- tor-dev - lists.torproject.org

Comments on Yawning's Draft proposal for Debian
by bancfc＠openmailbox.org 12 Jun '16

12 Jun '16

I thought the proposal [1] is well written but there is one major point it should include: Sometimes apt/dpkg can contain remotely exploitable bugs which s a big risk when updates are fetched over HTTP. As it happens, anyone could have been in a position to poison the update process and take over the machine because of [CVE-2014-6273] in apt-get [2]. What makes this bug crippling is that updating apt to fix it would have exposed it to what the fix was supposed to prevent. The safest option this time was to manually download the fixed package out of band. Updating from an Onion Service would protect systems from any tampering/attacks at the Exits while bringing all the usual benefits of package metadata privacy. *** While there's been some progress to setup Debian APT Onion Services [3][4], its still a long way away from being enabled as a safe default. This problem along many others summarized in the Debian wiki [5] (such as upstream patching of chatty apps that leak system information like pip [6]) would make great talking points at the next DebConf. [1] https://yawnbox.com/index.php/2016/05/03/draft-proposal-for-debian/ [2] http://security-tracker.debian.org/tracker/CVE-2014-6273 [3] http://richardhartmann.de/blog/posts/2015/08/24-Tor-enabled_Debian_mirror/ [4] http://richardhartmann.de/blog/posts/2015/08/25-Tor-enabled_Debian_mirror_p… [5] https://wiki.debian.org/TorifyDebianServices [6] https://lists.debian.org/debian-security/2016/05/msg00059.html

1 0

remotor - control console that can also notify into a chatroom
by carlo von lynX 12 Jun '16

12 Jun '16

Hi there. Here's a fine new little console-based perl script that lets you control your Tor, monitor circuits as they happen, issue commands like changing your identity etc, and forward critical events to a chatroom using the PSYC protocol. I found vidalia too heavy and arm too confusing and didn't see a simple tool that would leverage the Tor control protocol without excessive nuisances, just a bit of noise reduction and text coloring. Also I like notifications to show in my chat client. The notification feature works with a psyced running on the same host. I just committed a "remotor" chatroom which is preset to receive messages from the tool, all you need to do is install psyced and use your IRC client to join #remotor. You can git remotor and the rest of the perlpsyc library from torify git clone git://cheettyiapsyciew.onion/perlpsyc or git clone git://git.psyced.org/git/perlpsyc If you're a lucky owner of a Gentoo system, you can emerge both Net-PSYC and psyced from http://youbroketheinternet.org 's overlay. remotor should work pretty much out of the box. For a quick little glimpse into the perl script, click http://perl.psyc.eu/navigate/bin/remotor If anyone is interested, I can easily add the ability to control the Tor node from the chatroom. http://perl.psyc.eu tells you of the other tools included such as git2psyc for commit notifications in your developer chatroom, syslog2psyc, psycfilemonitor, psycmail, psycmp3... you get the idea. There's also a tarball for download, no wait, it's a zip. -- E-mail is public! Talk to me in private using encryption: http://loupsycedyglgamf.onion/LynX/ irc://loupsycedyglgamf.onion:67/lynX https://psyced.org:34443/LynX/

1 0

Bridge Directory Consensus
by Nicholas R. Parker (RIT Student) 07 Jun '16

07 Jun '16

I've got a quick question for you all. I have a functioning bridge directory authority and a bridge that's presumably pushing its descriptor to the authority (presents no error messages at all). My question is this: How do I confirm an update to the "bridge master list" on the authority? It doesn't appear on the general ip/tor/status-vote/consensus page, but that would make sense. Is there a bridge list generated to hold the descriptors? Nicholas R. Parker Rochester Institute of Technology

2 1

Paper: SoK: Towards Grounding Censorship Circumvention in Empiricism
by bancfc＠openmailbox.org 07 Jun '16

07 Jun '16

A paper presented at the Security and Human Behaviour 2016 conference examining how Tor pluggable transports old up against dozens of detection techniques. Censors focus more on detecting circumvention techniques during the setup phase than after the fact - opposite of most academic work in this area. http://internet-freedom-science.org/circumvention-survey/sp2016/sok-sp2016.…

2 1

DescripTor 1.2.0 is released
by Karsten Loesing 06 Jun '16

06 Jun '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello devs, I just released DescripTor 1.2.0: https://dist.torproject.org/descriptor/1.2.0/ - From the change log: # Changes in version 1.2.0 - 2016-05-31 * Medium changes - Include the hostname in directory source entries of consensuses and votes. - Also accept \r\n as newline in Torperf results files. - Make unrecognized keys of Torperf results available together with the corresponding values, rather than just the whole line. - In Torperf results, recognize all percentiles of expected bytes read for 0 <= x <= 100 rather than just x = { 10, 20, ..., 90 }. - Rename properties for overriding default descriptor source implementation classes. - Actually return the signing key digest in network status votes. - Parse crypto parts in network status votes. - Document all public parts in org.torproject.descriptor and add an Ant target to generate Javadocs. * Minor changes - Include a Torperf results line with more than one unrecognized key only once in the unrecognized lines. - Make "consensus-methods" line optional in network statuses votes, which would mean that only method 1 is supported. - Stop reporting "-----END .*-----" lines in directory key certificates as unrecognized. - Add code used for benchmarking. In particular the full rewrite of Javadocs was painful but hopefully useful to people here, not necessarily just DescripTor users but anyone working with Tor network data. Here's the compiled web version until DescripTor has its own website: https://people.torproject.org/~karsten/volatile/descriptor-docs-2016-05-31/ Many thanks to iwakeh for helping with most of these changes! All the best, Karsten -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXTeNUAAoJEC3ESO/4X7XB208IAKwyJF2jgjvuREfYKkI9UFva ZoMbXgITXfTNJ4hXSc5x30jMw56xVummaWMMgBKwscPyhJAdngUjxQt//8ZOwFx/ hezHbRGxxRZquiROvIMW1mLIfnvSnkZAVL6tPuQmiKfqcR2ExMs3KCZsdCcfI/KR ZB9tHnGsSqhME+XPxQNAhT/OgBNnaq4Y7WFMhLuOHDm4/sCIjeoeix8aF1ve27ue FdOvaxjY1iBipxNdKkup5SXmL1tBmQ7bwTV59EduLatq+30tMnE7Xyat9MeQMyGI Bs9/5h+f29zREzyPp6kPd/m0eN1udvXF8nqa34QqAk0YHECE1BoIRDRo7qkixx4= =xs8m -----END PGP SIGNATURE-----

