[HN Gopher] Spinning Up an Onion Mirror Is Stupid Easy
___________________________________________________________________
Spinning Up an Onion Mirror Is Stupid Easy
Author : speckx
Score : 170 points
Date : 2025-10-23 15:58 UTC (7 days ago)
(HTM) web link (flower.codes)
(TXT) w3m dump (flower.codes)
| simonmales wrote:
| This is a good reminder for myself to get some onion addresses
| for my sites and spread awareness of Tor.
|
| TIL that Onion-Location is a header, only new about the <meta>
| element. <meta http-equiv="onion-location"
| content="http://<your-onion-service-address>.onion" />
| CGamesPlay wrote:
| The "http-equiv" in that meta tag means "equivalent HTTP
| header", FYI.
| immibis wrote:
| But it's not always followed. Most HTTP headers aren't
| interpreted when specified with http-equiv, and vide versa.
| ktallett wrote:
| I am of the view having a .gopher and .onion version of sites is
| important for avoiding government blocking where possible and to
| keep information as free as possible.
| szszrk wrote:
| can you recommend some gopher server that is actively
| maintained? I always wanted to host gopher site but could not
| find a strong solution that I will not be afraid to be easily
| compromised.
| immibis wrote:
| I don't know the answer, but fortunately the protocol is so
| simple that you have the option to write a short Python
| script.
| dewey wrote:
| > I'm not sure if this is generally considered acceptable within
| the Tor network
|
| Tor is already encrypted, that's why you don't need TLS. Some
| services (Like the hidden service from Facebook back in the days)
| have https but that was more of a vanity from what I remember.
| aspenmayer wrote:
| Proton also uses HTTPS for their onion site, and they used the
| same certificate provider as Facebook did for theirs, Digicert,
| per this page:
|
| https://proton.me/blog/tor-encrypted-email
|
| In the above blog post, they seem to imply that they made HTTPS
| mandatory for Proton Mail over Tor for security reasons.
| adobrawy wrote:
| The best is to refer to official Tor project documentation
| for .onion over https:
| https://community.torproject.org/onion-
| services/advanced/htt...
|
| tl;dr: Pressure from browsers, enterprise, and the overall
| ecosystem to use HTTPS (e.g., unavailability of advanced web
| features without HTTPS) is pushing for the use of HTTPS
| without exception, even for .onion sites with no significant
| technical advantage.
| jszymborski wrote:
| Tor browser doesn't warn on http though and I feel like 90%
| of folks use it exclusively.
| orbisvicis wrote:
| Without https can't the last relay snoop the traffic?
|
| _edit_ : oh, is the last relay the onion service? So the
| entire chain is encrypted?
| rendx wrote:
| The key used to encrypt traffic is in the URL, everything
| including path is encrypted from client to the onion service
| end. What you are saying is true for non-onion HTTP sites,
| not for onions.
| edm0nd wrote:
| side note: there is a built in flag mechanism called BadExit
| for Tor that if a relay or exit is detected to be malicious,
| it is quickly removed from being used.
| embedding-shape wrote:
| > have https but that was more of a vanity from what I remember
|
| It has a functional difference as well, lots of new client-side
| features (like webcrypto) only work on "Secure Origins" which
| .onion isn't, but websites behind TLS are. So if you wanna
| deploy say something that encrypts/decrypts something client-
| side on .onion, you unfortunately need TLS today otherwise the
| APIs aren't available.
|
| Of course browsers could fix this, but I don't think they have
| any incentives to do so. I guess Tor Browser could in fact fix
| this, and maybe they already do, but it'd be a patch on top of
| Firefox I think, something they probably want to do less off,
| not more.
| crtasm wrote:
| My understanding is Tor Browser already treats .onion as a
| secure origin, could anyone confirm?
| bauruine wrote:
| Yes it does but you can use Tor with other browsers too so
| it can make sense if you want to support them.
| bragr wrote:
| I wouldn't recommend using Tor with anything other than
| Tor browser because there are so many browser features
| that will expose you now. If you don't need the Tor
| browser protections, you probably don't need Tor either.
