- tor-dev - lists.torproject.org

GSoC 2013 - "Compass"
by Emanuel Pascoal 29 Apr '13

29 Apr '13

Goof Night, My name is Emanuel Pascoal, i have 20 years-old and i'm from Portugal. I'm developing studies in the area of computer engineering in the University of Évora. I have knowledge in Python and a little of Java. I would like to make my candidacy in the project named"Compass", that are tagged on your ideas lists for Google Summer Of Code 2013. I would like to discuss the project in order to try to understand the best way to submit the application. I want to know more details about the ideas, so that you can outline what the best ways to make the project as well as the resources that I will need, and be able to think about the time we'll need for the project's development. I would have the most pleasure in work with your community, researching and developing the previous ideas, in any way that i can be helpful. Thanks for the time spent, Emanuel Pascoal

2 1

Source Code Static Analisys
by Ulises Cuñé 28 Apr '13

28 Apr '13

I want colaborate with Tor project. I send a document of analys source code about the lasted version Summary Issues by Fortify Priority Order High 1620 Low 178 Critical 38

3 3

"identity digest" and "hash of a router's identity key"
by Frank Young 28 Apr '13

28 Apr '13

In a consensus, the item after nickname is base64 encoded "hash of a router's identity key" If this item is base64 decoded, is it the same as the "identity digest" of the router?

3 3

Obfsproxy support for Tor Browser Launcher
by Micah Lee 27 Apr '13

27 Apr '13

I want to make it so Tor Browser Launcher users can optionally choose to install teh Obfsproxy TBB instead of the normal one, but I have some questions about that on this issue: https://github.com/micahflee/torbrowser-launcher/issues/38 Maybe someone here knows the answers. Here's the question: Do the obfsproxy bundles have the exact same release schedule as normal TBB? I know what the current alpha and stable version numbers are by looking here: https://check.torproject.org/RecommendedTBBVersions At the moment it seems like the current alpha is 2.4.11-alpha-2, and the obfsproxy bundle is at that same version too. Is it ever recommended to run the "stable" obfsproxy bundle? -- Micah Lee https://twitter.com/micahflee

4 4

GSoC 2013: Build Better Pluggable Transports
by Chang Lan 26 Apr '13

26 Apr '13

Hello all, My name is Chang Lan. I am a fourth-year computer science undergraduate student at Tsinghua University, China, and will be a grad student at Berkeley focusing on networking in this fall. I have been a big fan of the Tor Project for years, as I am actually using it for circumventing the censorship. I look forward to contributing to this project as well. Specifically, I would like to improve current obfsproxy implementation, so that it can resist active censors from scanning its presence. To my knowledge, obfsproxy should avoid responding to handshake requests from clients unless clients have the server's key, which shall be obtained from BridgeDB. I am a newbie at Tor development though, and it would be great if there is anyone willing to talk further with me on this topic. Thanks. - Chang

