March 2015 - tor-commits - lists.torproject.org

[webwml/staging] fix my contact info
by sebastian＠torproject.org 13 Mar '15

13 Mar '15

commit d3b0ad1b62ca511213af17f44835976c8872216a Author: Andrew Lewman <andrew(a)torproject.is> Date: Sun Feb 15 20:23:24 2015 -0500 fix my contact info --- about/en/corepeople.wml | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/about/en/corepeople.wml b/about/en/corepeople.wml index af84ffe..d914c23 100644 --- a/about/en/corepeople.wml +++ b/about/en/corepeople.wml @@ -1,4 +1,4 @@ -## translation metadata +## translation metadata # Revision: $Revision$ # Translation-Priority: 3-low #include "head.wmi" TITLE="Tor Project: Core People" CHARSET="UTF-8" @@ -220,14 +220,11 @@ <a href="http://www.subgraph.com/orchid.html">Orchid</a>, a Tor client in Java.</dd> - <dt>Andrew Lewman, Executive Director, Director, - <a href="<page press/press>">press contact</a></dt> + <dt>Andrew Lewman, Executive Director, Secretary and Treasurer of the Board</dt> <dd>Manages the business operations of The Tor Project, Inc. Plays roles of finance, advocacy, project management, strategy, press, law enforcement liason, and victim of domestic violence - advocate. He can be contacted via OpenPGP 0x6B4D6475, <a - href="http://ostel.co/">Ostel</a> via ostel-lewman(a)ostel.co, - or +1-781-948-1982.</dd> + advocate. He can be contacted via andrew(a)torproject.is or +1-781-948-1982.</dd> <dt>Dr. Karsten Loesing, Metrics Researcher and Developer</dt> <dd>Primary researcher and developer into

1 0

[webwml/staging] Bump dev version on website to 0.2.6.3-alpha
by sebastian＠torproject.org 13 Mar '15

13 Mar '15

commit ef8833d744bacecd8397c0bd120d10cfbc9b1f67 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 19 17:18:26 2015 -0500 Bump dev version on website to 0.2.6.3-alpha --- Makefile | 2 +- include/versions.wmi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index d8dda85..7cc2fda 100644 --- a/Makefile +++ b/Makefile @@ -15,7 +15,7 @@ # website component, and set it to needs_review. export STABLETAG=tor-0.2.5.10 -export DEVTAG=tor-0.2.6.2-alpha +export DEVTAG=tor-0.2.6.3-alpha WMLBASE=. SUBDIRS=docs eff projects press about download getinvolved donate docs/torbutton diff --git a/include/versions.wmi b/include/versions.wmi index 2c0d6ee..6d02728 100644 --- a/include/versions.wmi +++ b/include/versions.wmi @@ -1,5 +1,5 @@ <define-tag version-stable whitespace=delete>0.2.5.10</define-tag> -<define-tag version-alpha whitespace=delete>0.2.6.2-alpha</define-tag> +<define-tag version-alpha whitespace=delete>0.2.6.3-alpha</define-tag> <define-tag version-win32-stable whitespace=delete>0.2.5.10</define-tag> <define-tag version-win32-alpha whitespace=delete>0.2.5.10</define-tag>

1 0

[webwml/staging] Dropping the panopticlick project from the volunteer page
by sebastian＠torproject.org 13 Mar '15

