August 2016 - tor-dev - lists.torproject.org

Re: [tor-dev] Alternative Implementations of Tor
by Nathan Freitas 18 Aug '16

18 Aug '16

On Wed, Aug 17, 2016, at 11:01 AM, Alexander Færøy wrote: > There is, to my knowledge, currently only one implementation of Tor that > is actively in use on the production network, which is the C > implementation. I'm aware of a Haskell implementation made by Galois, Not sure how widely implemented it is, but Orchid was a formally implemented version of Tor in Java, by the Toronto-based Subgraph group: https://subgraph.com/orchid/index.en.html It was, at one point, integrated into the Martus human rights documentation platform. The developers are likely on this list, or if not, easily reachable to ask for any lessons learned. +n

2 1

stem is now available through Guix
by ng0 16 Aug '16

16 Aug '16

Hi, stem is now available as python-stem on all systems which are able to run GNU Guix: https://www.gnu.org/software/guix/packages/ "guix package -i python-stem" installs the python3 variant (binary substitute), "guix package -i python2-stem" installs the python2 variant (binary substitute). See Guix manual 3.2 [https://www.gnu.org/software/guix/manual/guix.html#Invoking-guix-package] for an explanation if you want to link it, and on the ways to get the sources based installation instead of the binary substitute. It would be great to have the following added to https://stem.torproject.org/download.html page: GNU Guix / GuixSD # python3 package: % guix package --install python-stem # python2 package: % guix package --install python2-stem On the side there can be the dar kvariant of the Guix package logo[1] It is correct that there is no "sudo", it's no typo. I did the initial packaging of it and will probably look for updates of stem, but Guix is a collaborative project, anyone who feels responsible can update and fix packages, it goes through a quality assurance process before changes are applied to the source. [1]: https://www.gnu.org/software/guix/static/base/img/Guix-package.png thanks, -- ♥Ⓐ ng0 For non-prism friendly talk find me on http://www.psyced.org

2 2

[GSoC 2016] Orfox - Report 6
by Amogh Pradeep 16 Aug '16

16 Aug '16

Hey guys, Things have been a little slow the past couple of weeks with moving back to college and all the related formalities. But these are the things that I’ve been up to. 1) Tor Button I’ve been looking into the tor button repo and trying to wrap my head around it. Porting this to the new convention of extensions to make it work with mobile was part of my plan. But I think this needs to be discussed more. 2) Official Build Plugins Looks like mozilla has some new checks for the plugins that get installed on shipment. This makes our build fail as the plugins we had weren’t being signed before installation. Trying to figure out what might be best to do next regarding this. Thats it from me for now, will catch up on lost time for the last leg of this years GSoC. Best, Amogh Pradeep amoghbl1(a)gmail.com

1 0

txtorcon 0.15.0
by meejah 15 Aug '16

15 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm happy to announce txtorcon 0.15.0: * added support for NULL control-port-authentication which is often appropriate when used with a UNIX domain socket * switched to https://docs.python.org/3/library/ipaddress.html instead of Google's ipaddr; the API should be the same from a user perspective but **packagers and tutorials** will want to change their instructions slightly (``pip install ipaddress`` or ``apt-get install python-ipaddress`` are the new ways). * support the new ADD_ONION and DEL_ONION "ephemeral hidden services" commands in TorConfig * a first stealth-authentication implementation (for "normal" hidden services, not ephemeral) * bug-fix from https://github.com/david415 to raise ConnectionRefusedError instead of StopIteration when running out of SOCKS ports. * new feature from https://github.com/david415 adding a ``build_timeout_circuit`` method which provides a Deferred that callbacks only when the circuit is completely built and errbacks if the provided timeout expires. This is useful because :doc:`TorState.build_circuit` callbacks as soon as a Circuit instance can be provided (and then you'd use :doc:`Circuit.when_built` to find out when it's done building). * new feature from https://github.com/coffeemakr falling back to password authentication if cookie authentication isn't available (or fails, e.g. because the file isn't readable). * both TorState and TorConfig now have a ``.from_protocol`` class-method. * spec-compliant string-un-escaping from https://github.com/coffeemakr * fix https://github.com/meejah/txtorcon/issues/176 You can download the release from PyPI or GitHub (or of course "pip install txtorcon"): https://pypi.python.org/pypi/txtorcon/0.15.0 https://github.com/meejah/txtorcon/releases/tag/v0.15.0 Releases are also available from the hidden service: http://timaq4ygg2iegci7.onion/txtorcon-0.15.0.tar.gz http://timaq4ygg2iegci7.onion/txtorcon-0.15.0.tar.gz.asc You can verify the sha256sum of both by running the following 4 lines in a shell wherever you have the files downloaded: cat <<EOF | sha256sum --check f2e8cdb130aa48d63c39603c2404d9496c669fa8b4c724497ca6bfa7752a9475 dist/txtorcon-0.15.0.tar.gz a359fb5e560263499400018262494378b3d347cd04a361adb08939df95ecedf6 dist/txtorcon-0.15.0-py2-none-any.whl EOF thanks, meejah -----BEGIN PGP SIGNATURE----- iQEcBAEBAgAGBQJXl/KEAAoJEMJgKAMSgGmn76gH/1du7i9dmkMpr2PJrexVeXSo 9mSaeX/7KKaW71pEMmaCXfvhDJ6dMZDQpZ7saTM31zJZTp+MXjtHf0DZI2QTwgDw NYEBH+LO8PINN1ezPomgeZE6E4eJYlaDCyO6c7j3cOsEmohST+GPpvvdWdft+Sw2 hWvVf2+I4BV7vcIx6WQx4jKBS2gmlHbxuUv3LAnjj/Tn6oSYpft1IUK39pM66DX4 FzdYeBTloC6nzyH4sRTxnax+l9MfQJ2ZR+5alJi8uEvGlk580ciFASQNCVLaBY9r 4YALoipEg2Fm4BFA7qLsH0aFoLgx0lv7ng8lmpaP7XlPjUCuA7OcDp5jSqhGt2A= =hWml -----END PGP SIGNATURE-----

