tor-commits September 2020

tor-commits@lists.torproject.org

17 participants
1822 discussions

[translation/communitytpo-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-contentspot
by translation＠torproject.org 03 Sep '20

03 Sep '20

commit 5f9c2143498c672edc821cb9a1ca78b27fd3cc73 Author: Translation commit bot <translation(a)torproject.org> Date: Thu Sep 3 12:15:08 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-conten… --- contents+es-AR.po | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/contents+es-AR.po b/contents+es-AR.po index 1f8a573275..358c020d15 100644 --- a/contents+es-AR.po +++ b/contents+es-AR.po @@ -2071,6 +2071,9 @@ msgid "" "surveillance, for example, might attract more attention when reaching out " "other activists to run a digital security training." msgstr "" +"1. **Tu modelo de amenaza.** Un activista de alto perfil que ya está bajo un" +" montón de vigilancia, por ejemplo, podría atraer más atención al contactar " +"a otros activistas para realizar un entrenamiento en seguridad digital." #: https//community.torproject.org/training/risks/ #: (content/training/risks/contents+en.lrpage.body) @@ -2080,6 +2083,10 @@ msgid "" " has a record in prosecuting individuals engaging in similar types of " "activities." msgstr "" +"2. **Las leyes y regulaciones en el país.** Consultá con abogados y " +"organizaciones de libertad de expresión locales, y aprendé si tu país tiene " +"un historial de procesamiento de individuos efectuando un tipo similar de " +"actividades." #: https//community.torproject.org/training/risks/ #: (content/training/risks/contents+en.lrpage.body) @@ -2087,6 +2094,8 @@ msgid "" "3. **The types of training.** Not all trainings carry the same weight in " "terms of potential risk." msgstr "" +"3. **Los tipos de entrenamiento.** No todos los entrenamientos tienen el " +"mismo peso en términos de riesgo potencial." #: https//community.torproject.org/training/risks/ #: (content/training/risks/contents+en.lrpage.body) @@ -2095,6 +2104,9 @@ msgid "" "but teaching how to circumvent government censorship could be a serious " "felony." msgstr "" +"Por ejemplo, hablar acerca de la privacidad en la era digital pudiera ser " +"apreciable, pero enseñar cómo evadir la censura gubernamental podría ser una" +" felonía seria." #: https//community.torproject.org/training/risks/ #: (content/training/risks/contents+en.lrpage.body) @@ -2104,6 +2116,11 @@ msgid "" "leaked documents about government corruption, you might need to be extra " "careful on how to reach out them in a private way." msgstr "" +"4. **La audiencia.** Reunir a estudiantes universitarios pudiera no llamar " +"la atención, pero si estuvieras juntando a un grupo de periodistas " +"trabajando con documentos filtrados acerca de la corrupción gubernamental, " +"podrías necesitar ser extra cuidadoso sobre cómo contactarlos en una forma " +"privada." #: https//community.torproject.org/training/risks/ #: (content/training/risks/contents+en.lrpage.body) @@ -2111,6 +2128,8 @@ msgid "" "5. **The training venue.** Running a Tor training in some spaces could " "expose your participants' identities." msgstr "" +"5. **El lugar del entrenamiento.** Efectuar un entrenamiento en Tor en " +"algunos espacios podría exponer las identidades de tus participantes." #: https//community.torproject.org/training/risks/ #: (content/training/risks/contents+en.lrpage.body)

1 0

[translation/communitytpo-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-contentspot
by translation＠torproject.org 03 Sep '20

03 Sep '20

commit 0d0bffaa35429cc6a12650d46ac127dc52c13289 Author: Translation commit bot <translation(a)torproject.org> Date: Thu Sep 3 11:45:11 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-conten… --- contents+es-AR.po | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/contents+es-AR.po b/contents+es-AR.po index 42dd1b7d26..1f8a573275 100644 --- a/contents+es-AR.po +++ b/contents+es-AR.po @@ -2054,11 +2054,15 @@ msgid "" "Some potential risks of running a digital security training are only valid " "in specific contexts." msgstr "" +"Algunos riesgos potenciales de efectuar un entrenamiento en seguridad " +"digital solamente son válidos en contextos específicos." #: https//community.torproject.org/training/risks/ #: (content/training/risks/contents+en.lrpage.body) msgid "The potential risks associated with running a Tor training depend on:" msgstr "" +"Los riesgos potenciales asociados con efectuar un entrenamiento en Tor " +"dependen de:" #: https//community.torproject.org/training/risks/ #: (content/training/risks/contents+en.lrpage.body)

