- tor-dev - lists.torproject.org

Request for feedback/victims: cfc
by Yawning Angel 24 Mar '16

24 Mar '16

Hello, Inspired by https://trac.torproject.org/projects/tor/ticket/18361 I've been working on way to improve the situation. My "proof of concept" tech demo is what I consider good enough for use by brave people that aren't me, so I have put up an XPI package at: https://people.torproject.org/~yawning/volatile/cfc-20160323/ The source: https://git.schwanenlied.me/yawning/cfc (Requires the Firefox SDK aka Jetpack to package). By default the addon will: * Rewrite the CloudFlare captcha error page with messages that reflect my perception of reality[0]. * Rewrite imgur ".gifv" links to ".gif". Under "Tools->Addons->Extensions" you can configure the addon to: * Automatically fetch a cached copy of pages hosted on CloudFlare infrastructure from archive.is. * Automatically fetch a cached copy of pages that present a CloudFlare captcha from archive.is. * Pop up a UI widget asking if you want to fetch a cached copy of the page from archive.is each time you encounter a captcha. * Disable the snarky error message replacement (Requires a restart to take effect, because I'm lazy). * Disable the gifv URL rewrite. TODO: * Support a user definable blacklist (eg: If you want to always use archive.is to access gawker.com or other clickbait bullshit, you should be able to easily do so). * Add more general quality of life things. * Think about making it work on Fenec (It currently will not because PopUpNotifications are handled differently, among other things). * Rewrite the internals to prepare for e10s. WARNING: * If archive.is is evil, they can track you across page fetches trivially, because this sort of use case is outside of Tor Browser's current threat model (Yes, CloudFlare/Google can also do the same thing currently, who do you trust more?). * PEOPLE THAT HAVE BIG SCARY ADVERSARIES IN THEIR THREAT MODEL SHOULD NOT USE THIS. If you don't know how to install addons given as XPI files, you shouldn't be using this. This is only tested on 6.0a4 (Linux/64 bit). It *should* work on everything that isn't Orfox that's relatively modern, YMMV. Regards, -- Yawning Angel [0]: A very cynical/adversarial take on things. Opinions are my own, etc, and I don't care if you're offended.

7 8

Urgent fixes for 0.2.8.2-alpha
by Tim Wilson-Brown - teor 24 Mar '16

24 Mar '16

Hi All, I think I've completed the urgent fixes assigned to me for 0.2.8.2-alpha and mentioned in the network team meeting yesterday. If we merge the following patches into the upcoming 0.2.8.2-alpha, we'll know: #18616 - whether AccountingMax still breaks relay bootstrap (master - not in any released version) #18351 - whether log messages are too frequent, or whether there are actual outgoing connection issues (0.2.8.1-alpha) #18517 - whether meek and bridges on private addresses are still broken (0.2.8.1-alpha) #18489 - whether extrainfo descriptors are still broken with fallback directory mirrors (0.2.8.1-alpha / 0.2.4.7-alpha) The release in brackets is when each issue was introduced. I don't know of any other patches (assigned to me) that are urgent enough to hold up the next alpha. Tim Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP 968F094B teor at blah dot im OTR CAD08081 9755866D 89E2A06F E3558B7F B5A9D14F

1 0

GSOC'16
by Ahmet Fatih Çamaltı 24 Mar '16

24 Mar '16

Hi, I'm Ahmet. I'm a senior undergraduate Computer Science student at Turgut Ozal University, Turkey. I'm interested Expand the OS and Server Support of the Let's Encrypt Client project for GSOC'16 and I would like to work on this. I will write proposal draft and upload to the system soon. Should I need to do anything else? Can you provide a little bit more details for this project for the proposal? Thank you for your interest.

1 0

GSoC proposal: Panopticlick
by Akito Ono 24 Mar '16

24 Mar '16

Hello! I'm writing a proposal for the Panopticlick project. Would you advise me about this proposal? https://gist.github.com/ak1t0/1bf1b6bd4e3fc99e2097 Best regards, Akito

2 3

GSoC proposal Review
by Pushkar Pathak 24 Mar '16

24 Mar '16

Hi, Please review my proposal to Improve Ahmia-Hidden Search Service https://docs.google.com/document/d/1VylEqQBdFPe-ev_naT9qA4ycNM1_U5j8OhMLATD… Thanks, Pushkar.