1 0

Human factors of security software
by Bernard Tyers - ei8fdb 26 Apr '13

26 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello nice Tor people, [I've spoken with Runa about this and she suggested me to send this to the dev list. If it should belong somewhere else, just let me know. Thanks Runa.] Tl;dr: 6 months worth of a reasonably security/privacy/encryption savvy HCI researchers time to carry out a MSc dissertation about usability of security software, and the effect their UIs have on peoples idea of how they work. (You may see this e-mail on a number of lists,I'm mailing each list individually.) Seeing as I am going to be asking for a favour, I should give some information about me. My background is: electronics engineering, network and systems admin, then telecoms engineer (mobile networks). I'm not a coding/security/crypto bod, but security has been part of the past 10 years+ of my work that I can understand some and know where to find/who to ask for the answers for the other. My interest is: HCISEC - Human Computer Interaction in security technology. Security, privacy, encryption tools and why people, who should use them, do not use them. I define a "people who should use them" as human rights activists, investigative journalists, people in countries whose government are oppressive. I define "security, privacy, encryption tools" as "Tor, TBB, Orweb, Orbot, PGP, Redphone, TextSecure, Pixelknot, Silent Circle, Tails, and other tools I don't yet know about. My focus is not with security professionals/experts, technical people who can understand the limitations of these tools, threats they defend against. These users have the technical knowledge and understanding of computing concepts, and threat models, etc which allow them to make a more educated decision. I am doing a masters in human computer systems, and it's coming to the time to start planning my dissertation. My chosen topic (very generally) is: "Usable security and its impact on mental models and trust." Over the next few weeks I want to focus this better. (If you're familiar with the concept, or are not interested, just skip this.) A mental model is a "small scale model of reality" humans create to use to reason, to anticipate events, and to reenforce explanation. Based on the users understanding of a software interface, they will construct an idea of what is happening in an application. If a user creates a number of mental models because a software interface gives different/wrong/conflicting information, this causes the user to be confused, as as result, they will make incorrect decisions, and possibly stop using the software. Given the scenarios where these tools are used, making mistakes, having a false sense of security, or not using them, can be dangerous. There is a lot of research in trust and confidence in recommender systems, transparency in system status, credibility of information provided in user interface, but (from what I've found so far) not much specifically to do with security and privacy tools. So to my request: I have 6 months (beginning from May) to carry out a hcisec human factors focused project. There have been usability evaluations of Tor carried out already, and I was looking for other areas to focus on. I can find a subject myself, but I would like to do some work on an area that could lead to some useful research/provide input to making these tools better, from a user point of view. Is there a question you'd love to see answered? Is there some area of a tool that needs some research? I will also be looking for participants to take part in research - again I am very conscience of the scenarios where these tools are used, and the need to maintain anonymity and privacy. I will be anonymising all research, asking for the minimum information and am happy to carry out communications via secure communications tools. I would appreciate support from users of security and privacy tools. At the end, all research will be released and available for use by the security community if required. At the risk of teaching you to suck eggs, if you are interested in learning more, I can recommend the "Security and Usability: Designing Secure Systems that People Can Use" book by Lorrie Faith Crannor and also the SOUPS Conference (http://cups.cs.cmu.edu/soups/2013/) I look forward to some feedback (on or off list). thanks, Bernard - -------------------------------------- Bernard / bluboxthief / ei8fdb IO91XM / www.ei8fdb.org -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJRY/8bAAoJENsz1IO7MIrrM4AIALW27F757Fn4Jgy3pk0ZX4PQ yl4ToEyJcFmZcKNjlejuTAeeVc00UGLlJRNTPuGT1WAUwt7JhgCYX8p9/YwgA4Pm 1AU6tCHcg9LBpc8ca+0lqBvCh/ZmVf5zTTEVjlXyylrUpqdlR67QemkpyjN0sUJW V7PGPxig2Y3opdVzWZRrmvhLsJf7qN2mAxLUyzSS44nInqpS9+Db1MsDLpI5mof5 ze/FUKV3eTiTzJJ1qLMXbo8VbJvpZO3HgeUFwZH7btbUZQszwrifWupuZefqtro5 nyCNFnUcQ6fyxMOnRLPAji2eAe/fBasQ9h5pCiYVScclddWe1VWhf4poyjVHv9U= =Sak4 -----END PGP SIGNATURE-----

2 3

Finding the HSDIR responsible for a certain onion address
by Frank Young 25 Apr '13

25 Apr '13

Dealing with v2 hidden service descriptors, how does a tor client get the list of HSDIR are responsible for a certain onion address so it can contact them for descriptor of the hidden service?. According to rend-spec.txt the list of the responsible HSDIR for a particular hidden service changes almost in every 24.

3 3

Atlas/Compass GSoC 2013
by Newk 24 Apr '13

24 Apr '13

Hi, I'm Nikola, 1st year student in the university in Skopje, Macedonia. Around 6 months ago I've put a tor relay at home - one of only two running in the whole country (the other one is placed in the local hackerspace, also the only one in the country). Being interested in internet anonymity and network security, I've started reading about how tor works and how I can make a contribution in the project. I would like to work on Atlas and/or Compass (even Vidalia or Arm), because as a tor relay owner, I've met some points I would like to improve. Any thoughts? Thanks, Nikola P.S. As a late blooming activist, I would like to contribute to this project even if I don't be selected for this years GSoC program. The reason being that in couple of years or less, you will see my country as a place where democracy quietly ceased to exist. And tor will be the only way reaching to the outside. On this note, I'd like to add that my goal is not only contributing by improving tor, but also making a shout to the free-minded