13 Mar '15

commit 5c39e14c7719cfc3506a297d5422c6972aa77f88 Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Feb 15 13:13:14 2015 -0800 Dropping the panopticlick project from the volunteer page Tried to get ahold of Georg to see if he's interested in mentoring this but no luck, so dropping the project. --- getinvolved/en/volunteer.wml | 63 ------------------------------------------ 1 file changed, 63 deletions(-) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index 0a1dd52..2b8362f 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -422,11 +422,6 @@ meetings around the world.</li> privacy and security issues in mainline version. - - Project Ideas: - <a href="#panopticlick">Panopticlick</a> - - <a id="project-httpseverywhere"></a> <h3><a href="https://www.eff.org/https-everywhere">HTTPS Everywhere</a> (<a href="https://gitweb.torproject.org/https-everywhere.git">code</a>, <a @@ -1432,64 +1427,6 @@ the codebase that you want to work on. </li> - <a id="panopticlick"></a> - <li> - Panopticlick - - Effort Level: Medium - - Skill Level: Medium - - Likely Mentors: Georg (GeKo) - - -The <a href="https://panopticlick.eff.org">Panopticlick project by the EFF</a> -revolutionized how people think about <a -href="https://panopticlick.eff.org/browser-uniqueness.pdf">browser -fingerprinting</a>, both by developing tests and metrics to measure browser -fingerprintability, and by crowdsourcing the evaluation and contribution of -individual browser features to overall fingerprintability. - - - - -Unfortunately, the way Panopticlick is designed <a -href="https://blog.torproject.org/blog/effs-panopticlick-and-torbutton">makes -it difficult</a> to evaluate defenses to browser fingerprinting, especially -for browsers with a relatively small userbase such as Tor Browser. This is -because any approach we take to reduce fingerprinting automatically makes our -users more distinct from the previous users who submitted their fingerprint -data to the EFF. Indeed, it is also impossible to ever expect that users of -one browser will ever be able to blend in with users of another browser -(Chrome users will always be distinguishable from Firefox users for example, -based on feature set alone). - - - - -To address this, we would like to have <a -href="https://trac.torproject.org/projects/tor/ticket/6119">our own -fingerprint test suite</a> to evaluate the fingerprintability of each browser -feature for users running a specific Tor Browser version. There are also <a -href="https://trac.torproject.org/projects/tor/query?keywords=~tbb-fingerprinting">additional -fingerprinting tests</a> we can add beyond those deployed by Panopticlick. - - - -For this project, the student would develop a website that users can -voluntarily visit to test and record their Tor Browser fingerprint. The user -should get feedback on how she performed and the test results should be -available in a machine readable format (e.g. JSON), broken down by Tor Browser -version. In a second step one could think about adding more sophisticated -tests or supporting other browser vendors that might want to test the -uniformity amongst their userbase as well. Of course, results from each -browser would also need to be broken down by both browser implementation and -version, so that results would only reflect the population of that specific -implementation. - - - </li> - <a id="ahmiaSearch"></a> <li> Ahmia - Hidden Service Search

1 0

[webwml/staging] update the end date of the rfa sponsorship
by sebastian＠torproject.org 13 Mar '15

13 Mar '15

commit fa1845b7ef777c1fe4be92da216e85d9b17e75dc Author: Roger Dingledine <arma(a)torproject.org> Date: Sat Feb 21 04:48:21 2015 -0500 update the end date of the rfa sponsorship --- about/en/sponsors.wml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/about/en/sponsors.wml b/about/en/sponsors.wml index b0c268a..45d4bbb 100644 --- a/about/en/sponsors.wml +++ b/about/en/sponsors.wml @@ -25,7 +25,7 @@ <h3>Active Sponsors in 2015:</h3> <ul> - <li><a href="http://www.rfa.org/english/">Radio Free Asia</a> (2012-2014)</li> + <li><a href="http://www.rfa.org/english/">Radio Free Asia</a> (2012-2016)</li> <li><a href="http://nsf.gov/">National Science Foundation</a> joint with Georgia Tech and Princeton University (2012-2016)</li> <li><a href="http://nsf.gov/">National Science Foundation</a> via University of Minnesota (2013-2017)</li> <li><a href="https://digitaldefenders.org/">Hivos/The Digital Defenders Partnership</a> (2014-2015)</li>

1 0

[webwml/staging] Bug 13407: Update signature verification
by sebastian＠torproject.org 13 Mar '15

