Re: Jacob should fork Tor
Unfortunately it is very hard to make useful security tradeoffs. We all know that there is no perfect security and we are used to the idea of a need to tradeoff between security and cost (how valuable is the item you are trying to secure? No point on spending more money than that on securing it).
What we very often forget about is usability. If you increase security by reducing usability (ease-of-use, performance, etc) then you are reducing the number of people who will use that security. So, your choices here will depend on whether you are aiming at committed, hardcore, tinfoil-hat-wearing security geeks or Facebook-loving grandmothers or where in between.
Some things (like the move to https: instead of http:) have so little impact on usability that they are no-brainers. However, the decisions made by the Tor project, including the controversial ones (like whether or not to enable Javascript in the Browser, whether to support UDP, whether to add background traffic, etc) are really hard as they have considerable impact on usability and hence real-world takeup.
@AC may have preferred different choices. And I think that some Tor developers and researchers are moving towards some changes, as the threat environment and usage has changed. But I think the Tor developers have generally made pretty good choices and I certainly acknowledge that these are hard decisions with no right answers.
@AC can go ahead and fork Tor/TBB with different choices, and then try to build up enough usage to get useful levels of anonymity. But I think the better choice is to work within the Tor environment, discuss potential changes, conduct (or sponsor) research and development and operate (or fund) relays.
Ranting on El Reg is not likely to help (yes, I know I am guilty of it as well!).
Biting the hand that feeds IT