| dewey wrote:
| Fair point but using Tor even if you don't need it, just
| to put more legit traffic noise in the network is a valid
| use case.
| bragr wrote:
| Given the actual correlations attacks governments have
| done on Tor traffic, I don't think more traffic moves the
| needle in any appreciable way. Ultimately the Tor
| architecture is very vulnerable to timing and correlation
| attacks (never use something like IRC over Tor), and the
| kinds of changes that would be needed to mitigate those
| would probably slow it down past the point of usability.
|
| One could argue, given the limited bandwidth of the Tor
| network, that by using it when you don't need it, you
| make the experience for those that do need it worse
| (looking at you everyone who tries to torrent over tor).
| Ajedi32 wrote:
| Back when EV certificates were widely supported by browsers,
| HTTPS was a great way of cryptographically associating a .onion
| service with a real legal entity, for sites like Facebook which
| didn't care about being anonymous.
| badmoddingyo wrote:
| Whats not easy is dealing with harassment from the law as a
| result.
| phaer wrote:
| Very unlikely if you just hosting an onion service with legal
| content, where all traffic is encrypted.
|
| Having to deal with law enforcement is unlikely even if you run
| a normal, encrypted, TOR relay.
|
| Exit nodes, on the other hand, will most likely get letters or
| even visits by law enforcement. But those are not involved at
| all when just running an onion service.
| TOMDM wrote:
| It does make me wonder if people are running very boring
| polite websites that can suddenly do very not boring or
| polite things if you know how to ask the right way over an
| onion address.
|
| Surely I can't be the only one to think of this right?
| throawayonthe wrote:
| that seems unwise, you'd be associating your 'impolite'
| activities with an irl legal identity
| tux1968 wrote:
| Well, you could use a disposable legal identity. Say a
| hobby site, about bowling.
| bauruine wrote:
| Tor does this sort of although not like you think. It's
| used as a bridge transport.
|
| >https://blog.torproject.org/introducing-webtunnel-evading-
| ce...
|
| >WebTunnel is a censorship-resistant pluggable transport
| designed to mimic encrypted web traffic (HTTPS) inspired by
| HTTPT. It works by wrapping the payload connection into a
| WebSocket-like HTTPS connection, appearing to network
| observers as an ordinary HTTPS (WebSocket) connection. So,
| for an onlooker without the knowledge of the hidden path,
| it just looks like a regular HTTP connection to a webpage
| server giving the impression that the user is simply
| browsing the web.
| jazzyjackson wrote:
| In fact dozens of US spies and informants were killed or
| imprisoned when a secret communications network was exposed
| doing just that. I wish I bookmarked a better source, it
| described that the HTML for the portal was reused on every
| site, so once it was discovered on one site, everyone using
| it was burned.
|
| Here's one article that alludes to it re: CIA informants in
| Iran, but I seem to remember China killing US spies and it
| just not making the news at all
|
| "an analysis by two independent cybersecurity specialists
| found that the now-defunct covert online communication
| system that Hosseini used - located by Reuters in an
| internet archive - may have exposed at least 20 other
| Iranian spies and potentially hundreds of other informants
| operating in other countries around the world.
|
| This messaging platform, which operated until 2013, was
| hidden within rudimentary news and hobby websites where
| spies could go to connect with the CIA. Reuters confirmed
| its existence with four former U.S. officials."
|
| https://www.reuters.com/investigates/special-report/usa-
| spie...
| jandrese wrote:
| There is one form of harassment though, if you run even just
| a TOR Relay you tend to be put on realtime blackhole lists
| regularly which will cause random websites to refuse your
| connection. Things like banks, ticket sites, even your
| insurance company might suddenly block your connection
| because your IP is listed as "Exterme Risk, active threats,
| verified" on one of like 200 RBL sites because someone
| scraped TOR and put all of the IP addresses they found on
| there and tagged them as active threats.
| immibis wrote:
| Don't run it at home then.
|
| Or do, and call your bank's customer support until they fix
| it.
|
| Or wait until the next day when it's your neighbour's
| problem because your IP changes every day and your bank
| gets a bunch of complaints from different customers who are
| your neighbours.