13 Mar '15

commit 072eeada5b3af0d9c789c5aa53f4ce7530ae093d Author: Georg Koppen <gk(a)torproject.org> Date: Tue Feb 24 12:50:53 2015 +0000 Bug 13407: Update signature verification --- docs/en/verifying-signatures.wml | 56 ++++++++++++++++++-------------------- 1 file changed, 26 insertions(+), 30 deletions(-) diff --git a/docs/en/verifying-signatures.wml b/docs/en/verifying-signatures.wml index af3e437..a489703 100644 --- a/docs/en/verifying-signatures.wml +++ b/docs/en/verifying-signatures.wml @@ -53,8 +53,8 @@ package and the extension ".asc". These .asc files are GPG signatures. They allow you to verify the file you've downloaded is exactly the one that we intended you to get. For example, - tor-browser-2.3.25-13_en-US.exe is accompanied by - tor-browser-2.3.25-13_en-US.exe.asc. For a list + torbrowser-install-<version-torbrowserbundle>_en-US.exe is accompanied by + torbrowser-install-<version-torbrowserbundle>_en-US.exe.asc. For a list of which developer signs which package, see our <a href="<page docs/signing-keys>">signing keys</a> page. <h3>Windows</h3> <hr> @@ -67,20 +67,20 @@ you will need to tell Windows the full path to the GnuPG program. If you installed GnuPG with the default values, the path should be something like this: C:\Program Files\Gnu\GnuPg\gpg.exe. - Erinn Clark signs the Tor Browsers. Import her key - (0x416F061063FEE659) by starting cmd.exe and typing: - <pre>"C:\Program Files\Gnu\GnuPg\gpg.exe" --keyserver x-hkp://pool.sks-keyservers.net --recv-keys 0x416F061063FEE659</pre> + The Tor Browser team signs the Tor Browsers. Import its key + (0x4E2C6E8793298290) by starting cmd.exe and typing: + <pre>"C:\Program Files\Gnu\GnuPg\gpg.exe" --keyserver x-hkp://pool.sks-keyservers.net --recv-keys 0x4E2C6E8793298290</pre> After importing the key, you can verify that the fingerprint is correct: - <pre>"C:\Program Files\Gnu\GnuPg\gpg.exe" --fingerprint 0x416F061063FEE659</pre> + <pre>"C:\Program Files\Gnu\GnuPg\gpg.exe" --fingerprint 0x4E2C6E8793298290</pre> You should see: <pre> - pub 2048R/63FEE659 2003-10-16 - Key fingerprint = 8738 A680 B84B 3031 A630 F2DB 416F 0610 63FE E659 - uid Erinn Clark <erinn(a)torproject.org> - uid Erinn Clark <erinn(a)debian.org> - uid Erinn Clark <erinn(a)double-helix.org> - sub 2048R/EB399FD7 2003-10-16 + pub 4096R/93298290 2014-12-15 + Key fingerprint = EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290 + uid Tor Browser Developers (signing key) <torbrowser(a)torproject.org> + sub 4096R/F65C2036 2014-12-15 + sub 4096R/D40814E0 2014-12-15 + sub 4096R/589839A3 2014-12-15 </pre> To verify the signature of the package you downloaded, you will need to download the ".asc" file as well. Assuming you downloaded the @@ -88,13 +88,11 @@ <pre>"C:\Program Files\Gnu\GnuPg\gpg.exe" --verify