5 7

[GSoC] CONIKS for Tor Messenger - Status report #6
by Huy Vu Quoc 15 Aug '16

15 Aug '16

Hi everyone, This is my sixth status report for my GSOC project. There are not much for this recent weeks since we (my mentors and I) are concentrating on reviewing/refactoring code. 1- Development of the CONIKS protocol library: The pull for this issue is at https://github.com/coniks-sys/coniks-go/pull/64. It’s almost done. However, we opened new ticket for discussion over key lookup & key monitoring function (issue #70). 2- Starting integrating CONIKS into Tor Messenger There’re currently 2 pulls for the integration (https://github.com/arlolra/ctypes-otr/pulls) We also probably would do some refactoring on the cgo client library, the idea is to wrap all client tasks into this library, and then the server’s responses would be passed in the library instead of unmarshalling the response and passing them into separate functions as now. 3- Fixing bugs and making improvements based on our discussions/feedbacks Basically, there’re many things need to be done before the end of GSoC. We probably cannot merge all the implemented features into master branch before the end of GSoC, so I’m working on a separate branch that merged all pulls so far, the main purpose is to have a working prototype for my GSoC. Best, Huy

1 0

How to integrate an external name resolver into Tor
by wire321＠sigaint.org 13 Aug '16

13 Aug '16

Blockchain addressing has some serious issues that will stand in the way of wide adoption. The need for payment already makes this out of reach for many users. Lack of anonymous payment is a privacy challenge until Zcash comes into the picture. The need to download a blockchain on embedded devices is a deal breaker. Battery life, storage space and storage life expectancy are tight constraints. How are you going to deal with this?

2 1

[GSOC 16] Ahmia status update #6
by Ismael R 13 Aug '16

13 Aug '16

Hi everyone, I'm working on ahmia.fi, the hidden service search engine and you're reading status update #6. During the last two weeks, I finished porting the django app to the new structure. I'm also working on last minute things before shipping the new site online. I will continue updating documentation and add some unit tests to the project. The code is not merged yet but you're welcome to check it on my forks. [1] [2] Since this status report is short, here is a list of goals I had in my initial project proposition and what work has been done on each. Review code and infrastructure: - Split the project in several repositories - Improve documentation - Automate testing (Travis.CI) - Track code quality (Landscape.IO) - Track requirements (Requires.IO) - Refactor each subproject Improve search results: - Better use of elasticsearch (use of stemmers, shingles, term-centric search) - Search results are now pages instead of domains. Improve UI/UX: Not much work has been done for this goal. The website has been in the process of porting old pages to a new design. All pages are now using the new design. Gather more statistics: - Pagerank is now used to compute an authority score for each page - I suggested that we could use a self hosted statistics framework like piwik [3] but no decision has been made. Use stats to better rank search results: - Results are ranked by authority score. Make sense of the indexed info to understand a search meaning: - Shingles enable us to differenciate these two queries: "i'm not happy i'm working" and "i'm happy i'm not working". - Synonyms could be used by the search algorithm if we provided a synonym dictionnary. No work has been done at making this work. Make a google trend-like interface to visualize searches over time: No work has been done to reach this optional goal. Even some stats fonctionnalities were dropped in the new site because they were "domain- centric" when a search engine needs to be "page-centric". We could probably index searches in elasticsearch and use Date Histogram Aggregation [4] to display trends. Make stats available with the API: No work has been done to reach this optional goal. Some API endpoints were also dropped because they were domain-centric. It would be great to have an API with a coherent url scheme. I think Django Rest Framework can help design that API while keeping the code simple. That's it for this week, Have a nice weekend. Ismael R. [1] https://github.com/iriahi/ahmia-site [2] https://github.com/iriahi/ahmia-crawler [3] https://piwik.org/ [4] https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggr… [5] http://www.django-rest-framework.org/