3 4

Txtorcon/Stem Integration : GSoC 2013
by Akshit Khurana 23 Apr '13

23 Apr '13

Hi, I'm Akshit, a 4th year Computer Science student at IIT Roorkee. I'm a part of Information Management Group(IMG) here, which is a student body responsible for developing and managing all Internet and Intranet applications in IIT Roorkee, including the institute website and registration & placement portals. I would like to work on Txtorcon/Stem Integration. I have some experience working with Python and web frameworks Django and Flask contributing to IMG's projects and to openSUSE's popcorn project[1]. I don't have much experience with Twisted except for a few tutorials but I'm sure I'll pick it up. To get acquainted with Tor and Stem, I'm working on a patch[2] for stem with Damian's help. I'm going though txtorcon's code as well. Thanks, Akshit http://github.com/axitkhurana [1] https://github.com/openSUSE/popcorn/commits/master?page=2 (username axitkhurana) [2] https://trac.torproject.org/projects/tor/ticket/8607

2 1

Stem GSoC 2013
by Tomasz Kunikowski 23 Apr '13

23 Apr '13

Hey, My name is Tomasz Kunikowski, I'm a production engineering student at Wroclaw University of Economics branching heavily into IT. My handle on IRC and trac is ragwater. I'm mainly interested in expanding stem's tutorial base as it could really use some more real-world applications and examples, but I'd be fine with extending the tests, too. I started with some minor bugfixes to stem to get a better hang of the library and the inner workings of tor in general, and if time permits I'll contribute some more besides the code sample required in application. Regards, Tom

2 1

Removing Onion Skins
by Frank Young 22 Apr '13

22 Apr '13

After circuit extension to the second Node, I realized that the OR at the second node can decrypt my cells and successfully process my circuit extension request to increase my circuit length to three but i can't decrypt the response from the same OR. At first I thought maybe I was messing up the key for backward encryption (should be decryption but it is counter mode crypto) but i realized it wasn't true. I extracted both the KF and KB at the same time and the crypto scheme is also the same for encryption and decryption since it is a counter mode AES operation. From the tor protocol specification, I will have to remove all skins starting with the immediate OR towards the exit Node. When the application of the above specification failed to decrypt the cell successfully, i decided to remove the skins in reverse order but this also failed. I'm really confused at the moment. Aren't each successive AES counter operation independent of the previous?

2 2

Remote access to TOR through web server
by Mahesh Baheti 22 Apr '13

22 Apr '13

I've discussed this idea before here. Few people asked me how to implement it? I can discuss it if someone gives me any idea about gsoc applications. Mentors please reply.

1 0

Behavior of pluggable transport proxies on SIGINT
by David Fifield 20 Apr '13

20 Apr '13

This is what 180-pluggable-transport.txt says about proxies and SIGINT: > Proxies should respond to a single INT signal by closing their listener > ports and not accepting any new connections, but keeping all connections > open, then terminating when connections are all closed. Proxies should > respond to a second INT signal by shutting down cleanly. I implemented the websocket-server transport to do this. https://gitweb.torproject.org/flashproxy.git/blob/c23caf1f71f8281319cadf550… I noticed unexpected behavior when the proxy receives a SIGINT, and doesn't have any open connection, and so exits immediately without waiting for a second SIGINT. The parent tor process tries to kill a nonexistent PID: > ^CApr 19 17:58:59.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. > ^CApr 19 17:59:05.000 [notice] SIGINT received a second time; exiting now. > Apr 19 17:59:05.000 [notice] Failed to terminate process with PID '18277' ('No such process'). Is this intended? It seems the PID might have been reclaimed in the meantime, and tor could be killing an unrelated process. I can think of two changes that would make it seem to me to work more naturally. The first is for tor to poll the child PID to see if it has exited before killing it; this reduces the race window. The other is to require proxies always to wait until their second SIGINT before quitting. (Concretely in the websocket-server example, remove the"numHandlers != 0" condition from the second sigint loop.) David Fifield