C:\Users\Alice\Desktop\torbrowser-install-<version-torbrowserbundle>_en-US.exe.asc C:\Users\Alice\Desktop\torbrowser-install-<version-torbrowserbundle>_en-US.exe</pre> The output should say "Good signature": <pre> - gpg: Signature made Wed 31 Aug 2011 06:37:01 PM EDT using RSA key ID 63FEE659 - gpg: Good signature from "Erinn Clark <erinn(a)torproject.org>" - gpg: aka "Erinn Clark <erinn(a)debian.org>" - gpg: aka "Erinn Clark <erinn(a)double-helix.org>" + gpg: Signature made Tue 24 Jan 2015 09:29:09 AM CET using RSA key ID D40814E0 + gpg: Good signature from "Tor Browser Developers (signing key) <torbrowser(a)torproject.org>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. - Primary key fingerprint: 8738 A680 B84B 3031 A630 F2DB 416F 0610 63FE E659 + Primary key fingerprint: EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290 </pre> Notice that there is a warning because you haven't assigned a trust @@ -118,21 +116,21 @@ key (0x416F061063FEE659) by starting the terminal (under "Applications" in Mac OS X) and typing: - <pre>gpg --keyserver x-hkp://pool.sks-keyservers.net --recv-keys 0x416F061063FEE659</pre> + <pre>gpg --keyserver x-hkp://pool.sks-keyservers.net --recv-keys 0x4E2C6E8793298290</pre> After importing the key, you can verify that the fingerprint is correct: - <pre>gpg --fingerprint 0x416F061063FEE659</pre> + <pre>gpg --fingerprint 0x4E2C6E8793298290</pre> You should see: <pre> - pub 2048R/63FEE659 2003-10-16 - Key fingerprint = 8738 A680 B84B 3031 A630 F2DB 416F 0610 63FE E659 - uid Erinn Clark <erinn(a)torproject.org> - uid Erinn Clark <erinn(a)debian.org> - uid Erinn Clark <erinn(a)double-helix.org> - sub 2048R/EB399FD7 2003-10-16 + pub 4096R/93298290 2014-12-15 + Key fingerprint = EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290 + uid Tor Browser Developers (signing key) <torbrowser(a)torproject.org> + sub 4096R/F65C2036 2014-12-15 + sub 4096R/D40814E0 2014-12-15 + sub 4096R/589839A3 2014-12-15 </pre> To verify the signature of the package you downloaded, you will need @@ -148,13 +146,11 @@ The output should say "Good signature": <pre> - gpg: Signature made Wed 31 Aug 2011 06:37:01 PM EDT using RSA key ID 63FEE659 - gpg: Good signature from "Erinn Clark <erinn(a)torproject.org>" - gpg: aka "Erinn Clark <erinn(a)debian.org>" - gpg: aka "Erinn Clark <erinn(a)double-helix.org>" + gpg: Signature made Tue 24 Jan 2015 09:29:09 AM CET using RSA key ID D40814E0 + gpg: Good signature from "Tor Browser Developers (signing key) <torbrowser(a)torproject.org>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. - Primary key fingerprint: 8738 A680 B84B 3031 A630 F2DB 416F 0610 63FE E659 + Primary key fingerprint: EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290 </pre>

