- tbb-dev - lists.torproject.org

Tor/Mozilla Meeting Notes on tor-in-firefox integration
by isis agora lovecruft 09 Nov '17

09 Nov '17

Hi everyone! Attached are the meeting notes from the video conference call we just had with Mozilla folks to talk about the ongoing project to integrate tor into Firefox's private browsing mode. This mostly concerns the Network and Browser teams, but towards the end the UX team was mentioned a lot as well. Best regards, -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://fyb.patternsinthevoid.net/isis.txt

2 1

Meeting time switches to 1900 UTC starting from Nov 6/11
by Georg Koppen 02 Nov '17

02 Nov '17

Hi! From next Monday on we'll meet on 1900 UTC for the weekly Tor Browser meeting. Daylight saving time will then be over in the US as well and we'll stick for roughly the next half year to 1900 UTC on Mondays as our time for weekly status updates and discussions in browser land. The meeting place, #tor-meeting on irc.oftc.net, remains the same, though. See you there, Georg

1 0

Inter-team roadmap meeting Fri 3/11 at 1600 UTC
by Georg Koppen 02 Nov '17

02 Nov '17

Hi all! In case you are interested in coordinating team roadmaps there will be a related meeting tomorrow, Fri 11/3 at 1600 UTC in #tor-meeting. We'll look over all the team roadmaps trying to figure out items other teams may need from the browser folks (and vice versa) so that we can properly plan for the upcoming 6 months at least. Feel free to drop by and help. The roadmaps and the outline of the underlying process can be found on https://storm.torproject.org/shared/BXfGyUltZOzksQ3a5EPqDC8p5Ijm_rsyCupNPJ0… and the pad for asking questions/clarifications etc. is on https://storm.torproject.org/shared/6_vKbNygWaF8WcG6xz3lTW6RWbJzlBdm8ZezRYW… Happy roadmapping, Georg

1 0

[tag] sandboxed-tor-browser-0.0.15
by Yawning Angel 30 Oct '17

30 Oct '17

Hello, I just tagged sandboxed-tor-browser 0.0.15. Changes in version 0.0.15 - 2017-10-30: * Bug 23915: 7.0.7 and later fails to work without `SECCOMP_FILTER_FLAG_TSYNC`. * Bug 23166: Add Felix's obfs4 bridges to the built-in bridges. * Bug 23943: obfs4proxy crashes on certain systems. * Disable the 2017 donation campaign banner. It should work out of the box on Debian oldstable along with other systems that use comparatively old kernels (< 3.17), and bridges should work on systems running comparatively recent things (I suspect glibc, but didn't bother isolating it fully). The donation banner is disabled by default because I use the non-volatile profile directory feature, and I don't want to be stuck seeing it till the expiration date passes. Regards, -- Yawning Angel

1 0

Richard updates
by Richard Pospesel 23 Oct '17

23 Oct '17

Hey all, Might not make it to dev meeting as I'm in the tor-office flattening my laptop install so I can get rbm build working on it (rbm requires particular mount options, ubuntu's ecryptfs encrypted home directory setup apparently doesn't use fstab to specify said mount options, learn from my mistaaaakes). updates from this past week: - print to file is broken in latest due to our sandboxing changes; gk found some similar issues in the firefox bug-tracker so presumably there's a path forward to fixing that particular issue (involves enabling print.print_via_parent and bringing over some font serialization patches). - investigation continues into the original issue posted by interigri, able to reproduce a *different* print-to-file issue with their debian setup, but not the one bugged - will start sniping tbb-fingerprinting and tbb-linkabililty issues this week best, -Richard

