August 2013 - ooni-dev - lists.torproject.org

Meeting notes for OONI weekly call 19 August 2013
by Arturo Filastò 02 Oct '13

02 Oct '13

Hi all, As promised here are the notes for the last OONI weekly call of August 19th 2013 18:00 CET. People present * Meredith * Nathan * Tom * Arturo * Stephen This is what was discussed: # Drop /nettest part of API Stephen raised some good points on the /nettest API. We agreed that since keeping track of versioning is something a bit complicated we should not implement this feature at this time. We should always update net tests and the probe software at the same time, therefore having a feature that could possibly lead to this un-alignement is not ideal. ## Next steps We will remove from the oonib.md specification the /nettest API and remove support for it inside of oonib. # Doing the security audit with test infrastructure Nathan said that it would be useful to have oonib deployed in an environment that resembles production is useful to them. We will not manage to have ooni deployed on the m-lab production nodes, but we can easily deploy it on the m-lab test nodes. Stephen says that as long as the package building process keeps on working, this will be easy for him to do. Making sure this stays true we have created this ticket: https://github.com/TheTorProject/ooni-probe/issues/161 ## Next steps OONI team will finish development on oonib, tag a release and test it with the deployment scripts. # Issue of backend collector mapping server side reports I explained the rationale behind having the test helpers keyed to a collector. As long as we make it that you report to the collector run by the test helper you used we will be able, in future versions, to collect also reports from the backend side. # Slight delay on this weeks milestone We are a bit behind on the next milestone, but we have however a bit of buffer with the one before the least authority audit starts. We will finish it by this week, but we will not change the date on the github milestone. It is just expected to be closed on the 25th. # Merging of wiki with ooni-spec We agreed that the wiki is going to go into the ooni-spec repository (https://github.com/TheTorProject/ooni-probe/issues/159?source=c) ## Next steps Merge the wiki into the ooni-spec repository and add a link in the wiki front page pointing to it's new location. -- If you think I missed something feel free to append your comments to this email. ~ Art.

3 2

M-Lab docs
by Meredith Whittaker 09 Sep '13

09 Sep '13

Hi all, As an action from today's call, here's a collection of most pertinent M-lab docs. If you're looking for something that doesn't seem to be here, or if you have questions, don't hesitate to ask Stephen and me. Cheers, Meredith *Documents: * - Platform architecture doc<http://measurementlab.net/sites/default/files/HowtoContributetoM-LabServerI…>. The intended audience is hosting partners (who donate space/power/connectivity/hardware). - Policies and procedures for approval<http://measurementlab.net/sites/default/files/SubmissionguidelinesforM-Labe…> of new experiments. Note that I wrote this, and that it may not be specific enough, but I can answer any questions. Note that OONI has been approved as meeting these criteria per the Steering Committee process. - Server map <http://measurementlab.net/mlab_sites>. Get a look at the global M-Lab footprint. - List of existing M-Lab<http://measurementlab.net/measurement-lab-tools> measurement tools. Code repos and documentation for individual tools should be linked from here. If they're not, let me know and I'll add this. - Access existing M-Lab data <http://measurementlab.net/data>, tarballs and BigQuery. - Blog post describing the process to visualize data using BigQuery<http://dmadev.com/2012/11/19/visualizing-m-lab-data-with-bigquery/>, a good introduction both to the tool and the data structure. If you'd like whitelisted access to M-Lab data on BigQuery, let me know and I'll make it happen. - Founding document<http://measurementlab.net/sites/default/files/mlab_intro_and_server_require…>, which will give you background on M-Lab's founding motivations. Many of the facts quoted here have changed (e.g. number of servers), but as history this is instructive. - Existing visualizations <http://measurementlab.net/visualization>, which are fun and may be instructive. -- Meredith Whittaker Program Manager, Google Research Google NYC

3 2

Meeting rescheduled: this friday 2013-08-30 0900 Pacific
by Tom Lowenthal 26 Aug '13

26 Aug '13

Since next week includes both Labor Day and the OTF summit which several of us will be attending, hold on to you britches, because next week's call will actually be held *this* week, on Friday! Agenda is something like: 0900: Hello fabulous people 0905: The Ceremony of the Handing Over of the Git Tag for Code Review 0906: Nathan tells us what to expect and what he needs for the review. 0925: Looking forward: documentation awaits! 0940: Complete! Everyone entitled to cookies in their browser of choice.

