- tor-commits - lists.torproject.org

[webwml/staging] remove utopic from supported .deb versions
by arma＠torproject.org 10 Mar '16

10 Mar '16

commit e63a653aaf526dd0d23ebc149654a4f47a3d33d6 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sat Feb 27 07:36:28 2016 +0100 remove utopic from supported .deb versions --- docs/en/debian.wml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/docs/en/debian.wml b/docs/en/debian.wml index e1e7bcc..87c4fd6 100644 --- a/docs/en/debian.wml +++ b/docs/en/debian.wml @@ -20,7 +20,6 @@ var software = { 'precise': [ 'precise'], 'saucy': [ 'saucy'], 'trusty': [ 'trusty'], - 'utopic': [ 'utopic'] }, 'experimental-0.2.7.x': { 'wheezy': [ 'wheezy' ], 'jessie': [ 'jessie' ], 'stretch': [ 'stretch' ], @@ -29,7 +28,6 @@ var software = { 'precise': [ 'precise'], 'saucy': [ 'saucy'], 'trusty': [ 'trusty'], - 'utopic': [ 'utopic'] }, }, 'tor (from source)': { '_stable': { 'squeeze': [ 'squeeze' ], 'wheezy': [ 'wheezy' ], @@ -40,7 +38,6 @@ var software = { 'precise': [ 'precise'], 'saucy': [ 'saucy'], 'trusty': [ 'trusty'], - 'utopic': [ 'utopic'] }, 'experimental-0.2.7.x': { 'wheezy': [ 'wheezy' ], 'jessie': [ 'jessie' ], 'stretch': [ 'stretch' ], @@ -49,7 +46,6 @@ var software = { 'precise': [ 'precise'], 'saucy': [ 'saucy'], 'trusty': [ 'trusty'], - 'utopic': [ 'utopic'] }, }, }; @@ -238,7 +234,6 @@ I run <option value="precise">Ubuntu Precise Pangolin</option> <option value="saucy">Ubuntu Saucy Salamander</option> <option value="trusty">Ubuntu Trusty Tahr</option> -<option value="utopic">Ubuntu Utopic Unicorn</option> </select> and want <select id="package" onchange="update()"></select>

1 0

[webwml/staging] Add 'Stem Descriptor Parsing in Go' project idea
by arma＠torproject.org 10 Mar '16

10 Mar '16

commit 1c76876fe8c5f71af7f1671426ebd612b74c0f29 Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Feb 27 19:32:29 2016 -0800 Add 'Stem Descriptor Parsing in Go' project idea Project idea I got from https://us.pycon.org/2016/schedule/presentation/85/ for me and phw to co-mentor. --- getinvolved/en/volunteer.wml | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index 15aa4b9..02b9746 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -605,6 +605,11 @@ meetings around the world.</li> Tor. + + Project Ideas: + <a href="#descriptor_parsing_in_go">Stem Descriptor Parsing in Go</a> + + <a id="project-txtorcon"></a> <h3><a href="https://txtorcon.readthedocs.org">Txtorcon</a> (<a href="https://github.com/meejah/txtorcon">code</a>, <a @@ -1301,6 +1306,43 @@ get ya started... </li> + <a id="descriptor_parsing_in_go"></a> + <li> + Stem Descriptor Parsing in Go + + Language: Go, Python + + Likely Mentors: Damian (atagar), Philipp (phw) + + + Tor consists of two parts: the application and a distributed network of a + few thousand volunteer relays. Information about these relays is public, + and made up of documents called <a href="https://stem.torproject.org/tutorials/mirror_mirror_on_the_wall.html#what-i…">descriptors</a>. We have + <a href="https://stem.torproject.org/tutorials/mirror_mirror_on_the_wall.html#are-th…">three libraries capable of reading these documents</a>... + + + <ul> + <li><a href="https://stem.torproject.org/">Stem</a> (Python)</li> + <li><a href="https://gitweb.torproject.org/metrics-lib.git/">Metrics-lib</a> (Java)</li> + <li><a href="https://gitweb.torproject.org/user/phw/zoossh.git/">Zoossh</a> (Go)</li> + </ul> + + + Stem is the most feature rich but slowest, and conversely Zoossh is fastest + but limited. But what if Stem used CFFI bindings to do the heavy lifting in + Go? Could we unify these libraries, getting the feature set of Stem with + the performance of Zoossh? + + + + Applicants should be familiar with both Python and Go. As part of your + application for this project please write a demo CFFI binding for Stem as a + proof of concept. Bonus points if you <a + href="https://stem.torproject.org/faq.html#how-do-i-get-started">get your + hands wet by contributing patches</a>! + + </li> + <a id="txtorcon_use_txaio"></a> <li> Convert txtorcon to use txaio

1 0

[webwml/staging] ... without breaking the script
by arma＠torproject.org 10 Mar '16