1 0

[tor-browser/tor-browser-78.2.0esr-10.0-1] Bug 1650281 - P1: Widen `gCombinedSizes` once the buffers grow r=gerald
by gk＠torproject.org 03 Sep '20

03 Sep '20

commit 5479c1f3ed0aa57b8f389a909d42343c9eaae09f Author: Chun-Min Chang <chun.m.chang(a)gmail.com> Date: Tue Jul 21 23:38:57 2020 +0000 Bug 1650281 - P1: Widen `gCombinedSizes` once the buffers grow r=gerald The `gCombinedSizes` need to be enlarged once the inner buffer within `MemoryBlockCache` grows. Otherwise, when the `MemoryBlockCache` is released, subtracting the buffer-size of the `MemoryBlockCache` from `gCombinedSizes` lead to a underflow. Differential Revision: https://phabricator.services.mozilla.com/D84273 --- dom/media/MemoryBlockCache.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/dom/media/MemoryBlockCache.cpp b/dom/media/MemoryBlockCache.cpp index 2d31119dca0a..bf073e6769d0 100644 --- a/dom/media/MemoryBlockCache.cpp +++ b/dom/media/MemoryBlockCache.cpp @@ -114,6 +114,10 @@ bool MemoryBlockCache::EnsureBufferCanContain(size_t aContentLength) { // possibly bypass some future growths that would fit in this new capacity. mBuffer.SetLength(capacity); } + const size_t newSizes = gCombinedSizes += (extra + extraCapacity); + LOG("EnsureBufferCanContain(%zu) - buffer size %zu + requested %zu + bonus " + "%zu = %zu; combined sizes %zu", + aContentLength, initialLength, extra, extraCapacity, capacity, newSizes); mHasGrown = true; return true; }

1 0

[tor-browser/tor-browser-78.2.0esr-10.0-1] Merge branch 'bug_40109' into tor-browser-78.2.0esr-10.0-1
by gk＠torproject.org 03 Sep '20

03 Sep '20

commit 885968e7a8374d3215e48cd27621fa7928200a38 Merge: b1f49b0a36f1 965a049f6bb1 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Sep 3 09:36:50 2020 +0000 Merge branch 'bug_40109' into tor-browser-78.2.0esr-10.0-1 dom/media/MemoryBlockCache.cpp | 5 +++++ 1 file changed, 5 insertions(+)

1 0

[tor-browser/tor-browser-78.2.0esr-10.0-1] Bug 1650281 - P2: Make sure `gCombinedSizes` won't be underflowed r=gerald
by gk＠torproject.org 03 Sep '20

03 Sep '20

commit 965a049f6bb123f384e72029feded2550f20027d Author: Chun-Min Chang <chun.m.chang(a)gmail.com> Date: Tue Jul 21 23:39:14 2020 +0000 Bug 1650281 - P2: Make sure `gCombinedSizes` won't be underflowed r=gerald In any case, `gCombinedSizes` should be larger than or equal to the buffer within `MemoryClockCache`. Differential Revision: https://phabricator.services.mozilla.com/D84274 --- dom/media/MemoryBlockCache.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/dom/media/MemoryBlockCache.cpp b/dom/media/MemoryBlockCache.cpp index bf073e6769d0..2848a3f3812c 100644 --- a/dom/media/MemoryBlockCache.cpp +++ b/dom/media/MemoryBlockCache.cpp @@ -52,6 +52,7 @@ MemoryBlockCache::MemoryBlockCache(int64_t aContentLength) } MemoryBlockCache::~MemoryBlockCache() { + MOZ_ASSERT(gCombinedSizes >= mBuffer.Length()); size_t sizes = static_cast<size_t>(gCombinedSizes -= mBuffer.Length()); LOG("~MemoryBlockCache() - destroying buffer of size %zu; combined sizes now " "%zu",

1 0

[translation/communitytpo-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-contentspot
by translation＠torproject.org 03 Sep '20

