February 2017 - tor-commits - lists.torproject.org

[webwml/staging] Drop Let's Encrypt project idea
by hiro＠torproject.org 15 Feb '17

15 Feb '17

commit 9a310751c2979801c267a75e3589bdca61d5b0e1 Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Feb 4 16:13:02 2017 -0800 Drop Let's Encrypt project idea The EFF still doesn't know if they have anybody to mentor this summer. --- getinvolved/en/volunteer.wml | 35 ----------------------------------- 1 file changed, 35 deletions(-) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index 166b425..75ef8c2 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -931,41 +931,6 @@ ideas. </li> - <a id="letsEncryptClient"></a> - <li> - Expand the OS and Server Support of the Let's Encrypt Client - - Language: Python, Bash - - Likely Mentors: Brad Warren (bmw) - - - <a href="https://letsencrypt.org/">Let's Encrypt</a> is a free and open - certificate authority that allows its users to setup HTTPS on their web - server in a matter of seconds. The project uses a new protocol called ACME - to automatically perform domain validation and certificate issuance. - - - - The Let's Encrypt client currently works on most Unix-like OSes and is - able to automatically set up HTTPS on many Apache configurations. The - purpose of this project is to expand Let's Encrypt support to new - systems. - - - - Potential targets include: - - - <ul> - <li>Better OS X support including a port or Homebrew package</li> - <li>A Let's Encrypt client for Windows / IIS</li> - <li>Handling of more obscure Apache configurations</li> - <li>Automated HTTPS configuration for other web servers such as Nginx or lighttpd</li> - <li>Improved support people using shared hosting who are unable to use the full Let's Encrypt client on their server</li> - </ul> - </li> - <a id="ahmiaSearch"></a> <li> Ahmia - Hidden Service Search

1 0

[webwml/staging] Drop Will as a prospective mentor
by hiro＠torproject.org 15 Feb '17

15 Feb '17

commit 19609a7a1133372099d915032ab4e35b5795cce1 Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Jan 29 13:46:44 2017 -0800 Drop Will as a prospective mentor Will's no longer around so dropping him from 'Feedback Extension for Tor Browser'. --- getinvolved/en/volunteer.wml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index 00f1d73..567cd0c 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -1113,7 +1113,7 @@ the codebase that you want to work on. <li> Feedback Extension for Tor Browser - Likely Mentors: Nima (mrphs), Will (willscott), Sukhbir (sukhe) + Likely Mentors: Nima (mrphs), Sukhbir (sukhe) Design and implement an extension for Tor Browser that can be used to gather

1 0

[webwml/staging] Add Tor Browser project ideas
by hiro＠torproject.org 15 Feb '17

15 Feb '17

commit a500e95ed37a8749098e0f8616e0b5f83bf1c90b Author: Damian Johnson <atagar(a)torproject.org> Date: Tue Jan 31 08:49:28 2017 -0800 Add Tor Browser project ideas Couple GSoC project ideas from Tom Ritter. --- getinvolved/en/volunteer.wml | 44 +++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 41 insertions(+), 3 deletions(-) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index 8604881..37f6879 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -422,8 +422,9 @@ meetings around the world.</li> Project Ideas: - <a href="#panopticlick">Panopticlick</a> <a href="#feedbackExtension">Feedback Extension for Tor Browser</a> + <a href="#torBrowserCrashReport">Crash Reporter for Tor Browser</a> + <a href="#fasterTorBrowser">Make Tor Browser Faster</a> <a id="project-httpseverywhere"></a> @@ -1056,7 +1057,6 @@ ideas. Likely Mentors: Nima (mrphs), Sukhbir (sukhe) - Design and implement an extension for Tor Browser that can be used to gather end-user UI/UX feedback on an opt-in basis. While the design and implementation is left as an exercise for the applicant (and also serves as @@ -1066,16 +1066,54 @@ ideas. - Please propose the extension design in a way that the information is strictly on an opt-in basis and scrubs any information that can be used to identify a user, and also come up with a way to send the gathered information to a central server, whether to an onion address (if the user has Tor running), or otherwise. To start with, we are looking to gather only text as part of the feedback process. + + </li> + <a id="torBrowserCrashReport"></a> + <li> + Crash Reporter for Tor Browser + + Likely Mentors: Tom Ritter (tjr), Georg (GeKo) + + Currently Tor Browser disables the Crash Reporter. We would like to + build it reproducible, enable it, and configure it to report crashes + containing non-detailed and impersonal information to Tor, on a .onion + submission platform that would allow us to view and explore the + crashes. + + + + The project will entail enabling the Crash Report on Tor Browser and + creating a backend to receive reports from it. Once created, the crash + reporter data will be analyzed and modified to fit Tor's requirements + for personal data collection. As time permits, we will update the + build system to ensure the crash reporter is built reproducibly and + add data analysis tools for the crash report database to visualize top + crashers and similar statistics. + + </li> + + <a id="fasterTorBrowser"></a> + <li> + Make Tor Browser Faster + + Likely Mentors: Tom Ritter (tjr), Georg (GeKo) + + This project will enable and take advantage of HTTP/2, the Alt-Srv + header, and tor's new single hop .onion mode to enable websites to + transparently move their traffic to a .onion address. In addition to + improvements in security, we will benchmark page load and paint times + under normal HTTP/1.1, HTTP/2, and when taking advantage of features + such as Server Push. </li> + <!-- <a id=""></a> <li>