10 Mar '16

commit 7249d28fce4ce09e8871da740fb90529fde78b23 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sat Feb 27 07:37:53 2016 +0100 ... without breaking the script --- docs/en/debian.wml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/en/debian.wml b/docs/en/debian.wml index 87c4fd6..a5a97c1 100644 --- a/docs/en/debian.wml +++ b/docs/en/debian.wml @@ -19,7 +19,7 @@ var software = { 'lucid': [ 'lucid'], 'precise': [ 'precise'], 'saucy': [ 'saucy'], - 'trusty': [ 'trusty'], + 'trusty': [ 'trusty'], }, 'experimental-0.2.7.x': { 'wheezy': [ 'wheezy' ], 'jessie': [ 'jessie' ], 'stretch': [ 'stretch' ], @@ -27,7 +27,7 @@ var software = { 'lucid': [ 'lucid'], 'precise': [ 'precise'], 'saucy': [ 'saucy'], - 'trusty': [ 'trusty'], + 'trusty': [ 'trusty'], }, }, 'tor (from source)': { '_stable': { 'squeeze': [ 'squeeze' ], 'wheezy': [ 'wheezy' ], @@ -37,7 +37,7 @@ var software = { 'lucid': [ 'lucid'], 'precise': [ 'precise'], 'saucy': [ 'saucy'], - 'trusty': [ 'trusty'], + 'trusty': [ 'trusty'], }, 'experimental-0.2.7.x': { 'wheezy': [ 'wheezy' ], 'jessie': [ 'jessie' ], 'stretch': [ 'stretch' ], @@ -45,7 +45,7 @@ var software = { 'lucid': [ 'lucid'], 'precise': [ 'precise'], 'saucy': [ 'saucy'], - 'trusty': [ 'trusty'], + 'trusty': [ 'trusty'], }, }, };

1 0

[webwml/staging] Add txtorcon project ideas
by arma＠torproject.org 10 Mar '16

10 Mar '16

commit c3598457a3c1eea84b49a87c137568e5fc3928e2 Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Feb 27 10:14:33 2016 -0800 Add txtorcon project ideas Couple project ideas from meejah. --- getinvolved/en/volunteer.wml | 60 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index 7a11a73..15aa4b9 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -616,6 +616,12 @@ meetings around the world.</li> Used by OONI and APAF. + + Project Ideas: + <a href="#txtorcon_use_txaio">Convert txtorcon to use txaio</a> + <a href="#txtorcon_use_pytest">Convert txtorcon to py.test</a> + + <a id="project-tlsdate"></a> <h3>Tlsdate (<a href="https://github.com/ioerror/tlsdate">code</a>)</h3> @@ -1295,6 +1301,60 @@ get ya started... </li> + <a id="txtorcon_use_txaio"></a> + <li> + Convert txtorcon to use txaio + + Language: Python, asyncio, Twisted + + Likely Mentors: meejah + + + txtorcon is currently supports only Twisted users. Re-working txtorcon + to use the txaio library would allow users to choose between Twisted and + asyncio for the client code. + + + + This would involve fairly extensive refactoring to txtorcon, as it + currently makes heavy use of @inlineCallbacks which doesn't work with + txaio. A prospective student should be very familiar with event-based + programming in general, and be familiar with one of Twisted or asyncio. + See also: https://github.com/meejah/txtorcon/issues/135 + + </li> + + <a id="txtorcon_use_pytest"></a> + <li> + Convert txtorcon to py.test + + Language: Python, Twisted + + Likely Mentors: meejah + + + Currently txtorcon uses the built-in "unittest" module, as well as + Twisted's Deferred-respecting extensions on top. However, meejah has + found py.test's "fixture" approach to be much more powerful in other + situations. + + + + This project would be to port at least part of txtorcon's test-suite to + use py.test style tests and fixtures and evaluate: are the tests easier + to read? are there fewer lines of code? If so, the rest of the suite + should be ported and txtorcon switched over to use py.test exclusively. + + + + As some of txtorcon's tests aren't very well-written, this would take a + prospective student who is very strong in unit-testing knowledge. As + txtorcon is event-based, familiarity with that style of programming + (preferrably with Twisted) is ideal. + See also: https://github.com/meejah/txtorcon/issues/136 + + </li> + <a id="coniks_in_messenger"></a> <li> Implement and Integrate CONIKS for Tor Messenger

1 0

[webwml/staging] Drop projects/mentors we haven't heard from
by arma＠torproject.org 10 Mar '16