2 1

[GSOC16] Fingerprint Central - Status report n°6
by Pierre Laperdrix 12 Aug '16

12 Aug '16

Hi everyone, Here is my sixth status report for my GSOC project. Repository: https://github.com/plaperdr/fp-central Beta: https://fpcentral.irisa.fr 1- Development of the "Acceptable" feature When a user sends his fingerprint to the server, he can now see for each attribute if the collected value is "acceptable" or not (i.e., if it is an expected one). If the server returns that a value is not an acceptable one, this means that it is something to investigate. Does it come from a simple misconfiguration of the browser or could it be a genuine difference between TBB browsers that should be fixed? Right now, it is a simple Yes/No answer but I'll add more feedback so that a user understands the information that is presented. 2- i18n support with documentation I have finished the FR version of the website. Not everything is localized since some libraries I use for the front-end are only in English but the majority of FP Central is now translatable. I have written a small guide if anyone wants to contribute (https://github.com/plaperdr/fp-central/tree/master/translations) The process is pretty simple: you generate a file that references all the strings that need to be translated and you complete it with your translations. 3- Multiple bug fixes and improvements I fixed multiple bugs in the customStats page that were caused by the way I structured data in the page and it should be much smoother now. I'm sure other bugs are lurking in the code so do not hesitate to visit the beta website and report to me any bugs you may find. In terms of features, I have normally developed everything I wrote in my proposal. So my focus for the final stretch of the coding period is to clean the code, fix bugs, improve the website and write even more documentation. I'll also start planning the post-GSOC period to see what interesting features could be added in the future and to make sure that FP Central is ready for prime time for users and developers. Have a great week-end, Pierre

1 0

First CollecTor Release 1.0.0
by iwakeh 12 Aug '16

12 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi there! A while ago I wrote about the CollecTor improvement project [0]. Since July we intensified work there to prepare the very first release of CollecTor, which is now available here: https://dist.torproject.org/collector/1.0.0/ CollecTor itself is much older, the git repository dates back at least six years and there is even data from the year 2004 available [1]. The three most significant changes for release 1.0.0: * CollecTor consists of a single executable Java jar now. * CollecTor schedules all modules without the help of any crontab like service. * Configuration is done via one file and all important settings were made configurable. CollecTor is only a download away now :-) Cheers, iwakeh [0] https://lists.torproject.org/pipermail/tor-dev/2016-April/010742.html [1] https://collector.torproject.org/archive/relay-descriptors/tor/?C=N;O=A -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAles67AACgkQsANAxTOj/ab/GQEAl/KUq2by8ooi2Nftw9RFh85L lLHf6uwzmHXD294lptQA/jHxOSCDUDUM4uEVV4HxvaUVbuToNNZ0mqbY45YbJz+r =rLeM -----END PGP SIGNATURE-----

1 0

https://gitlab.com/torproject
by Hans-Christoph Steiner 10 Aug '16

10 Aug '16

FYI I registered https://gitlab.com/torproject to claim the name in the gitlab namespace. I'm happy to hand it over to a more official Tor person if anyone wants. Or just let me know if anyone ever wants to actually use it. I've been using gitlab for a while now with F-Droid, and its quite nice. Guardian Project is going to move our stuff there too. .hc -- PGP fingerprint: EE66 20C7 136B 0D2C 456C 0A4D E9E2 8DEA 00AA 5556 https://pgp.mit.edu/pks/lookup?op=vindex&search=0xE9E28DEA00AA5556

3 2