1 0

[webwml/staging] Drop 'Make Stegotorus deployment ready' project idea
by hiro＠torproject.org 15 Feb '17

15 Feb '17

commit 6b4d2f149d3f6c21109757795b2e6f07052fce76 Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Feb 4 16:12:04 2017 -0800 Drop 'Make Stegotorus deployment ready' project idea Didn't hear back from vmon. --- getinvolved/en/volunteer.wml | 138 ------------------------------------------- 1 file changed, 138 deletions(-) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index 90f0500..166b425 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -931,144 +931,6 @@ ideas. </li> - <a id="stegotorus"></a> - <li> - Make Stegotorus deployment ready - - Language: C++ - - Likely Mentors: vmon - - - <a - href="https://github.com/TheTorProject/stegotorus/tree/master/src">Stegotorus</a> - is a PT framework which streamline the development stealthier pluggable - transport. An HTTP pluggable transport is already implemented in Stegotorus - framework and can be used when encrypted payloads are throttled and only - ephemeral connections are tolerated. - - - - The majority of work on Stegotorus is done and it can be deployed with a relatively minor improvements including: - - - <ul> - <li>#8098 A config file file for Stegotorus - - Stegotorus needs many configuration settings specially on the bridge - side. This include also the configuration required by each steg module. - Currently the configuration is fed to Stegotorus as command line - arguments but a file like torrc is needed so all tweaking can be read - from there. - - - - Current Status and work needed to be done: The code for reading the - config file is written by SRI but it is not yet used in the Stegotorus - to read the config. - - </li> - - <li>#8101 Debugging the transparent proxy - - Stegotorus http module uses other websites payload to hide and serve - censored traffic. As such it needs to decide if the request is - genuinely to the auxiliary website, in that case becomes a transparent - proxy and serves the website content as requested, or if the request is - actually a request to serve censored material which should be delivered - to steg modules. - - - - Current Status: This is completely implemented. However, the transparent proxy sometimes crashes and need to be triaged, debugged and fixed. - - </li> - - <li>#11337 refactoring the steg module code - - The http steg module code, although not essentials to the core of the - Stegotorus. needs some improvement and clean up. The solution is to - refactor the steg modules as children of FileStegMod. - - - - Current status and work needed to be done: This has already been done - but still needs testing and refactoring before it can be reliably merge - to the master branch. - - </li> - - <li>#8089 Adding Elligator to Stegotorus handshake and test - - The current Stegotorus handshake is distinguishable from random byte - string, which can be used to flag and detect Stegotorus traffic - deterministically and need to be implemented similar to - ScrambleSuite. Also because the capacity of client to server channel - might be slim depending on the choice of steg module it is desirable - to be implemented using Elliptic curve crypto. Hence, Elligator - protocol is ideal solution for this situation. All we need is to replace Stegotorus handshake by Elligator. - - - - Current Status and work needed to be done: Elligator handshake code is - included in stegotorus code base, it is only needed to be called by - instead of the current handshake and be tested. - - </li> - - <li>Make Stegotorus memory safe by using shared pointers - - Stegotorus has large code base and it is not written in a memory safe - languages. To facilitate its audit, we need to replace (almost all) use - of pointers to shared pointers. - - - - Current Status: No progress has not been done. - - </li> - - <li>Security Audit and writing more unit test - - To be able to deploy Stegotorus for real world use we need to audit the - code and write more unit test covering new aspects of the Stegotorus - (new http transport, proxy server, Elligator handshake) - - - - Current Status: No progress has been done. - - </li> - - <li>SRI branch merging - - Stegotorus has been forked from the initial development from SRI. Now - that SRI is hosting Stegotorus publicly it is desirable to merge the - two branches so we can benefit from both developments. - - - - Current Status: No progress has been done. - - </li> - - <li>#8099 deterministic build - - To make deterministic build possible we need to build many of - Stegotorus dependency from scratch. Boost library is a a huge - dependency for Stegotorus to access the file system. As we are only - planning to deploy Stegotorus bridges on Linux machines we can simplify - such access without that dependency. By dropping such dependency, it - should be straight forward to have deterministic build for Stegotorus. - - - - Current Status: No progress has been done. - - </li> - </ul> - </li> - <a id="letsEncryptClient"></a> <li> Expand the OS and Server Support of the Let's Encrypt Client

