March 2021 - tor-commits - lists.torproject.org

[community/staging] Update contents.lr
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit aa02a195d6aed33e0bf1d32040ef93db519438eb Author: Stephanie A. Whited <steph(a)torproject.org> Date: Fri Sep 20 08:04:01 2019 +0000 Update contents.lr --- content/onion-services/overview/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/onion-services/overview/contents.lr b/content/onion-services/overview/contents.lr index c85306f..e747052 100644 --- a/content/onion-services/overview/contents.lr +++ b/content/onion-services/overview/contents.lr @@ -24,7 +24,7 @@ Onion services offer various privacy and security benefits to their users. ### Location hiding -An onion service's IP is hidden. Onion services are an overlay network on top of TCP/IP/, so in some sense IP addresses are not even meaningful to onion services: they are not even used in the protocol. +An onion service's IP is hidden. Onion services are an overlay network on top of TCP/IP, so in some sense IP addresses are not even meaningful to onion services: they are not even used in the protocol. ### End-to-end authentication

1 0

[community/staging] Update Workflows
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 640f299baa6b40201bd97d0a9b0e8d6aa739ca6a Author: Pili Guerra <pili(a)piliguerra.com> Date: Fri Sep 20 12:12:52 2019 +0200 Update Workflows --- README.md | 49 +++++++++++++++++++++++++++++++++++++------------ 1 file changed, 37 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index cf1d9de..1bc2893 100644 --- a/README.md +++ b/README.md @@ -64,20 +64,45 @@ If you want to contribute to the Community portal, we will be happy to help you. ## Our Workflows -### Internal Workflow +### Tor Internal Workflow This is the workflow that Tor Internal people should use when making changes on the Community Portal: -1. When starting work on an issue or content, please assign the issue to yourself and move into the `Doing` column on the [Community Portal Project Board](https://dip.torproject.org/web/community/-/boards). You can follow the process outlined in ["How to send a merge request or propose a change"](https://dip.torproject.org/web/tpo/wikis/Git-flow-and-merge-requests#how-to-send-a-merge-request-or-propose-a-change) to work on your changes. -2. To view your changes on the website, you can either run lektor locally, or push to `develop` branch. -3. Once you are happy with your work, push your changes to `staging` branch and move to `needs-review` column on the [Community Portal Project Board](https://dip.torproject.org/web/community/-/boards) +1. When starting work on an issue or content, please assign the issue to yourself and move into the `Doing` column on the [Community Portal Project Board](https://dip.torproject.org/web/community/-/boards). You can follow the process outlined in ["How to send a merge request or propose a change"](https://dip.torproject.org/web/tpo/wikis/Git-flow-and-merge-requests#how-to-send-a-merge-request-or-propose-a-change) to work on your changes. e.g +``` +# Start a new feature +git checkout -b new-feature master +# Edit some files +git add <file> +git commit -m "Start a feature" +# Edit some files +git add <file> +git commit -m "Finish a feature" +``` +2. To view your changes on the website, you can [run lektor locally](https://dip.torproject.org/web/tpo/wikis/Compiling-a-local-version… +3. Once you are happy with your work, push your changes to `develop` branch and move to `needs-review` column on the [Community Portal Project Board](https://dip.torproject.org/web/community/-/boards) 4. Add a comment to the issue, tagging the reviewer, e.g `@steph`, with: - - Location of page on lektor staging, e.g https://lektor-staging.torproject.org/community/staging/ - - Contents file, on your branch, containing your changes, e.g https://dip.torproject.org/pili/community/blob/master/content/onion-service… - - For the review workflow, please see -5. Once the work has been reviewed and any necessary changes have been made, reviewer should move the issue to the `reviewed` column and add a comment to the issue with details of where the latest version can be found, e.g https://dip.torproject.org/{user}/community/blob/master/content/onion-servi… -6. Team members with write access to gitweb master will then push these changes to master, following the workflow outlined in [How to use our git flow](https://dip.torproject.org/web/tpo/wikis/Git-flow-and-merge-requests#… -7. Merger should then move the the ticket to the `Closed` column + - Location of page on lektor-staging `develop` branch, e.g https://lektor-staging.torproject.org/community/develop/ + - Contents file, containing your changes where it would be located on the **reviewer's repo** e.g `https://dip.torproject.org/steph/community/blob/develop/content/onion-services/contents.lr` + - For the review workflow, please see (Reviewer Workflow) +5. Once the work has been reviewed and any necessary changes and merge request has been made, a repo maintainer or team members with write access to gitweb master will then merge or cherry-pick these changes to master, following the workflow outlined in [How to use our git flow](https://dip.torproject.org/web/tpo/wikis/Git-flow-and-merge-requests#… +6. Merger should then move the the ticket to the `Closed` column + +### Reviewer Workflow + +1. Review the page on lektor-staging +2. Review the content on your repo's develop branch and use the gitlab edit button to make any changes. +3. When you are happy with your changes: + - Update the "Commit message" to explain why you have made your changes + - Update the "Target Branch" + - Make sure that the "Start a new merge request with these changes" checkbox is checked. + - Click on "Commit changes" +4. You will be sent to a new page to create your merge request: + - Update "Title" with a short title to explain your changes + - Update "Description", you can use the commit message you entered before additionally referencing the original issue you have reviewed, e.g `https://dip.torproject.org/web/community/issues/3` and tagging one of the repo maintainers e.g `@pili` so they know the change can be merged + - Make sure that both "Delete source branch when merge request is accepted" and "Squash commits when merge request is accepted" are checked. + - Click "Submit merge request" +5. Reviewer should comment on the original issue with a link to the merge request created, e.g `https://dip.torproject.org/steph/community/merge_requests/2` ### Volunteer Workflow @@ -86,12 +111,12 @@ This is the workflow that external volunteers should use when making changes on We recommend that you use our [github mirror](https://github.com/torproject/community) to submit PRs and contributions to our Community repo. Once you have a PR ready you should: 0. Ideally try to run it locally and check that nothing breaks and everything still behaves as before -1. Make a PR and ping the team on #tor-www IRC channel to let us know there's a PR waiting for reviewx +1. Make a PR and ping the team on #tor-www IRC channel to let us know there's a PR waiting for review At this point, one of us on the website team will aim to review your PR within 24h during the week (this may take longer on the weekends). Review will involve: - Reading the text to make sure it's accurate and there are no spelling errors or grammar mistakes - - If there are any front end and/or template changes involved, the changes will be pushed to our development branch for functionality review + - If there are any front end and/or template changes involved, the changes will be pushed to our `develop` branch for functionality review - If there are any fixes necessary, we will ask for changes to be made. Once it all looks good and behaves correctly, we will merge your request to the master branch of the community portal [canonical repo](https://gitweb.torproject.org/project/web/community.git/) on [gitweb](https://gitweb.torproject.org/) master.

