- tor-dev - lists.torproject.org

Rescheduling of OONI dev meeting of next week
by Arturo Filastò 05 Sep '14

05 Sep '14

Hello Oonitarians, Next week (on Friday 12th at 17:00 CET) we were supposed to have our weekly ooni dev meeting. Some of, though, will be at the OTF summit in DC and will therefore not be able to attend. After discussing this at todays weekly meeting we concluded to ask for feedback on whether we should skip next week and postpone it to next Friday 19th or if we should do it another day in the week of the 15th. If you have a strong opinion on doing either of these please let us know, if not it will by default be postponed to Friday 19th 17:00 CET. Have fun, ~ Art.

1 0

Orbot Fails to Transparent Proxy on lge-e739
by Jordan 05 Sep '14

05 Sep '14

Hi, all, I'm writing this not as a bug ticket: I'd like to try to get involved with fixing this issue (which is why I cc'd you, Nathan). Orbot seems to fail transparent proxy. Here's my device info, probably more for humor than for information: - Device: LGE E739 (T-Mobile MyTouch). - Android Kernel: Linux localhost 2.6.35.7-cyanogenmod+ #1 PREEMPT - Cyanogenmod Version: cyanogenmod 9 - Default iptables version: v1.4.14 Just a side note, that this bug doesn't seem to occur on certain versions of orbot (more on that later). Here are the properties of what happens when Orbot "fails to transparent proxy." - I can't get a mobile data connection. - I am able to connect to Wi-Fi just fine. However... - Some applications (specifically, **K-9 mail**), throw IOExceptions. I've tried to do a better job at tracking on which versions of Orbot this occurs, however, based on the last three releases, this is what I have found: - version 14.0.7.2: No TP - version 14.0.7.1: No TP - version 17.0.6: TP worked initially, and then randomly failed, even after I cleared iptables rules and reinstalled. For any version, it didn't seem to matter if I had a firewall installed (I tested both droidwall and AFWall+...and no firewall, too). I'm currently trying my hand at porting CM 11 to my device (having..."fun" do they call it?), but I figured I could try to get Orbot working in the meantime. Is this an issue to be resolved? I realize I'm using an out-dated kernel. Could it be an iptables issue? Thanks!

2 1

Fast flag assigned to slow relay
by Lei Yang 04 Sep '14

04 Sep '14

Hi, I notice that some relays with very low bandwidth (e.g., 2 KB/s) in the consensus have 'Fast' flag. However, the definition of 'Fast' in dir-sepc.txt is that a router is 'Fast' if it is active, and its bandwidth is either in the top 7/8ths for known active routers or at least some minimum (20KB/s until 0.2.3.7-alpha, and 100KB/s after that). For example, the relay named "PotatoPlace" has only 5KB/s but is marked as a "Fast" node if we check that in http://torstatus.blutmagie.de/ Does anybody can please explain this? Best, Lei

1 0

Reminder: tor dev meetings Wednesdays 1330 UTC
by Nick Mathewson 03 Sep '14

03 Sep '14

Reminder: the next Tor meeting is on #tor-dev on OFTC, at 1330 UTC on Wednesday. (That's approximately 12 hours from now: this is a time change.) This is the weekly IRC meeting for people working on the program "tor". (It won't cover all the other programs developed under the Tor umbrella.) cheers, -- Nick

1 2

oonibackend 1.1.0 released
by Arturo Filastò 02 Sep '14

02 Sep '14

Hello Oonitarians, I am pleased to announce that a new version of oonibackend has now been released. Here are some of the changes introduced in the new version: * Make changes to the bouncer API to make it aware of the policy of collectors. * Improve the bouncer API to make it more RESTful. * Add test helper that can be used to discover the DNS resolver being used by the probe. * Code coverage and unittesting improvements. * Fix compatibility with latest txtorcon versions. Starting from this version we will also be uploading the package to pypi, hence you will be able to install oonibackend with: pip install oonibackend https://pypi.python.org/pypi/oonibackend Have fun, ~ Art.

1 0

DNSSEC
by merc1984＠f-m.fm 02 Sep '14

02 Sep '14

I am surprised to find that there is no form of DNSSEC associated with TOR. I am running dnscrypt, but find that I fail the DNSSEC test at http://dnssec.vs.uni-due.de/ when using the TBB. I have unbound chained to dnscrypt which is on a rotary to 5 trusted DNS resolvers. How can you not understand what this means WRT DNS cache poisoning? Why are we susceptible to DNS cache poisoning? I suppose that the TOR system needs to resolve .onion addresses, but there should be some way of using dnssec locally if the TOR system cannot provide authenticated DNS. No one in the #tor irc channel seems to know how TOR DNS is done, and unfortunately there's not a word about it at https://trac.torproject.org/projects/tor/wiki/doc/DnsResolver . But I suspect it must be TCP DNS as TOR can't do UDP. And I suspect DNS must be done by relay servers, in order to resolve intermediate .onion addresses. Beyond that, it's a mystery how it's done. How to secure TOR DNS? -- http://www.fastmail.fm - mmm... Fastmail...

5 6

[PATCH] Proposal 236 and voting
by George Kadianakis 01 Sep '14

01 Sep '14

I inline a patch that specifies how voting should happen in proposal 236. The changes reflect a discussion I had yesterday with nickm during the Tor IRC meeting. BTW, while I like the simplicity of the new vote (just an integer), I'm afraid that this might hide any misconfigurations of the guardiness system in authorities. For example, maybe an authority is misconfigured and considers only 2 consensuses for guardiness data (instead of 6000 consensuses) and if it publishes only an integer percentage then we might not notice this misconfiguration. Maybe the number of consensuses parsed and the number of months considered should also be mentioned somewhere in the votes?

2 2

Weather post-GSoC
by meejah 31 Aug '14

31 Aug '14

Now that GSoC is over, there are some things that should be accomplished in the Tor Weather codebase soon to reach "deployment": 1. remove local copy of OnionPy and replace with real thing 2. (ideally automated) front-end tests 3. ensure production and Vagrant setup are as close as possible 4. tests with dump/copy of live database Less important, but still Very Nice To Have: 5. more unit-test coverage would be nice too 6. nicer-looking HTML I do not have enough spare cycles to accomplish all these things myself. I will commit to rapidly reviewing/merging to the "develop" branch any pull-requests. If any of the above sounds interesting, please follow-up here (or in #tor-dev). Thanks, meejah

2 5

DNSSEC
by merc1984＠f-m.fm 31 Aug '14

31 Aug '14

Does anyone know why TOR does not use DNSSEC? The only documentation I found on the TORProject website for DNS does not actually explain how DNS works on TOR. I infer it must be TCP, as TOR can not do UDP, and I imagine that relay nodes must be the resolvers in order to resolve .onion domains. But beyond that there is no information on how it works. Seems to me that the lack of DNSSEC in TOR is a gigantic security hole. (DNS cache poisoning) -- http://www.fastmail.fm - Access your email from home and the web

3 2

Gpg subkey for deb.torproject.org archive expired
by Lampshade 30 Aug '14

30 Aug '14

pub 2048R/886DDD89 2009-09-04 [expires: 2014-09-03] Key fingerprint = A3C4 F0F9 79CA A22C DBA8 F512 EE8C BC9E 886D DD89 uid deb.torproject.org archive signing key sub 2048R/219EC810 2009-09-04 [expires: 2014-08-29] Above text is from https://www.torproject.org/docs/signing-keys.html.en Today is 30 august, so subkey expired and master key is going to expire soon. Please generate new keys for Debian and Ubuntu users, of course in secure manner.

2 1