10 Mar '16

commit 3ddd63efa5296a221daa8a295280b37b2546e2bf Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Feb 29 09:07:37 2016 -0800 Drop projects/mentors we haven't heard from Dropping the folks we haven't heard from with regard to GSoC. For projects where they're the last names remaining dropping the project itself too. --- getinvolved/en/volunteer.wml | 307 +------------------------------------------ 1 file changed, 3 insertions(+), 304 deletions(-) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index aa53608..0b6d497 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -416,11 +416,7 @@ meetings around the world.</li> Project Ideas: - <a href="#torCleanup">Tor Codebase Cleanup</a> - <a href="#improveTorTestCoverage">Improve test coverage in Tor</a> - <a href="#useMoreCores">Have the Tor daemon use more cores</a> - <a href="#improveHiddenServices">Help improve Tor hidden services</a> - <a href="#improvedDnsSupport">Improved DNS support for Tor</a> + <a href="#improveHiddenServices">Help improve Tor hidden services</a> <a id="project-torbrowser"></a> @@ -558,12 +554,6 @@ meetings around the world.</li> block Tor. This has both a C and python implementation. - - Project Ideas: - <a href="https://trac.torproject.org/projects/tor/wiki/doc/PluggableTransports#Helpn…">Various coding tasks</a> - <a href="#betterPluggableTransports">Build Better Pluggable Transports</a> - - <a id="project-flash-proxy"></a> <h3><a href="https://crypto.stanford.edu/flashproxy/">Flash Proxy</a> (<a href="https://gitweb.torproject.org/flashproxy.git">code</a>, <a @@ -795,11 +785,6 @@ meetings around the world.</li> content. - - Project Ideas: - <a href="#ooniprobePcapsSupport">Add Support for Reporting Pcaps to OoniBackend and OoniProbe</a> - - <a id="project-torps"></a> <h3>TorPS</a> (<a href="https://github.com/torps/torps">code</a>)</h3> @@ -866,125 +851,13 @@ meetings around the world.</li> <ol> - <a id="torCleanup"></a> - <li> - Tor Codebase Cleanup - - Language: C - - Likely Mentors: David (dgoulet) - - - The Tor code is more than 10 years old in places, and we haven't always had - enough time or wisdom to write things as well as we could have. Our unit - test coverage is shamefully low, and the dependency graph of our modules is - shamefully convoluted . We could use refactoring and unit tests! Please - look through the Tor source code and look for ugly or tricky code or - dependencies -- the uglier and trickier the better -- and think about how - you could make the code look better, read better, and (subject to testing) - work better. - - - - If this is for a fun side-project, it would be great for you to work on - anything that can be made better and more tested. For an internship-level - position, we'd hope that you could find a number of particularly tricky or - knotty piece of the code to clean up, and aim for resolving the ugliest - problems, not necessarily the easiest. - - - - For a big project here, it would be great to pick one of the major - "submodules" of Tor -- path selection, node discovery, directory authority - operations, directory service -- and refactor its interface completely, to - minify and codify its points of contact with the rest of Tor. - - - - As part of your application for this project please identify one of the - thorniest Tor functions and submit a patch refactoring it to be better. If - you find this to be difficult then this likely isn't the project for - you. - - </li> - - <a id="betterPluggableTransports"></a> - <li> - Build Better Pluggable Transports - - Language: C, Python - - Likely Mentors: Ximin (infinity0) - - - For Tor users in censored countries, we have a <a - href="<page docs/pluggable-transports>"> - pluggable transports</a> framework that uses external programs to bypass - censorship in different ways. Each of these have their own strengths and - weaknesses. - - - - We have deployed <a - href="<page projects/obfsproxy>">obfsproxy</a>, - <a href="http://crypto.stanford.edu/flashproxy/">flashproxy</a>, - <a href="http://www.cs.kau.se/philwint/scramblesuit/">scramblesuit</a>, - <a href="https://trac.torproject.org/projects/tor/wiki/doc/meek">meek</a>, - and <a href="https://fteproxy.org/about">FTE</a> bridges into the main - Tor Browser.</a> - - - - There are several possible directions for this project. Ideas include: - <ol> - <li>Address gaps or weaknesses in our existing pluggable transports - <ul> - <li>Flashproxy: Add WebRTC support to traverse NATs.</li> - <li>Flashproxy: Improve the facilitator's resistance against DoS - and poisoning attacks.</li> - </ul> - </li> - <li>Finish and release our pluggable transport combiner, that chains - several transports together to take advantage of orthogonal types of - blocking resistance.</li> - <li>Improve the UX for selecting the appropriate pluggable transport in - the new Tor Browser, whilst maintaining user security.</li> - <li>Implement a new pluggable transport that resists blocking in a - novel way. - <ul> - <li>Impersonate a voice-over-IP protocol</li> - <li>Impersonate HTTP <a - href="http://www.cs.utexas.edu/~amir/papers/parrot.pdf">sufficiently - well</a> that traffic will go through a HTTP-only proxy</li> - <li>Implement <a - href="http://cacr.uwaterloo.ca/techreports/2011/cacr2011-21.pdf">scanning - resistance</a></li> - </ul> - </li> - </ol> - - - - Applicants should be familiar with asynchronous/reactive programming, in - particular the <a href="https://twistedmatrix.com/">Twisted framework</a> - or something related. Most of the existing code is written in Python, with - some parts in JavaScript and Go, so you should know at least one of these. - You are invited to talk to us and ask questions, via our mailing lists - or IRC. As part of your application, please contribute a patch that - implements a small feature or fixes a bug related to this area, e.g. <a - href="https://trac.torproject.org/projects/tor/query?status=!closed&component=Plu…">1</a>, - <a href="https://trac.torproject.org/projects/tor/query?status=!closed&component=Obf…">2</a>, - <a href="https://trac.torproject.org/projects/tor/query?status=!closed&component=Fla…">3</a>. - - - <a id="makeTorbirdyBetter"></a> <li> Make TorBirdy Better Language: JavaScript, C++ - Likely Mentors: Sukhbir Singh (sukhe), Jacob Appelbaum (ioerror) + Likely Mentors: Sukhbir Singh (sukhe) TorBirdy is an extension that