- tor-dev - lists.torproject.org

Whonix's help_check_tor_bootstrap.py
by Damian Johnson 03 May '14

03 May '14

Hi adrelanos, I just noticed that Whonix uses Stem. That's great! Just a few quick thoughts... https://github.com/Whonix/Whonix/blob/master/whonix_shared/usr/lib/whonixch… > with Controller.from_port(port = p) as controller: > > if os.path.exists("/usr/share/whonix/whonix_gateway"): > controller.authenticate("password") You always need to authenticate the controller. Tor will balk if you omit the authenticate() call, even if it isn't using authentication... >>> from stem.control import Controller >>> c = Controller.from_port() >>> c.get_info('version') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "stem/control.py", line 960, in get_info raise exc stem.ProtocolError: GETINFO response didn't have an OK status: Authentication required. You should probably change this to... with Controller.from_port(port = p) as controller: controller.authenticate() There also isn't a reason to pass in 'password' unless you're actually using that as your controller password. ;) > b = bootstrap_status.split( ) > progress = b[2] > progress_percent = ( progress.split( "=" ) )[1] > exit_code=int(progress_percent) Operating by the positional argument is fine, but a little risky since Tor is perfectly allowed to rearrange those. I'd suggest the following instead... match = re.match('.* PROGRESS=([0-9]+).*', line) if match: exit_code = int(match.group(1)) Cheers! -Damian

2 3

Trac accounts and potential account compromise
by Erinn Clark 02 May '14

02 May '14

Dear Tor Trac users, We learned on recently that there was a bug in our Trac setup that allowed anyone to register a new user account for an existing user name, overwriting the existing user's password and thereby taking over the account [0]. A workaround was quickly implemented by weasel to prevent new user registration while we investigated how to re-enable it without encountering this problem again. Soon after, our configuration was fixed to allow new registrations without overwriting existing usernames. However, it's still possible that somebody has taken over your account in the past and you didn't notice because you didn't log in recently. We recommend users try to login and if you find you are unable to do so, you can reset your password here: https://trac.torproject.org/projects/tor/reset_password We apologize for any inconvenience this may have caused you! Please feel free to contact me with any questions. Erinn & the rest of the Tor Trac team

1 1

GSoC Project: A Lightweight Censorship Analyzer for Tor
by Jacob H. Haven 02 May '14

02 May '14

Hi Everyone, I'm a student completing my Bachelor's degree in Computer Science at Stanford. This summer I'm going to be working with Tor for Google Summer of Code 2014. I'll be packaging a tool to allow non-technical users to monitor censorship of Tor occurring in their country/network My project based on Phillip Winter's paper "Towards a Censorship Analyser for Tor" <http://www.cs.kau.se/philwint/pdf/foci2013.pdf> [1], and design requirements described in [2]. My main goals being to: - Implement a number of tests using OONI [3] Including reachability to directory authorities, the torproject.org, bridges.torproject.org and relays - Bundle tests into small binary that is easy to distribute and run - With user's consent, transmit (anonymized) data back to Tor Project - Leave no trace of use on user machine after tool removal. Obfuscate network traffic to attempt to hide analysis. - Produce user-friendly output so non-technical users gain better understanding of why Tor connections failing and perhaps possible remedies I'll be on IRC as jhaven, as QuicksilverJohny on GitHub<https://github.com/QuicksilverJohny>, and available via email at jacob(a)jhaven.me. Thanks to Philipp (phw) and Art (hellais) for helping me as mentors over the summer! [1] http://www.cs.kau.se/philwint/pdf/foci2013.pdf [2] https://research.torproject.org/techreports/censorship-analysis-tool-2013-0… [3] https://ooni.torproject.org/ ————————— Jacob H. Haven – http://jhaven.me <http://jhaven.me/> jacob(a)jhaven.me jhaven(a)cs.stanford.edu +1-(949)-415-6469

1 0

Rewrite Tor Weather Project
by Jonathan Baker 01 May '14

01 May '14

I'm very interested in contributing to the Rewrite Tor Weather project and would like to know what my next steps should be. While not a student, I think this would be a great way for me to contribute to a project that I believe plays an essential role in society. On a more technical note, I do develop with Python/Django on a daily basis (in addition to a handful of other www-based technologies). Thanks for your time, Jonathan D. Baker

