= News and Status =

== Latest News ==

=== 2007-08-21 -- security flaw ===

Nathan Wilcox has discovered that the new web API in allmydata-tahoe
version 0.5 is vulnerable to XSRF attack.  An XSRF -- or "Cross-Site
Reference Forgery" attack -- is one in which an attacker creates an 
innocuous-looking hyperlink, and if a user clicks on that hyperlink 
then it causes deletion or theft of the user's data.  We are working 
on a fix for this problem, and in the meantime if you have stored any 
private or precious data on a tahoe grid, then you can make sure that 
you are not exposed to this threat by shutting down your tahoe node
before browsing the web. 

You can read more about the attack and our fix in the mailing list archves:

http://allmydata.org/pipermail/tahoe-dev/

and in this bug tracker ticket:

http://allmydata.org/trac/tahoe/ticket/98

=== 2007-08-17 -- Allmydata Tahoe v0.5 released! ===

This version adds a RESTful API allowing you to program your Tahoe node in the language of your choice, as well as a command-line API in the Unix style, and some performance improvements. 

Please see [source:relnotes.txt@1129 the Release Notes].

== Old News ==

[wiki:OldNews The OldNews page] is an archive of these news items.

== Others Source of News and Current Status ==

 * [/cgi-bin/mailman/listinfo/tahoe-dev The tahoe-dev mailing list] is the community forum for discussion of Tahoe design, implementation, and usage.

 * [http://allmydata.com/wordpress The Allmydata, Inc. blog] has news about Allmydata Inc.'s commercial offerings.

 * [http://zooko.com/log.html Zooko's blog] occasionally has Tahoe-related entries.

 * [/cgi-bin/mailman/listinfo/zfec-dev The zfec-dev mailing list] is specific to the [/source/zfec zfec] erasure-coding library.

 * [wiki:TestGrid The TestGrid page] contains usage statistics about the public test grid.

== Insight into the Development Process ==

See [wiki:Dev the Dev page] for detailed information about Tahoe development as it happens.