configures Thunderbird to make connections over @@ -1021,152 +894,13 @@ You may contact the mentors on IRC for more information. (sukhe on #tor-dev, #to </li> - <a id="ooniprobePcapsSupport"></a> - <li> - Add Support for Reporting Pcaps to OoniBackend and OoniProbe - - Language: Python - - Likely Mentors: Arturo (hellais) - - -The feature should also add support for including only packet capture data that -is relevant to the test being run. This means that the pcap should not contain -all the data sniffed on the users machine, but only that which was generated -and intended to be received by ooniprobe. - - - -This can probably be implemented by setting up a tun/tap device and routing all -the ooniprobe traffic through it and only capturing data sent and received from -that device. The task for the student will also be that of doing research into -what are possible strategies for doing this. <a -href="https://trac.torproject.org/projects/tor/ticket/7416">For more -information see ticket 7416.</a> - - </li> - - <a id="improveTorTestCoverage"></a> - <li> - Improve test coverage in Tor - - Language: C, Python - - Likely Mentors: David (dgoulet) - - -Right now, our unit test coverage with the tests we ship is around 30% --- only 30% of the executable lines in our source are reached by the -unit tests. Improving this test coverage could make Tor development -much more reliable. - - - -So we need better unit tests, and we need better integration tests too. - - - -Improving unit tests would involve refactoring functions to be more -testable, and writing a bunch of unit tests. - - - -Improving integration tests would involve refactoring and improving -the "chutney" program that launches a test tor network, and writing a -bunch of tests to see what works and what doesn't work on such a -network. It could also involve writing tests using the library "<a -href="https://stem.torproject.org/">stem</a>" to script individual clients on a -Chutney network. - - - -To get a feel for how testing works in Tor today, download Tor and -Chutney, and make sure you can build Tor and use Chutney. See how the -unit tests work by skimming some of the test code in the src/test -subdirectory. Try computing test coverage (according to the -instructions in the doc/HACKING file. - - - -Also, have a look at the one current integration test that works on -chutney today: it is a shell script distributed with Tor as -src/test/test-tor-network.sh . We probably don't want to have all of -our integration tests be written as shell scripts, but it's interesting -to see how one works. - - - -If working on designs for an improved or refactored Chutney, watch out for <a -href="http://www.joelonsoftware.com/articles/fog0000000018.html">"archicture -astronautics"</a>: while it's important that we have a well-designed and -maintainable Chutney architecture, it wouldn't be very useful if a good -architecture were the only outcome here: we need tests too. - - - -As part of the application process, please contribute a patch that makes -a non-trivial improvement to chutney, and/or include a new test for some -interesting Tor function. (Please pick a function that isn't completely -easy to test.) - - </li> - - <a id="useMoreCores"></a> - <li> - Have the Tor daemon use more cores - - Language: C - - Likely Mentors: David (dgoulet) - - -Right now, if you run a busy Tor server on a multicore computer, most of -the cores are mostly unused. We have a "cpuworker" mechanism to move -expensive computations into worker threads, but that mechanism is -currently only used for a small fraction of our cryptography. Moving -more work into the worker threads could improve performance immensely. - - - -So it would be great to parallelize our cryptography more in order to -better handle more cores. See -<a href="https://trac.torproject.org/projects/tor/wiki/org/projects/Tor/Multithreade…">MultithreadedCrypto</a> -for some background info, and -<a href="https://trac.torproject.org/projects/tor/ticket/7572">ticket 7572</a> for some subtickets -on our tracker. - - - -(If you're reading through the code to see how it works today, you will -also want to have a look at the new implementation for cpuworkers -described in <a href="https://trac.torproject.org/projects/tor/ticket/9682">9682</a>.) - - - -Completing the implementation of ticket #7572 --which would move our -circuit crypto onto separate threads-- could be a good summer project. -Alternatively, moving all of the signature generation and verification -code onto the cpuworkers could be fun. In either case, you will have -some important architectural decisions to make about how to minimize -shared data between the main thread and the workers, how to avoid -race conditions between them, and how to test it all to make sure it has -no hidden failure cases. - - - -As part of the application process for this project, please contribute a -nontrivial patch to Tor -- ideally, one that will affect some part of -the codebase that you want to work on. - - </li> - <a id="improveHiddenServices"></a> <li> Help improve Tor hidden services Language: C - Likely Mentors: David (dgoulet), George (asn) + Likely Mentors: George (asn) We're working on a revamp of the entire Tor hidden service design to @@ -1196,41 +930,6 @@ the codebase that you want to work on. </li> - <a id="improvedDnsSupport"></a> - <li> - Improved DNS support for Tor - - Language: C - - Likely Mentors: David (dgoulet) - - -Right now, you can only use Tor's DNS support to look up IPv4 and IPv6 -addresses, and to fetch PTR records. But DNS can do so much more! - - - -<a -href="https://gitweb.torproject.org/torspec.git/tree/proposals/219-expanded-dns.t…">Proposal -219</a> describes some new cell types that Tor could use to support -more types of DNS over Tor. - - - -To see how Tor implements its existing DNS lookups, start by tracing the -the connection_exit_begin_resolve() function in src/or/connection_edge.c , -and see how we pass these requests downwards through src/or/dns.c to the -underlying resolver. It's not too complicated, but there are some -tricky parts to understand. - - - -As part of the application process for this project, please contribute a -nontrivial patch to Tor -- ideally, one that will affect some part of -the codebase that you want to work on. - - </li> - <a id="exitmap_improvements"></a> <li> Exitmap Improvements