2 1

Scholar user questions
by Noel David Torres Taño 19 Apr '13

19 Apr '13

Hi all I need some help answering these questions from a scholar, for RT ticket #9112 El vie 19 de abr de 2013 07:12:45, leejunsik486(a)gmail.com escribió: > Hello~! > Thanks for your kind response. > Now I can use pop3 mail client using Tor network due to your help > > I am reading the thesis "Tor:The Second-Generation Onion Router" > There are some explains about Tor directory server. > > I have another Question about Tor Directory server. > > > 1. User's local SW(ex) Vidalia) already know directory server's IP or > URL? > Is it pre-loaded at SW? > (This Question means "how to access to directory server?") > > 2. How to user's local SW( ex) Vidalia) receive directory information? > Directory server send this information directly or other ORs > transfer > this information? > ( In vidalia control panel- relay setup, there are "Mirror the > relay > directory" option) > If other OR's transfer this infomation, Why directory server > doesn't > send directly? > > 3. In this thesis, "there are 3 directory server, but we expect as > many as > 9 as the network scale" > Now, How many directory server exist?(still 3 servers or increase) > > 4. All directory server have same directory information? > > 5. Is there any links or files about directory server's work(detailed > explanation)? > > > Always thanks your kind response > Best regards > > Leejiunsik > > > 2013/4/15 Noel David Torres Taño via RT <help(a)rt.torproject.org> > > > El lun 15 de abr de 2013 10:58:35, leejunsik486(a)gmail.com escribió: > > > Hi > > > > Dear user: > > > > > This is leejunsik in Korea. I'm studying computer network in > college. > > > I have some Question about Tor. > > > > We are happy you use Tor and try to understand it. > > > > > > In "Vidalia control panel- Setup Relay-Sharing" > > > I can select Exit Policies. > > > => It's mean I can use other services(POP3,IMAP,chat) using TOR > > > > > > I know that I can use web-browsing using Tor browser. > > > But I'dont know How can I use POP3, IMAP, chat etc. . > > > > > > 1) Is there any other Tor application for using POP3, IMAP, etc. > ?? > > > > You should either > > > > a) use a Tor-aware mail application. We do not know any of these > reliable > > at > > the moment. > > b) Torify an existing mail application. You should be very careful > and read > > this: > https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/EMail > > c) Use Tor as a SOCKS proxy and route your standard e-mail > applications > > through > > it. You should read this: > > https://trac.torproject.org/projects/tor/wiki/doc/SupportPrograms > > > > > 2) When I send ping or nmap or nslookup message In console > terminal, Is > > > there any way to use Tor?? > > > > ICMP PING is in the same layer as IP, while SOCKS provides TCP > proxying > > (one > > layer above), so no, there is currently no way to use Tor for that. > > > > > > Please let me know about it. > > > > > > I'll wait your response. > > > > Regards > > > > Noel Torres > > Tor Project Help Team > > > > Hope you can help! Regards Noel Torres er Envite ------------------------- A: Because it breaks the logical flow of discussion. Q: Why is top posting bad?

2 1

Re: [tor-dev] Embedding tor in an application and using tor without opening a port
by Navin Francis 17 Apr '13

17 Apr '13

On Sat, Apr 13, 2013 at 10:42 AM, wac <waldoalvarez00(a)yahoo.com> wrote: > > Hi Navis: > > Good to hear you built it. I have a working library with a defined API but > is not re-entrant. It can connect with a server over Tor circuits and > transmit/receive data but nothing is re-entrant at all. So the same Tor > thread must be used for all of that ATM. > > I can fetch webpages like that however and can also do some limited > chit-chat over IRC. > > I didn't realize that you already had it working :) I guess I will wait untill you post the code. > I attempted to add some locking to some of the data structures but that is > insufficient. For instance lists and buffers. Hash tables are complex. They > are defined with some macros in order to make them generic overcoming some > limitations of C language but they are less than maintainable IMHO. So I > was thinking to replace them with another one already built with a similar > license but re-entrant. Found a very good one. > I thought Tor already had some level of locking since multiple applications can connect to it at the same time via SOCKS. I completely agree about replacing the macros though.

2 2

Re: [tor-dev] Interested in getting involved with pyDoctor
by Karsten Loesing 17 Apr '13