2 1

OONI weekly meeting - 18:00 CET August 19 2013
by Arturo Filastò 26 Aug '13

26 Aug '13

This week we are going to be having as expected the weekly ooni meeting. This week also Sathyanarayanan will probably be present. He is working on a project that involves ooni-probe with georgia tech. I propose the following agenda. 18:00 - Greetings. 18:02 - The OONI team will say what it has done this last week. 18:20 - Get update from whoever feels like updating the rest of the team of what they did. 18:35 - Discuss what we are going to do next this week. 18:45 - Sathyanarayanan will tell us what he has been up to and ask some questions if he has some. 19:00 - Fin. For the link to the hangout join the IRC channel #ooni some minutes before the beginning and wait for the link to appear. ~ Art.

1 1

OONI weekly meeting - 18:00 CET August 19 2013
by Arturo Filastò 19 Aug '13

19 Aug '13

Hello Humans! This week we are going to be having as expected the weekly ooni meeting. I propose the following agenda, but feel free to add comments and provide feedback if necessary: 18:00 - Greetings. 18:02 - The OONI team will say what it has done this last week. 18:20 - Listen to feedback (if any) from m-lab team on https://github.com/TheTorProject/ooni-spec/issues/16#issuecomment-22169444. 18:30 - Get updates from the least authority. 18:45 - Discuss what we are going to do next this week. 18:50 - Evaluate if we can make the next milestone in time. 19:00 - Fin. ~ Art.

1 0

OONI Weekly meeting August 12 2013
by Arturo Filastò 12 Aug '13

12 Aug '13

This weeks meeting got skipped because there was not a big presence and there were not burning issues to require a call. Instead some small discussion of what is to be done and will be done happened on IRC. Here is the log: 17:58 < waaaaargh> hey folks! I'm afraid I can't join with video today. 18:01 < waaaaargh> my laptop display went completely dark yesterday and my new one doesn't have a webcam. 18:24 -!- MightyOctopus [~MightyOct(a)192.30.252.53] has joined #ooni 18:24 < MightyOctopus> EvilGenius/task/refactor 35cadaa Johannes Fürmann: remove unnecessary method 18:24 < MightyOctopus> EvilGenius/task/refactor 52cca87 Johannes Fürmann: replace some print statement with print function calls. 18:24 -!- MightyOctopus [~MightyOct(a)192.30.252.53] has left #ooni [] 19:20 < hellais> is the meeting on today? 19:20 < hellais> StrangeCharm: ping? 19:21 < hellais> I don't think a schedule was sent to the ml 19:21 < hellais> I have been, as I said last week, with globaleaks stuff so I don't have that much to report back on, apart from having reviewed the questions by stepehn 19:23 < StrangeCharm> hellais: im rather on vacation 19:24 < StrangeCharm> I think it productive for you to corral a meeting, but its up to you. 19:47 < mer_> Hey OONI, it's Mer 19:47 < mer_> how's the meeting looking? 19:50 < nejucomo> mer_: Here's a transcript from this channel: http://0bin.net/paste/vXLErDOZx84Bg7X+#3ASX01wQcRXmB/Icj4KyKL0UejIRPB6EuX2g… 19:51 < nejucomo> It sounds tenuous. hellais, what do you think? 19:52 < j_vinegar> mmm 19:53 < j_vinegar> I was here in case a sudden meeting happened, but it seems not the case 19:53 < mer_> definite tenuous vibes 19:53 < mer_> I am in favor of a meeting, for the record/transcript 19:53 < mer_> but a meeting requires some Tor involvement 19:54 < mer_> so I guess the question is, @hellais @aagbsn, how you feeling? 19:55 < j_vinegar> hellais provided already a succint report <grin> 19:56 < hellais> I would be up for a meeting, but I don't have much to say beyond what I said here above 19:56 < hellais> if soltesz2 has some burning questions I am very happy to answer them in a hangout 19:57 < hellais> but if that is not needed or we can do it offline I am up for skipping the meeting 19:57 < hellais> aagbsn told me he was going to be working on the url input list and oonib policy implementation this weeksend 19:57 < hellais> *weekend 19:57 < hellais> but I have not heard any updates from him about that yet 19:58 < hellais> if he is online I would be interested in hearing that 20:01 < soltesz2> hi hellais I do not have any burning questions right now. but look forward to hearing more about aagbsn's work on the policy implementation when it's ready to be discussed. 20:03 < hellais> cool 20:04 < hellais> I would suggest we copy and paste this transcript into the ooni-dev mailing list 20:04 < hellais> is that ok? ~ Art.