1 0

[webwml/staging] Add 'Make Stegotorus deployment ready' project idea
by arma＠torproject.org 10 Mar '16

10 Mar '16

commit fb8533f7efb33698413519fa391f400265ba994d Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Feb 29 09:00:35 2016 -0800 Add 'Make Stegotorus deployment ready' project idea --- getinvolved/en/volunteer.wml | 138 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 138 insertions(+) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index 6c73977..aa53608 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -1527,6 +1527,144 @@ implementation. </li> + <a id="stegotorus"></a> + <li> + Make Stegotorus deployment ready + + Language: C++ + + Likely Mentors: vmon + + + <a + href="https://github.com/TheTorProject/stegotorus/tree/master/src">Stegotorus</a> + is a PT framework which streamline the development stealthier pluggable + transport. An HTTP pluggable transport is already implemented in Stegotorus + framework and can be used when encrypted payloads are throttled and only + ephemeral connections are tolerated. + + + + The majority of work on Stegotorus is done and it can be deployed with a relatively minor improvements including: + + + <ul> + <li>#8098 A config file file for Stegotorus + + Stegotorus needs many configuration settings specially on the bridge + side. This include also the configuration required by each steg module. + Currently the configuration is fed to Stegotorus as command line + arguments but a file like torrc is needed so all tweaking can be read + from there. + + + + Current Status and work needed to be done: The code for reading the + config file is written by SRI but it is not yet used in the Stegotorus + to read the config. + + </li> + + <li>#8101 Debugging the transparent proxy + + Stegotorus http module uses other websites payload to hide and serve + censored traffic. As such it needs to decide if the request is + genuinely to the auxiliary website, in that case becomes a transparent + proxy and serves the website content as requested, or if the request is + actually a request to serve censored material which should be delivered + to steg modules. + + + + Current Status: This is completely implemented. However, the transparent proxy sometimes crashes and need to be triaged, debugged and fixed. + + </li> + + <li>#11337 refactoring the steg module code + + The http steg module code, although not essentials to the core of the + Stegotorus. needs some improvement and clean up. The solution is to + refactor the steg modules as children of FileStegMod. + + + + Current status and work needed to be done: This has already been done + but still needs testing and refactoring before it can be reliably merge + to the master branch. + + </li> + + <li>#8089 Adding Elligator to Stegotorus handshake and test + + The current Stegotorus handshake is distinguishable from random byte + string, which can be used to flag and detect Stegotorus traffic + deterministically and need to be implemented similar to + ScrambleSuite. Also because the capacity of client to server channel + might be slim depending on the choice of steg module it is desirable + to be implemented using Elliptic curve crypto. Hence, Elligator + protocol is ideal solution for this situation. All we need is to replace Stegotorus handshake by Elligator. + + + + Current Status and work needed to be done: Elligator handshake code is + included in stegotorus code base, it is only needed to be called by + instead of the current handshake and be tested. + + </li> + + <li>Make Stegotorus memory safe by using shared pointers + + Stegotorus has large code base and it is not written in a memory safe + languages. To facilitate its audit, we need to replace (almost all) use + of pointers to shared pointers. + + + + Current Status: No progress has not been done. + + </li> + + <li>Security Audit and writing more unit test + + To be able to deploy Stegotorus for real world use we need to audit the + code and write more unit test covering new aspects of the Stegotorus + (new http transport, proxy server, Elligator handshake) + + + + Current Status: No progress has been done. + + </li> + + <li>SRI branch merging + + Stegotorus has been forked from the initial development from SRI. Now + that SRI is hosting Stegotorus publicly it is desirable to merge the + two branches so we can benefit from both developments. + + + + Current Status: No progress has been done. + + </li> + + <li>#8099 deterministic build + + To make deterministic build possible we need to build many of + Stegotorus dependency from scratch. Boost library is a a huge + dependency for Stegotorus to access the file system. As we are only + planning to deploy Stegotorus bridges on Linux machines we can simplify + such access without that dependency. By dropping such dependency, it + should be straight forward to have deterministic build for Stegotorus. + + + + Current Status: No progress has been done. + + </li> + </ul> + </li> + <!-- <a id=""></a> <li>