1 0

[community/staging] Merge branch 'aadibajpai'
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit a98fe1c251eb9ded6e4aab6a62e9b7165ae4cc89 Merge: 8701e87 d556fe5 Author: gus <gus(a)torproject.org> Date: Mon Sep 23 14:19:18 2019 -0400 Merge branch 'aadibajpai' content/onion-services/setup/contents.lr | 4 ++-- databags/pagenav+en.ini | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)

1 0

[community/staging] Fix Heading
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 8701e8702103f8bc5dcfbfdef8dd024f779e0502 Author: Aadi Bajpai <me(a)aadibajpai.me> Date: Sat Sep 21 06:43:33 2019 +0530 Fix Heading The heading wasn't being rendered correctly. --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index f196cd5..b7dee2b 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # Community portal -This is the repository of Community portal. The current online version of this portal can be found at [https://community.torproject.org](https://community.torproject.org) or [Community Onion Service](http://3gldbgtv5e4god56.onion/). +This is the repository of Community portal. The current online version of this portal can be found at https://community.torproject.org or [Community Onion Service](http://3gldbgtv5e4god56.onion/). To clone the code use either of @@ -78,7 +78,7 @@ This is the workflow that Tor Internal people should use when making changes on 5. Once the work has been reviewed and any necessary changes and merge request has been made, a repo maintainer or team members with write access to gitweb master will then merge or cherry-pick these changes to master, following the workflow outlined in [How to use our git flow](https://dip.torproject.org/web/tpo/wikis/Git-flow-and-merge-requests#… 6. Merger should then move the the ticket to the `Closed` column. -### Reviewer Workflow +### Reviewer Workflow 1. Review the page on lektor-staging 2. Review the content on your repo's develop branch and use the gitlab edit button to make any changes.