1 0

[webwml/staging] Add new TBB version
by sebastian＠torproject.org 13 Mar '15

13 Mar '15

commit 4d5f05496b7278d66a7a9544003006a84334491a Author: Georg Koppen <gk(a)torproject.org> Date: Wed Feb 25 11:12:06 2015 +0000 Add new TBB version --- projects/torbrowser/RecommendedTBBVersions | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/projects/torbrowser/RecommendedTBBVersions b/projects/torbrowser/RecommendedTBBVersions index 4a5eb92..86125ee 100644 --- a/projects/torbrowser/RecommendedTBBVersions +++ b/projects/torbrowser/RecommendedTBBVersions @@ -3,6 +3,10 @@ "4.0.3-Linux", "4.0.3-MacOS", "4.0.3-Windows", +"4.0.4", +"4.0.4-Linux", +"4.0.4-MacOS", +"4.0.4-Windows", "4.5a3", "4.5a3-Linux", "4.5a3-MacOS",

1 0

[webwml/staging] Exitmap Improvements project idea
by sebastian＠torproject.org 13 Mar '15

13 Mar '15

commit 85e16b459be0f85e4d22e2774714b84d8ada349e Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Feb 21 11:44:02 2015 -0800 Exitmap Improvements project idea --- getinvolved/en/volunteer.wml | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index 2b8362f..7755501 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -1484,6 +1484,42 @@ There are several possible directions for this project, including... </ol> </li> + + <a id="exitmap_improvements"></a> + <li> + Exitmap Improvements + + Effort Level: Medium + + Skill Level: Medium + + Likely Mentors: Philipp (phw) + +The Tor Project makes use of the Python tool <a +href="https://gitweb.torproject.org/user/phw/exitmap.git/">Exitmap</a> to +systematically scan for malicious and misbehaving exit relays. Once such a +relay is found, it is assigned the BadExit flag which prevents clients from +selecting the relay as last hop in their circuit. + + + +Exitmap supports scanning modules which implement a specific scan over +exit relays. Examples are the DNS module which checks for DNS poisoning +or the patching check module which looks out for tampered file +downloads. + + + +This project is meant to extend exitmap in several ways. First, it +should be made fully autonomous. That means that exitmap should be able +to run in the background, periodically fetch new relay descriptors, and +have a smart algorithm which keeps scanning all exit relays +periodically. Second, exitmap should be able to emulate some user +interaction and dynamically "explore" the web in order to detect +tampering. Third, unit tests should be added for existing and new code +in order to make the code base more robust. + + </li> <!-- <a id="improveStegotorus"></a> <li>

1 0

[webwml/staging] Bump Tor Browser version to 4.0.4
by sebastian＠torproject.org 13 Mar '15

13 Mar '15

commit 7e2b3c8b2669ac4a2f8ca6a021291e62532fd834 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Feb 25 11:24:23 2015 +0000 Bump Tor Browser version to 4.0.4 --- include/versions.wmi | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/include/versions.wmi b/include/versions.wmi index 6d02728..977b8a3 100644 --- a/include/versions.wmi +++ b/include/versions.wmi @@ -19,10 +19,10 @@ <define-tag version-osx-ppc-stable whitespace=delete>0.2.3.25</define-tag> <define-tag version-osx-ppc-alpha whitespace=delete>0.2.4.17-rc</define-tag> -<define-tag version-torbrowserbundledir whitespace=delete>4.0.3</define-tag> +<define-tag version-torbrowserbundledir whitespace=delete>4.0.4</define-tag> <define-tag version-torbrowserbundlebetadir whitespace=delete>4.5a3</define-tag> -<define-tag version-torbrowserbundle whitespace=delete>4.0.3</define-tag> +<define-tag version-torbrowserbundle whitespace=delete>4.0.4</define-tag> <define-tag version-torbrowserbundlebeta whitespace=delete>4.5a3</define-tag> <define-tag version-torbrowser-tor whitespace=delete>0.2.4.19</define-tag> <define-tag version-torbrowser-tor-components whitespace=delete>libevent-2.0.21-stable, zlib-1.2.8, openssl-1.0.1e</define-tag> @@ -32,8 +32,8 @@ <define-tag version-torbrowser-otr whitespace=delete>3.2</define-tag> <define-tag version-torimbrowserbundle whitespace=delete>1.3.21</define-tag> -<define-tag version-torbrowserbundlelinux32 whitespace=delete>4.0.3</define-tag> -<define-tag version-torbrowserbundlelinux64 whitespace=delete>4.0.3</define-tag> +<define-tag version-torbrowserbundlelinux32 whitespace=delete>4.0.4</define-tag> +<define-tag version-torbrowserbundlelinux64 whitespace=delete>4.0.4</define-tag> <define-tag version-torbrowserbundlelinux32beta whitespace=delete>4.5a3</define-tag> <define-tag version-torbrowserbundlelinux64beta whitespace=delete>4.5a3</define-tag> <define-tag version-gnu-torbrowser-tor whitespace=delete>0.2.4.19</define-tag> @@ -41,7 +41,7 @@ <define-tag version-gnu-torbrowser-firefox whitespace=delete>24.2.0esr</define-tag> <define-tag version-gnu-torbrowser-torbutton whitespace=delete>1.5.2</define-tag> -<define-tag version-torbrowserbundleosx32 whitespace=delete>4.0.3</define-tag> +<define-tag version-torbrowserbundleosx32 whitespace=delete>4.0.4</define-tag> <define-tag version-torbrowserbundleosx64 whitespace=delete>2.3.25-15</define-tag> <define-tag version-torbrowserbundleosx64beta whitespace=delete>4.5a3</define-tag> <define-tag version-osx-torbrowser-tor whitespace=delete>0.2.4.19</define-tag>