1 0

(no subject)
by Huy Vu Quoc 24 Mar '16

24 Mar '16

Hi Arlo, > It may be prudent to consider a memory-managed language (I'll suggest golang here as popular choice) for the server component. It is good to know that I can use golang to develop the server component. I am going to rewrite this part. > Wherever possible, we'd like to avoid modals and use the notification bar. There's also a suggestion to grey out the conversation window and use a throbber here, https://github.com/arlolra/ctypes-otr/issues/20 Since the monitoring protocol is done periodically so there certainly exist a case of an unexpected key change whereas there are not any conversation windows. In such a case, how do we show the message using the notification bar? I think that a popup modal is a good choice for this situation. Btw, I also added a timeout enforcement for responding to events in my proposal. Timeout for requests is 100ms and this can be changed based on some surveys and tests during development phase (may the registration request take a longer time than other requests?). Best Regards, Vu Huy

1 0

Query regarding GSOC '16 - txtorcon
by Akash Mishra 24 Mar '16

24 Mar '16

Hi all, I am Akash Mishra, an undergraduate from India and if given an opportunity, I would love to participate in GSOC with the TOR project. This will be my first time contributing to an open source project. I have been using python for all my college projects for over a year. Due to my familiarity with python, I would like to work on txtorcon - Convert txtorcon to txaio - during the summers. The requirements state that I should be very familiar with asynchronous programming and with one of twisted or asyncio. I have only basic familiarity with asyncio - having explored it once after watching a pycon talk on it. But I am very enthusiastic to learn and bridge the skillgap that will be needed to complete the project. I have already started with the krondo tutorials on twisted to gain familiarity with the twisted framework. How should i get started with txtorcon project ? Are there any minor issues that i can work on as of now ? Thanks, Akash Mishra