1 0

The impossible fights on anti-fingerprinting
by Tom Ritter 23 Oct '17

23 Oct '17

<mozilla hat> As we add more and more coverage to privacy.resistFingerprinting in FF Nightly and Beta, we're getting more and more breakage reports. This is great. And it's showing us a few places we should think about more deeply. We have a list we're collecting here: https://wiki.mozilla.org/Security/Fingerprinting#Fingerprinting_Breakage 1) User Agent We round the user agent of the browser to the previous ESR version. So FF 57 appears as FF 52. This breaks Add-On installation: https://bugzilla.mozilla.org/show_bug.cgi?id=1394448 Addons.Mozilla uses the User-Agent header to detect if the user is able to install a given addon and will or will not enable the install button based on that. However, does spoofing the major version of the browser actually work? I would argue: no. A website that wants to learn what version of Firefox you're using can use feature detection. Every major release we're adding CSS stuff, creating or enabling DOM apis by default, and probably changing some subtelties of error messages. Spoofing the minor version is still valuable; but we're considering reporting the correct major version. What do you think? 2) OS We report the OS as Windows on Mac and Linux. This breaks google apps on mac: keyboard shortcuts are not recognized because Windows is looking for a key modifier that isn't there. https://bugzilla.mozilla.org/show_bug.cgi?id=1405810 It also gives desktop pages on mobile: https://bugzilla.mozilla.org/show_bug.cgi?id=1404608 But is spoofing the OS even possible? You guys don't reward for it in the bug bounty. I found your list of OS-fingerprinting bugs: https://trac.torproject.org/projects/tor/query?status=accepted&status=assig… Of those, I'm guessing the Math routines are probably the hardest. Also, this doesn't affect Tor Browser, but it does affect Firefox: you can passively (or actively) fingerprint the OS by TCP/IP characteristics: https://bugzilla.mozilla.org/show_bug.cgi?id=1409269 So I'm wondering, are there other OS-level fingerprinting vectors that seem unsolvable that don't have tickets for them? What do you think of reporting the correct OS (in FF at least), since it seems like we wouldn't be able to hide it anyway? For both of these Tor Browser will be able to do whatever it wants, since this data is all controlled by prefs; but we'd value your thoughts on these things for the FF use case. -tom

3 2

No Meeting on Monday, Oct 16
by Georg Koppen 15 Oct '17

15 Oct '17

Hi! Some of you might be wondering whether there will be a Tor Browser meeting tomorrow, Oct 16. We will skip that one as we had plenty of meeting time this week. See you the week thereafter, Georg

1 0

No meeting on Monday, Oct 9
by Georg Koppen 06 Oct '17

06 Oct '17

Hi all, I forgot to mention it at the last meeting but I think we'll skip the meeting on Monday as we'll have plenty of time next week to talk about status updates and to discuss important things in person. See you in Montreal, Georg

1 0

Roadmaps and funding moving forward.
by isabela 06 Oct '17

06 Oct '17

Hello Tor Browser team, as we approach Montreal's meeting and teams will be creating their roadmap for the months between meetings (till winter 2018 meeting). I would like to present you a new way of relationship we are building between teams work and our funding. Tor is trying to get out of the 'deliverable' funding model, which is mostly used with the current gov grants we have. We are working to shift to funding opportunities that follows a different model, more focus on the execution of the vision of our mission than on specific deliverables. It will take some time till we have a significant part of our fund to come from this type. But we have already started to seek for these opportunities and some teams will start to shift to this model. Another thing related to this model are reports. We will still keep our work organized and have tickets associated with every item on the roadmap so we can easily tell what happened with each task. Since it is a model focus more on the execution of the vision of our mission, our accomplishments from our roadmap is what we are reporting as they are driving us towards our mission. With this said, the Tor Browser 'desktop' team is one that is starting on this model. So for the roadmap exercise in Montreal you will have some freedom when creating it. I am saying 'some' because there are tasks you can't really ignore like keeping up with ESR releases from Mozilla. I am listing here some areas of work that the team can consider tasks for the roadmap, please add more if you have any. This is just a way to start our brainstorming process for Montreal: * keep up with ESR releases * acquisition ux work - download process and get connected to the network (tor launcher) * user onboarding ux work - about:tor page * fingerprinting * selfrando * sandboxing * release infra We can use this pad to document ideas for the roadmap: https://storm.torproject.org/shared/FJWrnBf1SXemGKhOK_Wxwl57BVlj0Ynjn8lXcjF… Cheers, Isabela

2 4

Should we delay Tails 3.2? [Was: Tor Browser release is postponed by two days]
by anonym 06 Oct '17

06 Oct '17

Georg Koppen: > Hi, > > Just to inform you about things we learned a couple of minutes ago: the > Firefox release is due on Thursday. It got postponed by two days mainly > to give 57 beta more publicity. > > We'll follow and release Tor Browser on Thursday as well. Got it! It makes sense for you Tor Browser folks, since the Firefox security issues fixed in ESR 52.3 are not publicly known yet (at least in theory, but the code changes have been out for a week so they can have been reverse-engineered). But what about Tails? Tails 3.2, which is ready to be published right now, would fix several publicly known security issues for our users, including some potential RCEs (Thunderbird, libsoup, ...). Of course, some of these issues have been out for weeks already, so what's two more days of delay? Still, it makes me want to remember/re-evaluate *why* we always wait on Mozilla. What are your feelings around this? What are the arguments for/against releasing early? TBH this has always seemed odd to me. I remember argument for this being about us behaving like good Free Software community members by coordinating releases. I wonder if they really care, especially given our users' position. So, let's ask them! Tor Browser folks, would you care if we released Tails 3.2 right now, so we in effect release Tor Browser 7.0.6 way before you? What do you feel about this in general? As for asking Mozilla, I'm not even sure who/where to ask. Does any one have a clue? Cheers!

4 8