News and Status

Latest News

2007-08-21 -- security flaw

Nathan Wilcox has discovered that the new web API in allmydata-tahoe version 0.5 is vulnerable to XSRF attack. An XSRF -- or "Cross-Site Reference Forgery" attack -- is one in which an attacker creates an innocuous-looking hyperlink, and if a user clicks on that hyperlink then it causes deletion or theft of the user's data. We are working on a fix for this problem, and in the meantime if you have stored any private or precious data on a tahoe grid, then you can make sure that you are not exposed to this threat by shutting down your tahoe node before browsing the web.

You can read more about the attack and our fix in the mailing list archves:

​http://allmydata.org/pipermail/tahoe-dev/

and in this bug tracker ticket:

​http://allmydata.org/trac/tahoe/ticket/98

2007-08-17 -- Allmydata Tahoe v0.5 released!

This version adds a RESTful API allowing you to program your Tahoe node in the language of your choice, as well as a command-line API in the Unix style, and some performance improvements.

Please see the Release Notes.

Old News

The OldNews page is an archive of these news items.

Others Source of News and Current Status

• The tahoe-dev mailing list is the community forum for discussion of Tahoe design, implementation, and usage.

• ​The Allmydata, Inc. blog has news about Allmydata Inc.'s commercial offerings.

• ​Zooko's blog occasionally has Tahoe-related entries.

• The zfec-dev mailing list is specific to the zfec erasure-coding library.

• The TestGrid page contains usage statistics about the public test grid.

Insight into the Development Process

See the Dev page for detailed information about Tahoe development as it happens.