diff --git a/src/content/posts/hardening-a-tor-onion-service.md b/src/content/posts/hardening-a-tor-onion-service.md
index 2b3b08b..2f75a7e 100644
--- a/src/content/posts/hardening-a-tor-onion-service.md
+++ b/src/content/posts/hardening-a-tor-onion-service.md
@@ -8,9 +8,9 @@ tags: [tor, docker, security, self-hosting, networking]
 
 I wanted a small file server that existed only on Tor. Nothing googleable, nothing port-forwarded, no public DNS entry. Just an address I could hand to people I trust, and everyone else gets to pretend it doesn't exist.
 
-While I was researching how to do this right, a lot of what I read online praised obfs4, and for a while I assumed it was a server-side thing I should probably add. It isn't. obfs4 is a client-side transport: it disguises a censored user's connection into the Tor network. A server hosting an onion service doesn't touch it.
+While I was researching how to do this right, a lot of what I read online talked up the benefits of obfs4. What actually kept my setup safe had nothing to do with that reading.
 
-So if obfs4 isn't the thing that keeps an onion-only host safe, what is? I went through this properly when I built mine, and again months later when I went back to check on it. Some of the setup held up. Some of it had quietly broken. And a couple of things I believed about Docker turned out to be wrong in ways I could measure.
+So what does keep an onion-only host safe? I went through this properly when I built mine, and again months later when I went back to check on it. Some of the setup held up. Some of it had quietly broken. And a couple of things I believed about Docker turned out to be wrong in ways I could measure.
 
 ## What actually protects the origin
 
diff --git a/src/content/posts/zh/hardening-a-tor-onion-service.md b/src/content/posts/zh/hardening-a-tor-onion-service.md
index 91935b7..8652fe4 100644
--- a/src/content/posts/zh/hardening-a-tor-onion-service.md
+++ b/src/content/posts/zh/hardening-a-tor-onion-service.md
@@ -8,7 +8,7 @@ tags: [tor, docker, security, self-hosting, networking]
 
 我想要一个小文件服务器,只存在于 Tor 上。它不会被搜索引擎收录,没有端口转发,没有公开 DNS 记录。就是一个我可以交到信任的人手里的地址,而其他人可以当作它不存在。
 
-研究怎么把它做好时,我在网上读到了很多夸 obfs4 的文章,一度以为那是服务器端该加的东西。它不是。obfs4 是客户端侧的传输层:它伪装的是被封锁网络里的用户接入 Tor 的流量。托管洋葱服务的服务器用不着它。
+研究怎么把它做好时,我在网上读到了很多讲 obfs4 好处的文章。最终让我的部署真正安全的东西,和那些阅读没什么关系。
 
 那么,真正保护一个仅限洋葱访问的主机的,到底是什么?我认真走了一遍全程,几个月后又回头检查了自己的部署。有一部分配置经受住了考验,有一部分已经悄悄坏掉,还有几件我原本对 Docker 的认知,被实测证明是错的。