- tor-dev - lists.torproject.org

Re: [tor-dev] GSoC proposal: Panopticlick
by Akito Ono 25 Mar '16

25 Mar '16

Hi Georg, >Thanks. What does "check fingerprint's uniqueness" entail? Is it just a >"Unique? - Yes/No"-thing? If not, what are your ideas in this regard? I think it is not a "Yes/No"-thing. My idea is that the uniqueness of fingerprint is evaluated in each element relatively in recorded data and total uniqueness of a fingerprint is calculated by those ratios. I added my ideas to my proposal. Best regards, Akito

1 0

Notes from the prop259 proposal reading group
by George Kadianakis 25 Mar '16

25 Mar '16

Hello, we had a meeting about proposal 259 "New Guard Selection Behaviour". You can see the logs here: http://meetbot.debian.net/tor-dev/2016/tor-dev.2016-03-23-15.01.log.txt Some notes: - The latest version of the proposal can be found here: https://lists.torproject.org/pipermail/tor-dev/2016-March/010625.html There is also some discussion with Tim that has been happening in that thread since yesterday. It's likely that the proposal will be slightly changed (read: improved) as implementation and testing proceeds. The implementation of the proposal is currently happening here: https://github.com/twstrike/tor_for_patching/tree/prop259 - We discussed whether the guard algorithm should care about circuit restrictions like requiring that the guard of a circuit needs to be Stable (needs_uptime) or Fast (needs_capacity). We decided that for now the algorithm should be able to handle these restrictions, by skipping to the next guard that satisfies the conditions in case the top guard does not. This is also how the current guard algorithm works. In the future we should make it so that all Guards are both Stable and Fast, so that this stupid check does not need to happen [TODO: I should open a ticket for this if it doesn't already exist]. - We discussed how ReachableAddresses should work with regards to guardlists. A suggestion by Tim came from here: https://lists.torproject.org/pipermail/tor-dev/2016-March/010630.html who says: "I suggest that we compose the set of UTOPIC guards based on addresses that are reachable and preferred (or, if there are no guards with preferred addresses, those guards that are reachable). I suggest that we use the same mechanism with DYSTOPIC guards, but add a port restriction to 80 & 443 to all the other restrictions. (This may result in the empty set.)" I think this suggstion makes sense for now. - We also talked about directory guards and how they should work but we didn't come to a conclusion. My current intuition is that if a directory circuit appears that requires a directory guard, we treat it as a constraint the same way we treat needs_capacity and needs_uptime. So if our top guard cannot be a directory guard (is not a V2Dir), we skip it and go down our list till we find a guard that does. In the future (almost) all guards will be directory guards so this should become less of an issue (see #12538). - Finally, a topic that came up after the meeting in: https://lists.torproject.org/pipermail/tor-dev/2016-March/010635.html had to do with how we treat bad guards in SAMPLED_UTOPIC_GUARDS and SAMPLED_DYSTOPIC_GUARDS. So if suddenly 90% of the guards in SAMPLED_UTOPIC_GUARDS drop out of the consensus, what do we do? We mark them as bad, and then what? Do we remove them from the sampled list? Or do we keep them in there in case they come back? (This latter behavior is what tor currently does). But then if we keep them, don't we also need to add some more guards in there to make up for the bad ones? How exactly should this work? Some thinking needs to be done here. - We also discussed the need for good debug logging in the prop259 tor branch, so that we can test it ourselves. Ideally, the logging should be nice and intuitive, so that we can monitor the logs every now and then and check if the guard picking works properly. For example, if the algorithm keeps on switching guards all the time, there is a problem. If the algo is using the 5th guard while the 1st guard is up, it's a problem. Good logging should be able to reveal all these problems without having to spend 20 minutes investigating every new log message.

2 1

[GSoC 16] Proposal to work on the Ahmia.fi search engine
by Ismael R 25 Mar '16

25 Mar '16

Hi everyone, I'm a french student and I would like to share my GSoC application with all of you. I plan to work on the Ahmia hidden service search engine. Because of my experience with python, django and web in general, I feel like I can make a substantial contribution to this project during summer. I'm also very interested about the Tor ecosystem, and privacy in general. You can read my proposal on Google doc [1] or download a pdf [2]. You are welcome to comment it, I'm open to suggestions. Best regards, Ismael R. [1] : https://goo.gl/AT37hA [2] : http://dl.free.fr/f6EMq8vOu

1 0

Review of GSoC proposal - Ahmia.fi
by Srikrishna 25 Mar '16

25 Mar '16

Hi people, Sorry for the late approach. Here is my proposal for the project, Improving Ahmia.fi, search engine for hidden services. Any suggestions are most welcome. Thanks to Juha ( juha.nurmi(a)ahmia.fi ) for helping me out with the proposal. I'll be available on irc as 'skrish13' or you can comment on the doc itself or reply here :) Link for my proposal -> https://docs.google.com/document/d/1GOQMi7qkR7Ppuh4sF5EoSv4Io5D2Dwpz8OyzNoi… -- Thanks and Regards Srikrishna <Attached my PGP signature> <Using PGP/MIME, notify me for Inline PGP>