| dpoloncsak wrote:
| ....do ISP provided public IPs really change that
| often...? My homelab's public IP has been the same so
| long I have all four octets memorized....and I don't
| remember ever asking (or paying for) a static one.
|
| I know they _can_ , and sometimes do, but do people
| really experience this daily/weekly?
| wolrah wrote:
| On DOCSIS and PON networks my experience has been that
| dynamic IPs are generally stable as long as your DHCP
| lease is active, so my IP generally wouldn't change
| unless I changed equipment or there was an extended
| outage that kept me offline during the entire time it
| would normally have renewed.
|
| On DSL networks it's been the opposite, if the PPPoE
| session was lost I was definitely going to get a new IP
| address, and on some providers the session would be reset
| every 1-7 days so the IP would change at exactly the same
| time of day which almost always ended up being in the
| middle of a work day corresponding with whenever the
| equipment was last rebooted due to some other problem. I
| got in the habit of setting up my equipment to restart on
| its own terms in the middle of the night on those
| providers, but this came with its own downsides when
| something would go wrong and it'd fail to negotiate.
| theshrike79 wrote:
| Which is funny when anecdotal evidence says that over 50% of
| existing tor relays are controlled by US TLAs :)
| mo wrote:
| Anecdotally, I used to be in control of more than half of
| Tors exit capacity (until I had inspired enough other people
| to take over), with no association to US TLAs, and I
| personally know many exit and other relay operators. I have
| no reason to assume they are affiliated with US TLAs or other
| TLAs. The majority in terms of numbers may be, but not the
| majority in terms of bandwidth.
|
| Personally, I doubt the US TLAs have a need to operate any
| relays themselves. They can simply wiretap, and use control
| flow data for correlation when necessary. Tor can still be
| useful for all those who do not try to hide from the few
| agencies who may have this kind of visibility.
|
| The relay community is pretty good in terms of interacting
| with each other. There are real-world meetings to get to know
| others in the space, which may make you also more comfortable
| seeing their personal reasons for providing bandwidth.
| qhwudbebd wrote:
| This has prompted me to look at how the Tor Project's Arti
| reimplementation is going. They've got way further along than I
| realised:
|
| https://tpo.pages.torproject.net/core/arti/
|
| https://gitlab.torproject.org/tpo/core/arti/-/blob/main/CHAN...
|
| Hosting onion services is apparently still a work-in-progress,
| though, and turned off by default.
| yogorenapan wrote:
| I was already able to host onion services last year by using
| the crate directly. A few footguns related to flushing but it
| generally works as expected. I will however say that the code
| quality could be improved though. When trying to contribute, I
| found a lot of somewhat bad practices such as having direct
| file read/writes littered around without abstraction which made
| refactoring difficult (trying to add different storage/cache
| options such as in-memory only or encrypted)
| cncjchsue7 wrote:
| Opting not to over engineer the solution with abstractions
| nobody asked for until you came along is the definition of
| best practice. something not being designed for any and all
| use cases doesn't make something bad practice. Reading and
| writing from a filesystem you always expect to available is
| more than reasonable. Modular code for the sake of modularity
| is a recipe for fizz buzz enterprise edition.
| embedding-shape wrote:
| > along is the definition of best practice
|
| Not disagreeing or agreeing, but "best practice" is
| probably one of the concepts together with "clean code",
| that has as many definitions as there are programmers.
|
| Most of the time, it depends, on context, on what else is
| going on in life, where the priorities lie and so on. Don't
| think anyone can claim for others what is or isn't "best
| practice" because we simply don't have enough context to
| know what they're basing their decisions on nor what they
| plan for the future.
| m00dy wrote:
| Letscage [0] is also using Arti to implement its privacy
| features.
|
| [0]: https://github.com/letscage
| INTPenis wrote:
| It's not a mirror, it's a proxy. If someone encroaches on their
| free speach and shuts down their hosting account that "mirror"
| will not save them.
|
| Just saying, this is an important distinction to me and I've been
| hosting tor nodes since the 2000s.
|
| Archiving information, and making it available, is sometimes more
| powerful than anonymous proxying.