17 Apr '13

(Adding tor-dev back to the cc.) On 4/16/13 9:31 PM, Miłosz Gaczkowski wrote: > On 16/04/2013 07:28, Karsten Loesing wrote: >> Sounds great! Welcome to Tor! > Thanks for the warm welcome :) > >> In theory, you can start working on this project right now. The first >> step is probably to understand what the current DocTor code (Java) >> does and what capabilities the stem library (Python) may still be >> missing to rewrite DocTor in Python. See the links in the project >> idea, and ask for more pointers if you're missing something. > All right, I've started my research on DocTor earlier today. I'll start > looking at Stem when I have a decent understanding of the design choices > and approaches in DocTor. Sounds good. >> For the GSoC project, you should come up with a project plan >> explaining what parts need to be implemented, and you should suggest a >> schedule that fits the GSoC timeline. See the GSoC FAQ for details. >> Bonus points if you already have some code for PyDocTor in your GSoC >> application. Or you could write a patch for #8164 [0], which still >> means writing Java code not Python, but which would show you're >> familiar with the code base you're planning to rewrite. Another >> alternative would be to write a stem patch that adds part of the >> missing features to write PyDocTor. Lots of options there. > I think the best approach (in the long term, at least) would be to start > with extending Stem, then building pyDoctor on that, and only focusing > on extra functionality once we have the new product. Probably better > than doing #8164 now and then re-inventing it a few months later in > Python anyway. What do you think? I agree that doing #8164 now and rewriting it a few months later means duplicating some effort. But it's not that complicated, and we'll want to have that feature in the next few months anyway. But don't worry too much about it, I can write the #8164 patch myself. If you want to focus on the rewrite instead, please do so! >> Does that answer the who/what/where/when? If not, just ask! > It does, thanks a lot. I'll carry on reading through the code and > working out how things work for a while, but I should be able to start > work on my project plan and code in a week or so. > > If you have any ideas and suggestions, those are always welcome. If not, > I'll be in touch soon! Great! Looking forward to commenting on your project plan or code! :) Best, Karsten

1 0

More-static throttling parameters
by Roger Dingledine 17 Apr '13

17 Apr '13

Hi Rob, We spoke at the dev meeting about how throttling that's a function of number of clients introduces new anonymity vulnerabilities (for those following along at home, see the upcoming PETS paper "Balancing Performance with Anonymity in Tor"). It seems to me that we want to explore more static options. For example, we watch a rolling window of Y seconds and throttle you to 50KB/s for 2Y seconds if you send or receive more than X bytes in those Y seconds. Here are plausible values of X and Y: 12MB in 30 seconds ("400KB/s") 18MB in 60 seconds ("300KB/s") 27MB in 120 seconds ("225KB/s") 40.5MB in 240 seconds ("169KB/s") 60.75MB in 480 seconds ("126KB/s") 91.125MB in 960 seconds ("95KB/s") 136.6875MB in 1920 seconds ("71KB/s") The goal is that a client who wants to game the system could self-throttle to just under the limit, and then we don't trigger, but the user would have to self-throttle more and more over time as he continues to transfer many bytes. The smallest Y we consider is 12MB in 30 seconds, and from there when Y doubles we multiply X by 1.5. And then when X/Y reaches 50KB/s we don't throttle further. It's possible there are simple self-contained equations to describe the above curve; it's also possible there are better curves to explore. And I also confess that I didn't pick the above design with an eye towards easy implementation (somebody's going to have to get out their algorithms magic wand and rephrase it so it looks easier to implement). My goal was to pick parameters such that we don't impact normal users, but if we *do* trigger on a user then we sure are glad we did. And there are of course reduced returns here because the user can have multiple entry guards (and all the other cheating questions a la the LIRA design). --Roger

1 1

Remote anonymous browsing
by mahesh 17 Apr '13

17 Apr '13

Hi, I am a third year undergraduate student of Information Technology at PICT, Pune, India. I'm dying to contribute to tor community as I use it a lot. There's an opportunity for me in GSOC-2013. I read tor's idea page and came to know that would have to contribute to existing project. But, I would like to propose a new project. I came across this problem statement from a friend of mine who is journalist. He says, most of the times he don't have his laptop with him so he cant access tor from a CyberCafe as they won't let him download the bundle. So, I propose that there should be a web server to handle tor requests over http. I did my study and think its feasible but let me know everyone else's thought on it. Mahesh

5 7

txtorcon [GSoC 2013]
by Anshul Singhle 16 Apr '13

16 Apr '13

Hi, I'm a fourth year undergraduate student of Computer Science at IIT Kharagpur,India. I'm interested in applying for Gsoc this year for Tor. Specifically i'm interested in the project on txtorcon/stem integration. I have worked on twisted before developing ssh and git daemons using it. I'm a newbie at tor development though. Could someone point me to what is required for a good application for this project? Do I need to submit a patch to Tor? I have no experience working with stem. Could someone give me pointers on where to start? PS - You can view my twisted code at - https://github.com/lonehacker/Drupal.org-Git-Daemons . My contributions are under the id [anarix] Thanks, Anshul Singhle