03 Sep '20

commit 621c788edf6dd673ac27d7e8803e0cfe75a982f4 Author: Translation commit bot <translation(a)torproject.org> Date: Thu Sep 3 09:15:09 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-conten… --- contents+es-AR.po | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/contents+es-AR.po b/contents+es-AR.po index f8c48810ed..42dd1b7d26 100644 --- a/contents+es-AR.po +++ b/contents+es-AR.po @@ -2029,6 +2029,11 @@ msgid "" "threats, placement on government watch lists, and targeting for " "surveillance." msgstr "" +"Sin embargo, en algunos países y en ciertas circunstancias, es posible que " +"simplemente una reunón de defensores de los derechos humanos pudiera ser " +"riesgosa, ilegal o incluso someter a alguien a encarcelamiento, asaltos " +"físicos, grandes multas, amenazas, inclusión en listas gubernamentales de " +"observación y ser hecho objeto de vigilancia." #: https//community.torproject.org/training/risks/ #: (content/training/risks/contents+en.lrpage.body) @@ -2038,6 +2043,10 @@ msgid "" "read this document and, in case of doubt, to reach out to the Tor Community " "Team privately." msgstr "" +"Si querés efectuar un entrenamiento en Tor por primera vez y no sabés cómo " +"evaluar el entorno político y social, te alentamos enfáticamente a que leas " +"este documento, y, en caso de duda, contactarte con el Equipo de la " +"Comunidad Tor en forma privada." #: https//community.torproject.org/training/risks/ #: (content/training/risks/contents+en.lrpage.body)

1 0

[translation/communitytpo-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-contentspot
by translation＠torproject.org 03 Sep '20

03 Sep '20

commit 53de93001cf1c2077d3d4e8c7630317fc33db5b5 Author: Translation commit bot <translation(a)torproject.org> Date: Thu Sep 3 08:45:10 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-conten… --- contents+es-AR.po | 42 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 34 insertions(+), 8 deletions(-) diff --git a/contents+es-AR.po b/contents+es-AR.po index 7c5e408913..f8c48810ed 100644 --- a/contents+es-AR.po +++ b/contents+es-AR.po @@ -1892,11 +1892,13 @@ msgid "" "* [Country Level " "Overview](https://metrics.torproject.org/rs.html#aggregate/cc)" msgstr "" +"* [Resumen a Nivel de " +"País](https://metrics.torproject.org/rs.html#aggregate/cc)" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) msgid "# Choosing an Operating System" -msgstr "" +msgstr "# Eligiendo un Sistema Operativo" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) @@ -1905,11 +1907,14 @@ msgid "" "you're able, the network would most benefit from BSD and other non-Linux " "based relays." msgstr "" +"Recomendamos usar el sistema operativo con el que estás más familiarizado, " +"pero si sos capaz, la red se beneficiaría al máximo con repetidores basados " +"en BSD y otros que no sean Linux." #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) msgid "Most relays currently run on Debian." -msgstr "" +msgstr "La mayoría de los repetidores corren actualmente sobre Debian." #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) @@ -1917,16 +1922,19 @@ msgid "" "The following table shows the current OS distribution on the Tor network to " "give you an idea of how much more non-Linux relays we should have:" msgstr "" +"La siguiente tabla muestra la distribución actual de SO en la red Tor, para " +"darte una idea de cuántos más repetidores que no sean Linux deberíamos " +"tener:" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) msgid "* https://nusenu.github.io/OrNetStats/#os-distribution-relays" -msgstr "" +msgstr "* https://nusenu.github.io/OrNetStats/#os-distribution-relays" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) msgid "# OS Level Configuration" -msgstr "" +msgstr "# Configuración a Nivel de SO" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) @@ -1935,11 +1943,14 @@ msgid "" "points are crucial for a Tor relay, so we want to mention them here " "nonetheless." msgstr "" +"La configuración del SO está fuera del ámbito de esta guía, pero los " +"siguientes puntos son cruciales para un repetidor Tor, por lo que queremos " +"mencionarlos acá de todas maneras." #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) msgid "## Time Synchronization (NTP)" -msgstr "" +msgstr "## Sincronización Temporal (NTP)" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) @@ -1948,16 +1959,20 @@ msgid "" "you use the network time protocol (NTP) for time synchronization and ensure " "your timezone is set correctly." msgstr "" +"Los ajustes correctos de tiempo son esenciales para los repetidores Tor. Es " +"recomendado que uses el protocolo de tiempo de red (NTP) para la " +"sincronización temporal, y te asegures que tu huso horario está establecido " +"correctamente." #: https//community.torproject.org/relay/getting-help/ #: (content/relay-operations/getting-help/contents+en.lrpage.title) msgid "Getting help" -msgstr "" +msgstr "Obtener ayuda" #: https//community.torproject.org/relay/getting-help/ #: (content/relay-operations/getting-help/contents+en.lrpage.subtitle) msgid "How to get help if you run into issues" -msgstr "" +msgstr "Cómo obtener ayuda si te encontrás con dificultades" #: https//community.torproject.org/relay/getting-help/ #: (content/relay-operations/getting-help/contents+en.lrpage.body) @@ -1968,6 +1983,11 @@ msgid "" "The list is a great resource for asking (and answering) questions, and for " "getting to know other relay operators. Make sure to check out the archives!" msgstr "" +"Si te encontrás con problemas mientras estás configurando tu repetidor, " +"podés hacer tus preguntas en la [lista de correo pública tor-" +"relays](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays). " +"Es un recurso bárbaro para hacer (y responder) preguntas, y para conocer a " +"otros operadores de repetidores. ¡Asegurate de comprobar los archivos!" #: https//community.torproject.org/relay/getting-help/ #: (content/relay-operations/getting-help/contents+en.lrpage.body) @@ -1975,17 +1995,21 @@ msgid "" "You can also get help by joining the IRC channel #tor-relays in the network " "[irc.oftc.net](https://support.torproject.org/get-in-touch/#irc-help)." msgstr "" +"También podés obtener ayuda uniéndote al canal IRC #tor-relays en la red " +"[irc.oftc.net](https://support.torproject.org/get-in-touch/#irc-help)." #: https//community.torproject.org/training/risks/ #: (content/training/risks/contents+en.lrpage.title) msgid "Risks" -msgstr "" +msgstr "Riesgos" #: https//community.torproject.org/training/risks/ #: (content/training/risks/contents+en.lrpage.subtitle) msgid "" "Things you should be aware of before running a digital security training." msgstr "" +"Cosas de las que debieras ser conciente antes de efectuar un entrenamiento " +"en seguridad digital." #: https//community.torproject.org/training/risks/ #: (content/training/risks/contents+en.lrpage.body) @@ -1993,6 +2017,8 @@ msgid "" "To our knowledge, no Tor trainer has ever faced consequences as a result of " "training others or speaking about Tor." msgstr "" +"En la medida de nuestro conocimiento, ningún entrenador en Tor ha encarado " +"consecuencias como resultado de entrenar a otros o hablar acerca de Tor." #: https//community.torproject.org/training/risks/ #: (content/training/risks/contents+en.lrpage.body)