4 4

Revising Proposal 140
by Daniel Martí 01 May '14

01 May '14

Hello everyone, Last week I introduced myself [0] on this list, shortly after being accepted into GSoC to work on Consensus Diffs. My GSoC proposal is heavily based on the Tor proposal #140 [1], which is close to being six years old now. This is why, after some discussion with Nick, Sebastian and Weasel (the original author of the proposal), it became obvious that it needs some revising. Here are the improvements we discussed on IRC: * Microdescriptors didn't exist back then, so the proposal makes no mention of microdescriptor consensus diffs. We should support these too. * Weasel added the 's' command just so that a line with just one dot could be produced. Since consensuses should never have such a line, I think it would be best to drop 's' and not support such a line as an input when generating the diffs. * In response to my introduction mail, Ian mentioned that fetching a diff is leaking data about when you last used Tor. Nick proposed to have a time limit on these diffs, to e.g. 24 or 36 hours, which should mitigate this problem. * Regarding their size, #140 suggests that they are not useful past 16 hours. I thought we could compare the compressed size of the diffs when creating them, since they may be of use for a longer time. We could do this relative size limit first as well as the time limit mentioned above. That is all that we came up with for now, what do you think? Ideas about what might be missing or needing an update are welcome, of course :) Regards. [0] https://lists.torproject.org/pipermail/tor-dev/2014-April/006744.html [1] https://gitweb.torproject.org/torspec.git/blob_plain/refs/heads/master:/pro… -- Daniel Martí - mvdan(a)mvdan.cc - http://mvdan.cc/ PGP: A9DA 13CD F7A1 4ACD D3DE E530 F4CA FFDB 4348 041C

3 5

Damian's Status Report - April 2014
by Damian Johnson 01 May '14

01 May '14

Hi all. This April's status report is gonna be short and sweet. The bulk of my time went toward Google Summer of Code student selection. I'm delighted to announce that we have thirteen great students working with us this summer (twelve with Tor and one with the EFF)! This is twice as many as last year, so it will be interesting to see if we can manage it. https://trac.torproject.org/projects/tor/wiki/doc/gsoc This concludes the bulk of my work as the org admin, so this next month I should be able to focus back on writing sweet, sweet code. On April 26th I presented at LinuxFest Northwest. For those who haven't seen it, this was a repeat of my TA3M 'Tor Ecosystem' presentation... http://linuxfestnorthwest.org/2014/sessions/tor-ecosystem-developers-guide-… https://media.torproject.org/video/2013-11-t3am-damian-johnson.mp4 And last but not least, bit by bit I've been picking away at a feature branch for Stem. It's not quite ready yet, but expect an announement and a new Stem release sometime in May. One improvement that *is* now available though is the following: The connection module's connect_port() and connect_socket_file() functions have been deprecated in favor of a new, slicker connect(). https://stem.torproject.org/api/connection.html#stem.connection.connect This new function is quite a bit smarter about the error responses it provides, and is more intuitive to use. Cheers! -Damian

1 0

Tor Specs
by Ahmed 01 May '14

01 May '14

Hello Everyone, Is this the latest version of Tor specification protocol? https://gitweb.torproject.org/torspec.git?a=blob_plain;hb=HEAD;f=tor-spec.t… -- Ahmed <ahmed(a)linuxism.com>

2 1

New events calendar
by Ximin Luo 30 Apr '14

30 Apr '14

Hi all, I decided to create a new calendar, since the old one is out-of-date and we seem to have lost the access. View as a web page: https://www.google.com/calendar/embed?src=dt92shou5q1ooe1kptubhclo4s%40grou… Import into your calendar program: https://www.google.com/calendar/ical/dt92shou5q1ooe1kptubhclo4s%40group.cal… If anyone would like write-access, or for me to make a one-off change, just ask! Please also update any links to the old calendar in trac; I forget where they all are. X -- GPG: 4096R/1318EFAC5FBBDBCE git://github.com/infinity0/pubkeys.git

1 0

TOR compilation with MinGW
by primster primster 30 Apr '14

30 Apr '14

Hi, i’d like to compile tor in my mingw installation, how could i achieve the same results as you: https://www.torproject.org/dist/win32/ It will be awesome to have tiny client as soon as possible in one exe Could you please give me full instruction or shell script ? -- Regards!

1 0

GsoC: Revamp GetTor
by Israel Leiva 29 Apr '14

29 Apr '14

Hi all! My name is Israel Leiva, and I'll be working on the "Revamp GetTor" [1] project during this GsoC. My mentors will be sukhe and mrphs. What I propose is to redesign the current "GetTor" code in order to make it oriented to modules, which the users can access via common "services" (like SMTP, for instance) and get the required info (packages or links). The idea is that this new design could allow the implementation of new modules in the future. You can find more details about my proposal in [2]. Needless to say I'm very excited and honored to collaborate with the Tor project and community! [1] https://www.torproject.org/getinvolved/volunteer.html.en#revamp_gettor [2] http://ileiva.github.io/gettor_proposal.html Best, -- israel

2 2