Tor bridge outdated and flagged as "not recommended" on OpenBSD 7.8

Support Relay Operator
1

I run an obfs4 bridge on OpenBSD in an effort to contribute to OS diversity in the Tor network. I like many aspects of OpenBSD, but one thing that bothers me is how rarely they upgrade their Ports in the stable release.

The Tor version currently on -stable is still 0.4.8.18. We’re missing a fix for a security issue (remote crash) that was released in 0.4.8.23, and my bridge has been flagged as “Not recommended” for quite a while now. I couldn’t get a response from the Tor port maintainer (Pascal, I think).

I’m considering building from source, or building the latest from ports; but given that I’m running it on a Raspberry Pi 4B (arm64) with limited storage, I’m not so confident about it. The Pi works as a headless home server that I access through SSH for regular maintenance, with access to the serial console for installation, major version upgrades and for handling boot issues.

If I’m okay with losing stability, I could also follow -current and upgrade with sysupgrade -s, which I already do on my amd64 laptop; or I could just go back to Alpine Linux. OpenBSD 7.9 will be released soon with newer packages, but I’m afraid I would eventually find myself in the same place again. I have to think…

2

I get the motivation behind OS diversity, but in this case I think it’s worth questioning whether it’s actually helping.

If your bridge is running an outdated Tor version with known security issues and gets flagged as “Not recommended”, then it’s not just a theoretical concern anymore. At that point, staying on a platform that delays security updates may end up doing more harm than good — both for your own system and for the network.

If your main goal is to contribute a reliable bridge, I would seriously consider switching to a system with faster Tor update cycles (e.g. Debian with the Tor Project repository or Alpine). That way you get timely security fixes without having to maintain your own builds.

OS diversity is nice to have, but not at the cost of running insecure or discouraged relays.