1 0

[webwml/staging] Add 'Panopticlick' project idea
by arma＠torproject.org 10 Mar '16

10 Mar '16

commit ec691dded4cff4c4c8bc5996821bfdab94b16976 Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Feb 27 23:27:16 2016 -0800 Add 'Panopticlick' project idea https://trac.torproject.org/projects/tor/ticket/18328 --- getinvolved/en/volunteer.wml | 60 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index 02b9746..6c73977 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -437,6 +437,11 @@ meetings around the world.</li> privacy and security issues in mainline version. + + Project Ideas: + <a href="#panopticlick">Panopticlick</a> + + <a id="project-httpseverywhere"></a> <h3><a href="https://www.eff.org/https-everywhere">HTTPS Everywhere</a> (<a href="https://gitweb.torproject.org/https-everywhere.git">code</a>, <a @@ -1467,6 +1472,61 @@ href="https://github.com/arlolra/ctypes-otr/issues">one of the open key verification issues</a> as part of the application process. </li> + + <a id="panopticlick"></a> + <li> + Panopticlick + + Likely Mentors: Georg (GeKo) + + +The <a href="https://panopticlick.eff.org">Panopticlick project by the EFF</a> +revolutionized how people think about <a +href="https://panopticlick.eff.org/browser-uniqueness.pdf">browser +fingerprinting</a>, both by developing tests and metrics to measure browser +fingerprintability, and by crowdsourcing the evaluation and contribution of +individual browser features to overall fingerprintability. + + + + +Unfortunately, the way Panopticlick is designed <a +href="https://blog.torproject.org/blog/effs-panopticlick-and-torbutton">makes +it difficult</a> to evaluate defenses to browser fingerprinting, especially +for browsers with a relatively small userbase such as Tor Browser. This is +because any approach we take to reduce fingerprinting automatically makes our +users more distinct from the previous users who submitted their fingerprint +data to the EFF. Indeed, it is also impossible to ever expect that users of +one browser will ever be able to blend in with users of another browser +(Chrome users will always be distinguishable from Firefox users for example, +based on feature set alone). + + + + +To address this, we would like to have <a +href="https://trac.torproject.org/projects/tor/ticket/6119">our own +fingerprint test suite</a> to evaluate the fingerprintability of each browser +feature for users running a specific Tor Browser version. There are also <a +href="https://trac.torproject.org/projects/tor/query?keywords=~tbb-fingerprinting">additional +fingerprinting tests</a> we can add beyond those deployed by Panopticlick. + + + +For this project, the student would develop a website that users can +voluntarily visit to test and record their Tor Browser fingerprint. The user +should get feedback on how she performed and the test results should be +available in a machine readable format (e.g. JSON), broken down by Tor Browser +version. In a second step one could think about adding more sophisticated +tests or supporting other browser vendors that might want to test the +uniformity amongst their userbase as well. Of course, results from each +browser would also need to be broken down by both browser implementation and +version, so that results would only reflect the population of that specific +implementation. + + + </li> + <!-- <a id=""></a> <li>

1 0

[webwml/staging] List GetTor and Github mirror on Tor download pages
by arma＠torproject.org 10 Mar '16

10 Mar '16

commit 896f0bac59b676d2bb317d83c3b0e0aff6b6dd4f Author: Donncha O'Cearbhaill <donncha(a)donncha.is> Date: Wed Mar 2 13:21:09 2016 +0100 List GetTor and Github mirror on Tor download pages --- download/en/download-easy.wml | 6 +++++- projects/en/torbrowser.wml | 7 +++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/download/en/download-easy.wml b/download/en/download-easy.wml index 5885a70..c2bee90 100644 --- a/download/en/download-easy.wml +++ b/download/en/download-easy.wml @@ -299,7 +299,11 @@ use Tor, too! Be smart and learn more. Understand what Tor does and does not offer. This list of pitfalls isn't complete, and we need your help <a href="<page getinvolved/volunteer>#Documentation">identifying and documenting all -the issues</a>. +the issues</a>. +<h2><a class="anchor" href="#mirror">What else can I get Tor?</a></h2> +In some countries the Tor Project website is blocked or censored and it is not possible to download + Tor directly. The Tor Project also hosts a mirror of <a href="https://github.com/TheTorProject/gettorbrowser">Tor Browser Bundle on Github</a>. +The <a href="https://www.torproject.org/projects/gettor">GetTor</a> service can also be used to download Tor Browser when the Project website and mirrors are blocked. </div>  diff --git a/projects/en/torbrowser.wml b/projects/en/torbrowser.wml index 3e0f757..a5b45c5 100644 --- a/projects/en/torbrowser.wml +++ b/projects/en/torbrowser.wml @@ -680,10 +680,13 @@ href="https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Hacking">Tor Browser Hacking</a> intro document useful for learning about the build system and our development processes. - + What else can I get Tor Browser? + In some countries the Tor Project website is blocked or censored and it is not possible to download + Tor directly. The Tor Project also hosts a mirror of <a href="https://github.com/TheTorProject/gettorbrowser">Tor Browser Bundle on Github</a>. + The <a href="https://www.torproject.org/projects/gettor">GetTor</a> service can also be used to download Tor Browser when the Project website and mirrors are blocked. </div> </div> - </div> + </div> </div>  </div>