1 0

[webwml/staging] Alpha is now 0.3.0.3-alpha
by hiro＠torproject.org 15 Feb '17

15 Feb '17

commit 45d157bb71c7da3fe5be9877bdcde9bdbd4c2b09 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 3 13:57:19 2017 -0500 Alpha is now 0.3.0.3-alpha --- Makefile | 2 +- include/versions.wmi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index cedf601..87149e3 100644 --- a/Makefile +++ b/Makefile @@ -15,7 +15,7 @@ # website component, and set it to needs_review. export STABLETAG=tor-0.2.9.9 -export DEVTAG=tor-0.3.0.2-alpha +export DEVTAG=tor-0.3.0.3-alpha WMLBASE=. SUBDIRS=docs eff projects press about download getinvolved donate docs/torbutton diff --git a/include/versions.wmi b/include/versions.wmi index 40d087c..d2e0da6 100644 --- a/include/versions.wmi +++ b/include/versions.wmi @@ -1,5 +1,5 @@ <define-tag version-stable whitespace=delete>0.2.9.9</define-tag> -<define-tag version-alpha whitespace=delete>0.3.0.2-alpha</define-tag> +<define-tag version-alpha whitespace=delete>0.3.0.3-alpha</define-tag> <define-tag version-win32-stable whitespace=delete>0.2.9.9</define-tag>

1 0

[webwml/staging] Drop broken TorBrowser link
by hiro＠torproject.org 15 Feb '17

15 Feb '17

commit dfca2029f35e01297434d5ba288f89cc312948f2 Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Feb 4 13:43:29 2017 -0800 Drop broken TorBrowser link Presently our site shows... ../$dir/$lang/$base.wml), but that doesn't exist.";};}:>">Tor Browser (code, bug tracker, design doc) Guess the tor browser page was dropped or moved. --- getinvolved/en/volunteer.wml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index 1033515..1fa28a0 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -399,7 +399,7 @@ meetings around the world.</li> <a id="project-torbrowser"></a> - <h3><a href="<page projects/torbrowser>">Tor Browser</a> (<a + <h3>Tor Browser (<a href="https://gitweb.torproject.org/tor-browser.git">code</a>, <a href="https://trac.torproject.org/projects/tor/query?status=accepted&status=assig…">bug tracker</a>, <a href="https://www.torproject.org/projects/torbrowser/design/">design doc</a>)</h3>

