I recommend these sources: The Tor Wiki and Bug Tracker: https://trac.torproject.org/projects/tor The mailing lists: https://lists.torproject.org/cgi-bin/mailman/listinfo The anonymity bibliography: http://freehaven.net/anonbib/date.html Also, the Whonix documentation is great: http://sourceforge.net/p/whonix/wiki/Home/ There's no way to win this. It's useful to vendors, and they will do it regardless. If you make a big deal about it, they will lie and say they are not doing it. You have no way to catch them or call them out. If they could, we would have no reason to use Tor. Why pay good money for information that academic researchers provide for free? A guy who wants to get paid is much more likely to tell you what you want to hear, or to falsify results to make his services look useful.