3 5

Interested in getting involved with pyDoctor
by Miłosz Gaczkowski 16 Apr '13

16 Apr '13

Hi, I'd like to get involved in the development of pyDoctor (https://www.torproject.org/getinvolved/volunteer.html.en#metrics-pyDoctor) I'm not too bothered about whether it'd be through GSoC or not (i.e. I obviously wouldn't mind GSoC, but I'm no less interested in simply volunteering). A few words about me: I'm a reasonably competent 2nd year CS student at the University of Southampton. Not a programming prodigy, but a reasonably quick learner with some enthusiasm for learning how to suck less. My motivation for doing pyDoctor is having an opportunity to learn something while producing useful code and hopefully becoming a part of the Tor community. I feel that this project is adequate for my abilities (both in the sense that I won't screw up and that I'll learn a lot while doing it). If you would like to take me in, I'd be very happy to get started asap. Any pointers on the who/what/where/when would be very much appreciated. Cheers, Miłosz Gaczkowski

2 1

Searchable Tor descriptor and Metrics data archive - GSoC 2013
by Praveen Kumar 16 Apr '13

16 Apr '13

Hi, I am Praveen Kumar from India. I want to work on the project "Searchable Tor descriptor and Metrics data archive". I have participated in the past instances of GSoC with Melange and e-cidadania, and have an extensive experience in development with Python. For the search application, I propose using Django with MongoDB as a NoSQL database backend for our search application. We have 100GB+ of data which eventually grows everyday and so using a NoSQL backend will ensure us that our application scales well with the increase in data as well as user traffic. The application will have various interfaces such as: 1) Data Updator: This end will connect and retrieve data from the metrics website periodically via rsync. It will also be responsible for pre-processing the data to a suitable format as our search application needs. 2) Storage End: A relay descriptor can be searched by nickname, fingerprint, IP Addr and various other attributes that define a relay descriptor. So we can preprocess the whole data, extract the attributes that define a descriptor and then save it in an appropriate model MongoDB provides. Since queries are very fast in a NoSQL datastore, our searches will be very fast. 3) Search Front End: This will be exposed to the user where a user provides its search query to us. 4) Search query processor: This end will process the query of a user and determine its type for eg. whether the query is an IP Address or a nickname etc. It will then connect with our Storage End and return the appropriate data to the Search Front End. Above is a very high level view of my approach to this project. We can also use Django Haystack as a search application framework(I did some research for existing search frameworks). I can implement this app in an object oriented way in Python. Python being such a beautiful and easy to understand language, it will be easy for others to understand and make changes to the application in least amount of time. I would like to know if I am thinking in the right direction and would like to know what Karsten has to say about this. - Cheers Praveen

2 3

Re: [tor-dev] Tor trademark (was Embedding tor in an application and using tor) without opening a port
by wac 16 Apr '13