2 7

Notes from network team meeting Wed 3/23/2016
by Isabela 23 Mar '16

23 Mar '16

tl;dr; important updates related to triage process and important discussion topics related to release guidelines draft. Also, help needed to get 0.2.8 out. Pay attention to next meeting time! It's new! == Notes from little t Tor team - Wed March 23rd @ #tor-dev == Participants + updates: * nickm - working on modularity documentation + reviewing, merging, fixing bugs. Got coverity autobuilds to happen 3 times a week, we can have others if desired (up to 8 a week). This link might be useful: https://people.torproject.org/~nickm/tor-auto/ - next week: more triage and planning things. Finish up modularity ideas and v1 implementation for most of them; release 0282rc * isabela - I migrated all the info you added into the spreadsheet back to trac (thanks for doing it); worked on the release guidelines first draft with nick and y'all has it now; trying to organize the next step on triagging (need some answers to help guide it / email I sent yesterday); * asn - did some guard research, also did some hackerone triaging. Finally I also did some work on prop224 specifically on the cell formats. i have a torspec branch with initial changes here: https://lists.torproject.org/pipermail/tor-dev/2016-March/010561.html - I also started a thread about more singificant changes to the cell, here it is https://lists.torproject.org/pipermail/tor-dev/2016-March/010560.html * armadev - I actually wrote a tiny bit of Tor code lately (#18332). I mostly have questions though (from thinking this morning): a) Where is the 0.2.8 timeline posted? Maybe it should be on the network team trac page? Or somewhere else? b) I see athena mentioning backporting the #18570 patch. Do we (you) have consensus on what is worth backporting? Should we (you)? (i would argue that the patch doesn't want a backport) (i see the questions for me about prop224. i am being a bad person and not being able to keep the 224 design in my head. that makes it hard to usefully answer questions. :/ ) * dgoulet - code review and a bit of patches last week, got sucked in LibrePlanet during friday/weekend/monday and I basically catched up on things yesterday. I plan to continue prop224 implementation today as I'm moving to do the cache work for HSDir. so I still need to answer bunch of people on email including GsoC stuff for HS but hoping to jump back in the coding arena * athena - merged #18570 past week (but it needs code review for backport to 0.2.7; on it); now digging into some code reviews (working on #7478) == Discussion topics and action items: Backport strategy Athena will take over 0.2.7 (and any other previous release if she can) - this means doing the backports / merges / releases. Athena could start by going over all the tickets in maint-0.2.7 and saying which should get backported, which not? armadev and weasel will have opinions. About backport policy in general, here is a draft: http://paste.debian.net/418364/ Isabela will look in the wiki for any old notes related to this topic and create a new page for our policy on Network Team's wiki. #idea: two-person approval to backport? #commnet: a nice side effect of a good backport policy is that it saves time and effort 0.2.8 timeline Timeline was freeze-start-of-march, then rc mid-march, we did the freeze ontime and now the rc is late. And we are concerned about when it will be ready to go out. Folks should prioritize 0.2.8 release and 0.2.9 *triage*. If everybody else jumps into 0.2.9 without nick, and/or without triage, bad stuff will happen. Most obviously, 0.2.8 will be slow, and everything else will get off track with 0.2.9. Tickets that we are waiting on a decision are market with the tag: 'must-fix-before-028-rc', we will probably ignore those marked as 'needs-info'. During discussion people took tickets to review and we will follow up in the next meeting. About timelines in general we are trying to build guidelines (timeline) for all releases. once is finalize we will add it to the wiki Summarize promising gsoc students for network team topics? We decided on the both actions items: * get quick list of network-team-related projects * somebody ask atagar if there are network team projects without enough adequate associated possible mentors Discuss draft plans for 029 release/triage/etc. We reviewed priority list and capacity formula in the pad: https://storm.torproject.org/shared/71UUCvDgDA6q9lfdndAtRZoWQdjz4Wb8EoX0eLy… Most important thing to do from now till Friday is to make sure tickets on 0.2.9.x-final milestone has the following information: * points - small == <1 day (a task you can get done in a day)| medium == <1 week | large == +1week * owner (assign a ticket to yourself if you are the one doing the task) * priority * sponsor -must and -can information If you want to suggest a ticket to be part of 0.2.9 now is the time to add it to the milestone. The above will give us the necessary information to organize our release until it has a good size for the team. Discussion about tickets workflow We will send an email to tor-dev talking about adding a step to the workflow ("need_merge", "ready_merge") to indicate that it has been reviewed and someone did Acked it. Check if other dev teams objects against havingt his step. Milestones discussion We decided to talk about the "Making traige stick" in the pad We discussed how we can have control of what goes in and out of a release after we are done triaging it. One thing could be by chaning the permissions for the milestone, so there must be a team agreement for things to be added. We discussed about creating a bucket (milestone or keyword) to know what are the tickets people would like us to consider for the release. This discussion is part of the team routines discussion. These buckets will help us organize tickets we will be looking at during our check in moments on irc. See in the pad the team routine to see what check ins we are planning to do weekly, monthly and by release. Action Items ------------ asn publish the latest prop259 revision nickm publich the modularity document as it stands examine/merge asn's changes in https://lists.torproject.org/pipermail/tor-dev/2016-March/010561.html send new prop224 to mailing list when it's done asn explains the prop224 questions to arma? :) athena bangs on 0.2.7 isabela to add backport policy to the wiki somebody needs to go over this with the devs who weren't here. isabela asks about ready_for_merge == Next meeting and other updates: STARTING ON MARCH 28 our meeting times will move: Primary meeting Monday 1700 UTC Monday 7:00pm CEST Monday 1:00pm EDT Monday 10:00am PDT Patch party! Tuesday 2300 UTC Wednesday 1:00am CEST Tuesday 07:00pm EDT Tuesday 4:00pm PDT -- PM at TorProject.org gpg fingerprint = 8F2A F9B6 D4A1 4D03 FDF1 B298 3224 4994 1506 4C7B @isa

1 0

Re: [tor-dev] tor-dev Digest, Vol 62, Issue 38
by Hugo Maxwell Connery 23 Mar '16

23 Mar '16

Hi, Hats off to Yawning Angel for doing work to address this "CAPTCHA" challenge. The idea of using archive.somewhere to fetch cached versions of walled garden internet zones seems sensible. More points to YA with the ALL CAPS warning about "big nasty adversary in you threat model dont go here" and "who do you trust ? archive.somewhere or Google/Cloudflare/other internet dominant organisation". I use TBB because I dont believe that others have a right to know what I am reading, rather than because I face a specific threat. But, the act of deanonymizing to gain content access is a very slippery slope and I congratulate YA for putting effort into addressing this slightly obscure but very important challenge. With respect, Hugo

1 0

Re: [tor-dev] Tor 0.2.8 and Fallback Directory Mirrors
by Nathan Freitas 23 Mar '16

23 Mar '16

On Mon, Mar 21, 2016, at 02:16 PM, Tim Wilson-Brown - teor wrote: > Just a heads' up that tor 0.2.8 includes a fallback directory mirrors > feature, where tor clients bootstrap from a set of hard-coded long-lived > directory mirrors. This makes bootstrap more reliable, and makes it > harder to block tor. The wiki has an entry with more details. [0] > > We're currently trying to finalise a list of around 100 fallback > directory mirrors by the time tor 0.2.8-stable is released. [1] Thanks for the heads up on this. It sounds like an excellent feature. Is there any randomization to the selection of which mirror to use? Any events or info notice when the fallback is being used? +n

2 1