1 0

[webwml/staging] Display Orbot on Tor download page
by arma＠torproject.org 10 Mar '16

10 Mar '16

commit e72ad6bf1b0537acfea83c8c2d67b0f92725e581 Author: Donncha O'Cearbhaill <donncha(a)donncha.is> Date: Tue Mar 1 18:04:44 2016 +0100 Display Orbot on Tor download page This commit adds a box on the download-easy.html.en webpage which includes links to install Orbot. The jquery.client.min.js script is from 2009 and does not detect Android. I've added JS Android detection. --- download/en/download-easy.wml | 14 ++++++++++++++ js/dlpage01.js | 6 +++++- js/jquery.client.min.js | 2 +- 3 files changed, 20 insertions(+), 2 deletions(-) diff --git a/download/en/download-easy.wml b/download/en/download-easy.wml index 5885a70..91f98b0 100644 --- a/download/en/download-easy.wml +++ b/download/en/download-easy.wml @@ -137,6 +137,19 @@ Not Using GNU/Linux? Download for <a href="#mac">Mac</a> or <a href="#windows">Windows</a> </div> </div> + + <div id="android" class="easy android"> + <div class="package" style="padding-top: 13px; border-top: 0px;"> + <div class="desc"> + <h2>Orbot - Tor for Android</h2> + Our software is available for Android-based phones, tablets, and computers from the <a href="https://guardianproject.info/">Guardian Project</a> in their <a href= "https://guardianproject.info/2012/03/15/our-new-f-droid-app-repository/">F-Droid Repository</a> or the <a href="https://play.google.com/store/apps/details?id=org.torproject.android">Google Play Store</a>. + <a href="https://www.torproject.org/docs/android.html.en">Learn more »</a> + </div> + <form class="downloads"> + <a class="button lin-orbot" href="https://guardianproject.info/apps/orbot/?src=tbb_download">DownloadOrbot</a> + </form> + </div> + </div> Looking For Something Else? <a href="<page download/download>">View All Downloads</a>  </div>  @@ -313,6 +326,7 @@ the issues</a>. <li class="dropdown"><a href="#windows">Microsoft Windows</a></li> <li class="dropdown"><a href="#mac">Apple OS X</a></li> <li class="dropdown"><a href="#linux">Linux/Unix</a></li> +<li class="dropdown"><a href="#android">Android</a></li> <li class="dropdown"><a href="<page download/download>">All Downloads</a></li> </ul> </div> diff --git a/js/dlpage01.js b/js/dlpage01.js index a4bc89f..2adc2bd 100644 --- a/js/dlpage01.js +++ b/js/dlpage01.js @@ -17,6 +17,8 @@ function OScheck() { $('.easy.windows').css('display', 'block'); }else if(clientos == "Mac"){ $('.easy.mac').css('display', 'block'); + }else if(clientos == "Android"){ + $('.easy.android').css('display', 'block'); }else{ $('.easy').css('display', 'block'); } @@ -63,7 +65,7 @@ $(document).ready(function () { var url = $.param.fragment(); // Toggle the '.easy' divs to off - if(url == 'windows'|url == 'mac'|url == 'linux'){ + if(url == 'windows'|url == 'mac'|url == 'linux'|url == 'android'){ $('.easy').css('display', 'none'); } @@ -74,6 +76,8 @@ $(document).ready(function () { $('.easy.mac').css('display', 'block'); } else if(url == 'linux'){ $('.easy.linux').css('display', 'block'); + } else if(url == 'android'){ + $('.easy.android').css('display', 'block'); } else { $('.easy').css('display', 'none'); $(function(){OScheck();}); diff --git a/js/jquery.client.min.js b/js/jquery.client.min.js index 44ea629..c24627d 100644 --- a/js/jquery.client.min.js +++ b/js/jquery.client.min.js @@ -1,4 +1,4 @@ (function(){var BrowserDetect={init:function(){this.browser=this.searchString(this.dataBrowser)||"An unknown browser";this.version=this.searchVersion(navigator.userAgent)||this.searchVersion(navigator.appVersion)||"an unknown version";this.OS=this.searchString(this.dataOS)||"an unknown OS";},searchString:function(data){for(var i=0;i<data.length;i++){var dataString=data[i].string;var dataProp=data[i].prop;this.versionSearchString=data[i].versionSearch||data[i].identity;if(dataString){if(dataString.indexOf(data[i].subString)!=-1) return data[i].identity;} else if(dataProp) -return data[i].identity;}},searchVersion:function(dataString){var index=dataString.indexOf(this.versionSearchString);if(index==-1)return;return parseFloat(dataString.substring(index+this.versionSearchString.length+1));},dataBrowser:[{string:navigator.userAgent,subString:"Chrome",identity:"Chrome"},{string:navigator.userAgent,subString:"OmniWeb",versionSearch:"OmniWeb/",identity:"OmniWeb"},{string:navigator.vendor,subString:"Apple",identity:"Safari",versionSearch:"Version"},{prop:window.opera,identity:"Opera"},{string:navigator.vendor,subString:"iCab",identity:"iCab"},{string:navigator.vendor,subString:"KDE",identity:"Konqueror"},{string:navigator.userAgent,subString:"Firefox",identity:"Firefox"},{string:navigator.vendor,subString:"Camino",identity:"Camino"},{string:navigator.userAgent,subString:"Netscape",identity:"Netscape"},{string:navigator.userAgent,subString:"MSIE",identity:"Explorer",versionSearch:"MSIE"},{string:navigator.userAgent,subString:"Gecko",identity:"Mozilla",version Search:"rv"},{string:navigator.userAgent,subString:"Mozilla",identity:"Netscape",versionSearch:"Mozilla"}],dataOS:[{string:navigator.platform,subString:"Win",identity:"Windows"},{string:navigator.platform,subString:"Mac",identity:"Mac"},{string:navigator.userAgent,subString:"iPhone",identity:"iPhone/iPod"},{string:navigator.platform,subString:"Linux",identity:"Linux"}]};BrowserDetect.init();window.$.client={os:BrowserDetect.OS,browser:BrowserDetect.browser};})(); \ No newline at end of file +return data[i].identity;}},searchVersion:function(dataString){var index=dataString.indexOf(this.versionSearchString);if(index==-1)return;return parseFloat(dataString.substring(index+this.versionSearchString.length+1));},dataBrowser:[{string:navigator.userAgent,subString:"Chrome",identity:"Chrome"},{string:navigator.userAgent,subString:"OmniWeb",versionSearch:"OmniWeb/",identity:"OmniWeb"},{string:navigator.vendor,subString:"Apple",identity:"Safari",versionSearch:"Version"},{prop:window.opera,identity:"Opera"},{string:navigator.vendor,subString:"iCab",identity:"iCab"},{string:navigator.vendor,subString:"KDE",identity:"Konqueror"},{string:navigator.userAgent,subString:"Firefox",identity:"Firefox"},{string:navigator.vendor,subString:"Camino",identity:"Camino"},{string:navigator.userAgent,subString:"Netscape",identity:"Netscape"},{string:navigator.userAgent,subString:"MSIE",identity:"Explorer",versionSearch:"MSIE"},{string:navigator.userAgent,subString:"Gecko",identity:"Mozilla",version Search:"rv"},{string:navigator.userAgent,subString:"Mozilla",identity:"Netscape",versionSearch:"Mozilla"}],dataOS:[{string:navigator.platform,subString:"Win",identity:"Windows"},{string:navigator.platform,subString:"Mac",identity:"Mac"},{string:navigator.userAgent,subString:"iPhone",identity:"iPhone/iPod"},{string:navigator.platform,subString:"Linux",identity:"Linux"},{string:navigator.userAgent,subString:"Android",identity:"Android"}]};BrowserDetect.init();window.$.client={os:BrowserDetect.OS,browser:BrowserDetect.browser};})();