|
| Especially if there's an anonymous proxy available to that
| archive. ;)
| Retr0id wrote:
| As long as they have the private key they can move it to new
| hosting infrastructure without issue, and the same onion
| address will still be operational.
| a022311 wrote:
| "Mirroring" is a term also used when a single source publishes
| data in different mediums (technically in this case we're
| talking only about the internet but the internet is full of
| different protocols so I'll call them mediums). For example
| there are websites that mirror their content to Geminispace or
| in this case make it available as an onion service.
|
| You are correct that this solution does not prevent problems if
| the server goes down. This particular approach aims to reach a
| larger audience, while your idea of mirroring enables
| resiliency.
|
| Both approaches have their use cases and can even be combined
| too!
| maeln wrote:
| It is also very useful to expose services to the world wide web
| behind a restrictive network, Tor takes care of the Nat punching
| and all that jazz, and you get free dns and encryption as an
| extra bonus :)
| stephenlf wrote:
| What a pleasant read. Informative in all the right places without
| losing brevity. Thank you.
| hshdhdhehd wrote:
| Anyone comment on the http thing? Does Tor layer security in that
| anyway so "Saul Goodman" or is there anything more needed here?
| blueflow wrote:
| Without having a trustable certificate, the connection can be
| MITM'ed anyways. Anyone can produce a self-signed cert on
| demand.
| immibis wrote:
| Onion addresses are unforgeable and traffic is encrypted.
| http over .onion is comparable to http over tls.
| mzajc wrote:
| The onion address is the certificate, albeit not one that
| expires or can be revoked. As long as you get it from a trusted
| source, you should be good.
| wartywhoa23 wrote:
| > Oh, and free speech and anti-censorship and all that jazz.
|
| That jazz is increasingly played by the same band of
| 185.220.0.0/16 exit nodes, and plays it in a scale which is all
| but Anonymian.
| storm1er wrote:
| I would like to know more, can you give me some insight?
| wartywhoa23 wrote:
| Well if you use Tor somewhat regularly and check your exit
| node IP, it is about 50% possible that yours is in that
| subnet each time you renew the route. Which begs questions.
|
| Maybe I'm wrong, but it would look more benign to have exit
| nodes distributed without this much bias towards that
| particular subnet.
| bauruine wrote:
| It's only 185.220.100 [0] and 185.220.101 [1] that contain
| all those relays. Some of the bigger German families work
| together as "Stiftung Erneuerbare Freiheit" that's why you
| see a big cluster there. But Tor never uses relays in the
| same /16 for a circuit so it's not really an issue.
|
| [0]
| https://metrics.torproject.org/rs.html#search/185.220.100
| [1]
| https://metrics.torproject.org/rs.html#search/185.220.101
| mo wrote:
| Correct. "Stiftung Erneuerbare Freiheit" acts as LIR in
| charge of the address space, handing out chunks of that
| space to exit relay operating non-profits for free, but
| does not operate any Tor infrastructure themselves and
| has no visibility into the traffic. The cost for us are
| the RIPE membership fees (approx 2000EUR/yr).
|
| Source: I'm its director and founder of torservers.net.
| Usually using a different nick here.
| 5f3cfa1a wrote:
| https://nusenu.github.io/OrNetStats/ should give you a feel
| for the overall size & relative homogeneity of the current
| Tor network.
| flotzam wrote:
| No part of hosting or visiting onion services involves exit
| nodes. Onion service traffic stays within the Tor network
| instead of exiting to the clearnet.
| immibis wrote:
| Run more exit nodes then, and more onion services so they don't
| need to involve exit nodes.
|
| It's also not such a big deal, provided they aren't messing
| with your exit traffic which you did encrypt, right? There are
| few exit nodes, but a great many non-exit nodes which still
| help anonymize your traffic. If you think it's a problem
| though, run an exit node.
| crtasm wrote:
| >I have no interest in running a relay or exit node on my VPS, so
| I made some minimal changes to the config file
|
| Noting the default configuration does not turn your server into a
| relay or exit node, in case anyone interprets this that way.
|
| Thanks for offering a .onion, bookmarked for the caddy
| configuration.
