DEV Community

Cover image for How to protect your submissions on gitGost using Tor for complete anonymity
Livrädo Sandoval
Livrädo Sandoval

Posted on

How to protect your submissions on gitGost using Tor for complete anonymity

#programming #security #privacy #git

Hello again!

Thank you again for taking the time to read this. When contributing to open source projects, maintaining your privacy can be essential, especially if your contributions cover sensitive topics or you prefer not to expose your identity or location. gitGost already removes your name, email and metadata in your commits, but there is still one important piece of information: your IP address. How to prevent this last clue from giving you away? The answer is simple and effective: use Tor.

Why use Tor together with gitGost?

gitGost hides who you are at the Git level, but it can't hide where you are on the network. When you connect over the Tor network, your traffic is routed through multiple nodes before reaching the server, which prevents even the gitGost server from identifying your real IP.

This means that your anonymity is reinforced with a double layer: gitGost protects your identity in the repository; Tor protects your footprint on the Internet.

gitGost hides who you are in Git, Tor hides where you are on the network.

Importance of hiding your IP

Even if a system keeps no logs or little data, your IP address is exposed momentarily at the network layer when sending the request. This information may be enough to link you to a contribution, especially if it is a sensitive action.

With Tor, your connection is camouflaged behind a globally distributed chain of nodes, making tracing the true origin virtually impossible.

How to configure Tor to send anonymous commits

On Linux and macOS

Install the Tor package and torsocks to redirect git traffic over the Tor network:

# Install tor + torsocks
$ sudo apt install tor torsocks # Debian/Ubuntu
$ sudo pacman -S tor torsocks # Arch
$ brew install tor torsocks # macOS
Enter fullscreen mode Exit fullscreen mode

Start the Tor daemon:

$ sudo systemctl start tor # Linux
$ brew services start tor # macOS
Enter fullscreen mode Exit fullscreen mode

Verify that your IP is correctly masked:

$torsocks curl https://check.torproject.org/api/ip
→ {"IsTor": true, "IP": "185.220.101.x"}
Enter fullscreen mode Exit fullscreen mode

Finally, push your changes through Tor using git with gitGost:

$torsocks git\
    -c http.extraHeader="X-Gost-Authorship-Confirmed: 1" \
    push gost my-branch:main
→ PR opened as @gitgost-anonymous — server sees Tor exit node, not you
Enter fullscreen mode Exit fullscreen mode

On Windows without WSL

It uses the Tor browser, which runs a local SOCKS5 proxy at 127.0.0.1:9150. Then configure Git to use that proxy:

$git config http.proxy socks5h://127.0.0.1:9150
$git config http.extraHeader "X-Gost-Authorship-Confirmed: 1"
Enter fullscreen mode Exit fullscreen mode

Do the push normally:

$ git push gost my-branch:main
→ PR opened as @gitgost-anonymous — server sees Tor exit node, not you
Enter fullscreen mode Exit fullscreen mode

On Windows with WSL2

Here you can follow the same steps as in Linux:

$ sudo apt install tor torsocks
$ sudo service tor start

$torsocks git\
    -c http.extraHeader="X-Gost-Authorship-Confirmed: 1" \
    push gost my-branch:main
→ PR opened as @gitgost-anonymous
Enter fullscreen mode Exit fullscreen mode

Considerations and limitations

While Tor extends your anonymity, it also comes with some compromises you should keep in mind:

  • Slower connection: Routing through multiple nodes introduces latency.
  • Trust in exit nodes: although the content travels encrypted (HTTPS) to the server, the node where your traffic leaves is public.
  • Operational consistency: Privacy depends on using these tools in a disciplined way, without mixing identities or direct connections.

gitGost does not replace Tor, but complements it perfectly: one protects your identity within the code, the other protects your footprint on the network.

Final reflection on privacy in open source

True privacy is built by adding layers and measurements. Only gitGost reduces personal traces in your commits, but combining it with Tor takes that protection to the next level, hiding both visible identity and location.

For some this level of anonymity may be unnecessary, but for others it means the difference between not participating and being able to do so safely and freely.

In essence, it is about making the world of open source truly accessible to those who prefer to contribute without leaving traces that expose them. Because open source is also for those who choose to remain invisible.

Top comments (0)