3 5

Improving PT documentation on website
by George Kadianakis 06 Jun '16

06 Jun '16

Hello Nima, I see you said this on IRC yesterday while referring to the pluggable transport docs: "I'm gonna be working on some of these documentations this month. do you have any suggestions on how we can improve them?" I agree that this is extremely high priority right now and I'm very glad to see you working on it. I feel that this is far more important than designing new protocols at this point. The way I see it, our main issues with PTs at this point is documentation and UX. I imagine you are talking about https://www.torproject.org/docs/pluggable-transports.html.en and maybe also the wiki page: https://trac.torproject.org/projects/tor/wiki/doc/PluggableTransports Some thoughts: - With regards to the pluggable-transports.html.en page: -- we should cleanup the PT list in the website. only include deployed PTs. maybe even remove list entirely and move it to wiki. if that page is only for users, they don't need to know info about each PT. -- add some sort of intuitive diagram similar to: https://www.torproject.org/images/obfsproxy_diagram.png -- link to the new video as well -- IMO we need a PT logo to give PTs a visual identity. When I wrote those pages, I used the moustached-onion logo. Do we have a better one? - We also need up-to-date instructions on how to setup obfsbridges. -- Maybe we need https://www.torproject.org/projects/obfsproxy.html.en but for obfs4 -- Here are the instructions that need to be updated: https://www.torproject.org/projects/obfsproxy-debian-instructions.html.en#i… https://www.torproject.org/projects/obfsproxy-instructions.html.en#instruct… -- (but obfs5 is coming soon as well... PT deployment startegy not very good.) - The wiki page is also quite bloated by now, and it's unclear what the audience is. -- The wiki page should also have links to user/bridge instructions, since that's where most people end up looking. -- It might be worth cleaning it up, or splitting it in multiple pages. especially so since we link it from the main PT page. I'm not very good with UX and web design stuff, but the above list would be the things I would start addressing first... Let me know what you think!

1 0

[GSoC 2016] Exitmap Improvements Project - Status Report #1
by Mridul Malpotra 05 Jun '16

05 Jun '16

Hey everyone! Here a few points from my initial 2 weeks at working on Exitmap improvements project. 1. Gone through the Exitmap code base and understood the working. Primarily identified the Tor Browser actions that can be replaced for better automation. 2. Currently there is a simple HTTP header that is being used for a simple GET request. As suggested in the proposal, using Selenium seems like the right choice. I have read about the RC and WebDriver and have decided to go forward with the latter as it allows for programmable actions as supported by the Firefox browser and also has Python support, allowing for better integration with the existing scanner. 2a. Studied the basics of the Selenium Webdriver and learnt simple browser automation techniques on Firefox - interaction with the webpage and other pool of actions. 2b. Ported basic actions to Tor Browser. Facing some issues with integration which I hope to rectify in a day or two and push. Next two weeks will involve: 1. Integrating randomized actions on Tor Browser with Exitmap. Creating a pool of possible ways to interact with the web service to make it difficult for the malicious Exit node to suspect scanner activity. 2. Add test cases to added interactions and observe changes in scanner output from the initial simple usage of urllib2 actions and assert the changes. I apologize for the delay in submitting my first report. Cheers! Mridul (mtyamantau) ============================= PGP keyID: 0xb716e33ab6d0a653

3 2

Getting error while making a build
by AKASH DAS 04 Jun '16

04 Jun '16

I am getting the following error while running make fetch :- Can't exec "hg": No such file or directory at rbm/lib/RBM.pm line 406. Error: Error cloning https://hg.mozilla.org/releases/mozilla-esr45/ make: *** [fetch] Error 1 any help would be appreciable.

2 1

[GSoC16] Expand Nyx - Status Report 1
by Sambuddha Basu 04 Jun '16

04 Jun '16

Hi everyone, This is the first status report for the 'Expand Nyx' project for GSoC 2016. I have been working on the following things: * Load events dynamically from Tor for event selection. For selecting the events, the users can `check` any event. The dialog box remembers previously selected events and includes Tor runlevels and Nyx runlevels along with the Tor events. * The event descriptions have been added to Stem. The event descriptions will be leveraged into Nyx in the future patches. * Added unit tests for the event selection dialog box[1] Next up, I will be working on adding the event descriptions along with the event selection dialog box. Hope everyone has a fun weekend! Sambuddha [1]: https://gitweb.torproject.org/nyx.git/commit/?id=a976f7699c9ed63ca65c16da71…

1 0

Jacob Appelbaum's departure?
by Jacek Wielemborek 03 Jun '16

03 Jun '16

Hello, I heard on Hacker News that Tor Project announced that Jacob Appelbaum "Appelbaum stepped down from his position at The Tor Project". Why is that? HN users are theorizing about FBI's involvement: https://news.ycombinator.com/item?id=11831629 Does anybody know anything specific? Cheers, d33tah

2 1