1 0

[webwml/staging] Deprecate old TBB versions
by sebastian＠torproject.org 13 Mar '15

13 Mar '15

commit dde69c25a12e726c77f9b8170ab3af9f263aa773 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Feb 25 17:11:30 2015 +0000 Deprecate old TBB versions --- projects/torbrowser/RecommendedTBBVersions | 4 ---- 1 file changed, 4 deletions(-) diff --git a/projects/torbrowser/RecommendedTBBVersions b/projects/torbrowser/RecommendedTBBVersions index 86125ee..2bd096b 100644 --- a/projects/torbrowser/RecommendedTBBVersions +++ b/projects/torbrowser/RecommendedTBBVersions @@ -1,8 +1,4 @@ [ -"4.0.3", -"4.0.3-Linux", -"4.0.3-MacOS", -"4.0.3-Windows", "4.0.4", "4.0.4-Linux", "4.0.4-MacOS",

1 0

[webwml/staging] make the new tor browser key super obvious
by sebastian＠torproject.org 13 Mar '15

13 Mar '15

commit 1857af8ba7570bfe8fe6dedeede373e857898754 Author: Roger Dingledine <arma(a)torproject.org> Date: Thu Feb 26 11:57:41 2015 -0500 make the new tor browser key super obvious --- docs/en/signing-keys.wml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/docs/en/signing-keys.wml b/docs/en/signing-keys.wml index 2398ba7..d17fcae 100644 --- a/docs/en/signing-keys.wml +++ b/docs/en/signing-keys.wml @@ -14,18 +14,19 @@ The signing keys we use are: <ul> + <li>The Tor Browser Developers (0x93298290), + Mike Perry (0x0E3A92E4), Georg Koppen (0x4B7C3223), + Nicolas Vigier (0xD0220E4B) and Linus Nordberg (0x23291265) + sign the Tor Browser releases.</li> <li>Roger Dingledine (0x28988BF5 and 0x19F78451) or Nick Mathewson (0x165733EA, or its subkey 0x8D29319A) sign the Tor source code tarballs.</li> - <li>Erinn Clark (0x63FEE659) signs the Tor Browser Bundles + <li>Erinn Clark (0x63FEE659) signed earlier Tor Browser Bundles and many other packages. She signs RPMs with her other key (0xF1F5C9B5). Andrew Lewman (0x31B0974B, 0x6B4D6475) used to sign packages for RPMs, Windows, and OS X.</li> <li>Tor Project Archive (0x886DDD89) signs the deb.torproject.org repositories and archives.</li> - <li>Mike Perry (0x0E3A92E4), Georg Koppen (0x4B7C3223), - Nicolas Vigier (0xD0220E4B), Linus Nordberg (0x23291265), and the - Tor Browser Developers (0x93298290) sign the Tor Browser releases.</li> <li>Damian Johnson (0x9ABBEEC6) signs Arm releases.</li> <li>Sebastian Hahn (0xC5AA446D), and David Fifield (0xC11F6276) sign Pluggable Transport Tor Browser Bundles. Sometimes Sebastian signs the Tor Browser Bundles.</li> <li>The Tails team (0xBE2CD9C1) signs the Tails live system

1 0