That excerpt still says it was deployed to all the businesses listed above it, though. So yes it was being used however those businesses used it.
It was in the OpenSSL (for example) as an option you could manually enable. Who knows if anyone actually did, given that everyone who knew enough to specifically ask also heard it was suspicious.
























I mean, it’s not that expensive to start an exit node, and requires “only” knowhow to mess with someone’s unencrypted browsing, which is what the first and third did. I can’t remember now if Onymous actually managed to break Tor anonymity - I’m pretty sure good-old-fashioned stings turned out to be a big part of it.
IIRC the two-node timing attack I was thinking of was an academic demonstration. Because it’s too non-specific to be very useful.