1 0

[webwml/staging] Drop 'IP hijacking detection for the Tor Network' project idea
by hiro＠torproject.org 15 Feb '17

15 Feb '17

commit c8aff65216c074c10edbc97f33c740a4b00e3185 Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Feb 4 16:07:06 2017 -0800 Drop 'IP hijacking detection for the Tor Network' project idea Didn't hear back if it was still relevant. --- getinvolved/en/volunteer.wml | 40 ---------------------------------------- 1 file changed, 40 deletions(-) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index bf13aec..90f0500 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -1104,46 +1104,6 @@ ideas. </ul> </li> - <a id="ipHijacking"></a> - <li> - IP hijacking detection for the Tor Network - - Likely Mentors: Aaron Gibson (aagbsn) - - - <a href="https://en.wikipedia.org/wiki/IP_hijacking">IP hijacking</a> - occurs when a bad actor creates false routing information to redirect - Internet traffic to or through themselves. This activity is straightforward - to detect, because the Internet routing tables are public information, but - currently there are no public services that monitor the Tor network. The - Tor Network is a dynamic set of relays, so monitoring must be Tor-aware in - order to keep the set of monitored relays accurate. Additionally, consensus - archives and historical Internet routing table snapshots are publicly - available, and this analysis can be performed retroactively. - - - - The implications of IP hijacking are that Tor traffic can be redirected - through a network that an attacker controls, even if the attacker does not - normally have this capability - i.e. they are not in the network path. For - example, an adversary could hijack the prefix of a Tor Guard relay, in - order to learn who its clients are, or hijack a Tor Exit relay to tamper - with requests or name resolution. - - - - This project comprises building a service that compares network prefixes of - relays in the consensus with present and historic routing table snapshots - from looking glass services such as <a - href="http://routeviews.org">Routeviews</a>, or aggregators such as <a - href="https://bgpstream.caida.org">Caida BGPStream</a> and then issues - email alerts to the contact-info in the relay descriptor and a mailing - list. Network operators are responsive to route injections, and these - alerts can be used to notify network operators to take immediate action, as - well as collect information about the occurrence of these type of attacks. - - </li> - <a id="ahmiaSearch"></a> <li> Ahmia - Hidden Service Search

1 0

[webwml/staging] Add 'Stem Descriptors' project idea
by hiro＠torproject.org 15 Feb '17

15 Feb '17

commit 07159d29f72deaf59be93dc0d4b7dc522d1f8d9b Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Feb 2 10:05:21 2017 -0800 Add 'Stem Descriptors' project idea Adding a project of my own to mentor this summer. --- getinvolved/en/volunteer.wml | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index b6c6011..6a372d2 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -568,6 +568,11 @@ meetings around the world.</li> Tor. + + Project Ideas: + <a href="#stemDescriptors">Stem Descriptors</a> + + <a id="project-txtorcon"></a> <h3><a href="https://txtorcon.readthedocs.io/en/latest/">Txtorcon</a> (<a href="https://github.com/meejah/txtorcon">code</a>, <a @@ -901,6 +906,39 @@ ideas. </li> + <a id="stemDescriptors"></a> + <li> + Stem Descriptors + + Language: Python + + Likely Mentors: Damian Johnson (atagar) + + <a href="https://stem.torproject.org/">Stem</a> is a Python library for working with tor. With it you can build applications on tor as well as learn information about the relay network. This project concerns this second capability. + + + + Information about relays are published hourly in documents called <a href="https://stem.torproject.org/tutorials/mirror_mirror_on_the_wall.html">descriptors</a>. With Stem you can download, parse, and validate all kinds of descriptor documents. + + + + Ideas welcome! You're encouraged to brainstorm improvements we can make to this space but here's a few to get you started... + + + <ul> + <li><a href="https://trac.torproject.org/projects/tor/ticket/11045">Validate signatures in the consensus</a>. Stem has the ability to validate cryptographic signatures in several descriptor types but not the consensus.</li> + <li><a href="https://trac.torproject.org/projects/tor/ticket/21086">Migrate from pycrypto to a supported library</a>. Stem presently uses pycrypto for signature validation but it's no longer maintained. We should evaluate options and move to whatever whavever the cool kids are using nowadays.</li> + <li><a href="https://trac.torproject.org/projects/tor/ticket/18856">Retrieve descriptors over tor's ORPort</a>. Tor relays commonly provide two ports, an ORPort which is used by clients and a DirPort which is obsolete nowadays but in the past was used by tor to download descriptors. Stem still uses tor's DirPort to retrieve descriptors, but it would be neat if we could download from the ORPort instead. + This requires implementing part of tor's communication protocol. Depending how complicated this is it might be neat to expand this task to allow the full construction of circuits, allowing client usage of tor without the C executable. Keep in mind though that this later bit hasn't been investigated and might be a pipe dream. ;P</li> + <li>Improve performance of reading descriptors. Stem <a href="https://stem.torproject.org/tutorials/mirror_mirror_on_the_wall.html#are-th…">isn't the only descriptor parsing library</a> and sadly is the slowest. Tricks like lazy loading have substantially improved our performance but no doubt a dedicated effort to profile Stem would find more low hanging fruit.</li> + </ul> + + + + As part of applying for this project please get your hands wet with the codebase by contributing some patches for <a href="https://stem.torproject.org/faq.html#how-do-i-get-started">Stem</a>! + + </li> + <a id="stegotorus"></a> <li> Make Stegotorus deployment ready