| deadbabe wrote:
| What's a better place for hosting a .onion, Panaman or
| Switzerland?
| Bender wrote:
| Anywhere and on just about anything. The only time a location
| would be of concern would be on Tor Exit nodes which is not
| what they are discussing.
| edm0nd wrote:
| doesnt really matter. its just regular hosting underneath. I
| used DigitalOcean for my relays, exits, and hosting.
| xena wrote:
| I do something similar like this for xeiaso.net (http://ryelkcbr6
| 5vy7pzx26c3rvxya54yuh5ciafth7p6d3p3phpgo2wkz...), but I use
| Kubernetes so I installed the Tor controller:
| https://github.com/bugfest/tor-controller. I then added an
| OnionService pointing to the website:
| https://github.com/Xe/site/blob/main/manifest/xesite/onionse....
| It works pretty great!
| age123456gpg wrote:
| You can generate yourself a vanity .onion address using
| https://github.com/AlexanderYastrebov/onion-vanity-address tool.
| It can also generate vanity client authorization keypair.
| tripplyons wrote:
| Be careful with vanity address generators. A cryptocurrency
| market maker once lost around $160,000,000 in a vanity Ethereum
| address because the generator they used was only seeded with 32
| bits of entropy.
|
| https://www.forbes.com/sites/jeffkauflin/2022/09/20/profanit...
| age123456gpg wrote:
| Indeed, be careful with anything that involves secret bits.
|
| This tool uses proper crypto/rand initialisation of the
| starting key https://github.com/AlexanderYastrebov/onion-
| vanity-address/b...
|
| Check out my other vanity generators (they all use
| crypto/rand):
|
| https://github.com/AlexanderYastrebov/wireguard-vanity-key
|
| https://github.com/AlexanderYastrebov/age-vanity-keygen
|
| https://github.com/AlexanderYastrebov/ethereum-vanity-
| addres...
| superkuh wrote:
| One problem with .onion is that it is _not_ for casual sites or
| people trying to build lasting communities. The Tor Project
| _only_ prioritizes security and they can and have and will again
| wipe out the entire tor web to nothing if they feel it is
| required by security. They have full control of the network. No
| v2 tor sites exist anymore, none of the communities, they were
| are just wiped out by the Tor Project because only their security
| use case matters. They care nothing for communities that use
| their software. Do not try to build communities on Tor .onion. It
| 'll just be made inaccessible some day. All the hyperlinks will
| become useless. All the databases of sites, all the discussions,
| just gone. Because the tor project cannot abide potential lax
| security of older protocols.
|
| .onion is not a way to own your domain. Even though you may have
| the private key and no one else does, the true owners of your
| domain remain the tor project themselves, as they can make it
| inaccessible to tor clients any time they want. They have before,
| they will again. And they aren't going to listen to any community
| feedback about it. Tor .onion is only for people that don't care
| about longevity or links working. Only for people who have
| 'security' as their number 1 and only concern.
|
| I wasted a decade building my personal sites and casual
| communities on .onion. I won't be fooled again. A dot com or org
| is just as much mine as a .onion is, unfortunately, and at least
| those don't all disappear every 10 years.
| bfkwlfkjf wrote:
| I would love to hear more. Have you published this somewhere
| you wanna share?
| jjmarr wrote:
| https://news.ycombinator.com/item?id=36261206
| ugur2nd wrote:
| I'm not an expert. I'm asking because I don't know.
|
| Did I understand correctly? You can create a site with a .onion
| extension without a domain on a hosting service.
|
| I'm thinking. If you can do it this way with .onion, can you do
| it with something else? That would be a bit unusual.
|
| If that were possible, being able to customize the extensions
| would be interesting. Being able to customize brand names. Like
| .mybrand, or .egg, .bread, whatever you want.
| hrimfaxi wrote:
| I think you are misunderstanding. You may want to learn more
| about how onion services work but in the blog post, the hosting
| service is the author's server/host running Caddy.
|
| https://community.torproject.org/onion-services/overview/
___________________________________________________________________
(page generated 2025-10-30 23:01 UTC)