1 0

[translation/communitytpo-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-contentspot
by translation＠torproject.org 03 Sep '20

03 Sep '20

commit 5b3292455e032325067dc077a5177120258a5a94 Author: Translation commit bot <translation(a)torproject.org> Date: Thu Sep 3 08:15:12 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-conten… --- contents+es-AR.po | 38 +++++++++++++++++++++++++++++--------- 1 file changed, 29 insertions(+), 9 deletions(-) diff --git a/contents+es-AR.po b/contents+es-AR.po index d5e0cf0046..7c5e408913 100644 --- a/contents+es-AR.po +++ b/contents+es-AR.po @@ -1760,11 +1760,14 @@ msgid "" "question you can use the AS rank of the autonomous systems if you want to " "compare: (a lower value is better) http://as-rank.caida.org/" msgstr "" +"* ¿Qué tan bien conectado está el sistema autónomo del alojador? Para " +"responder a esta pregunta, podés usar el rango AS de los sistemas autónomos," +" si querés comparar: (un valor más bajo es mejor) http://as-rank.caida.org/" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) msgid "## If you plan to run exit relays" -msgstr "" +msgstr "## Si planeás correr repetidores de salida" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) @@ -1772,6 +1775,8 @@ msgid "" "* Does the hoster allow Tor exit relays? We recommend you explicitly ask " "them before getting started." msgstr "" +"* ¿El alojador permite repetidores de salida Tor? Te recomendamos que les " +"preguntes explícitamente antes de empezar." #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) @@ -1779,6 +1784,8 @@ msgid "" "* Does the hoster allow custom WHOIS records for your IP addresses? This " "helps reduce the amount of abuse sent to the hoster instead of you." msgstr "" +"* ¿El alojador permite registros WHOIS a medida para tu dirección IP? Esto " +"ayuda a reducir la cantidad de abuso enviada al alojador en vez de a vos." #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) @@ -1786,16 +1793,18 @@ msgid "" "* Does the hoster allow you to set a custom DNS reverse entry? (DNS PTR " "record)" msgstr "" +"* ¿El alojador te permite configurar una entrada a medida de DNS inverso? " +"(registro PTR del DNS)" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) msgid "You can usually ask these questions in a Pre-Sales ticket." -msgstr "" +msgstr "Usualmente podés hacer estas preguntas en un tique de preventa." #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) msgid "# AS/location diversity" -msgstr "" +msgstr "# AS/diversidad de ubicación" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) @@ -1803,22 +1812,27 @@ msgid "" "When selecting your hosting provider, consider network diversity on an " "autonomous system (AS) and country level." msgstr "" +"Cuando seleccionés tu proveedor de alojamiento, considerá la diversidad de " +"red sobre un sistema autónomo (AS) y el nivel del país." #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) msgid "A more diverse network is more resilient to attacks and outages." -msgstr "" +msgstr "Una red más diversa es más tenaz a los ataques y apagones." #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) msgid "" "Sometimes it is not clear which AS you are buying from in case of resellers." msgstr "" +"A veces no está claro de qué AS estás comprando, en el caso de revendedores." #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) msgid "To be sure, ask the host about the AS number before ordering a server." msgstr "" +"Para estar seguro, preguntale al alojador acerca del número AS antes de " +"ordenar un servidor." #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) @@ -1826,31 +1840,33 @@ msgid "" "It is best to avoid hosts where many Tor relays are already hosted, but it " "is still better to add one there than to run no relay at all." msgstr "" +"Lo mejor es evitar equipos donde muchos repetidores Tor ya están alojados, " +"pero aún es mejor agregar uno ahí que no correr un repetidor en lo absoluto." #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) msgid "**Try to avoid** the following hosters:" -msgstr "" +msgstr "**Intentá evitar** los siguientes alojadores:" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) msgid "* OVH SAS (AS16276)" -msgstr "" +msgstr "* OVH SAS (AS16276)" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) msgid "* Online S.a.s. (AS12876)" -msgstr "" +msgstr "* Online S.a.s. (AS12876)" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) msgid "* Hetzner Online GmbH (AS24940)" -msgstr "" +msgstr "* Hetzner Online GmbH (AS24940)" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) msgid "* DigitalOcean, LLC (AS14061)" -msgstr "" +msgstr "* DigitalOcean, LLC (AS14061)" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) @@ -1858,6 +1874,8 @@ msgid "" "To find out which host and countries are already used by many other " "operators (that should be avoided) you can use Relay Search:" msgstr "" +"Para ver qué alojadores y países ya están usados por muchos otros operadores" +" (eso debiera ser evitado) podés usar la Búsqueda de Repetidores:" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body) @@ -1865,6 +1883,8 @@ msgid "" "* [Autonomous System Level " "Overview](https://metrics.torproject.org/rs.html#aggregate/as)" msgstr "" +"* [Resumen a Nivel de Sistema " +"Autónomo](https://metrics.torproject.org/rs.html#aggregate/as)" #: https//community.torproject.org/relay/technical-considerations/ #: (content/relay-operations/technical-considerations/contents+en.lrpage.body)

1 0

[tor-browser-spec/master] Bug 40003: Document the Canvas Breakage Ideas conversation from [tbb-dev]
by gk＠torproject.org 03 Sep '20

