May 2014 - tor-dev - lists.torproject.org

GSoC: Stegotorus Security enhancement
by Noah Rahman 05 May '14

05 May '14

Hi all, I'm an entering PhD student in the department of physics at Tulane University. In the past I studied chemistry at Caltech, went for a master's at UCSB, and worked in the software industry at various positions, including a stint as a contractor in Intel's Verification and Test division. This summer I will be working on refactoring Stegotorus more along DRY lines as well as enhancing and updating various handshaking protocols, and getting it ready to merge in upstream changes from its originators at SRI. My mentors this summer will be vmon and as support, Zack Weinberg (zackw) I am available on github (https://github.com/BaronWolfenstein) and via gmail (selimthegrim(a)gmail.com) Happy hacking everyone! I look forward to a long and productive summer. Best Noah Rahman

1 0

GSoC: Implement consensus diffs
by Daniel Martí 05 May '14

05 May '14

Hello everyone, My name is Daniel and this summer I'll be working on consensus diffs [0], heavily based on proposal 140 [1]. This should allow for quicker and scalable consensus udpates, which will have more weight as the consensus grows larger. I've never gotten involved in Tor before, so I'm really looking forward to this summer. My intention is to use a simplified ed format as described on proposal 140, but I am open to alternatives and suggestions. As far as the diff creation algorithm, I plan on using a dynamic programming algorithm for the Longest Common Substring problem. Like before, comments are very welcome. I will spend the following couple of weeks looking at alternative diff formats and algorithms, rather than start coding this early. It would be appreciated if any ideas regarding any of the two aspects were posed during this time, so that afterward I can start their implementation. I will always be lurking on #tor-dev, #tor-project and #tor under the nick 'mvdan'. I am also subscribed to the tor-dev and tor-talk mailing lists. And lastly, my PGP fingerprint is below - encrypted mail is welcome :) Regards. [0] https://www.torproject.org/getinvolved/volunteer.html.en#consensusDiffs [1] https://gitweb.torproject.org/torspec.git/blob_plain/refs/heads/master:/pro… -- Daniel Martí - mvdan(a)mvdan.cc - http://mvdan.cc/ PGP: A9DA 13CD F7A1 4ACD D3DE E530 F4CA FFDB 4348 041C

3 3

GSoC Project tor daemon mutlicore implentation
by Белоус Михаил 04 May '14

04 May '14

Hello, every body I'm a student completing my Specialist's degree in Programming Enginer at Saint-Petersburg State University and Computer Science in Computer Science Center. This summer I'm going to be working with Tor for Google Summer of Code 2014. In my project I want to implement mutlicored version of tor daemon. My mail goals is: Create tests and benchmarks for tor daemon. Implement threadpool using pthreads Using threadpool make tor faster I'll be on IRC as towelenee, in github as towelenee, and you want to contact me please write at belous.mikhail at gmail.com.

1 0

Whonix's help_check_tor_bootstrap.py
by Damian Johnson 03 May '14

03 May '14

Hi adrelanos, I just noticed that Whonix uses Stem. That's great! Just a few quick thoughts... https://github.com/Whonix/Whonix/blob/master/whonix_shared/usr/lib/whonixch… > with Controller.from_port(port = p) as controller: > > if os.path.exists("/usr/share/whonix/whonix_gateway"): > controller.authenticate("password") You always need to authenticate the controller. Tor will balk if you omit the authenticate() call, even if it isn't using authentication... >>> from stem.control import Controller >>> c = Controller.from_port() >>> c.get_info('version') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "stem/control.py", line 960, in get_info raise exc stem.ProtocolError: GETINFO response didn't have an OK status: Authentication required. You should probably change this to... with Controller.from_port(port = p) as controller: controller.authenticate() There also isn't a reason to pass in 'password' unless you're actually using that as your controller password. ;) > b = bootstrap_status.split( ) > progress = b[2] > progress_percent = ( progress.split( "=" ) )[1] > exit_code=int(progress_percent) Operating by the positional argument is fine, but a little risky since Tor is perfectly allowed to rearrange those. I'd suggest the following instead... match = re.match('.* PROGRESS=([0-9]+).*', line) if match: exit_code = int(match.group(1)) Cheers! -Damian

2 3

Trac accounts and potential account compromise
by Erinn Clark 02 May '14

02 May '14

Dear Tor Trac users, We learned on recently that there was a bug in our Trac setup that allowed anyone to register a new user account for an existing user name, overwriting the existing user's password and thereby taking over the account [0]. A workaround was quickly implemented by weasel to prevent new user registration while we investigated how to re-enable it without encountering this problem again. Soon after, our configuration was fixed to allow new registrations without overwriting existing usernames. However, it's still possible that somebody has taken over your account in the past and you didn't notice because you didn't log in recently. We recommend users try to login and if you find you are unable to do so, you can reset your password here: https://trac.torproject.org/projects/tor/reset_password We apologize for any inconvenience this may have caused you! Please feel free to contact me with any questions. Erinn & the rest of the Tor Trac team

1 1

GSoC Project: A Lightweight Censorship Analyzer for Tor
by Jacob H. Haven 01 May '14