16 Apr '13

Hi Roger: On Mon, Apr 15, 2013 01:04 EDT Roger Dingledine wrote: >> I changed from libTor to libtor as Tor is a registered trademark but >>lowercase tor is not. > >I'm afraid that's not how trademark works. The trademark is infringed by >any name that might confuse users into thinking that it is, represents, >or is endorsed by the Tor Project. The confusion argument is not based in any facts for instance like statistics. I can also think a zillion words that have tor as part of their names. Fine is there a name I could use to reference Tor network and nothing else but that network without using the name Tor or any other "trademark"? >> I already paid for the domain and to make sure people knows is a library >>to use the Tor network. > >I would be happy to paypal (or whatever) you some money to register a >different domain -- e.g. libonion.org -- before you get too established >in your brand. Well is not a wrench thrown like before. Thanks I appreciate it. In any case is not a brand just a name. I would however redirect in such case libtor.org explaining this change to such new domain as some people already knows it. A change has benefits as gives me more freedom to operate. At least removes the commercial exploitation lock. > >(Many generic Tor-related projects use the community-oriented word >'onion', which we have intentionally left out of all our trademarks.) > IMHO onion is far from specific and is confusing. It could be anything. I mean what would someone who have no idea of what is Tor or onion *routing* would think it is? >> This is also non-profit and I clarified at the website what is Tor and >>that carries no guarantee from the Tor Project about quality, suitability >>or anything else. > >Thanks -- that is a good first step. > >> The guidelines also say that being non-profit I could >>even use a modified Tor logo. > >Actually, that's not what the guidelines say. They say "Please don't >modify the design or colors of the logo." Can you point to the sentence(s) >that confused you, so we can clean them up? I double checked, yes. This one "If you're making non-commercial use of Tor software, you may also use the Tor onion logo" The confusion source seems to be the first clarification inside the parenthesis as the meaning changes when you remove it. "If you're making non-commercial use of Tor software, you may also use the Tor onion logo. Please don't modify the design or colors of the logo. You can use items that look like the Tor onion logo to illustrate a point, so long as they're not used as logos in ways that would confuse people." What I interpret here now is that I can use it if I am non-commercial as long as I don't modify design or colors. "Confuse people" is subject to open interpretation too. >> This is in any case not a trademark, is just a name so people knows >>what they are getting that comes out almost naturally. A library to >>connect to the Tor network. > >You're making modifications to Tor, Correct >and then telling people what they're >getting is Tor. Where? No, never claimed that. >I'd say that's a clear opportunity for confusion. There is absolutely no intention of causing confusion. >> I do not pretend to sell anything. But I >>made it lowercase however in order to reduce any possible tension. > >I understand, and that's why it would be best to resolve the confusion >early before users start to associate your software with this name. Ok looking forward to remove the "source of confusion". I still don't think it is. >In fact, I'd love to have an officially associated project, called >something like libtor, that is a library version of the Tor software, >endorsed and maintained by Tor (including maintained by you as a Tor >project core member). But the way to get there is to become a part >of the Tor community and establish a history of doing development and What would be the exact measurement parameter/s to make this move? And what would this mean? I would not like to be changing names back and forth so I would like to keep it. Changing it is problematic to users and the project itself as would take established users away. Basically what I am looking is to satisfy my own needs and maybe get help from the community. So I would like it to be used. I would like to innovate at some point in the future too. I have some ideas in several aspects. >maintenance of libonion the right way, What is the precise meaning of "right way" here? Sorry is not clear to me. >rather than to start out with a confusing name So far no visitors have showed any sign of confusion. They all know is a modification of Tor. >and hope everything works out from there. I will find roadblocks for sure. Well I've being getting some already. I am not the kind who steps back easily in front of them. Things will work. I've being developing/fixing bugs in software for years: http://www.reactos.com/wiki/ChangeLog-0.2.1 http://aircash.sourceforge.net/zerodaypatches.html I know nobody knows me here but assuming that anybody new around is going to provide something broken or low quality doesn't seems to me a good approach. Fine I do not pretend to be trusted right away or change ppl way of doing things. This is something I want to use myself. I am not looking to blow my own feet. Fine I could do it unintentionally as everybody can make mistakes. That's why I am looking to open it and looking to get it used because of the peer review. > >> Is >>not that I have to obey any law from the USA as they don't apply to me. > >I'm afraid that part isn't true either in this case -- you got your >domain from a US-based TLD, and through an ICANN-accredited registrar, >so both US trademark law and the UDRP apply. Do a web search for 'icann >udrp' for the gritty details. I have not waved any fist. Yes I used a USA owned TLD in order to follow the netiquette. As a matters of fact is the most non-profit way I could do it. I am not looking for any trouble, but this kind of things... well. I feel tension. In any case all that could happen here is ICANN cancelling the domain at some point maybe which doesn't stops me from using the name per se. In front of litigation a judge from the USA would fail in favor of anything US based no matter what. Ok as I said earlier I am not looking to cause any confusion or any tension. I am not looking to use that precise name or infringe any trademark. And still think is fair use. In any case I would really like to use a precise and descriptive name for the library if you feel uncomfortable with that one. Regards Waldo

1 0

Re: [tor-dev] Embedding tor in an application and using tor without opening a port
by wac 15 Apr '13