1 0

[webwml/staging] Revert "Drop broken TorBrowser link"
by hiro＠torproject.org 15 Feb '17

15 Feb '17

commit 6f83149ceea0fa621529d403c1d1390c2fc257a5 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Feb 7 21:18:08 2017 -0500 Revert "Drop broken TorBrowser link" This reverts commit dfca2029f35e01297434d5ba288f89cc312948f2. --- getinvolved/en/volunteer.wml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index dd41a85..e276865 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -399,7 +399,7 @@ meetings around the world.</li> <a id="project-torbrowser"></a> - <h3>Tor Browser (<a + <h3><a href="<page projects/torbrowser>">Tor Browser</a> (<a href="https://gitweb.torproject.org/tor-browser.git">code</a>, <a href="https://trac.torproject.org/projects/tor/query?status=accepted&status=assig…">bug tracker</a>, <a href="https://www.torproject.org/projects/torbrowser/design/">design doc</a>)</h3>

1 0

[webwml/staging] Remove comm dir position from jobs
by hiro＠torproject.org 15 Feb '17

15 Feb '17

commit 902aa14e150a44eaf2ac1e16cb5d465805967ec4 Author: hiromipaw <hiro(a)torproject.org> Date: Wed Feb 15 13:19:06 2017 +0100 Remove comm dir position from jobs --- about/en/jobs.wml | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/about/en/jobs.wml b/about/en/jobs.wml index bf7e38e..e61435e 100644 --- a/about/en/jobs.wml +++ b/about/en/jobs.wml @@ -12,20 +12,19 @@ <div id="maincol"> <h1>The Tor Project is always looking for more great people to join our team!</h1> -#At the moment, we don't have any official open positions. Please check back -#soon, though! In the meantime, you may want to glance at our -#<a href="<page getinvolved/volunteer>">volunteers</a> page. +At the moment, we don't have any official open positions. Please check back +soon, though! In the meantime, you may want to glance at our +<a href="<page getinvolved/volunteer>">volunteers</a> page. # -Specifically, we're looking for the following people currently: - -<ul> -<li><a href="<page about/jobs-comm-director>">Communications Director</a></li> +#Specifically, we're looking for the following people currently: +#<ul> +#<li><a href="<page about/jobs-comm-director>">Communications Director</a></li> #<li><a href="<page about/jobs-ooni-ux-designer>">UX Designer - OONI</a></li> #<li><a href="<page about/jobs-coredev>">Core Developer</a></li> #<li><a href="<page about/jobs-editor>">Writer/Editor</a></li> #<li><a href="<page about/jobs-admin-assistant>">Administrative Assistant</a></li> -</ul> - +#</ul> +# In the past, we looked for the following people:

1 0