1 0

[community/staging] Replace Debian repository instructions to Support portal
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 4cbe0a2a48d5845b2f44f4001ed9cff12d901611 Author: Gustavo Gus <gusgustavo(a)users.noreply.github.com> Date: Fri Sep 27 17:49:45 2019 +0000 Replace Debian repository instructions to Support portal --- .../relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr b/content/relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr index b97259c..9596a38 100644 --- a/content/relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr +++ b/content/relay-operations/technical-setup/bridge/debian-ubuntu/contents.lr @@ -10,7 +10,7 @@ body: Get the latest version of Tor. If you're on Debian stable, `sudo apt-get install tor` should give you the latest stable version of Tor. -* Note: **Ubuntu users need to get it from Tor repository. Please see** [Download instructions for Ubuntu](https://www.torproject.org/docs/debian.html.en#ubuntu). +* Note: **Ubuntu users need to get it from Tor repository. Please see** [Download instructions for Ubuntu](https://support.torproject.org/apt/tor-deb-repo/). ### 2. Install obfs4proxy

1 0

[community/staging] Add new page - training checklist
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 0f09bc4e3b69d2259a2cfca0701b66fad3197d45 Author: gus <gus(a)torproject.org> Date: Wed Oct 2 11:51:11 2019 -0400 Add new page - training checklist --- content/training/checklist/contents.lr | 75 ++++++++++++++++++++++++++++++++++ 1 file changed, 75 insertions(+) diff --git a/content/training/checklist/contents.lr b/content/training/checklist/contents.lr new file mode 100644 index 0000000..5712680 --- /dev/null +++ b/content/training/checklist/contents.lr @@ -0,0 +1,75 @@ +_model: page +--- +title: Training checklist +--- +body: + +Use this checklist to run a Tor Training. + +## Get prepared + + [ ] I read and agree with the Tor Project [Code of Coduct](https://community.torproject.org/training/code-of-conduct/) + + [ ] I read the Trainers Guide + + [ ] I have an agenda for the training + + [ ] I reviewed the training slides + +## Security protocol + + [ ] I already contacted my organization and told them that I'm organizing this training + + [ ] I shared a contact to whom my organization should call if something happens + +## About the venue + + [ ] The venue has enough tables and chairs to everyone + + [ ] The venue has internet connection and I know the wifi password + + [ ] It has a projector available and works on my computer + +## Audience & Communication + + [ ] I sent an e-mail with the address and time to all participants + + [ ] I asked them to bring the necessary equipment to the training + + [ ] I have confirmed participants for the training + +## During the training + +Before starting the training, make sure you: + + [ ] Make an agreement about taking or not taking photos + + [ ] Present the agenda + + [ ] Introduce yourself and ask people to introduce themselves + + [ ] "All questions are welcome" + +## After the training + + [ ] Collect participants feedback + + [ ] Leave an e-mail for further contact and support + + [ ] Make an evaluation about the training + + [ ] Report privately to Community Team +--- +color: primary +--- +html: two-columns-page.html +--- +key: 1 +--- +section: Training +--- +section_id: training +--- +subtitle: Based on our best practices, we have a training checklist to help you +--- +key: 4

1 0

[community/staging] Replace old Debian docs link to Support portal
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 950fc0ac71010946e2106a242b2ecb2ec3c1a21b Author: gus <gus(a)torproject.org> Date: Fri Sep 27 13:24:57 2019 -0400 Replace old Debian docs link to Support portal --- content/relay-operations/technical-setup/guard/debianubuntu/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/technical-setup/guard/debianubuntu/contents.lr b/content/relay-operations/technical-setup/guard/debianubuntu/contents.lr index 23b009a..851d399 100644 --- a/content/relay-operations/technical-setup/guard/debianubuntu/contents.lr +++ b/content/relay-operations/technical-setup/guard/debianubuntu/contents.lr @@ -12,7 +12,7 @@ One of the most imported things to keeps your relay secure is to install securit # 2. Configure Tor Package Repository -Enable the Torproject package repository by following the instructions **[here](https://2019.www.torproject.org/docs/debian.html.en#ubuntu)**. +Enable the Torproject package repository by following the instructions **[here](https://support.torproject.org/apt/tor-deb-repo/)**. # 3. Package Installation