01 May '14

Hi Everyone, I'm a student completing my Bachelor's degree in Computer Science at Stanford. This summer I'm going to be working with Tor for Google Summer of Code 2014. I'll be packaging a tool to allow non-technical users to monitor censorship of Tor occurring in their country/network My project based on Phillip Winter's paper "Towards a Censorship Analyser for Tor" <http://www.cs.kau.se/philwint/pdf/foci2013.pdf> [1], and design requirements described in [2]. My main goals being to: - Implement a number of tests using OONI [3] Including reachability to directory authorities, the torproject.org, bridges.torproject.org and relays - Bundle tests into small binary that is easy to distribute and run - With user's consent, transmit (anonymized) data back to Tor Project - Leave no trace of use on user machine after tool removal. Obfuscate network traffic to attempt to hide analysis. - Produce user-friendly output so non-technical users gain better understanding of why Tor connections failing and perhaps possible remedies I'll be on IRC as jhaven, as QuicksilverJohny on GitHub<https://github.com/QuicksilverJohny>, and available via email at jacob(a)jhaven.me. Thanks to Philipp (phw) and Art (hellais) for helping me as mentors over the summer! [1] http://www.cs.kau.se/philwint/pdf/foci2013.pdf [2] https://research.torproject.org/techreports/censorship-analysis-tool-2013-0… [3] https://ooni.torproject.org/ ————————— Jacob H. Haven – http://jhaven.me <http://jhaven.me/> jacob(a)jhaven.me jhaven(a)cs.stanford.edu +1-(949)-415-6469

1 0

Rewrite Tor Weather Project
by Jonathan Baker 01 May '14

01 May '14

I'm very interested in contributing to the Rewrite Tor Weather project and would like to know what my next steps should be. While not a student, I think this would be a great way for me to contribute to a project that I believe plays an essential role in society. On a more technical note, I do develop with Python/Django on a daily basis (in addition to a handful of other www-based technologies). Thanks for your time, Jonathan D. Baker

4 4

Revising Proposal 140
by Daniel Martí 01 May '14

01 May '14

Hello everyone, Last week I introduced myself [0] on this list, shortly after being accepted into GSoC to work on Consensus Diffs. My GSoC proposal is heavily based on the Tor proposal #140 [1], which is close to being six years old now. This is why, after some discussion with Nick, Sebastian and Weasel (the original author of the proposal), it became obvious that it needs some revising. Here are the improvements we discussed on IRC: * Microdescriptors didn't exist back then, so the proposal makes no mention of microdescriptor consensus diffs. We should support these too. * Weasel added the 's' command just so that a line with just one dot could be produced. Since consensuses should never have such a line, I think it would be best to drop 's' and not support such a line as an input when generating the diffs. * In response to my introduction mail, Ian mentioned that fetching a diff is leaking data about when you last used Tor. Nick proposed to have a time limit on these diffs, to e.g. 24 or 36 hours, which should mitigate this problem. * Regarding their size, #140 suggests that they are not useful past 16 hours. I thought we could compare the compressed size of the diffs when creating them, since they may be of use for a longer time. We could do this relative size limit first as well as the time limit mentioned above. That is all that we came up with for now, what do you think? Ideas about what might be missing or needing an update are welcome, of course :) Regards. [0] https://lists.torproject.org/pipermail/tor-dev/2014-April/006744.html [1] https://gitweb.torproject.org/torspec.git/blob_plain/refs/heads/master:/pro… -- Daniel Martí - mvdan(a)mvdan.cc - http://mvdan.cc/ PGP: A9DA 13CD F7A1 4ACD D3DE E530 F4CA FFDB 4348 041C

3 5

Damian's Status Report - April 2014
by Damian Johnson 01 May '14

01 May '14

Hi all. This April's status report is gonna be short and sweet. The bulk of my time went toward Google Summer of Code student selection. I'm delighted to announce that we have thirteen great students working with us this summer (twelve with Tor and one with the EFF)! This is twice as many as last year, so it will be interesting to see if we can manage it. https://trac.torproject.org/projects/tor/wiki/doc/gsoc This concludes the bulk of my work as the org admin, so this next month I should be able to focus back on writing sweet, sweet code. On April 26th I presented at LinuxFest Northwest. For those who haven't seen it, this was a repeat of my TA3M 'Tor Ecosystem' presentation... http://linuxfestnorthwest.org/2014/sessions/tor-ecosystem-developers-guide-… https://media.torproject.org/video/2013-11-t3am-damian-johnson.mp4 And last but not least, bit by bit I've been picking away at a feature branch for Stem. It's not quite ready yet, but expect an announement and a new Stem release sometime in May. One improvement that *is* now available though is the following: The connection module's connect_port() and connect_socket_file() functions have been deprecated in favor of a new, slicker connect(). https://stem.torproject.org/api/connection.html#stem.connection.connect This new function is quite a bit smarter about the error responses it provides, and is more intuitive to use. Cheers! -Damian

1 0

Tor Specs
by Ahmed 01 May '14

01 May '14

Hello Everyone, Is this the latest version of Tor specification protocol? https://gitweb.torproject.org/torspec.git?a=blob_plain;hb=HEAD;f=tor-spec.t… -- Ahmed <ahmed(a)linuxism.com>

2 1