- tor-dev - lists.torproject.org

Orfox: Tor Browser for Android - GSoC 2016
by Amogh Pradeep 26 Apr '16

26 Apr '16

Hey guys, I’m amoghbl1, a 3rd year undergraduate student at International Institute of Information Technology, Hyderabad. I have been selected to work on Orfox this summer as part of Google Summer of Code. Here is my proposal if anyone wants to take a look at it: http://people.torproject.org/~amoghbl1/GSoC_2016.pdf <http://people.torproject.org/~amoghbl1/GSoC_2016.pdf> . I have tried to contribute to tor project as much as I can since 2013. I started working on Orbot late 2013 and did GSoC with tor in 2014. Since then, I have tried to involve myself with this community as much as I can. Trying to balance college work and my open source work has been difficult, but I’ve tried my best and have dedicated the past two summers to tor. In 2014, it was GSoC and in 2015, I went on to become an intern at The Guardian Project. This summer, I get to contribute again and hope to continue doing so after the summer as well. I will also be pursuing research this summer, as a visiting scholar at Katholieke Universiteit Leuven. But the best part is, I am going to do research browser fingerprinting risks for mobile browsers and Orfox. So I guess I get to enjoy the best of both worlds of research and development! Please do let me know if you have any suggestions, I’m always available on email and IRC. amoghbl1 on OFTC as well as Freenode. Best, Amogh Pradeep amoghbl1(a)gmail.com <mailto:amoghbl1@gmail.com>

1 0

Stress testing guard nodes
by Abhishek Singh 26 Apr '16

26 Apr '16

Hi, I am trying to identify bottlenecks at an entry guard when it is used to create a large number of circuits. To identify this I started a set of clients which use a single entry-guard to create 5K-10K circuits in total. With this scale clients observe timeouts (waiting for CREATED cell) while constructing circuits and they consider the entry guard to be down. I control the entry-guard chosen in this experiment and no other client should be using this relay node as a entry guard as it does not have GUARD flag in consensus. Lack of bandwidth at the entry guard is not the cause for timing-out for circuits. It consumed 80-90 KBps while the entry guard's RelayBandwidthRate is set to 400 KBps. Also, CPU at the entry-guard is not bottleneck as it was always less than 10% during the course of experiment. Can anyone provide me pointers to why these circuits timeout? And, what would be an effective way to verify that this indeed is the bottleneck? I tried profiling the entry-guard with callgrind but this is extremely slow. In the meanwhile I will create a static tor instance so that gprof produces some meaningful results. Motivation for this work is to enable a client to predict how many circuits it can create without degrading performance of its entry-guards. If a circuit is not created within a timeout period, then the client perceives the entry guard to be down and it starts using another guard node. If the client keeps on creating excessive circuits, then it is more likely to end-up using a malicious (and resourceful) entry guard. The prediction model would help the client to stay anonymous as it would refrain from unnecessarily switching guard nodes. Thanks, Abhishek

2 1

[GSOC 16] Ahmia : Hidden service search engine
by Ismael R 26 Apr '16

26 Apr '16

Hi everyone ! My name is Ismael and I'm a french student in information security. I will be working on the Ahmia search engine for this year's Google Summer of Code. Before going back to school, I was working as a "full-stack" developer for a web agency. This is why I have a little experience with the tech I will be using for this project. I'm also more free-software and privacy conscious since a couple months, that's why I'm really happy to contribute to the Tor Project. I will be working from 23 May to 21 August with my mentors Juha Nurmi (numes) and George Kadianakis (asn). I plan to send bi-weekly reports on tor-dev@. I have several major goals: Review code and infrastructure This is the part where I focus on code quality, test cases, automation and fixing bugs. I want to make existing features work better, faster, easier. Improve the search experience It all starts with indexing more information about hidden services: - Browse links on the same hidden service and treat them as different search results - Get a screenshot of the page and display it on search results - Using statistics (popularity, backlink) to give search results a score and sort them. Then, the search engine should accept commands (think duckduckgo's !bangs) or parameters (think google's site:*). Finally, (and I'm not sure I will have the time to implement this) consider using natural language processing techniques to better understand the search's query or a page's title, description or content. Statistics What should we be collecting? Can it improve search results? How can we share or visualize the data? You can read my complete project proposal on Google doc [1] or download a pdf [2]. I'm open to suggestions or questions. You can reach me by email or IRC (nick: zma). Cheers, Ismael [1] : https://goo.gl/AT37hA [2] : http://dl.free.fr/f6EMq8vOu