1 0

[community/staging] Add digital security risks disclaimer and quick assessment
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit efc7eea85ff23dc737aa4d318e42fb009a5448b8 Author: gus <gus(a)torproject.org> Date: Wed Oct 2 21:26:03 2019 -0400 Add digital security risks disclaimer and quick assessment --- content/training/risks/contents.lr | 52 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) diff --git a/content/training/risks/contents.lr b/content/training/risks/contents.lr new file mode 100644 index 0000000..6da1774 --- /dev/null +++ b/content/training/risks/contents.lr @@ -0,0 +1,52 @@ +_model: page +--- +title: Risks +--- +body: + +To our knowledge, no Tor trainer has ever faced consequences as a result of training others or speaking about Tor. However, in some countries and in certain circumstances, it's possible that a simply gathering of human rights defenders could be very risky, illegal or even subject of imprisonment, physical assaults, large fines, threats, placement on government watch lists and targeting for surveillance. + +If you want to run a Tor training for the first time and you don't know how to assess the political and social environment, we strongly encourage you read this document and, in case of doubt, to reach out Tor Community Team privately. + +Some of potential risks of running a digital security training are only valid in specific contexts. Therefore the potential risks associated to running a Tor training depend on: + +1. **Your threat model.** A high-profile activist already under a lot of surveillance, for example, might attract more attention when reaching out other activists to run a digital security training. +2. **The laws and regulations in the country.** Best to consult with local lawyers and local freedom of expression organizations, and learn whether your country has a record in prosecuting individuals engaging in similar types of activities. +3. **The types of training.** Not all trainings carry the same weight in terms of potential risk. For example, talking about privacy on digital age might be appreciable, but teaching how to circumvent government censorship could be a serious felony. +4. **The audience.** Gathering university students might not attract attention, but in case of a group of journalists working on leaked documents about government corruption, you might need to be extra careful on how to reach out them in a private way. +5. **The training venue.** Running a Tor training in some spaces could expose your participants identity. Ideally, you should use a private space that you can control the participants entrance. Check before the training if participants are comfortable on revealing their identity to a third party, if it's the case. + +## Evaluating risks + +Some questions you may want to answer before running a digital security training include: + +* Has anyone in my country ever been criminalized based on their internet activity? (This does not necessarily need to be specific to digital security training or use of Tor) +* Are there laws in my country that require Internet Service Providers (ISPs) to track my online activity? +* Is it illegal for me to access certain websites? +* Does my country prohibit me from using: + * Cryptography? + * Anonymity software? + +Note, this is not an exhaustive list of questions. + +Additionally, while many countries do not have laws specifically prohibiting the activity of running digital security training, the use of digital security tools may still be criminalized in certain countries under other, broader laws. For example, using Tor Browser may be viewed as illegal or anti-government activity. + +Please note that we are not lawyers, and any information we give you does not constitute legal advice. Additionally, your communication with us is not protected by any legal privilege so law enforcement may subpoena and obtain any information you give us. However, we may be able to put you in touch with lawyers who are capable of addressing your questions and/or concerns. + +Some relevant resources include: + + * [EFF Know your rights](https://www.eff.org/issues/know-your-rights) + * [EFF Tor legal FAQ](https://community.torproject.org/relay/community-resources/eff-tor-leg… + * [OONI disclaimer](https://ooni.io/about/risks/) +--- +color: primary +--- +html: two-columns-page.html +--- +key: 6 +--- +section: training +--- +section_id: training +--- +subtitle: Things you should be aware before running a digital security training

1 0

[community/staging] Add links to training best practices
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 4c3d0456b0234c047e5154f09799a15a11bb9988 Author: gus <gus(a)torproject.org> Date: Wed Oct 2 11:03:39 2019 -0400 Add links to training best practices --- content/training/best-practices/contents.lr | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/content/training/best-practices/contents.lr b/content/training/best-practices/contents.lr index 1f9fced..19c7946 100644 --- a/content/training/best-practices/contents.lr +++ b/content/training/best-practices/contents.lr @@ -20,7 +20,7 @@ html: two-columns-page.html --- body: -Running security trainings is a fun and rewarding way to help your community conduct human rights work safely. +Running security training is a fun and rewarding way to help your community conduct human rights work safely. Good preparation is essential to an effective and safe training, so we've curated some resources to help you make the most of your training event. ## Before the training @@ -50,8 +50,9 @@ Once you've answered those questions, you're ready to plan your training! 6. Determine how you'll do hands-on assistance at your training. Will you be able to handle this alone? Or will you require partners? If you need more help, make sure the partners you're bringing in are aware of the safety needs of the community, and communicate with your contacts in the community to make sure they're okay with you bringing in additional trainers. 7. Make sure your presentation is up-to-date (both information and screenshots) and save your presentation in two file formats -- for example, odp and pdf -- and on at least one additional device -- for example, on your computer and on a USB stick. -8. Decide how you will facilitate a safer space. We recommend using the Tor Code of Conduct. - You can also start the training by asking participants to come up with their own community agreements for the space. +8. Decide how you will facilitate a safer space. We recommend using the [Tor Code of Conduct](/training/code-of-conduct/). + +You can also start the training by asking participants to come up with their own community agreements for the space. ## At the training @@ -60,10 +61,11 @@ Once you've answered those questions, you're ready to plan your training! 3. Communicate about when you'll take questions, either during the training, at the end, or both. 4. Communicate about how you'll offer hands-on help (if at all). 5. Communicate about how participants can contact you securely after the training. -6. Show the participants the resources at community.torproject.org and support.torproject.org. -7. Show the participants other resources like sec.eff.org. +6. Show the participants the resources at [community.torproject.org](https://community.torproject.org) and [support.torproject.org](https://support.torproject.org). +7. Show the participants other resources like [sec.eff.org](https://sec.eff.org). ## After the training 1. Think about how you will evaluate your success at the training. - You may want to create a follow up survey, or at least contact participants and ask them to share their feedback with you. + +You may want to create a follow up survey, or at least contact participants and ask them to share their feedback with you.