15 Apr '13

Hi Nick: I changed from libTor to libtor as Tor is a registered trademark but lowercase tor is not. I already paid for the domain and to make sure people knows is a library to use the Tor network. To name that sort like Silvertunnel is actually a deformation caused by fear of this policy that causes confusion among users that IMHO is causing problems at the Tor community. I am not a lawyer but even if it were I consider is pretty much fair use same way as Winrar, Winzip or Winamp are trademarks that use part of a brand from Microsoft Corp. to let know persons the software targets the Windows platform. This is also non-profit and I clarified at the website what is Tor and that carries no guarantee from the Tor Project about quality, suitability or anything else. The guidelines also say that being non-profit I could even use a modified Tor logo. I won't, but obviously I have absolutely no intentions of damaging any trademark or confuse anyone. This is in any case not a trademark, is just a name so people knows what they are getting that comes out almost naturally. A library to connect to the Tor network. I do not pretend to sell anything. But I made it lowercase however in order to reduce any possible tension. Is not that I have to obey any law from the USA as they don't apply to me. I perceive some ppl doesn't likes the idea. Some others do. Well ok is a diverse world, I do not pretend everyone to see it same way I do. Regards Waldo ------------------------------ On Sat, Apr 13, 2013 16:05 EDT Nick Mathewson wrote: >> On Apr 13, 2013 1:42 PM, "wac" <waldoalvarez00(a)yahoo.com> wrote: >> > >> > >> > Seems you want to put your hands at it so that makes two of us. You >don't need to do what I already did. I am preparing the environment to move >towards team mode. Check the website http://libtor.org. > >This name is likely to be a problem with our trademark policy. Please read >the policy, and consider a rename. > >-- >Nick

2 1

Re: [tor-dev] Embedding tor in an application and using tor without opening a port
by Nick Mathewson 13 Apr '13

13 Apr '13

> On Apr 13, 2013 1:42 PM, "wac" <waldoalvarez00(a)yahoo.com> wrote: > > > >> > > Seems you want to put your hands at it so that makes two of us. You don't need to do what I already did. I am preparing the environment to move towards team mode. Check the website http://libtor.org. This name is likely to be a problem with our trademark policy. Please read the policy, and consider a rename. -- Nick

2 1

Re: [tor-dev] Embedding tor in an application and using tor without opening a port
by wac 13 Apr '13

13 Apr '13

Hi Navis: Good to hear you built it. I have a working library with a defined API but is not re-entrant. It can connect with a server over Tor circuits and transmit/receive data but nothing is re-entrant at all. So the same Tor thread must be used for all of that ATM. I can fetch webpages like that however and can also do some limited chit-chat over IRC. I attempted to add some locking to some of the data structures but that is insufficient. For instance lists and buffers. Hash tables are complex. They are defined with some macros in order to make them generic overcoming some limitations of C language but they are less than maintainable IMHO. So I was thinking to replace them with another one already built with a similar license but re-entrant. Found a very good one. I have a couple of ideas to make it usable before that happens however. Seems you want to put your hands at it so that makes two of us. You don't need to do what I already did. I am preparing the environment to move towards team mode. Check the website http://libtor.org. In any case remember all of this to make it solid is not just about coding. Regards Waldo ------------------------------ On Thu, Apr 11, 2013 21:29 EDT Navin Francis wrote: >I managed to build it with MSVC after tinkering with the code a little. Did >you guys make any progress in making tor a library? It seems like I can >directly call functions like handle_getinfo_helper in control.c to control >tor. > >//application_main.cpp >//Application that starts tor in a new thread in the same process >#include <future> >#include <iostream> >#include "libtor.h" >using namespace std; >int main(int argc, char *argv[]){ >auto tor_return=async(launch::async,start_tor_main,argc, argv); >while (tor_return.wait_for(chrono::seconds(2))!=future_status::ready){ >char *ans; >const char *errmsg; >handle_getinfo_helper(NULL, "config/names", &ans, &errmsg); >cout<"application is running! ["<ans<"]"<endl; >} >return tor_return.get(); >} > >//libtor.h >//Duplicates the definitions in Tor. If there is a way around this, do >tell! :) >extern "C"{ >int start_tor_main(int argc, char *argv[]);//Tor's main() is renamed to >start_tor_main >int >handle_getinfo_helper(void *control_conn, >const char *question, char **answer, >const char **err_out); >} > >It seems like handle_getinfo_helper is called asynchronously by tor >whenever a GETINFO is recieved on the control port so I don't need >locking/synchronization. Can someone confirm this? > > >On Sun, Apr 7, 2013 at 4:40 AM, Gisle Vanem <gvanem(a)broadpark.no> wrote: >> >> I didn't read the original messege on this, but you have problem building >> Tor and it's libs using MSVC? If so, >> you could try my "GNU make" based system for MingW + >> MSVC here: >> http://home.broadpark.no/~**gvanem/misc/#tor<http://home.broadpark.no/~gvanem/misc/#tor> >> http://home.broadpark.no/~**gvanem/misc/tor-windows.zip<http://home.broadpark.no/~gvanem/misc/tor-windows.zip> >> >> I just tested it with today's Tor Git-repo. And it works for me. >> >> --gv >>

2 1