1 0

[GSoC] CONIKS implementation for Tor Messenger
by Huy Vu Quoc 25 Mar '16

25 Mar '16

Dear devs, My name is Huy, and I am a computer science student at Hanoi University of Science and Technology, Vietnam. GSoC is a great opportunity for me to contribute to Tor. I have been watching the development of Tor Messenger since its release. As my major is cryptography, I find the idea “implement and integrate CONIKS for Tor Messenger” very interesting. I am studying the CONIKS paper and my confusions were mostly answered in Elias's thread. I'm thinking about how to integrate CONIKS module to current implementation of Tor Messenger. I have some questions to ask: - A standard for data formats & protocol: I know the standard is essential for the project, so can I define a standard when developing (with your review) or I have to wait for your work in future? Another question about GSoC: - What should be deliverable by mid-term of GSoC? Btw, I also created a pull-request for ctypes-otr project on Github. Best, Huy Vu

3 9

WTF is going on? An evolutionary biology approach to the human condition
by Hugo Maxwell Connery 24 Mar '16

24 Mar '16

Dr. E. O. Wilson. 40 mins + 20 mins questions. https://www.youtube.com/watch?v=DWLoluq-HCo How and why. /Hugo PS: Sorry, this may be completely outside of the normal channel of this space. I hope that some members are shocked by this presentation. I believe in tech, but more importantly I believe in the informed.

2 1

Request for feedback/victims: cfc
by Yawning Angel 24 Mar '16

24 Mar '16

Hello, Inspired by https://trac.torproject.org/projects/tor/ticket/18361 I've been working on way to improve the situation. My "proof of concept" tech demo is what I consider good enough for use by brave people that aren't me, so I have put up an XPI package at: https://people.torproject.org/~yawning/volatile/cfc-20160323/ The source: https://git.schwanenlied.me/yawning/cfc (Requires the Firefox SDK aka Jetpack to package). By default the addon will: * Rewrite the CloudFlare captcha error page with messages that reflect my perception of reality[0]. * Rewrite imgur ".gifv" links to ".gif". Under "Tools->Addons->Extensions" you can configure the addon to: * Automatically fetch a cached copy of pages hosted on CloudFlare infrastructure from archive.is. * Automatically fetch a cached copy of pages that present a CloudFlare captcha from archive.is. * Pop up a UI widget asking if you want to fetch a cached copy of the page from archive.is each time you encounter a captcha. * Disable the snarky error message replacement (Requires a restart to take effect, because I'm lazy). * Disable the gifv URL rewrite. TODO: * Support a user definable blacklist (eg: If you want to always use archive.is to access gawker.com or other clickbait bullshit, you should be able to easily do so). * Add more general quality of life things. * Think about making it work on Fenec (It currently will not because PopUpNotifications are handled differently, among other things). * Rewrite the internals to prepare for e10s. WARNING: * If archive.is is evil, they can track you across page fetches trivially, because this sort of use case is outside of Tor Browser's current threat model (Yes, CloudFlare/Google can also do the same thing currently, who do you trust more?). * PEOPLE THAT HAVE BIG SCARY ADVERSARIES IN THEIR THREAT MODEL SHOULD NOT USE THIS. If you don't know how to install addons given as XPI files, you shouldn't be using this. This is only tested on 6.0a4 (Linux/64 bit). It *should* work on everything that isn't Orfox that's relatively modern, YMMV. Regards, -- Yawning Angel [0]: A very cynical/adversarial take on things. Opinions are my own, etc, and I don't care if you're offended.

7 8

Urgent fixes for 0.2.8.2-alpha
by Tim Wilson-Brown - teor 24 Mar '16

24 Mar '16

Hi All, I think I've completed the urgent fixes assigned to me for 0.2.8.2-alpha and mentioned in the network team meeting yesterday. If we merge the following patches into the upcoming 0.2.8.2-alpha, we'll know: #18616 - whether AccountingMax still breaks relay bootstrap (master - not in any released version) #18351 - whether log messages are too frequent, or whether there are actual outgoing connection issues (0.2.8.1-alpha) #18517 - whether meek and bridges on private addresses are still broken (0.2.8.1-alpha) #18489 - whether extrainfo descriptors are still broken with fallback directory mirrors (0.2.8.1-alpha / 0.2.4.7-alpha) The release in brackets is when each issue was introduced. I don't know of any other patches (assigned to me) that are urgent enough to hold up the next alpha. Tim Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP 968F094B teor at blah dot im OTR CAD08081 9755866D 89E2A06F E3558B7F B5A9D14F

1 0

GSOC'16
by Ahmet Fatih Çamaltı 24 Mar '16

24 Mar '16

Hi, I'm Ahmet. I'm a senior undergraduate Computer Science student at Turgut Ozal University, Turkey. I'm interested Expand the OS and Server Support of the Let's Encrypt Client project for GSOC'16 and I would like to work on this. I will write proposal draft and upload to the system soon. Should I need to do anything else? Can you provide a little bit more details for this project for the proposal? Thank you for your interest.

1 0

GSoC proposal: Panopticlick
by Akito Ono 24 Mar '16

24 Mar '16

Hello! I'm writing a proposal for the Panopticlick project. Would you advise me about this proposal? https://gist.github.com/ak1t0/1bf1b6bd4e3fc99e2097 Best regards, Akito

2 3