1 0

[community/staging] hello DragonFlyBSD!
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit dbfe843d265cb7df664104898fd3f24a0ccded34 Author: Vinicius Zavam <egypcio(a)googlemail.com> Date: Thu Oct 3 18:43:34 2019 +0000 hello DragonFlyBSD! - avoid pushing people to use DPorts, as we have `pkg` :) --- .../technical-setup/guard/dragonflybsd/contents.lr | 99 ++++++++++++++++++++++ 1 file changed, 99 insertions(+) diff --git a/content/relay-operations/technical-setup/guard/dragonflybsd/contents.lr b/content/relay-operations/technical-setup/guard/dragonflybsd/contents.lr new file mode 100644 index 0000000..8218178 --- /dev/null +++ b/content/relay-operations/technical-setup/guard/dragonflybsd/contents.lr @@ -0,0 +1,99 @@ +_model: page +--- +color: primary +--- +title: DragonflyBSD +--- +body: + +# 1. Bootstrap `pkg` + +DragonFlyBSD's daily snapshots and releases (starting with 3.4) come with `pkg` already installed. Upgrades from earlier releases, however, will not have it. + +If `pkg` is missing on the system for any reason, it can be quickly bootstrapped without having to build it from source or even having **DPorts** installed: + +``` +cd /usr +make pkg-bootstrap +rehash +pkg-static install -y pkg +rehash +``` + +### 1.1. Recommended Steps to Setup `pkg` + +Here, it will be similar to what we have on a **FreeBSD** system, and we are going to use HTTPS to fetch our packages, and updates - so here we also need an extra package to help us out (ca_root_nss). + +Installing the `ca_root_nss` package: + +``` +pkg install ca_root_nss +``` + +For fresh installations, the file `/usr/local/etc/pkg/repos/df-latest.conf.sample` is copied to `/usr/local/etc/pkg/repos/df-latest`. The files ending in the ".sample" extension are ignored; pkg(8) only reads files that end in ".conf" and it will read as many as it finds. + +DragonflyBSD has 2 packages repositories: + + - Avalon (mirror-master.dragonflybsd.org) + - Wolfpond (pkg.wolfpond.org) + +We can simply edit the **URL** used to point out the repositories on `/usr/local/etc/pkg/repos/df-latest` and that's it! Remember to use **pkg+https://** for Avalon. + +After applying all these changes, we update the packages list again and try to check if there's already a new update to apply: + +``` +pkg update -f +pkg upgrade -y -f +``` + +# 2. Install `tor` DragonflyBSD's Package + +Here we can choose to install the latest stable version, like: + +``` +pkg install tor +``` + + ... or install an alpha release: + + +``` +pkg install tor-devel +``` + +# 3. Configure `/usr/local/etc/tor/torrc` + +This is a very simple version of the `torrc` configuration file in order to run a Middle/Guard relay on the Tor network: + +``` +Nickname myBSDRelay # Change your relay's nickname to something you like +ContactInfo your@email # Please write your email address and be aware that it will be published +ORPort 443 # You might want to use/try a different port, should you want to +ExitRelay 0 +SocksPort 0 +Log notice syslog +``` + +# 4. Start `tor`: + +Here we set `tor` to start at boot time and use the setuid feature, in order to bind to lower ports like 443 (the daemon itself will still run as a regular non-privileged user). + +``` +echo "tor_setuid=YES" >> /etc/rc.conf +echo "tor_enable=YES" >> /etc/rc.conf +service tor start +``` + +# 5. Final Notes + +If you are having troubles setting up your relay, have a look at our [help section](/relay/getting-help/). If your relay is now running, check out the [post-install](/relay/setup/post-install/) notes. +--- +html: two-columns-page.html +--- +key: 2 +--- +section: Middle/Guard relay +--- +section_id: relay-operations +--- +subtitle: How to deploy a Middle/Guard relay on DragonflyBSD

1 0