[tor-dev] Network Team - New Support and Release Policy

[David Goulet]

Greetings everyone!

This is, for now, the last policy change from the network team after the
Deprecating C Patches policy from couple days ago[0].

However, this one has a bit more impact especially on the relay operators and
thus the network. We are changing the C-tor support and release policy which
essentially changes "for how long" we will maintain stable releases.

This will particularly affect relay operators that are using the tor stable
package of their OS distribution. It is very important to use a more "current"
update channel like deb.torproject.org for Debian/Ubuntu. As for BSDs, since
they have a faster stable release cycle, keeping the OS updated should help
getting the latest stable of tor.

Here is the new policy:
https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/SupportPolicy

There are lots of changes but three in particular are worth highlighting and
explaining:

1. No More LTS

Apart from being a burden because in part due to backports complexity, they
are actually a bit of a problem on the relay side with regards to the network
itself. We need an healthy network and that implies, in part, to have up to
date relays. Both for security reasons, but also to take advantage of the new
features and defenses we roll out in the latest stable releases. We are
currently suffering around 3 years upgrade path due to LTS versions that
lingers in the stable OS distributions (Debian, Ubuntu, ...) for a long time.

Tor is in a constant arms race against powerful adversaries, evolving
technologies and resource restrictions. Fast network upgrades is instrumental
to keep us in this race and provide the best security and anonymity for our
users.

2. Drop the 6 months fixed stable release

With 0.4.7.x series, we needed more time to roll out a version that we were
satisfied with quality-wise due to not only its awesomness and complexity but
because we had less people to work on the C implementation of Tor than before
(some engineering power shifted to Arti development). It lead to having a much
better and thoroughly tested tor without having an intermediary release with
half backed features forcing us to maintain for months while being a torn in
the network foot.

3. Faster End-Of-Life Path

We will now only support for 3 months the previous stable once a new stable
comes out. In other words, a stable version is maintained until a new stable
is released plus 3 months to the date. This will also make our rejection of
EOL relays from the network faster tying this to the importance of the network
health with updated relays.

These changes also fall into our overall efforts to shift our resources
towards arti development. C-tor is not going away anytime soon, we are simply
slowing down its development pace.

Please, don't hesitate to ask questions and comments. We know this might not
be ideal for everyone but we believe this is the best route to the
sustainability of C-tor, health of the network and security for our users.

Cheers!
Network Team

[0] https://lists.torproject.org/pipermail/tor-dev/2022-May/014731.html

-- 
G1nLmyQttfczv2rHXvhgktvgPessxMCOKSOe/VwGY/Y=
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20220511/cdedc6c1/attachment.sig>