1 0

[webwml/staging] Tweak wording for gettor/github addition
by arma＠torproject.org 10 Mar '16

10 Mar '16

commit c2e5f13a51be658f555ac845c539e4b7986824af Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Wed Mar 2 14:23:28 2016 +0100 Tweak wording for gettor/github addition --- download/en/download-easy.wml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/download/en/download-easy.wml b/download/en/download-easy.wml index c2bee90..58a6ba8 100644 --- a/download/en/download-easy.wml +++ b/download/en/download-easy.wml @@ -300,10 +300,15 @@ use Tor, too! This list of pitfalls isn't complete, and we need your help <a href="<page getinvolved/volunteer>#Documentation">identifying and documenting all the issues</a>. -<h2><a class="anchor" href="#mirror">What else can I get Tor?</a></h2> -In some countries the Tor Project website is blocked or censored and it is not possible to download - Tor directly. The Tor Project also hosts a mirror of <a href="https://github.com/TheTorProject/gettorbrowser">Tor Browser Bundle on Github</a>. -The <a href="https://www.torproject.org/projects/gettor">GetTor</a> service can also be used to download Tor Browser when the Project website and mirrors are blocked. +<h2><a class="anchor" href="#mirror">Where else can I get Tor?</a></h2> +In some countries the Tor Project website is blocked or censored and +it is not possible to download Tor directly. The Tor Project hosts a +Tor Browser <a +href="https://github.com/TheTorProject/gettorbrowser">mirror on Github</a>. +Using the <a +href="https://www.torproject.org/projects/gettor">GetTor</a> service is +another way to download Tor Browser when the Project website and mirrors +are blocked. </div>

1 0