2 1

[GSoC16] Expand Nyx
by Sambuddha Basu 25 Apr '16

25 Apr '16

Hi everyone! I'm Sambuddha, a junior year undergraduate from IIIT-Hyderabad, India. This summer, I will be working on expanding Nyx(previously known as Arm) as a part of GSoC 2016. Nyx had its last release(1.4.5) back in 2012 and is presently under development for its next release. Some of the things that I will be working on are, getting the interpreter panel[1] back to Nyx, making use of additional relay information provided by Onionoo and expanding unit testing for Nyx. You can read my complete project proposal at [2]. My primary mentor is Damian Johnson (atagar) and my secondary mentor is Sebastian. I plan on working on the project from the first week of May till the end of July. During this time, I will be sending bi-weekly reports to this list. I'm open to any questions or suggestions and, my IRC nick is: sambuddhabasu1 Cheers! Sambuddha [1]: https://www.atagar.com/arm/images/screenshot_interpretor_full.png [2]: https://docs.google.com/document/d/12bZZq_eOMNYR8rxP4AhEgkayamLcWWul35aKgy4…

1 0

Tor Browser Bundle on musl libc systems
by Daniel Simon 25 Apr '16

25 Apr '16

Hi, the Tor Browser Bundle binaries available at https://dist.torproject.org/torbrowser/5.5.4/ do not run on musl-libc-based systems, like Void Linux, Alpine Linux, and other Linux distributions. I believe that's the case because the Tor Browser Bundle binaries are compiled dynamically to glibc, making them fail when ran on systems that any other libc. I'm sending this message to the Tor mailing list and to the Musl mailing list, so we can together find a solution. I think there are 4 possible solutions: - the tor developers can provide binaries built with musl libc - the tor developers can provided statically compiled binaries (with any libc, but musl is especially good for this). These statically compiled binaries would run on any system independently of the libc. - the musl libc developers could identify why the binaries fail on musl and try to add compatibility - Linux distributions that use musl libc could figure out how to compile the Tor Browser Bundle from source and provide binaries themselves What does everyone think about these possible solutions? Which one is the best? Are there any others you can think about? Thanks for everyone's time, D. Simon

1 0

meek-server performance improvements?
by David Fifield 25 Apr '16

25 Apr '16

I saw you say on IRC that you had an idea for improving the efficiency of meek-server. What's your idea? The server hosting meek-azure is passing 90% CPU at times. One idea I've seen is using one connection for upstream data (data-carrying POSTs, emptry responses), and one connection for downstream data (GET, one big chunked download). As I understand it, this is what Lantern's enproxy does: https://github.com/getlantern/enproxy So far I've avoided this idea because of the possibly weird traffic patterns. I've also done some preliminary work on allowing the server to send data in larger chunks, which should reduce polling: https://trac.torproject.org/projects/tor/ticket/12857#comment:4 All that's really needed here is a decision on how to let the client indicate that it supports such a server, as the change is backward incompatible.

2 2

Onioncat and Prop224 (was Re: [tor-onions] Hidden datagram service)
by Tim Wilson-Brown - teor 25 Apr '16

25 Apr '16

> On 22 Apr 2016, at 17:03, grarpamp <grarpamp(a)gmail.com> wrote: > ... > > https://www.onioncat.org/ > https://www.cypherpunk.at/onioncat_trac/ > > FYI: The onioncat folks are interested in collaborating > with tor folks regarding prop224. > > https://gitweb.torproject.org/torspec.git/tree/proposals/224-rend-spec-ng.t… Hi grarpamp, I'm interested in what kind of collaboration onioncat would like to do on prop224, next-generation hidden services. It would be great to work this out in the next few weeks, as we're coding parts of the proposal right now. But the tor-onions mailing list is to discuss the technical details running onion services. Can we discuss onioncat, tor, and the development of prop224 on tor-dev mailing list? Tim Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP 968F094B ricochet:ekmygaiu4rzgsk6n