1 0

Integrating specifications and associated issues.
by Nathan Wilcox 06 Aug '13

06 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I just created two tickets which are almost copies of each other: "Integrate `ooni-spec` and the `ooni-probe` wiki." https://github.com/TheTorProject/ooni-spec/issues/18 -and: https://github.com/TheTorProject/ooni-probe/issues/159 How should we address this? It's an unfortunate amount of busy work, but I feel like the cost of spreading the documentation and associated issue tracking across repositories is too high. -- Nathan Wilcox Least Authoritarian GPG id: CBA48BDD GPG fingerprint: 9309 EB72 87D4 192F 0D7E 0F16 1191 AF31 CBA4 8BDD -----BEGIN PGP SIGNATURE----- Version: OpenPGP.js v.1.20130420 Comment: http://openpgpjs.org wsBcBAEBAgAQBQJSAW2MCRDbSx6L/XOPqAAAtmQH/jS7irNsgYdzjU9sXhiX XjsS2OkASeOHsnD1n36s8dB4Xji+4W+RK6fcXbaODkvTVmHnwl+ieWw72eYQ aGfcGum0u+OVf890Rq+7kR8YGyBoBbhY33o4MUQ1mIxHbmrCKERJNtfEHu8Z UFA/c3uflZ34brYqkGRv+f5f5iYUbPQYiF9BfBEIsHilDgm3k5sdaKdVLL8c eLYCaneG3xuDUERrsctFxFgTkDyDEkBYQzBfdW++1XfDi/6tiY1SX0N/96gM FMbXT1lGE9OM3x8YoIrz/e/am7NG2UdbezddwOPw9wR/JDHBeNDTKkt5kvin w96zUKlF0znAWrDp6OHEngs= =adRv -----END PGP SIGNATURE-----

1 0

Meeting recap
by Meredith Whittaker 05 Aug '13

05 Aug '13

Hi all, The meeting was fairly short. Attending: Stephen, Johannes, Giuseppe, Arturo and me. On the core OONI-dev side, things have been quiet due to the TorDev meeting and OHM. They're set to pick up work this week. In the meantime Johannes has been working on Vagrant (backend tool that helps launch VMs). It's now possible to put up and take down a test network. The next step will be refactoring, which will be a long process. In addition he'll be working to back-port the DNS censorship module to YAML format. Giuseppe gave an update from the BISmark project, where he's working on censorship measurement, and will be engaging in the future to track OONI progress, and ensure that when there are opportunities for collaboration. Stephen brought up the question that was raised by him and me, regarding the collector policy and the current documentation. Arturo plans to reply to this in the ticket. We're on for the regularly scheduled meeting time next week. Others who were there, please add anything I missed. Cheers, M -- Meredith Whittaker Program Manager, Google Research Google NYC

1 0

Missing today's project meeting
by Tom Lowenthal 05 Aug '13

05 Aug '13

Sadly I won't be able to make today's meeting due to the tail end of some travel. By all means, go on without me; I'll catch up with the notes. -Tom

