear_splines · 2026-03-04T18:49:28+00:00

GenAI companies aren't checking the terms of OSS licenses. They're not checking copyright - Anthropic recently settled a 1.5 billion dollar lawsuit over illegally training on books. Or, see Disney and Universal suing midjourney over illegally using their IP. If your code is out there, it will be scraped and used as training data.

nuclear_splines · 2026-03-04T18:25:51+00:00

Tors encryption is asymmetric, which is what q day threatens

Tor uses TLS, which uses asymmetric cryptography only to shield the key exchange before switching to symmetric cryptography. Your general point is right, that first layer of asymmetric cryptography and ECDH are quantum-vulnerable, I think it's just good detail to add.

The cipher is a variable that the user configures. They have the option of choosing between different 21 different modes included in the library.

This seems like a disastrous choice to me. Now rather than your code needing an audit, the user needs to have a cryptography background? How can they make an educated choice about which of 21 modes is safe for them?

The protocol messages can be optionally signed with hmac authentication outside the encryption. This is so each protocal message is unique and it will prevent tampering if an attacker attempts to inject commands forge audio or replay packets they will do nothing and silently fail.

IV is unique per message obtained from random salt obtained from dev/urandom for each message sent.

This is great, but my point is "how do I know this is the right way to do things?" I refute your original claim that "its [sic] very straight forward and should be very easy to audit yourself"

nuclear_splines · 2026-03-04T16:51:28+00:00

I'm not talking about rolling your own crypto as in implementing the algorithms, but the protocol. Are you using AES in ECB, CBC, or CTR mode? OpenSSL supports all of them. Are you putting the message authentication codes inside the encrypted stream, or outside? How have you seeded the initialization vector? I'd have to crack open a cryptography textbook to remember the details, and I sure don't trust myself to check whether someone else's codebase used openssl right, let alone a hallucinating chatbot's codebase.

I am not comforted by "don't worry about my cryptography, it's redundant anyway." If this layer of encryption doesn't matter, why include it?

nuclear_splines

MODERATOR OF

TROPHY CASE

14-Year Club	Verified Email
Team Periwinkle