Now Everyone Wants to Sell You a Magical Anonymity Router (opens in new tab)

You mean that by design Tor acts as MITM, and that end-to-end crypto should be used to provide integrity?

The major users of Tor need to consider even their ISPs as an adversarial agent - that they are being actively monitored and MITMed. In this sense, these users are not trading security for anonymity.

For those who trust their telecommunications carriers (in the US even in the face of CALEA) - they are certainly introducing a MITM. It's also important to note that the linked article considers the 'security bug' to be owned by software updaters and software vendors that that do not sign binaries - the vulnerabilities are not specific to Tor, but it does provide one mechanism to exploit them.

This is all a good reminder, as the Tor team themselves regularly say, that secure operational browsing and software practices are crucial to anonymity and security even with Tor installed.

The problem with Tor is that anonymizes your endpoint but not the traffic itself. What it needs to do is scrub YOU from the stream. No logging into services, or providing bugmenot temporary alternatives. Once you are on a Tor session and you leak a single piece of info, that session is tagged to your user profile. Tor by itself is fairly low security. Great for getting out of shitty places, but it does not anonymize you in any way.