1 0

[GSoC16] A website to improve Tor fingerprinting defenses
by Pierre Laperdrix 24 Apr '16

24 Apr '16

Hi Tor Community! My name is Pierre and I'm a second year PhD student from France working on browser fingerprinting. I'm really fortunate that my proposal for this year Google Summer of Code has been been selected. My goal for this summer is to set up a website similar to Panopticlick or AmIUnique that will collect data to improve Tor fingerprinting defenses. The collected data will be used to detect if there are differences between browsers that could ultimately lead to a user's identification. With that knowledge, developers will be able to patch the Tor browser to prevent leak of identifiable information and reinforce the anonymity of Tor users. I also plan to add details on browser fingerprinting for users who are not familiar with the subject so that they may learn about its mechanisms and the potential dangers linked to it. I'll also try to implement a page where Tor users can see how far they are from an "acceptable" fingerprint so that they may tweak their browser in order to have a fingerprint that is shared by many more users. I'll officially start coding at the end of May but in the mean time, I'll familiarize myself with the Django framework that I plan to use and I'll lock down the exact set of features that I'll include in the very first version of the project. My primary mentor is Georg and my secondary mentors are Gunes and Nicolas. I'll post bi-weekly reports to the tor-dev mailing list and to my blog to inform everyone of my progress. If you have any questions about the project, don't hesitate to ask me. The name of the project has not been found yet so feel free to send me any suggestions that you may have. You can reach me here or on IRC where my handle is SuperOctopus. Cheers! Pierre

3 5

CollecTor has a new Git home
by Karsten Loesing 24 Apr '16

24 Apr '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi devs, the CollecTor Git repository just moved from metrics-db to collector: https://gitweb.torproject.org/collector.git/ The old name made sense when the Tor network data archive was still part of Metrics, but it's rather confusing since CollecTor and Metrics are two distinct services. Therefore the renaming. If you have cloned the CollecTor sources in the past, you'll want to update the Git remote. The following line worked for me, but there are probably a dozen other ways: git remote set-url origin https://git.torproject.org/collector Let us know if you have any trouble. All the best, Karsten -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXHIcDAAoJEC3ESO/4X7XBD0MH/jz5sq9KAieUKPxvg3sW0v5t iEbDI5wFav/KGJpa7TaBZ8+XJ3KNm8N97fVsQwryGsXVIugci0eH72x+WedM4TAZ +JyRaAmaRroz+etPByQFU17SHisJX4wA2yJ9KwO1XmxhWKpiIMKV4pMFkCqOjDER VMmu6AGXRihoUrkPpsXn0iXHK7s1gLyfBeAkC5lWO8GM2FedVP2xkzSXKaM15+Y9 oP8UZ0gFaIWIhIok0i/GdClJHIQxppBW+aqJ4g5wFx3J8rHczvGEpTMF9oy+xK2D LaZTmqWHWMvdjVaF968KdFkW2GMhiGf+znYuZS1LpChu7WAeGANEanR5yaoE9J0= =X47s -----END PGP SIGNATURE-----

1 0

[GSoC] CONIKS for Tor Messenger - gsoc.hello()
by Huy Vu Quoc 23 Apr '16

23 Apr '16

Hi everyone! I'm Huy, a senior year undergraduate from HUST-Vietnam, who is starting to work with CONIKS for Tor Messenger as a part of Google Summer of Code. This project aims at implementing a CONIKS server for key verification and a CONIKS client which integrates with the Tor Messenger client. The details of CONIKS system is described in [0]. My mentors are Marcela and Arlo. I will start with this project soon, may be on the first day of May and finish at the end of July. Currently, I am studying deeper about crypto primitives. After that, I think I will speed up with code base in the GitHub :) I will be on IRC as c633, in GitHub as c633. I will send bi-weekly status reports to this list, and also share it on my blog [1]. Cheers! Vu Huy — [0]: https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper… [1]: http://c633.net

1 0