September 2014 - tor-dev - lists.torproject.org

Fast flag assigned to slow relay
by Lei Yang 04 Sep '14

04 Sep '14

Hi, I notice that some relays with very low bandwidth (e.g., 2 KB/s) in the consensus have 'Fast' flag. However, the definition of 'Fast' in dir-sepc.txt is that a router is 'Fast' if it is active, and its bandwidth is either in the top 7/8ths for known active routers or at least some minimum (20KB/s until 0.2.3.7-alpha, and 100KB/s after that). For example, the relay named "PotatoPlace" has only 5KB/s but is marked as a "Fast" node if we check that in http://torstatus.blutmagie.de/ Does anybody can please explain this? Best, Lei

1 0

Reminder: tor dev meetings Wednesdays 1330 UTC
by Nick Mathewson 03 Sep '14

03 Sep '14

Reminder: the next Tor meeting is on #tor-dev on OFTC, at 1330 UTC on Wednesday. (That's approximately 12 hours from now: this is a time change.) This is the weekly IRC meeting for people working on the program "tor". (It won't cover all the other programs developed under the Tor umbrella.) cheers, -- Nick

1 2

oonibackend 1.1.0 released
by Arturo Filastò 02 Sep '14

02 Sep '14

Hello Oonitarians, I am pleased to announce that a new version of oonibackend has now been released. Here are some of the changes introduced in the new version: * Make changes to the bouncer API to make it aware of the policy of collectors. * Improve the bouncer API to make it more RESTful. * Add test helper that can be used to discover the DNS resolver being used by the probe. * Code coverage and unittesting improvements. * Fix compatibility with latest txtorcon versions. Starting from this version we will also be uploading the package to pypi, hence you will be able to install oonibackend with: pip install oonibackend https://pypi.python.org/pypi/oonibackend Have fun, ~ Art.

1 0

DNSSEC
by merc1984＠f-m.fm 02 Sep '14

02 Sep '14

I am surprised to find that there is no form of DNSSEC associated with TOR. I am running dnscrypt, but find that I fail the DNSSEC test at http://dnssec.vs.uni-due.de/ when using the TBB. I have unbound chained to dnscrypt which is on a rotary to 5 trusted DNS resolvers. How can you not understand what this means WRT DNS cache poisoning? Why are we susceptible to DNS cache poisoning? I suppose that the TOR system needs to resolve .onion addresses, but there should be some way of using dnssec locally if the TOR system cannot provide authenticated DNS. No one in the #tor irc channel seems to know how TOR DNS is done, and unfortunately there's not a word about it at https://trac.torproject.org/projects/tor/wiki/doc/DnsResolver . But I suspect it must be TCP DNS as TOR can't do UDP. And I suspect DNS must be done by relay servers, in order to resolve intermediate .onion addresses. Beyond that, it's a mystery how it's done. How to secure TOR DNS? -- http://www.fastmail.fm - mmm... Fastmail...

5 6

[PATCH] Proposal 236 and voting
by George Kadianakis 01 Sep '14

01 Sep '14

I inline a patch that specifies how voting should happen in proposal 236. The changes reflect a discussion I had yesterday with nickm during the Tor IRC meeting. BTW, while I like the simplicity of the new vote (just an integer), I'm afraid that this might hide any misconfigurations of the guardiness system in authorities. For example, maybe an authority is misconfigured and considers only 2 consensuses for guardiness data (instead of 6000 consensuses) and if it publishes only an integer percentage then we might not notice this misconfiguration. Maybe the number of consensuses parsed and the number of months considered should also be mentioned somewhere in the votes?

2 2