03 Sep '20

commit 1b265d8711626b6511e8ce4a3300360d873d8da7 Author: Sanketh Menda <sanketh(a)c1own.com> Date: Mon Aug 17 16:15:16 2020 -0400 Bug 40003: Document the Canvas Breakage Ideas conversation from [tbb-dev] --- .../xxx-canvas-tainting-for-fp-resistance.txt | 134 +++++++++++++++++++++ 1 file changed, 134 insertions(+) diff --git a/proposals/ideas/xxx-canvas-tainting-for-fp-resistance.txt b/proposals/ideas/xxx-canvas-tainting-for-fp-resistance.txt new file mode 100644 index 0000000..0c4fd17 --- /dev/null +++ b/proposals/ideas/xxx-canvas-tainting-for-fp-resistance.txt @@ -0,0 +1,134 @@ +Filename: xxx-canvas-tainting-for-fp-resistance.txt +Title: Canvas Tainting for Fingerprinting Resistance +Authors: David Fifield, Matthew Finkel, Sanketh Menda, and Tom Ritter +Created: 21-Aug-2020 +Status: Draft + +1. Motivation + + Canvas permissions currently break the following workflow: + 1. user uploads image + 2. website tries to display the image back to the user + 3. this image is white or noise (if canvas fuzzing is enabled.) + + Here are some instances of this breakage: + 1. Uploading images to WhatsApp Web: + https://bugzilla.mozilla.org/show_bug.cgi?id=1631673 + 2. Image cropping in Expensify: + https://bugzilla.mozilla.org/show_bug.cgi?id=1456378 + 3. Uploading images to Craigslist: + https://bugzilla.mozilla.org/show_bug.cgi?id=1573834 + + This workflow does not seem to be invading the user's privacy so it would be + nice to support it. Currently, to unbreak this functionality, the user has to + give full canvas permissions which may be abused by websites. + + This proposal specifies an approach towards allowing some use of the canvas + without sacrificing privacy. + +2. Proposal + +2.1 The Key Idea + + Keep track of whether the canvas is safe (in terms of fingerprintability) to + extract or not, and allow extractions if it is safe. + + This idea was first proposed by Gijs Kruitbosch [0] in analogy to canvas + tainting used to prevent cross-origin image loading [1]. + +2.2 Canvas Tainting for Fingerprinting Resistance + + We attach a state variable `isFPSafe` to the canvas, define three classes + of operations: safe, unsafe, and extraction, and when the canvas is + manipulated, we perform the following depending on whether the operation is + safe or not. + + ``` + if (safe operation) pass; + elif (unsafe operation) isFPSafe = false; + elif (extraction operation) { + if (isFPSafe) extract; + else return placeholder; + } + ``` + + See the canvas element section of the HTML spec [2] for details on canvas + operations. + +2.2.1 Safe Operations + + - `canvas.getContext`: returns the canvas object + - `canvas.drawImage` for user uploaded images: draws the given image onto the + canvas + + We hypothesize that allowing these operations unbreaks the aforementioned + workflow (see Research Question 1) and is safe (see Research Question 2). + + These operations are also probably safe: + - `canvas.getContextAttributes` + +2.2.2 Unsafe Operations + + All operations that have not been classified as safe (i.e., not listed in + Section 2.2.1) are considered unsafe. + +2.2.3 Extraction Operations + + - .toDataURL`: returns a dataURL of the canvas + - `canvas.toBlob`: returns a blob of the canvas + +3. Concerns + +3.1 Scaling inside drawImage + + The specification [3] does not specify how to scale images, so the scaling + algorithm may be implementation dependent and is a possible fingerprinting + vector. + +3.2 Image format encoding + + The specification [4] does not specify how to do image format encoding so it + may be implementation dependent and is a possible fingerprinting vector. + + Gómez-Boix, Laperdrix, and Baudry [3, p.314] noticed that compressing a canvas + to an image format adds entropy. However, in the case of user uploaded images, + this might be less of an issue (see Research Question 3.) + +3.2.1 `quality` levels + + `quality` levels add another layer of uncertainty to image format encoding as + they are not standardized [4]. + +3.2.1 Wide-gamut colors + + This does not seem to be in the HTML standard yet but it seems like WebKit and + Chrome already support it so it is worth looking into (see Research Question + 3). + + WebKit: https://github.com/whatwg/html/issues/299 + Chrome: https://github.com/whatwg/html/issues/4167 + +4. Research + + We would like to perform experiments to answer the following questions. + 1. Does this approach unbreak the motivating workflow? + 2. Are "safe operations" (the ones listed in 2.2.1) safe against + fingerprinting attacks? + 3. How bad are issues mentioned in the concerns? + +5. Acknowledgements + + We thank Alex Catarineu and Gijs Kruitbosch for insightful conversations, + and Georg Koppen for valuable comments on drafts of this document. + +6. References + +[0]: https://bugzilla.mozilla.org/show_bug.cgi?id=1631673#c8 +[1]: https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_enabled_image +[2]: https://html.spec.whatwg.org/multipage/canvas.html +[3]: https://html.spec.whatwg.org/multipage/canvas.html#drawing-images +[4]: +https://html.spec.whatwg.org/multipage/canvas.html#serialising-bitmaps-to-a-file +[5]: Hiding in the Crowd: an Analysis of the Effectiveness of Browser +Fingerprinting at Large Scale. Gómez-Boix, Laperdrix, and Baudry. WWW '18. +https://doi.org/10.1145/3178876.3186097

1 0

[tor-browser-spec/master] Merge branch !6 into master
by gk＠torproject.org 03 Sep '20

03 Sep '20

commit 62045ea62ab28d8b1e9c25b7dc2b5ebdb509e145 Merge: f857ef5 1b265d8 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Sep 3 08:04:26 2020 +0000 Merge branch !6 into master .../xxx-canvas-tainting-for-fp-resistance.txt | 134 +++++++++++++++++++++ 1 file changed, 134 insertions(+)

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits September 2020