1 0

Least Authority Audit of Ooni: status and plan
by Nathan Wilcox 03 Aug '13

03 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Least Authority audit of Ooni ============================= Least Authority has concluded the first of two phases of an audit of Ooni, at the behest of Radio Free Asia. In this first phase we've helped to develop and integrate a Threat Model into the specification of Ooni. The fruit of our labor is primarily in the Threat Model-related wiki pages which are all linked from this page: https://github.com/TheTorProject/ooni-probe/wiki/Threat-Model There are two linked pages which are of value to both the general specification of Ooni as well as security analyses: the definition of Roles, and the specification of Use Cases. There are three additional pages which are primarily of value for security analyses: Threats, Impacts, and Disclosure. The current Threat Model would be complemented by incorporating the architectural specifications, and by incorporating the Threat Model into those specifications. This is part of the goal for the next phase. Phase Two Plan -------------- The second phase of this audit will focus on analyzing the implementation and smaller scale design choices. During this phase, Least Authority intends to review the code in tandem with the architectural specification documents, and while doing so, crosslinking Threat Model documentation to the architectural documentation. There will be four tangible results from this second phase, produced by Least Authority: * Improved integration between the architectural specification and the Threat Model. * Outstanding unresolved issues from the above integration, embodied as Github issues. * Bug and vulnerability findings, embodied as either Github issues or encrypted email, depending on their severity and evaluated risk to real or potential users. * A coverage log, where Least Authority documents each code component which was reviewed, along with any notes, whether or not those notes developed into bug or vulnerability findings. Schedule ~~~~~~~~ The tentative schedule for the next phase will be September 9th through the 20th, a two week period. Contract ~~~~~~~~ This report represents the first deliverable for the first of two tasks in the contract between Least Authority and RFA, which includes interviews and documentation. Additionally a fair amount of our effort has involved design review and specification, which applies to the second task focused on design review, code audit, and testing. Least Authority has invoiced RFA for a total of 118 hours out of 160 specified on the contract. This leaves 42 hours for the next phase, of which we anticipate 2-6 will be used to write the final deliverable and the remaining hours will be devoted to code review, architecture analysis, updating documents, and filing tickets. Conclusion Process ------------------ After the contractual agreement is complete for this audit of Ooni, Least Authority intends to follow up with short informal interviews from both RFA, Ooni, and M-Lab team members to solicit feedback on our work. If anyone has specific feedback at any time, feel free to contact any of us. We will also be available to answer any questions, and will continue to participate to some degree in the IRC channel, mailing list, and issue tickets. Future Work =========== As technology evolves, so does the need for security analyses. Our goal is to produce useful results for Ooni, which includes making those results easily accessible for future security auditors. We recommend that the Ooni project solicit other security reviews (from a variety of analysts) at each major release, or at some regular schedule which integrates into their development schedule. Contact ======= These are the contacts for project coordination issues between the organizations: Nathan Wilcox - Least Authority nathan(a)leastauthority.com Liz Pruszko Steininger - RFA steiningerl(a)rfa.org Tom Lowenthal - Ooni / Tor me(a)tomlowenthal.com Meredith Whittaker - M-Lab meredithrachel(a)google.com -----BEGIN PGP SIGNATURE----- Version: OpenPGP.js v.1.20130420 Comment: http://openpgpjs.org wsBcBAEBAgAQBQJR/EITCRDbSx6L/XOPqAAAk5sIAJRAUsAWybTiMlPX7BN+ ae9Cz9uCccBSxSsidBf6Twbdjx7+kZMs4SFDiGDIMJ9057rxgMqIArPSv5BL s3tTn1Y+ZCheagEmjSyPn6aqLWMzbdMUSG9b8lEBbOJExciRY7pyIzPSmN1k 51d2IanQAS3prlVWPnVDBidv/mmrKVxPp82DPU9BlOKrjrE+otbUSuxIHHK7 8B51v225WGUyfIoNh6ZW3ztCmTzIGUQlHvqtmqjijCbLXk/dPNj0tAx8njF6 uBi2QLQb4Hat8irkcC8DMVxPgm8vNdSGMw0HjI85kr3xA7IyqxxhYOx+WKx7 i1pAtGfI0OO6dnWj8VvT3c0= =whex -----END PGP SIGNATURE-----

1 0